API tools faq
paste
paladin316

RTF_9fbcfe645282669e8825a84680c2011c_doc.json

paladin316
Jun 19th, 2019
2,255
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 340.16 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "RTF_9fbcfe645282669e8825a84680c2011c.doc"
  7. [*] File Size: 3567
  8. [*] File Type: "Rich Text Format data, unknown version"
  9. [*] SHA256: "3fb4cecab39de80896b61c958f8648f7872d72e4ad5872a40648dda9f98ec3f3"
  10. [*] MD5: "9fbcfe645282669e8825a84680c2011c"
  11. [*] SHA1: "e4b44f8ae32973a1d2d2ba7ce50c152d584d8281"
  12. [*] SHA512: "a86378a54b626076f165350110a71869c0945b63f0ddde2ceb3861834ce617a7cdb8c7269262505bf75fe518e81f2b44bcc6b7da4fab5953e11b6f767b284b46"
  13. [*] CRC32: "F2ABD017"
  14. [*] SSDEEP: "96:Oj8Yl7IwZclBV25FN3O3nuH/1oU8TMZdU6YOlW:OZleGP3ZoU8MdU6YOY"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "A process attempted to delay the analysis task.",
  23. "Details": [
  24. {
  25. "Process": "WINWORD.EXE tried to sleep 309 seconds, actually delayed analysis time by 0 seconds"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  31. "Details": [
  32. {
  33. "IP": "52.109.16.5:443"
  34. },
  35. {
  36. "IP": "23.64.120.157:443"
  37. },
  38. {
  39. "IP": "65.52.98.231:443"
  40. },
  41. {
  42. "IP": "72.21.91.29:80"
  43. },
  44. {
  45. "IP": "184.84.243.193:80"
  46. },
  47. {
  48. "IP": "23.194.108.146:443"
  49. },
  50. {
  51. "IP": "104.18.25.243:80"
  52. },
  53. {
  54. "IP": "52.109.6.40:443"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  60. "Details": [
  61. {
  62. "ioc": "set.dotx"
  63. },
  64. {
  65. "ioc": "ontent.inf"
  66. },
  67. {
  68. "ioc": "rocess.glox"
  69. },
  70. {
  71. "ioc": "ist.glox"
  72. },
  73. {
  74. "ioc": "iso690.xsl"
  75. },
  76. {
  77. "ioc": "ext.glox"
  78. },
  79. {
  80. "ioc": "gb.xsl"
  81. },
  82. {
  83. "ioc": "rame.glox"
  84. },
  85. {
  86. "ioc": "gosttitle.xsl"
  87. },
  88. {
  89. "ioc": "ieee2006officeonline.xsl"
  90. },
  91. {
  92. "ioc": "e.gu"
  93. },
  94. {
  95. "ioc": "sist02.xsl"
  96. },
  97. {
  98. "ioc": "nline.xsl"
  99. },
  100. {
  101. "ioc": "rings.glox"
  102. },
  103. {
  104. "ioc": "ccent.glox"
  105. },
  106. {
  107. "ioc": "chevronaccent.glox"
  108. },
  109. {
  110. "ioc": "gostname.xsl"
  111. },
  112. {
  113. "ioc": "iso690nmerical.xsl"
  114. },
  115. {
  116. "ioc": "chicago.xsl"
  117. },
  118. {
  119. "ioc": "quations.dotx"
  120. },
  121. {
  122. "ioc": "rid.glox"
  123. },
  124. {
  125. "ioc": "..3b"
  126. },
  127. {
  128. "ioc": "harvardanglia2008officeonline.xsl"
  129. },
  130. {
  131. "ioc": "mlaseventheditionofficeonline.xsl"
  132. },
  133. {
  134. "ioc": "pictureorgchart.glox"
  135. },
  136. {
  137. "ioc": "asis.thmx"
  138. },
  139. {
  140. "ioc": "content.inf"
  141. },
  142. {
  143. "ioc": "turabian.xsl"
  144. },
  145. {
  146. "ioc": "eadlines.thmx"
  147. },
  148. {
  149. "ioc": "rop.thmx"
  150. },
  151. {
  152. "ioc": "etropolitan.thmx"
  153. },
  154. {
  155. "ioc": "adge.thmx"
  156. },
  157. {
  158. "ioc": "rame.thmx"
  159. },
  160. {
  161. "ioc": "iew.thmx"
  162. },
  163. {
  164. "ioc": "anded.thmx"
  165. },
  166. {
  167. "ioc": "uotable.thmx"
  168. },
  169. {
  170. "ioc": "late.thmx"
  171. },
  172. {
  173. "ioc": "eathered.thmx"
  174. },
  175. {
  176. "ioc": "esh.thmx"
  177. },
  178. {
  179. "ioc": "ype.thmx"
  180. },
  181. {
  182. "ioc": "rail.thmx"
  183. },
  184. {
  185. "ioc": "ircuit.thmx"
  186. },
  187. {
  188. "ioc": "g.n9"
  189. },
  190. {
  191. "ioc": "vent.thmx"
  192. }
  193. ]
  194. },
  195. {
  196. "Description": "Performs some HTTP requests",
  197. "Details": [
  198. {
  199. "url": "http://yogh.eu/richmore/richmore.exe"
  200. },
  201. {
  202. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  203. },
  204. {
  205. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  206. },
  207. {
  208. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  209. },
  210. {
  211. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  212. },
  213. {
  214. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  215. },
  216. {
  217. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  218. },
  219. {
  220. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  221. },
  222. {
  223. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  224. },
  225. {
  226. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  227. },
  228. {
  229. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  230. },
  231. {
  232. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  233. },
  234. {
  235. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  236. },
  237. {
  238. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  239. },
  240. {
  241. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  242. },
  243. {
  244. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  245. },
  246. {
  247. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  248. },
  249. {
  250. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  251. },
  252. {
  253. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  254. },
  255. {
  256. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  257. },
  258. {
  259. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  260. },
  261. {
  262. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  263. },
  264. {
  265. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  266. },
  267. {
  268. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  269. },
  270. {
  271. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  272. },
  273. {
  274. "url": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes"
  275. }
  276. ]
  277. },
  278. {
  279. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  280. "Details": [
  281. {
  282. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw\\x1b\\xc3%\\xbb\\xfb\\x9a]\\xeb.](\\xc6amp\\x95&\\xd3\\xff\\xb2l\\x9cq\\x9db.p>\\x18\\xa7\\x9fd\\xdb+k!\\xab\\x8d9\\x84\\x9c\\xd4.\\xb6\\xe8\\xc31\\xde\r\\xe9\"\\xa8xk\\xc6\\xe1[\\xb0\\xb3[\\x1fv|i\\xd9\\xfe\\xda\\x9e\\xf9\\x10\\xf4-6\\x81\\xf0\\x80p\\xcck\\x15\\x81\\xdc\\xcc8\\xcf+\\xa9\\x8a\\xef\\xca\\x96\\xff\\xf1#\\xd9h\\x18\\xcc\r[u\\xdf\\xbey\\xb8\\xe9\\xd0\\xa6\\xcb\\x1ah\\xfd\\xc2\\x83)\\xa3nm!nz\\xc2\\x9b\\x9f\\xe8\\xf9%\\xdc\\x08\\xe7\\xe9\\xbf\\xa4vg\\x9b\\xd4\\xe0n\\xeb\\x92\\x96m^\\xcf)\\xc5i\\xa1ds\\x1a\\x842\\xd9\\x80\\xfc\\xfd\\x05uc\\xc1%\\xadu\\x85\\x9a\\xbc0\\x15\\x90\\xcc(\\x7f\\xe8\\xd4\\xdf\\xa9?\\xfc\\xa2\\x98\\x86\\xebwi\\xe0.\\x8e \\xbdvgd<\\xfana\\xc5\\x17s\\x82'v\\xa8r\\x0c\\xf2\\xd0\\x99\\x92\\x0b\\x84u\\xc1[\\xab\\xcc\\x8b\\x17\\x03/\\xf5\\x86\\xec\\xe5\\x03jca\\x91\\x96\\xaf|\\xc4\\xf7\\x88rh\\x1e\\xdd\\xcd\\xd7r\\x01\\xcal\\x9a\\xfd_"
  283. },
  284. {
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\t\\xcd\\xbe\\xb9%\\xc7\\x18\\xaeg\\x18\\x1d\\xea\\xdd\\xc1\\x8f\\x1b\\xffl\\x81\\x06ch\\xab\\xbc\\xd2\\xf1\\xc9\\xb1\\x12dw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286. },
  287. {
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ojq\\xae\\x16o5\\x8a\\x01:\\xa0\\xe4\\x83\\x87\\x8e\\x88r\\x10\\xf9yr\\x1d%\\xa6\\xc5o\\x13\\xea4\\xc8\\xc2\\xb1\\xdfg\\x0f\\xebc\\x82\\xc7nz\\xded\\xbay\\xc6|3\\x8c\\xbd\\xcbu69\\x1f*k\\x0c\\x86\\\\x0c\\x95\\xb6\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xa6}\\xc36\\xb63\\xd8\\x86\\x13\\xf8\\xb1&\\xa2eu\\xd7g\\x18\\x13\\xb7\\xf2nl\\xe2\\x15\\x91#$\\x02x\\x8b\\xe3\\xc7\\x9b0\\x9fqp\\x08w\\xb8\\xc5\\xb4{\\x9by\\xf4"
  289. },
  290. {
  291. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  292. },
  293. {
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\t\\xcd\\xbf\\x85\\x88{\\xbf;\\xb0\\xc5(\\xb7b`\\xfd\\xb7^\\xfc\\xc9_%da\\xc0 \\xc9\\xa9\\xc3\\xbal\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295. },
  296. {
  297. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  298. },
  299. {
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$@$\\x93\\x8e\\xed\\xc3\n=\\xeaf\\x92(\\xc0\\x16r\\xe8hq\\x18rxt'|\\xe0\\x9e\\xdbq\\xaa%x\\xa2hh*\\x1b\\xff\\xbe\\xbc\\xab\\xed\\xb3\\x97%c<+\\x84\\xb4\\xadp|\\xce\\xac\\xca7\\x92hy\\xfei\\x95a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91\\xf9\\xdb\\x9dh\\xf4\\xaf\\xb8\\x91\\xf5\\xd8$\\x0f\\xa0l\\xf5\\xfdg\\xfd\\x9c\\x92\\xbc\\x0b\\x9b\\xac\\xa7\\xef\\x80\\xa4po\\xde\n\\xbbzl1:\\xbb\\xdf3\\xf4\\xcb\\xf2\\xb6\\xf2\\xa2\\xa0"
  301. },
  302. {
  303. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfa\\xa0\\xc6\\xbel\\xb1\\xe8u\\xf9\\xc5`\\xd5\\x87r_]\\xd7q<\\x95\\x04\\xbd\\xa2\\xcc\\xe5\\xa1\\xcd+\\xce\\xe8\\x1e\\xe0\\x0cjm\\xa9\\xe7\\xee\\x8c\\x18\\x13\\xc2\\x1e\\xc1\\x0e\\x82\\x05`\\xec\\xfe*\\xf5?n\\x82`\\xd2\\xf7\\x1f\\x0b\\x0f\\xb8rw\t\\xd4\\x89\\xec\\x9a-\\x96;\\xca\\xe5>\\xffc\\x88\\\\xff\\x85x\\x0bw\\xd1\\x02\\xc0\\xa6\\xbd\\x08`rc\\xa9)\\xfd2\\xac,\\xc2q\\xc3\\x0e\\xe4\\xdb|;\\xeds~\\xd7\\xe6\\xf0vyl\\x96\\xf8\\xe9\\x0c\\x1c\\xb3\\x03\\xd2p\\x85[\\xd0!\\xb2z2\\x8e\\xc9\n\\x98\\xe2\\x1f6z\\xaf<\\xa4\\xf5,\\x03\\x9c)\\x83\\xd5\\x92\\x9d\\x10\\x16|\\xb8\\x91\\xcfn\\xbac\\xcah\\xcc\\xd3r4\\x02:x\\xcb\\xbb\\xaa\\xeab^\\x97`[#\\xbe=\\x1e\\xa6\\x11qd\\xecuas\\x07\\x82=\\x16\\xf6\\x19\\x88z]c\\xf9\\xcb@r\\xbb\\xb9\\xc0\\xdda\\xfa*\\x81\\xe9\\xb9\r9\\xb6\t::\\x12\\xa2$\\xb69\\xad\\x9bb8t\\xee\\x03%\\xb7\\x8e\\xc5?6\\xe1$\\xde\\x88nw;\\x84\\xb0\\x03r:"
  304. },
  305. {
  306. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfbav\\xe2\\xa3\\x89\\xc0\\xcdu\\xb4)w{\\xab\\x0f\\x7f\\xdb\\xa8\\xdd\\x15\\x8e\\x08\\x01:\rv<\\xce\\xf7\\xf9\\xb4x\\xbee\\xd7o\\x00q\\xc2=|.\\xf4\\xeb\\xd0@\\xf0\\x1e\\x13\\xf32\\x81\\x9d\\xd3\\xd9a\\x10\\xb1p\\x1dbg\\x84\\x13\\x9a<\\xcd\\x03\\xf2\\xf3\\x02\\x92c\\xc5b\\x94\\xeajr\\x8a\\x06\\x12\\x8c\\xe3\\xa9\\xb9\\x9c\\xe2\\x1d7(\\xfa{\\xbe\\xcde\\x89&\\x7f&\tv\\xcb\\x917p\nf\\\"tx;\\x0e\\xa0\\x03d\\x03[}\\x01\\x14]\\x89w\\x9e\\x83\\xd0\\xb2w7l\\x15\\xfa.\\|\\xac\\x10\\x89\\\\x95\\x14\\x8c\\x83\\x98\\xa5\\x18v{\\xa9\\x9e,\\x06\\x8b_u\\x0f\\xe8\\xee\\x0e7\\xf6m\\xf3^\\xad\nu\\x9d{\\x03_t\\xa0\\xd3\\x94\\xb3\\x11\\x81t\\x119m\\xdb\\x96d\\x0376\\xbe\\xcain`\\xd40\\xe2\\xe51\\xbc\\x16~\\xc3`z\\x14\\x1d\\xf9\\xe0\\x12)\\xb8h%\\xcctpd\\x0ek`\\x01\\x9c\\x8e\\xbb\\xac\\x83\\xb3\\x9f\\xb3@\\xd6!\\x05\\xbf=\\xc8\\xffc3\\xce\\xf5wcw\\xec\\xca;4\\xdf"
  307. },
  308. {
  309. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x8f\\xfb\\x0cu\\xaep\\x1a}\\x1ad\\x17\\xf7\\xea\\x8d\\xaa\\xe8 ,\\xb7\\xb2\\x1a\\xb6\\x89va\\x9ey7\r4\\x82\\xf1\\xa4h\\xdf\\x94\\xb0\\xb7\\x99\n\\xc4\\xd9b7\\xf5\\xd4\\xe2\\xba\\h\\x1dr\\x8d\\xa3p\\xb7\\xf9\\xcfzr\\xbc\\x99j[\\xb6kax\\x80v\\x83\\xc8\\xaft\\xb4a\\xee\\xcb~\t\\x92\\xad4\\xcesa\\xe7\\x97\n\\xec\\x01\\xa2\\xb9\\x1a\\x82&\\xe1\\xf1\\xc7?\\xb0\\xa6\\xfb-\\xd17^\\xa6a\\xf9\\x9f\\xcc\\xa2\\x98\\xd0f\\xc7c{\\xb36bn\\xe52m\\xcf\\xd8\\x1e\\xa3\\xe11\\x02\\xe0t\\xf8m\\x15\\xe6\\x98\\x0c\\x1c\\xd4/\\x05w\\x95|'\\xb7b\\xe7\\xc9\\x81\\xe5\\xaa\\x9d\\x04\\xd1\\xc4`s\\x1cu\\x80\\x8d\\xfc\\x9fb\\xd6\\x8e\n\\x8b\\xd2\\x94\\x84\\xd3r\\xcc\\x95\\x99t\\x90\\xf6\\x11p\\xc3w\\xf8\\xea\\xb63\\xd4\\x80\\xde8.\\xe0\\xe0\\x8b(y\\xdd\\x85\\x92x\\xc3yu\\xa6^\\xa1pc\\xf2\\x8c\\xba\\xe6\\xb6\\x02\\x14\\xd3\\xde\\xe6\\xe1\\xb0\\x7fn\\xeb:<\\x12jx\\x92\\xab\\x97\\x9f\\x83\\xdc\\x9e\\xdd\\xefpi\\xd4,\\x008\\xdf\\xec"
  310. },
  311. {
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\t\\xcd\\xc0e\\x8d\\x0e\\x9c\r\\xf8\\xb8\\x06\\x9dq\\x14\\x94$\\xba\\x06fg\\xb1\\x1a[\\x92\\xe4f\\xfaxc\\x8bt\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313. },
  314. {
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xefl&\\x8e%\\xa1[\\xed#\\xed.\\x1f\\x02\\x9b\\xa2\\x15\\x9a\rsn\\x07c\\xb0\\xe8(\\x96\\xe7\\xab\\x16\\xdf>\\xfdo\\xc2\"\\xbed\\xea9[\\xf0\\xa0\\x87\\x95\\xa2\\xb6,b\\x07\\x9ap\\xb5\\xa7o\\xf5\\x0fz\\xb0\\x82\\x9dd`c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}\\x91\\x96\\xa1\\xab\\x92\\xb2\\x16>\\x82p\\x9cg\\x03w\\x80\\xb6)\\xce\\xe6\\x19\\x16!nq9\\xcc\\x8e\\x0c\\xa9\t\\xda\n{\\x1c\\xd3j\\xaeu\\xfa\\x13\\xc4\\x11\\xf8_ol\\xcd"
  316. },
  317. {
  318. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x0bk\\x98\\xe2\\x9a-\\xc9\\xa3\\xd3\\xac\\x8b^j\\x1d{\\x8br\\x82\\xbfj\\x13h\n\\xea_\\xf8e6\\xf0\\x14\\xe6%b.\\xe1\\xb5\\x1c\\xa7\\x1fts9\\xb6\\xb8s\\xe2\\xc8\"\\x9eh~i\\xa3\\x9b\\xd4\\xf0\\xc5@\\xdc\\x80\\xc1\\x0e\\xc9\\x9d\\x19}\\x9e\\xeb\\x16\\xb7\\x93j\\xf8\\x07\\xf4\\xf1\n\\xe3\\xcb\\x06\\xb6\\x13@\\x85\\x9e\\x92\\xf5\\x0e,jr&\\xa3:\\xb5pt\\x8f\\xeff\\x98ie\\x9b\\x06\\xfez\\x93'\\x12xz\\x99\\x08\\xae%\\x07\\x82nw\\x94\\x86t\\xa9s\\x7f\\xb9l\\x8f\\xd9\\x1a'\\x8c\\x15s\\xac\\xf7\\xeb\\x7f\\x96\\xca\\xac;\\x9dr\\xcd\\xf26\\xb8\\x9b\\xb6\\xe2@0\\x8f0\\x87\\xec\\xe5\\xf2\\xd5\\x9eg&#\\xcf\\xce\\x160pm\\xad\\xbc]?\\xd8\\x89+5\\x81\\x0b\\x97\\k\\xeau\\xb0\\xf9\\xb6+\\xb0\\x10lm}n\\xda\\x00,\\x95\\xaa\\x84\\xa5\\x81\\xdd\\xb13\\x8a,@[z\\x83\\xd6\\x96\\x0f%,\\xba\\xefsu\\xdf8\\xafog\\x1b\\xce\\x96\\xef\\xda\\xd4j\\xdb\\xa2\\xad\\xee\\x83\\xe5p\\xf8\\x94\\xf0\\xa4\\xbe4\\x82j.-"
  319. },
  320. {
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc25\\x0f\\x98i\\xc3{\\x002\\xb5u\\xa8\\xd8\\xaf\\xaf\\xc6\\x99+\\x89\\x13\\x81yza0\\x85\\xf8s(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322. },
  323. {
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xe9\n:\\xf6k1\\xfd!\\xf4\\x84o\"{\\xa1\\xbb@\\xbfr\\xc2g\\x91\\xedp\\xca(\\xbd\\xd2t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325. },
  326. {
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2@\\x9dbo\\xb5k_\\x8b#\\x88 \\xee\\xbf\\x9b\\x9a$_\\x1a\\xb3x\"\\xc0[\\xea\\xf9\\xf0=\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328. },
  329. {
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xe0w%\\xf8\\xb2\\xdb@\\x16\\x19\\x18`\\x1f\\xdeu\\x14x\\xb2\\x8c\\x81)3\\xab\\xb5\\x8e:nm]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331. },
  332. {
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x83l\\x06\\xaa\\xaf5/x\\x8ea\\xcd\\xde\\xbb\\x04\\xac5\\x13\\x06\\xafnn\\xd9h\\xefc;_\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334. },
  335. {
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xfa\\x80op:\\x92\\x85\\x81\\xfd\\x9f(\\xdb\\xfb\\xffd\\xab\\xcf\\xa6\\xfe\\x9c\\xcek\\xd5\\xb1?=\\x0bi\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337. },
  338. {
  339. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2:\\xd0tp\\xae\\xff\\xd2\\xd8\\xba\\xf7r\\xdb\\xc4\\x9fa\r\t\\x8bpv\\xac\\x06\\xde\\x92\\x95\\xf2\\xe0#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340. },
  341. {
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2x\\x8e\\xee\\xd8no\r\\x16\\xc0\\x12\ti>;\\xa5\\xb7j\\xee\\xf0?\\xb1\\xe7\\x0bv\\xe4b\\xc9p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343. },
  344. {
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2{\\xc7_\\xc9\\x8e#\\xe7+\\x929\"\\xe8k)\\xb6\\xea\\x9fk\\xb99\\x8d\\xa2d\\xb1\\xd4\\xebx\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346. },
  347. {
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x99\\xaf6m\\xf2s\\xe0\\xdbw\\xfc\\xc2[\\x83\\xf1'\\xf7\\xd2\\x9b\\xc3\\xd6\\xb1\\x06o\\xf8\\xc5.\\xc0\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349. },
  350. {
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x13\\xe0\\x1e\\xc5\\xf7\\x87\\xdd\\x1a\\xda\\xc0\\xbb)\\x9dn\\xd4-\\x98\\xecp2\\xfb\\xc1\\xfe\\xc9\\x87\\xdc\\x99\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352. },
  353. {
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xb5ovgk\\xd0&\\xaa\\xc0\\x07\\x1a0\\xa3\"3\\x98-w\\xc1\\x90\\xfc\\xae\\x88\\x1coz2a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355. },
  356. {
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x01\\xa5\\xad\\xa6\\xc5i\\xdbx\\xdd5\\xeb(\\x90kn\\xe5\\xe8\\x9a\\x98l}\\x8bqq:sj\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358. },
  359. {
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2z\\xa9\\xcc\\x86\\x0bm`u\\xfcz\\xf8\\xa0dz\\xe9\\xf7\\xfd\\x93yc\\xeci`\\x17\\xc9v5$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361. },
  362. {
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xc2+q\\x1e\\x8b\\xdc\\x0c[\\xbc+a\\x8d\\x01j=q\\xe0ey\\xdb4n\\xc62(\\xec\\x98\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364. },
  365. {
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2df\\xd8\\xa7\\x9e\\xd4]\\x84|jc\\x9d-\\x1b\\xc9^n\\x03\\xcclbu'\\xb1b\\xc4w7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367. },
  368. {
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2[j<\\x10_t\\xc2?\\xcal\\xb6c\\xc4\\x88\r\\x9b\\xc9\\xc8`\\x95\\xfe0\\xb5.\\xbb\\xc0u\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370. },
  371. {
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x12k\\xf6qqw\\xff\\x82\\xb6t\\xbd\\xf6\\x86\\x97\\xed;\"\\x1ci$\\x12q\\xd4\\x7f\\xb8\\xc3s]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373. },
  374. {
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xb1\\xcb\\xa6q\\xfc\\xf7t\\xa8\\xe8\\xfdx\\x10z\\xd5u\\x18*9\\xab\\xac\\x1b\\xe7\\x00\\xbe\\x1b\\x9b\\xf6\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376. },
  377. {
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xe81\\x89\\xe6\\xa0\\x8e\\x19n\\xa4[\\xc2\\xda\\xc7\\xa0\\xb4%\\x14\\xb3\\x95\\x1c?\\xc66\\xc1o\"\\x1e}\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379. },
  380. {
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xbb\\xd2\\xb7\\xc7l\\xea\\x12t\n\\x0e\\xcd>z\\xb6rlav\\xe1\\x0b(k\\xe50=\\x127\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382. },
  383. {
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xbae\\xa7\\xb5\r9te\\xfe\\x10\\xb1\\x85s&\\xcd\\xe2\\x8e\\x8e\\xde\\xa0\\x85@z\\xd3`\\xc4\\xb3\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385. },
  386. {
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\"\\x9f*dx4\\xb7\\xffj\\xfb\\x8f\\xd1\\x13\\x86\\x84\\x88\\xc3%?\\xac\\xe1\\x87\\xd61v\\xde\\xa5\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388. },
  389. {
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc20\\xf8\\xada4\\xc8\\xe3\\x8a\\x0c#\\x88\\xb8\\xbe\n9b{\\xb0\\x0bw\\x82;f\\x06\\xac\\xa4om\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  391. },
  392. {
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2jgq\\xca\\xb4\\xbf\\xa5\\xa9a.\\x883)~\\xfa\\x8d_\\xb4bt\\x1c\\xd0\\xebzke\\x04\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394. },
  395. {
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2<\\xc2\\xbf\\x06\\x19\\xf4\\x87[.!\\xc1\\xd6\\x0b|\\xb1\\x8as\\xc7_%\\x9f\\xe2\\x95\\x9d\\xa4\\xe5m\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397. },
  398. {
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xb6k\\xfdtl\\xee.\\xf5\\x12\\x93\\x8f!\\xfa\\xa1\\xf2\\x9b\\xe5\\xdbk\\x13\\xe1\\xc2\\xc1r\\x93^8`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400. },
  401. {
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x0c\\xf5y\\xd4\\xdf\\xe8\\xd7~j\\x00b+\\x06\\x9a\\xa5\\xc7\\xea\\xf5\\x14\\x99\\x87p:'\\xd3\\x8du[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403. },
  404. {
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xf71\\x9e\\x8ashfp\tv\\xfef\\x19\n\\x1f\\xe8\\x07\\x9f3\\x17\\x8d\\xc4\\x018\\x9f\\x9cp\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406. },
  407. {
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\x88\\x04\\xeb)\\xa4j\\xa2 \\xa9\\xc7\\x1c\\x06f-\\x1c\\xb5h\\xf9\\xc1\\x0eu:{c\\xfe\\xca\\x99\\xf6\\xa2\\x9a@z\\xdc0\\xd8\\xdb\\xea\\x98\\xc4\\xb9\\xef\\x1c\\xee\\xa9\\x95[\\xfe\\x0e4\\xe0}+\\xcb)h\\x15\\xb3\\x83cd\\xfa\\x143\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc73\\xe43\\xdf\\xffr_\\xe3\\xba\\xf1jf^b\\xe7&\\xcc\\xe5\\xe5\\x9e\\x86\\xdf\\xa5r\\xa2\\xfc\\x0e\\x7fd\\x96\\xd0\\x00\\xaek\\xb1\\xe5\\xc3\\x88\\x16\\x1c\\xd1\\x80\\xff\\xbf\\xe1+q"
  409. },
  410. {
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x0bh\\xaf\\x19\\xc6zc\\xf7k\\x99\\xd2p\\x16\\x9f\\xb1\"0\\xc8\\xd9\\x98\\xefb\\xc3\\xfc2\\x03\\xacu\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  412. },
  413. {
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xdd\\xe7\\xd7\\xb0\\x866\\xb3}\\xfe\\xdc\\xab\\xc4\\x81\\xa9x\\xa4$b\\xe8\"\\xaa\\xb8\\xa8\\xe1\\x1a\\xa2\\xde\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415. },
  416. {
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xd2-\\x81k\\x1a=\\x99x\\x90rf\\xb9!cp\\x97\\x1d\\xa4\\xe7z\tja\\x89\\xbfm\\x9f\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418. },
  419. {
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2*\\x10w\\x9d]k\\xd1\\x94\\xe1\\xfc\\x1f^\\xa6i\n\\x9f\\xbea}\\x9a\\xc3nxia<5\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421. },
  422. {
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x89[\\xc5\\x9d\\xbc\\x88\\xecy\\xdf\\xd5\\xf8g\\xc1\\xd5]\\xce\\xa2z\\xc3+\n\\x19\\xf9\\xa4|\\x01\\xbe^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424. },
  425. {
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\x82\\x02t\\xa4\\xf5\\x8c\\xa2\\xeb\\x10\\xcb\\xe3h\\x8dw\\x89\\xcfketac\\x0e\\xca\\x9eo3\\xc8:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427. },
  428. {
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xf4:\\xc7a\\xd6~j=i\\xc2\\x94\\xcfw \\xe7\\x15\\xc1\\x95l\\xdf%>\\x93\\xbe\\xf3qd\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430. },
  431. {
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2d'w\\xe3\\xd6\\x89\\xfb|\\xf13m\\x13\\xffy\\xb3\\x9e\\xc8\\xa2t\\xealp\\xf4\\xc4\\x01\\x03]\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  433. },
  434. {
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2n\\x00=!\\xfa\\xc1\n\\xd7?\\xad.\\xdff2~\\x81\r\\xea\\xd3_\\xcb\\xb2\\xce\\xed\\xd8\\x10\\xf6\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436. },
  437. {
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xbb\":\\xdb\\x96\\x93\\x10\\xf3\\x137\\xbc\\x08\\xdfp#f\\x82|\\x80\\x97\\xf1\\xe7\\x7f\\xb4\\xa3\\xc4\\xe9\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  439. },
  440. {
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2u8\\xad\\xb2\\xcfn8!\\xe8|\\x90\\xbdp$o\\x15\\xa0g\\x89\\xbfk\\xa2\\x01\\x82\\x02\\x1da\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  442. },
  443. {
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2*0\\xb8\\x94o\\xf4b7\\x95\\x8c!\\x9e~\\xa6\\x8dtl\\x89\\x14#\\xb3\\xe9m\\x05\\x7f\\xb9\\xa5\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445. },
  446. {
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xdf\\x1e\\x1a~\\xc7\\x15\\xcb\\x025\\xe1\\x9a\\xe6s\\x9a\\x7f\\xa7~p1\\x9d\t\\x16\\x99\\x02\\xbc\\x00\\x1c\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448. },
  449. {
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xac\\xa1\\xd2\\xa7\\xa5\\x1b\\xefk,\\x91o\\xc9!\\xc9\\xe7\\x01z\\xe1\\x9b\\xd8\\x8e69o\\x1e,\\xbc$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451. },
  452. {
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xf3z\\xc6m\\xef\\xc0*s\\xbd/nj\\xfc\\xf1\\xf7k\\xd9\\x9ay\\xfa\\x9a\\xd2ve2\\xa5\\x7f\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454. },
  455. {
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xa7*a5+\\x06\\x1ck;s=]\\x8f\\x97u+\\xb7\\xee\\x7f\\x8f\\x8f^\\x15d\\xb5\n\\xb4\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457. },
  458. {
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2z\\xc5h<\\xc76\\x97\\x95z<\\x1d\\x05r\\x1bf<^\\xe4[\\xb4o\\xd9\\xa2\\xe4u(\\xb99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460. },
  461. {
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xf3au\\xf5\\x8a\\x8a\\x0ca\\x064\\xc3\\x07\\xcaz\\xdf^u\\xca\\xcd\\xd8f\\x8b br\\xba\\xad7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463. },
  464. {
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2 3\\x86 \\xa5\\xff\\x06\\xbe\\x85~qv\\x9a\\xa6\\x1e\\xc6\\xc9!\\1)h\\x9a\\x1a\\xd5wa\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  466. },
  467. {
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xd3\\xad\\xc6\\xff\\xa9\\xce(^\\x8a\\x08h}\\x06\\xf1\\xbc\\xbf\\x88\rkzcz\ttoyn\\x80d\\xcb>\\x00\\x1d]\\xb2\\xb9_`1\\xd1!c\\xdc^\\xbc\\xba\\xdb\\x98m\\xc2\\xaf\\x16\\x15c\\xf7\\xf9u\\x04y\\xc3\\xe2\\xcd|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u0u\\x17\\xee\\xc94\\xa7\\xae\\x9c\\xacng\\x01\\xda/z\\xd7f\\x06\r&{\\xb6\r\\x84\\x034\\xad@\\xbe@\\xc5\\x17*\")c\\x03\\xfc\\x91\\xf29\\xa6\\xbe)\\x19\\xf5"
  469. },
  470. {
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\x0b\\x17vs\\xf8\\x9fs2\\x92\\x82s,\\x8f\\xfe\\xca\\xdb\\x0bb\\xcf\\xdb\\xd23\\xa0\\x0f\\x9f\\xca\\x9fs\\x83em\\x18\\xbe\\xe7a\\x9ah\\x18scs\n@\\x8a\\xady\\x03\\x9e}\\x07\\xe0\\xbdi{)\\xcc\\xd5z\\x7f\\xdd\\x1f\\xa2\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\x82\\xec\\xb7j\\x8d\\xf5ko\\x13\\xccmy\\x9f\n\\xfe\\xc9$\\u\\xb2j\\xdb;\\xc85\\x9f\\xe2\\xea\\x9f_k\\xfa\\x9fke\\xc5l\\xb4\\xe1\\xc2\\xab\\x85\\xbe\\xed\\x88\\xf2\\xda"
  472. },
  473. {
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1\\x8b\\x00\\xaf\\x93b\\xfbs\\x16\\xffg\\xbf\\x02\\xd7\\xe6z\\xd2\\x1a\\xcff\\x05\\x02xgq\\x00\\xeds\\xc6\\\\xd0\\x08\\xacb+\\xaf\\x19\\x86\\x82\\xb0\\xf4\\xeb\\xce\\xa5\\x0ct\\x91\\xe7\\xb4\\x0b\\x88ea\\xcb\\xeac\\x0b\\xdf\\x04b\\xc7$\\xe5\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xee\\xb8y\\x01\\xa2?\\xee\\xd6\\xc3t(x?*\\xcfx\\xd8\\x08g\\xc7)\\xef2\\xc6t\\xfc\\xf2\\xae\\x11\\xe8=\\x13\\x8cc\\xf0\\x8b\\xc6@\\xa7wp\\x92\\xd1\\x03xd\\x9f"
  475. },
  476. {
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\x94\\x94\\xb5\\x0c\\xa7\\xd7jk2oi_\\x14\\x89\\xbcr\\xf5w\\xdd$a\\xa5^\\x9fv\\x04(\\xea\\xf2#+\\xe2\\x83\\x8d\\x92\\xa8\\xb1a\\x16\\xd7.^zpr\\x01\\xe9}\\xdd\\x01\\xb41\\x92\\xcd\\x00o\\xa1vc\\xf4\\x86\\xc4\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/h\\x87l\\xea1\\x0e7sa\\x9cj;\\x7f\\x0fb~\\xc9\\x02\\xc4\\x93@\\x84\\xec\\x0f>~2\\x1e&\\\\x19zzg\\x15\\x83\\x08a\\x15\\xe2jh;\\x19c\\x1b\\x0b"
  478. },
  479. {
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9cw\\xbf\\xa7,\\x18#\\x1f\\xec\\xc3\\x8bo\\x98\\xa1\\\\x88\\xe8\\x0bf\\x14\\x88\\xd5?\\xd7\\xb1\\x8a>\\xd5l\\x08b\\x87q\\xa0[d\\x9c\\xca\\xaf\\xda\\xe2\\xc9\\xc6/k=\\x9b\\xf4\\xf6\\x95=\\x97\\xeb\\x9cf\\xcag3\\xc9%\\x11r\\xc3r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9i6u\\x90\\xe7\\xf0|\\xc1\\xc4\\xa5f\\x9a0-j`\\x80p\\xb3p\\xf3\\xf9y\\xbd)t\t%\\xd7\\x15p\\xf5tvr`3\\xb3\\xd8_\\x9b\\xa1\\xe9k{\\xde\\xf7"
  481. },
  482. {
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86\\xdc\\x803\\xad_=\\x92w\\x0b\\xd7\\x90\\x93g\\xf4u\\x98\\xb1\\x9fr4\\xcd\\xbb\\xc2kd\\xcc{\\xb7\\xd2$n\\x9c\\x96\\xace\\x1dysi\\x10\\xc6&\\xc2hi\\xed\\xb5\\xce-\\xfb\\xbb\rq\\xce\\xff\\x969\\xe0\\x16\\xf4\\xf8\\x13\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\xb0\\xbc0\\x9e\\xe8\\\\x051i\\xd4\\xf4fx\\xf9\\xb8\\x1e\\xbbtz\\x8b#\\x04\tc\\xe0e\\x15p!\\xc6.\\xf2\\x95\\xb4u\\x91\\x89\\x1d(\\x01\\xccd\\x92m\\xcf\\x07\\x88"
  484. },
  485. {
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86k`\\xed\\x8b\\xa0x\\xf5\\xc7.\\xa2l\\x1d\\x0b\\xa1\\xfa\\x18$6w\\x0f#\\x7f.\\x9a<\\xaey\\xf8z\\xde\\x8cr\\xca\\x1a;\\xf9h\\xe6\\x02m\\xed\\xdf'\\x12\\xc0\\xa1pk\\xab055\\x1a\\xfa)p\\x15\\xbcu\\xdb\\xde\\x83\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\x96i\\xfcr\\xb0^^its\\x17\\xfehe\\x0b\\xd5\\x81\\xdf`\\x8eho\\xfdur\\xecc\\xb1\\x86n\\xe9\\xb5\\x11\\x8d_\\x86\\xee\\x1a[\\xf3a:\\xfc\\xdd\\x87\\x03\\xa0"
  487. },
  488. {
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4!7\\xbaw9\\x95\\x12g^8\\xaa\\x98p^\\x0b1\\x03\\xb9\\x11\\xb9\\xa0\\xeb\\xf9\\xc89\\x1f\\xc5\\x1f\\x16\\xfe\\xac\\xd1\\xaan\\xdetn\\xc1\\x8b\\x8f\\xa5\\xca\\x0c\\x03q8p\\xf3j\\xa4\\x87\\xfc:\"\\xa8\\x04\\x9d\\xfdk\\x89\\x99\\x10\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-i~\\xc3\\xbe\\x0c\"\\x01\\xc3\\x00wu\\x9b\\xbe\\xcd\\xcd\\xa9c?\\xfa\\xd5\\xae\\xb9\\xd1\\x85g\\x9ar!\\xbfx\\xb4\\xdc\\xee\\xfd#\\xdd\\x1f\n\\xf1\\xcc<\\xa4\\x03<_\\xdf\\x1d"
  490. },
  491. {
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04,@:%\\xb9\\xa9\\x8d\\xceuv\\xdc[\\xce\\x1dz\\x88p5\\x9a\\x890d\\x9bv\\xe5<\\x95c\\xd3u\\x15\\x93c\\xed\\xd3~\r\\x8d,\\x0b\\xac\\x99/\\xac\\xf1|\\x1c}\\xb9\\xd3\\x82,\\xee\\x7f{a\\x98\\xd6\\x1a\\xb8\\xcek\\xfc\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2\\x0c\\x01\\xc1\\xe7\\xa99?$\\xe1=k\\xb9j+\\x95yy\rq+\\xca\\x0e\\x1f\\xd7\\x0em\\x93s\\x15\\x90\\x8b^jf:\\xcb\\xa4\\x8c\\x91\\x87\\xfde\\x82\\xc0\\x99\\x96\\xcc"
  493. },
  494. {
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd26\\x0c2\\x96\\x92\\xd0\\xbf\\x04\\x98\\xcajlqde[\\x9b\\x01\\xbc\\x0b\\x8b\\x91rl\\xb7\\xb3\\x04\\xad\\x8ei\\xf7\\x0b\\x13\\x03b\\xd2\\x02\\xc9:\\xb8\\xe8\\xde\\xb64\\xd3\\xc3\\x16-v\\x84\\x16\\xec}\\|\\xf5\\xb4\\xbe\\xdfx\n\\xefk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\x7f\\xd1\\x84cg\\x9d\\xd6\\xd5<\\xd8\\xaf\\x01\\xe0f\\xf7\\xb0\\xb4\\xde\\xafo,psq>\\xc18r\\x8b\\xe0\\xd0>\\x9b\\x15\\xd0c\\xf5\\xdb\\xf6\\xeada\\x15\\xd9\\xa7\\xe3\\xf1"
  496. },
  497. {
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04vq\\x87\\x1c\\xa3n\\xb1\\xcf\\xe7k\\x7ft\\xc4\\xdf\\xe9q\\x10\\xa3\\xe4x\\x9c\\xc7t!\\xd8hn\\xb5\t\\x8a\\x87&\\xac\\xc3\\xb5\\x06\\x7f\\xf2\\x1e=\\xa0\\xd3x\\xd9]\\xa3\\x8af\\xe5\\xc1\\x9d\\xd4\\xf3\\xc1\\xed\\xd2od#\\x8c\\x12\\xe0\\x95\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0_ji<\\x16\\x92.\\xe7\\x07w\\xe4\\x1ar$s\\x9dyq\\\\x8a\\x9f\\x99\\xb6o\\x8dj\\x8caa\\xe5j0\\xe1i1\"\\x9b=\\xb0\\xf1\\xc3\\xfe\\x90\\xb4\\xc2\\x14}"
  499. },
  500. {
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcf\\x9a\\xa9u\\x8f5\\x85\\xccb\\x19\\xf3\\x1d\\xd4\\xb3\\x1ep\\xf76\\x1d\\xcf+\\xbf9t[\\x99z:\\x0b\\xbaw\\xe9\\x7f]@p \\x06\\xf4/\\x96\rr\"\\x04\\xd1\\xf0\\xab\\x7fxg@]\\xde\\xd6\\xbeo\\xa9\\xea\\x8f'\\xd0\\xb2h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b^\\xfe\\xc0\\xd2\\xa5(\\xd9\\xb8}\\x7f\\x82\\x91b\\x1c\\x1dhu.\\xa7\\xcah\\xb57kr\\xef\\xb4\\x11u4\\x95\\x84v\\x80\\x06\\x93e\\xbb\\x9e\\x15\\xf1]\\xbb6\\xaf\\ "
  502. },
  503. {
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|\\xfd\\x8c\\xba\\xd6\\x19\\xd2u\\x85\\xdf\\xd1\\xacwlo\\x10\\xf1\\xb9'!s\\x89\\xf0\\x84\\xbf=\\xc1\\xe0\\x81\\xf2\\xd8v\\xbcu\\xcd\\xb1\\xcf\\xd3\\xd9\\xb0/\\xd5\\x95\\xd4a\\xd6\\xd9\\xc6\\xf9bt\\x1c`\\xfd\\x8a\\xf6\\xd6r\\xae\\xf0\\\\xd8\\x9e\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xce\\x0e\\x8f\\xc2u\\xa1\\xd2if\\xfa!:\\xff\\xca\\x13\\x16\\xbd\\xdai\\xd3\\x12\\xe3,x\\x18\\xb8\\xa5\"^\\xea\\xfa\\xd2+\\xf8'\\x9d\\x85\\x8fnt\\xa2\\x9a\\x1f\\xb1\\x0f$q"
  505. },
  506. {
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xdd\\xc37\\xb0\\x90\\xcb\\x0e\\x13\r\n\\xaa\\xc4{\\x8fi\\xb4\\xbe\\xbb\\x97&?\\xe9\\xfa\\xf2\\x90\\xa1\r&,\\x06ho\\x8b\\xee\\xab=h\\xa4\\x0e\\x94uodu/\\xc9\\xf4\\x99\\x8a\\x7f\\xc9\"\\xe1\\xf9m\\x00\\xab\\xf5\\xe4fba\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\xd6\\xc1\\xf5\\xadc60\\xae\\x9e\\x9b\\xb1\\xc8%\\x94\\xad\\x024f\\xd0\\x04&\\x05\\x8b\\xae\\xc50\\x8bn\\x9d\\x82\\xdfdn\\xf8\\xb8\\x9bq\\x9e\\x00\\xaa\\x96\\xa7y\\x0c\\xac \\xfc"
  508. },
  509. {
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x15\\xfe\\x8d_\\x1b\\xe4\\xf5\\x86\\x84\\x96%\\x0f\\x06\\xe7\\xf7)r\\x1d\\xce\n\\xe5\\xfc\\xd8p\\xc5\\xb7<\\xe0d\\x97\\xa0'l\\xb46\\x8d\\xd8a\\xc3\\x8fp;@\\xe5d\\x07o\\xed\\xb2\\x97li\\xaaq\\xc36\\xf1\\x81\\x11\\x17:\\xe1\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xdcxaiu2z\\x94\\x13l{>\\xeb\\xea\\x9f(;\\x8e\\xbf\\xa8\\xdft\\x94\\x1b\\x87\\xc1h\\xeed\\x00\\x9c.k\\x9dw1\\x17-\\xcag/\\xabh\\xab\\x89r\\x01"
  511. },
  512. {
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4srj\\x87$\\xfd\\xdf\\x99\\x19z\\x1cz\\x8cm\\xa8yg\\xc3a\\xfb\\xeb\\xab\\xa5\\xfb\\xb9'^\\x04\\xcb4\\x82tqc\\x9b\\x04\\x7f\\x9d\\xd6\\x0c\\x93\\xb7\\xd5\\x94\t(t\\x98\\xec\"\\x84\\xd2\\xb0f\\xe3\\x9a\\x1c\\xde\\xfb:-\\x82g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\x0fzg\\xaf\\xb7\\x08\\xaah\\xf9\\x7f\\x9ae.\\xcb[gi\\x8f\\x1cga\\x06\\xf3\\x17\\x05\\xadr\\xf5\\xed\\xe9\\xc3\\x03su\\x92\\x17\\xfa\\xbbvx>t\\xc9\\x88\\xbe\\x04\\x07"
  514. },
  515. {
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\xa3c\\x04\\xe6\\xaf\\xe0\\xe2\\x1d3\\xcb\\xcf\\x99\\x81v\\x10\\xb10\\x0c71\\x9f|y\\xfd\\xf8\\x00c\\\\xd5\\xa2q\\xf9\\xad\\xff\\x8f\\xef\\xe2\\xc4\\x1b\\xc8b\\xa3k)\\xfcx\\xf2\\x84\\x11\\x83z\\xf0\\xd2k\\xef\\x8c\\x7f:\\xb5\\x85|u\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\x1d\\x9b/`\\xa9\\x1d\nx6\\xee\\xd0o~\\xf1\\x08|\\xcb\\x94*@\\xeb\\x8f\\xd1\\xc6\\xbai\\xc19(\\xce2y\\x0f\\x95\\xc9vn\\x9b$*\\x1el\\xe8\\xba\\x1b@)"
  517. },
  518. {
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xb6\\xea\\xabi\\x94z\\xf0a\\xbd\\xe76\\xd4\\x8f1o\\x86\\x13\\x1bs &\\x9c'\\xe7l\\xc6hf\\xfa\\xdc\\xfa\\xbe\\xa6n\\x8b\\xaf\\x90\\xb7\\xfb\\x04\\xf8\\xb2\\x96_d\\x0c\\xb2\\xd7mrt;\\xf5\"o\\xc0\\xd7~\\x1d\\x0c\\xcd\\x04\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;g\r\\x01\\xb9\\x9b|\\xd7\\x80\\xbb\\xff8\\x05\\xfa\\xc0+\\xbd\\xfcp\\x90>k\\xb1\\xcc[\\x06[a\\xd6\\xfe\\x13\\\\xff\\xda\\xa6e\\xf0:ckyj\\xe8\\xc94\\x18>\\xdb"
  520. },
  521. {
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1\\xae\\xfe\\xd5*\\xeb\\x0cf>\\xe1 \\xd6r\\xba\\xa0\\x0c>\\xe8[\\x1d.w\\x84\\xe2\\x06;\\xe7$d/q^y&\\xfe\\xa3\\x944\\x04)\\xf5\\x86n\\xb1\\x00kj'\\xb8\\x86!a\\xff\\xc8\\x8f\\x06\\x1d\\xf9\\x7f0\\xad\\x11{c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x19\\x9e$\\xf1u\\xbb\\x0b\\xea\\xc60a);%\\xa4/\\xf4\\xf6\\xac\\xa6w\\\\xfc\\x033\\xbc\\xd2v&\\xfc\\xec\n$\\xa6\\x06\\xb7\\xe3\\x11\\xdfe\\x9fcu\\x95\\x15\\x94\\xa3"
  523. },
  524. {
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\xf6\\x8ar\\x0f\\x8f\\x0f@}.$\\x04\\xff\\xe9\\xc6\\x8d>c!j\\xe1t\\xae\\xf0\\xd0\\xb3yy\\xee\\xe84lg\r\\xc72\\xa6,\\x801\\x10\\x00\\xf5=u,]c\\x9d\\xb0\\x1f\\x08h\\x87\\xbc#\\xfc\\xa6@\\x0c\\x87\\xe5\\x13\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x1a\\x1b\\x1dw\\xd8\\xd7+\\xfc2\\x93\\xd6rm\\xa0\\x07q\\xe4\t\\xe0\\x84\\xed-\\x04\\xa0\\x06\\xf6\\xd9\\xa0\\x9c\\xf6\\x0c\\xc9c\\x06lu\\x0fm\\xff]%\\x9ac\\xc5x\\xcc\\x0f"
  526. },
  527. {
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\x12\\xd6\\xc2\\xd9\\xd0\\xc4k\\xa0&\\x8eq&\\x16\r\\xa6l\\xadr\\xad\\xbc\\x12\\xc00\\xfa\\xee\\x13,8\\x91\\xc1\\xcej\\xbf\\xd7\\x0e\\xdf>\\xd0\\xee\\x93\\xe7\\x85,t{kry\\xdf\\xb4j\\xb8\\xda$|\\x940\\x95%\\x9f6\\xe0\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xe3i\\xa4\\x9f\\xfc\\xe6\\x96=\\x08\r\\xac-\\x01\\xbe\\xeb\\xf6\\xb6\\xa7\\x9bl\\x98gl\\xd2\\x93\\xfbq)7kmq>\\x0f\\x90e\\xcc\\x7frum\\xaah\\xba\\x05\\xcal"
  529. },
  530. {
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb\\xad\\x1f4-\\xc1\\xf2>\\xe8\\xc4<f\\x19\\xbe\\x9bb\\xc2\\xab\\xaa\\xcb\\xa1\\xb7\\xa3\\xfb\\x1a=\\x15\\x8d\\x18\\xd7t\\xa4\\xaa\\xde\\xcd\\x18v\\xbc\\xedp~g\\xd2\\x86qrh\\xb4h8v1\\x93(\\x94\\xaf\\xdar=\\x8da\\xb5\\xce\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\x80\t \\xc8\\xe9]xi\\xa7\n\\xd2g\\xdf\\x10\\x0b\\x15v\\xf2x\\xae\\xe0\\xf6\\xed\\xba:\\x08j\\xc3b\\xd3|\\xb0\\x08*\\xc46h\\xbf\\x19\\xe0\\x02j\\xcd\\xa5wz\\x99"
  532. },
  533. {
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xdf?x|\\xb3\\xbc\\x06\\xdf\\x81\\xf8c\\xad)\\xb3k~l\\x83\\x1am\\xbf\\xc07c\\x067l\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  535. },
  536. {
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc1_\\x14\\xa9#'\\xd3\\xf4\\xdf\\xd7!\\xe4;\\x1e\\x02\"3j\nf\\xe1\\_\\x8a\\xb2\\vl\\xd12\\xe949zmn\\x96#\\x9f\\x11\\xda\\xe4\\x90\\x88h\\x1dxoc\\x0c\\xdf\\xef1\\x17\\xd8\\xf2\nepf\\x0ct\\x0ck\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000gm\t\\xdc\\x0c\\xfb\\xc8|\\x01\\xe3\\xc5\\xae\\xd8\\\\x17(\\xff\\x90\\xfa\\xeef\\xf7\\x06\\xdf\\xdc\\x9a\\x84\\x8f}\\xa8\\xaf\\xab\\x10\\xea\\xae\\xfe\\xa5\\x05#\\xbe(:\\x12\\xa7\\xfc\\x89\\xa5c"
  538. },
  539. {
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xe8\\xb1\r\\xa0\\xf3\\x13\\x9d\\xda\\x9e\\x7f\\xbc\\x85\\xb4*t\\xbc\\xc2\\x08\\x95tf\\xda\\xcfre\\xe0\\x8b\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  541. },
  542. {
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2l\\x82\\xe6\\xfb\\xde\\xc4\\xb6\\xf83m\\x12\\xcbu\\x16=tj\\xa3\"\\x85j\\xa2i\\x1f\\x16\"\\xec\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  544. },
  545. {
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2a\\xb6h\\xc1=4\\xcb\\xc5l!\\x87\\xdb/j\\xe7b\\xadf\\x94\\x92\\xa0\\x8d\\x92\\xe5z\\xaba`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  547. },
  548. {
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xe9\\x88\\xf0\\xbe\\xa9\\x99\\x7f\\xbe\\xca\\x01\\x96\\x03y\\xeep\\xe3\\x8eh(7\\x94\\x00:\\xb7\\x0br5\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  550. },
  551. {
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xbf\\x9ar\\x94(a\\xc0\\xb9\\x1c\\xba\\xcb\\x99)\\xd9\\xcc\\xae\\xbf\\xd1v\\xd4\\x02q\\x83\\xdf\\x8b\\xd6\\xec?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  553. },
  554. {
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xcd\\xc2\\xdertgp\\x84\\x91\\x98fh3`h\\xa7\\xa3\\x7fi\\x0fd%\\x03\\xc5\\xabj\\x0b\\xd7\\xf4\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  556. },
  557. {
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf21\\xb4\\xbd\\x1f4\\xf88\\xcc)\\x9d\\x8bu\\xe3#\\x9bn\\x98e\\x84\\xd3\\xe3<\\xa2\\xac\\xf6\\xf4\\x8b\rfoz\\xc3\\x04\\x81\\xee\\x9fpz\\x16>=\r\\x1e\\xb87\\xc4\\xa4\\xd7\\xfb\\x8e\\xb7\\xa1p\\xd2s\\xeb\\xaf\\x9c\n\\xc5\\x00e\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g,t\\xd9\\xbcd\\xa2\\xa1\\xd5\\x9d\\xe0\\xdc=2\\xc9`\\xfc\\xa0\\x08g\\xfbj=;\\xc3:un\\xff'\\xcb\\x91\\xcfe\\x1a\\xb9wa!}v\\xcf\\xa4tz\\xefoq"
  559. },
  560. {
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89*f\\x94\\xfc\\xc4\\xf2&dhh\\xb1v\\xc2\\xaa\\x91\\xe3\\xe1\\xbf\\xfe9o&\\xd7\\x92\\x9c\\xf5~\\xf9\\xc3\\x08\\xf6\\xb1\\xb4\\xd1te\\x94.au/i%\\x0b\\xe9\\xb7j<7\\xbb\\xeef\\xc3\\xa6\\x977\\xb0\\x80yu\\xbeb\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x89\\xccd\\x9d\\xa9).\\x90qo\\xec\\xcbt\\x8a\\xe9%\\x0c\\xed\\x104\\xb1\\x82\\xaa\\x98\\xb0\\x88\\x05\\xfb\\xc1c\\xffm;\\x1c\\x01\\x05s\\x9dz\\\\xf0\\x9e\\x0f\\xb6\\xbco\\xc9"
  562. },
  563. {
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7\\xa1c\\x0641s\\xf2\\x9b\\xae$w\\x1c\"4c\\xe9\\xd3\\x07\\xae\\x00\\x02\\x96/g\\xfc\\x16<\\xad\\xe6k\\xfe\\x93_\\x90\\xa6z$\\x9c\"\\xa8\\xce\\x07\\xfe^~\\xe8\\x81a\\x1d\\xd1\\xfer\\x17\\xd3\\xcdm\\xa7\\x02lp\\xa2b\\x9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6\n\\xafa\\xd5\\x8e\\xfa\\xd5^v\\xec\\xc1\\xe2\\x060\\xbc\\x94\\x9d.\\xb0hu\\xad\\xbd\\x02\\xd8v\\xdb-\\xb4\\xf9\\xe4\\x11:=\"\\x0e\\xe0\\x82\\xd2\\xa7u\\x816:\\xc1ld"
  565. },
  566. {
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9ai\\x0ch\\xcfp\\xc3\\xa7\\x0c\\x03y\\x99\\xd7\\xb7<\\x97,4{\\xf4\\xc6\\xa0\\x86f\\xe5@\\\\x14\\xff1b\\x9c\\x98&\\xea\\xe1\\x89e\\x837\\xe3\\xebq=\\x8c\\xb1\\xd5$80\\xaak\\x9d\\x98\\xcc\\xf6\\x0c\\x96+\\xd6\\xee0\\xf2\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07c\\x93\\xdf=\\x10\\x98\\xaf3>s\\x8f\\x17\\xd9++\\xd5\\xa8\\xb5dg\\x85\\xe4\\xe6\\qy'\\xff\\xec\\x9a\\xb2\\x1a\\xd6\\xa0\\xfa\\xb5\\xcdmz\\xc8\\xe8\\x9a\\xc7t3\\xe7%"
  568. },
  569. {
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\xdd5>\\x9f'a\\xfcv-\\xaa?\\\\xc2l\\x01\\xabc\\x9d\\x84\\xd8b\\x877\\x8d\\xefdk\\xe6\\xe34u\\xf1\\x94'c\\x1bc\\xd8\\xe6*f\\xa6e\\xc1\\xb8\\xf7?\\xce\\xea\\x99xm&\\xe2\\xa7\\x01z\\xd45\\xda`\\x11u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\\xdb\\xd3\\xb7\\x88\\xcf\\xa5vm|s\\x01\\xa9\\xf0\\x83\\x9d_\\xd4n\\xbf\\x03\\xf2c\\x87\\xff\\x9e\\xebo\n\\x97\\xf6\\xff-\\xa5r\\xbe\\x00\\x8b\\xd9\\x9d\\x82\\xff\\xa1+\\xb2\\xf2\\xd4\n"
  571. },
  572. {
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90k\\xe4\\xd7\\x1b\r\\x15-p+\\x90\\xc4ba\\xa7f,\\x17\\xeep\\xe72\\xaa\\x83\n\\x80|l\\x06\\xd6_\\xf3\\xb1\\xb8\\xcd0g`r\\x82\\x181c\\xad#\\xedo^\\xbd`\\xa8}\\xc7xw\\x03f\\xbc\\xec\\xef\\x8cx\\x05\\x04z\\x9ct\\xa9i\\x0en\\xa7x0{\\xe9\\x86\\xc40\\xb5uf\\x9d\\xa7\\xd8\\x97\\x13\\x9bf\\xa7\\xa0\\x18\ry\\x0bqv\\x80f/\\xc1\\x99\\x1a\\x00\\xa6f\\xbb}\\x82<\\xa0\\xb2\\x84g\\x81aa\\x0e\\x14@\\x9c\\x8f\\xd6\\x1b\\x15\\xc5\\x96\\xb3\\x05$z\"\\x94\\x95s\\x92lg\\x9c\\xcf\\xe2\\x8a\\x8bn\\xc8v\\x86\\x9e\\x1e\\xab\\x078\\xaf\\x0ep\\xec<\\xeb\\xfa\\x992\\xa1\\xf9\\x8e\\xbb\\x0f\\xca\\xbb\\xeef^\\x97\\xd8\\xbf\\x1fl\\xf0c\\xbf\\xbd\\xe1\\x14\\x93\\x8b#|'\\xdf\\x98h\\x90<\\x16e:\\x89a\\x9do(\\xcf\\xe2\\xea\\xd1\\x9d\\xfe\\x02\\xd8\\xbe;\\x1e\\xdd~\\xff}q\\xcc\\xe2mv|\\xf395y\\xfe\\xc0\\xf7\\xc8\\x08\\xfex\\x9e\\xc6\\x95\\xb3\\x1b\\x84\\xe3\\x13v`f\\x01m\nsn5v4"
  574. },
  575. {
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xa2\\x17\\xbf\\x15y3\\xbevz\\xbe\\xd4\\xf1\\x7fb\\x85\\xcc\\xdei\\xd7\\x05*;_\\xca\\x06zc\\x96\\xce\\xfb\\xe9\\x9d\\x8d\\xdb\\xd3^\\xbd\\xd0\\x16\\xda\\x9a\\xb6fbfs3\\x99\\xa6[\\x0b\\x8fpv\\xf5v\\x82\\x1e\\x19\\xf7t\\x90\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\xf5\\xf8\\x02\\x902\\xe21\\xdc\\x82\\xe8\\x97\\xd5\\x80d}\\x83g\\xa2\\xa0_\\xe5\\xe8\\xd3b#\\x00\\xcd\\x18\\x0bx\\xb3\\x05\\xd4\\xd9q\\xb8\\xd5n\\xc9+}b\\xfb7a\\x011"
  577. },
  578. {
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8boi\\xa2i}6\\xb8#\\xb2\\x0f\\x84\\xca\\x1b\\xd4\\x8d0\\x8e\\x83j\\x9f\\x9fk\\v\\xa6/\\xdb\\xc2#\\xd4\\x981#\\xcd\\x90\\xf2\\xa0\\x9d\\x93\\xd9\\xbc\\xf21(]\\x0f\\x8e\\xfc4:\\xe9\\xd8\\x89\\x95nvh\\xb7\\x05\\x96\\xef\\x153\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7{$\\xf8\\x81\\xfa\\x1c|\\xce%\\x1d\\xbc\\xcc\\xef7\\xba>1[e\r\\xcb\\xf3u\\xe10|\\x81\\xe4\\x0cb\\x02\\xe4\\xbb\\xb8\\x8c\\xae\\xe1\\x87\\xd4w\n\\xed\\x01(\\x7f\\xca\t"
  580. },
  581. {
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91.cw\\xdcr\\x15;wajx\\xf7@\\xf5\\xac\\x04\\xb3\\xbb!\\x02;t\\xdfopt\\x83\\xc6\\\\xb8\\x9c\\xfb\\x90x\\x0e\\\\x04td<\n\\xd6\\xdf\\x8c&\\xdf\\xd5\\x8a\\x9f\\xf9u\\xf6?\\x05\\x08\\x19\\x1a\\xee={\\xe7\\xde\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe*\\x88\\xf6\\x10*\\xfb\\xbe\\xacl\\x0ce\\x93ej\\xd0\\xe1u\\xadl\\x87!*y\\x0e\\x0b\\x86n\\xdc@\\x9az\\xdf7t\\x9a\\xa1\\i\\xd6\\x07\\xdd\\xc0\\x1c\\xffk\\xe9\\x02"
  583. },
  584. {
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\"\\x90v\\xd3\\xca\\xf0\\x9b\\xd6\\x99e\\xe8\\x90\\xa9\\x85\r\\xdf\\x88\\xb6\\x96z\\x86\\xce\\x92\\x9b\\xb2\\x9a\\x04wl\\x8bu\\xf3\\xfe\\xcd\\x9d\\x17=\\xd9\\x9f\\xe1cx2\\xe2\\x150\\xad\\xe5pp\\xb1\\xa2\\x82\\x1dx\\x9cn\\xec\\xcd\\x1d\\x8c\\xca<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xa6\\x87\\xf06+7:\\x9a\\x87s\\xae\\x03o\\xd9\\\\xd8\\x9d\\xa8\\x00\\xbav\\xb19\\x7fu>\\xa1_jq\\xb8\\xf8\\xc2zn[\\xa3\\x8a\\xfc/u|\\x81\\x9ba\\x08$"
  586. },
  587. {
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2 {\\x8b_i\\xe2\\xf2\\x02\\x066\\xd0%\\x98\\xcf\\xb8a\\x83\\x83\\x1ed\\xe4\\xa5\\xacgu\\xe94\\xe4i\\xc7\\x9a<l\\xbe#\\x8b\\xbd\\x91jm\\xadco\\x18$\\x95:\\x06k\\xac\\xa8\\x91\\xe2\\x9by\\xbc\\xa0\\xe6\\xb5\\xb4\\xf7j\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xdb\\xf5\"\\x8e\\xb2)}\\xad\\xec\nr\\xad\\xf4(^y\\x839\\x11;?\\x9c.\\xacxa\\xd0\\xfc\\xed\\xc3,\\x02\\xc2\\x97\\x007w\\xba,\\xa55x\\xc6t\\x85\\xe6\\x92"
  589. },
  590. {
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{p\\xdfvkt<\\xf2\\xc3\\xdb\\x9b\\x9e}\\xd5\\x19\\x05)s\\x83_\\xf5\\xd5z\\xfe\\x0f\\x7f\\x82z%\\xb1\\xdfq\\xc0\\x17vb\\xbcn\\xc0\\x037\\xdc\\xc7\\xe0\tyo\\x9eb\\xb6z\\xc1\\xe8b\\xcf\\xe8\\x16\\x12*[d\\xbb\\xfb\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x94\r\\xb5k\\xaa\\xc7 )\\xe2`o=\\xd8\\x80\\xc3\\xd2\\xd7%\\xe5\\xd8\\x10\\x02\\x02\\xc6\\xa4\\x96\\x0c\\xee\\xcc[)uvvu\\xd0\\x12\\xd6e\\x13(2[\\x98\\x03\\xa6\\x0e\\x95"
  592. },
  593. {
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\x9a\\xfe\\x9a4\\x94\\xa9n\\x17cu\\xdb\\xf8[2\\x940\\xb8\\xf5>smuk\\xdfa\\x93\\xdbx\\x00\\xbd\\xb6a:\\xc6vx\\x88d&<1g\\xdc\\x9bb[s\\x88?\\xc9\\xfd\\x96\\x9ar|]a\\x9b\\xfe\\x8c?\\x85\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|[\\xeani\\m\\xb8pi\\x8c\\xc6\\xfb\\x98r&\\xfd\\x1f'\\x125\\xdez,c\\xe0\\xe4\\xbe,\\xbf\\xba;\\xddc\\xb4\\x0c\\xaay$=\\x9a\\x9a\\x06\\xc8~\\xc2?\\x1e"
  595. },
  596. {
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\x01\\xe9:\\xf1\n\\x8b\\x82v0\\x99\\xfd}\\xba\\xbd\\xd3\\xfc8:t\\xc3\\x12\\xf2\\xcbs\\x9b\\xd0\\xb4z\\xe6\\xea\\xe3\\xe6\\x1611bn\\x18wk\\x1b\\xd0\\xb7g\\xf7\\x9f6\\x99\\xa2\\xdd\\xb60\\x07#\\x01\\xa6\\x9c\\xfc\\xea\\xaf\\x94\\xb9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000%\\x18i\\xe0ne\\xefa\\xcf\\xad\\xde\\xe4}\\x16\\x82\\xef\\x93<\\xc5\\x1a\\x06dq,\\xb7\\xfc(8#\\xe4\\xe2j\\x12dz\tz\\xdb\\xc3cv\\xe7\\xc4\\xb4\\x99\\xde\\x08"
  598. },
  599. {
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xaen\\x9d{{@y\\xbc\\xfd\\xa8a\\xe4\\x8cq\\x07l\\xb0\\x0fc\\x8f\\xe1\n\\xe4\\x89r\\xd4n\\xc9\\xd56\\xf0\\xf3\\xf1\\x14\\x9do\\xc1\\xc0\\xe9\\x96\\xcdv\\x1f\\xddqr\\xd7\\xc4\\xe7kk\\x04.v\\x7f\\x17m\\xed\\x0f\\xddv=\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98\\xab\\xa8\\xbaw\\x8d\\xdb\\&\\xdc\\xb3\\xd9\\xe1\\xce\\x8a\\xa9\\x8enhj\\xaag\\x1f\\xa2\\xd3\\xb23\\xb5v\r\\x17\t8\\x93\\x93\\xae\\x8e$\\xaf\\xc3\\x97\\x027\\x84\\xda\\xb1\\xfd\\xe1"
  601. },
  602. {
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\xee8\\xae\\\\xaf\\x03\\xe4\\x15\\xa5\\x0e\\xe1z5r~'\\xb40e\\xa4\\xael^\\x88\\xe9\\xc3s\\x80jz\\x01\\xd5\\x04\\x08\\xc5\\xc1\\x1f*}\\x0fz\\xcf\\xc1\\xfe9\\xa5c\\xd4\\xcbw\\xda\\xd6\\x98\\x83\\xb8w\\x14|\\xf8\\x02\\xe6g\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\x7f\"\\xeb\\x8fob\\x0c\\xe4\\xd6\\xf6\\x8b(\\xfd\\x19j\\x0c\\xe3\\xaer\\xddp\\x11\\xd6\\xe4\\x92\\xbf&\\x05\\xfa\\xd7\\x91\\x12g\\xd1m\\x91\\x1by\\xca\\x88\\xc0\\xb79\\xe5\\xbd\\xd7\\x9c"
  604. },
  605. {
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04uqll\\xf7p\\xeb\\xfd\\xca\\xach\\x8fsu)\\xe77<\\xefl*\\x89\\x8f\\xef\\xfe\\xf8m!\\xe1l\\x88\\xff8\\x956\\xc5\\xb4w\\xe6d\\xa4\\xaf;\\x92\\xf58t\\xcb\\xf3\\xd2\\xbez\\xe0\\x15\\xbc\\x1b\\xd2lo\t\\xe6b\\xd7\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83kip\\xa0)s\\xe5l\\xe3\\xb5\\x06\\x11\\xed\\x86\\xef\\xcc\\xe7h\\xdf[\\x08\\x85i\\xceg\\xa2\n\\x9b\\xec\\x8fpg\\x92b\\x82\\xcee\\xdf`\\xea\\xe7&,5\\xe0\\xd42"
  607. },
  608. {
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a\\x8d\\xe8\\xabp\\x7f\\x90\\x937<,\\xcc\\x0b4\\x05\\xb0\\x14\\xd7\\xc6a\\xa9e\\x1d\\x9e\\xe5\\xdc\\xfd\\xe6\\x82>s\\xdb\\x11\\xdf\\xc8b\\x050c\\xf5\r\\xd3\\x98\\xf1\\x0fp\\xa8\t\\xe8\\xd1\\x97\\xfe'\\xe7!\\x7f\\xaa(#\t\\x96\\xcf+~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x97\\xf1\\xfe\\x07\\xad-zv\\xda{\\x9dk\\x12\\xbe\\xe1|\\xb9\\x9a`\\xa3\\xf9\\xa9%b\\x9b\\xd7_\\x01s\\x13\\x11!\\xd0\\xe1\\x1e|\\xb0\\xaa6\\xac\\xac\\xf2p\\xa1\\xa6.\\x93"
  610. },
  611. {
  612. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103,.\\x82\\x11\\\\xfa\\xae=m\\xf3\\x05e\\xa4j\\xfcp\\x9a\\xd0\\x8cqv\\x82\\xbc?\\x1c\\xcc\\xad\\xc0q*m\\xfd\\xb0\\x04\\x14-\\xbf\\xffb\\x8e\\x0b\\xf6b\\x7f\\x1e\\xc8p\\x0f\\x80ta\\xc2\\x0e\\xa4\\xd0\\x89z\\x9c\\xa6\\x93b\\xea\\xc6\\x91\\xb5\\x96w\\x9f\\xfc\\xda!\\xf3\\xb2!w\\x1e\\xfb\\xca\\x8c\\xf5(\\xb1k\\xb2hd\\xa7q\\x08\\x81t\n\\xee\\xf1\\x8e\\x98\\xea\\xe9\\x94\\x9a\\xd8g}\\x1b<\\xf8\\x86!\\xf9\\xdf\\xf3\\xfag\\x1a b\\x8d\\xc8\\xbd\\x1964\\xfc\\x9b\\x1d\\xce\\x96c\\xf8,]\\x9c7\\x12\\xf6p'\\xf5\\x11%\\xff\\x94'\\x8e \\xe4\\xb8\\x93\\xbc\\x8fun:'\\xf7\\xcc\\x04aa\\xba\\xac\\xf0j}\\xc16\\x89\\xde\\xd7hq\\x03\\x8e\\x84\\x99t\\xb0\t\\xa4'[\\x90\\\\xe0\\xc1\\xf41\\xb7\\xd5p\\xe6#\\x1f\\xe1j\\xb9\\xf7\\x97.\\xb3!\\xdd\\xd62\\x1e\\xb1t\\x99cm\\xb2\\xd4\\xba\\xd52\\xb7\\xdc\\x8b\\xc4\\xae%,bvg\\xf6l^\\x7f\\xe4;\\xa8\\xe5\\xf66\r\\x14\\xbf\\x087\\xeb\t>\\x92:k{\\x03\\xc2\\x96"
  613. },
  614. {
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04vr\\x12\\xd3m>\\xf0!\\x9f\\xda\\x0fgcu\\xfd\\xe9\\x83\\x9a\\x8b=vk=w\\xecu\\xfe\\xea\\xa0\\x1e\\xe5\\x7f<\\xacb!v\\xf4\\x92\\x17r\\xd7ud\\xc51\\x98\\xe4\\x95h=\ry|\\xd8{+na\\x170\\xa3\\xe1\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc\\x89\\xf5\\x96\\x18\\x85\\xbd\\xd5\\xbbw\\x0bwi\\x80\\xae,^$\\x8f[g\t3\\x8f\\x88f\\x8b\\xd0\\x08f\\xb0=!\\x04\\xac\\xe6\\xeb)\\xc4\\xc1\\xd1<t\\xe1\\xea\\xbc\\x1f*"
  616. },
  617. {
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb&lke2\\xd4\\x14\\x1d\\xf6\\xdf\\xf4p^\\xda\\x97?\\x83\\xe0al.s\\x1b\\x9c\\x90w\\x1b\\x15%\\xfdg\\xcc\\xd2\\xbdb\\x9bd\\x01\\xe13\\x9b\\x06\\x1f\\x87\\x055d\\xf6\\xb5\\x0e\tx\\xaf\\x8a-\\x1be\\x97\\x1fd\\xb0`\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa<\\xb3\\x1f\\x8e4\\x1e\\xed\\xe5\\x9el\\xb1/\\xf1\\xeb\\xd5\\xdc\\xa2\\x02\\x05<\\x94\\x92\\x01\\xa0\\xb1\\x8b\\xfd3\\xae!f\\xe3l\\xf1yjw\\xe80\\x01\\x93y\\x13\\x88\\xda\\x9d}"
  619. },
  620. {
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe1\\xdc/\\xb2\\x01\\x95d\\x11\\xdb\\xe5\\x85/\\x7fv\\xa3y\\xf1,\\x85\\x13\\xd9\\xc1\\xbcq*\\x8f\\xa0\\xe1\\xad\\x97\\x86n\\x86\\xf2\\xbd~@\rj\\x15i\t\\xc6\\x04[2 \\x81\\x1a\\xc1\\xaa\\xf4\\xab\\xfe8\\xa55\\x89l\\xae\\x127\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8b\\x9e\\x06\\xde\\x82\\x1e\\xe3\\x9a\\xac\n\\xbb\\xe5x\\x8e\\x1b\\xe8\\x0c\\xe1\\xb4\\xf6\\x95}|\\xb0%\\xe3n\\xfe\\x90\\xebd\\x979_\\xb8\\xe4\\xbbu\\xe35\\xe6\\xe0\\xd2\\xc5n\\xf0\\xb7"
  622. },
  623. {
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\xd1\\x0ept.\\xa42\\xc6h\\xf4\\x8chg\\xac\\xfa\\xc2w\\x17\\x99=twz\\x1a\\x93(i\\xfdx\\xbf\\x83\\xe0\\x13\\xa2\\xcb\\x878\\xa9jd\\xa5\\xc5\\x86\\xa8\\x12n\\xc1b\\xec\\x18\\xfc\\xa0\\x05\\xf8q\\xa8\\x88p\\x06\\xd6\\xea\\\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xbf\\xafw\\xa36\\xd8\\x9b\\xb8a\\xe4\\x8c\\xdc#<:\\xe6\\xe6qp>\\xb6l \\xd9\\xe1:p\\x80\r\\x88\\xa8\\xa1c\\x97\\xa0k&\\x1b\\xb5\\x96\\xbb\\x0f\\xe8d\\x88\\x00 "
  625. },
  626. {
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07\\xbc\\x02?l\\x91\\x05\\xa2\\xbe\\xc5\\x81\\xb6!f\\xfc\\xf1h\\xec]\\xa4\\xafy\\x03\\xa2\\xb7|\\xf5cn\\xc7\\x03\\xcckr2\\xfd\\x13\\x1c\\xe6l,\\x15\\x19]o\\x87\\x12\\xf7\\xba\\xe5\\xdd\\xc9\\xb3\\x19d\\xe8\\xb9~\\x1e\\x8a\\xbbgs\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xe9\\xe4\\x1a\\xd3\\x8e\\x1f/$\\x93\\xb5\\xc0(\\xe3\\xfd\\xb7\\xf1\\x05\\xc4w9\\xf2\\xd7o\\x8eg\\xca\\xb2\\xb2\\x7f\\xcfn`\\x9c*6\\xd2\\xc7i\\xaa\\xe6e\\xa4c\\xa2o\\x0e\\xde"
  628. },
  629. {
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\x14=\\xef+\\xb0\\xd1=\\xd9j|\\xdd!\\x9aw]\\xf2\\xc0\\xeb]\\xbd\\xb5rd\\xcd\\xbb\\xaa\t\\x87\\x99\\xf2\\xef4\\x9b\\xc3\\x83b\\xcd\\xdb\\x02\\x86\\xa8\\xcd\\xdf\\x02\\xd6`\\x02\\x96t\\xb5\\x15\\xb2\\x0f\\xcd.\\xd5\\x1e{\\xe2\\xa0n\\xab\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?\\xa0\\xd5tc\\x82\\xa4\\xd3\\xcc\\xb3v's\\xda?\\xc8?u%$\\xfeks\r>\\xa4\\xf1\\x03\\xf5\\x1e\\xd9\\xaa\\x0f\\x97\\x04\t\\x16\\x18kc\\xd7j\\xb6j\\xaf\\xc6\\xd7\\x85"
  631. },
  632. {
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8dhz\\x9e-$\\x97\\xe9\\x97\\x8f\\x9c\\x91\\xe8\\xf4\\x95\\x16\t\\xa6\t\\xbc\\xdb&r\\xb9\\xd1\\x01\\x90m\\xe35<\\xfc\\xc7\\xb6y\\xd3\\xd4w+\\x86\\xf1\\xfd\\xe6\\xf7r3sd\\xb9\\xe5\\xcb\\x93\\x90|a\\xb3\\x9e\\x9b\\xe6\\xc6vb\\xdek\\x12\\x93a\\xf5\\xeae\\xff\\xabw\\x99\\xf7\\xf4\\x7f\\xef\\xf1\\xa5b\\x8b=u\\x1e\\x10\\xdd\\xe9\\xeei]\\x84.\\x10x\\x82\\x95u\\x1c\\x98\\x12\\x1a\\x05\\xa3\\xbc0\\x1e\\xaa\\x06\\xac&\\x1d\\xfa<\\xd7e\\xabf\\x0f\\xde\\xfbu\\xad\\xeddj\\xc3\\xfc\\xab\\xa4\\x1b~b:\\xca\\xae\\xab\\xc6\\xfd\\xf8\\xf7b\\x86\\xf4\\xeas\\x8e\\xddo[|j\\xa2\\xd4_\\xd0w\\xbe\\x96j\\x81\\xd6\\xc6\\xf2\\xd0;\\x1d\\x1bt<\\xb7\\xf9\\xe3\\xff\\xf4c\\x8ei=.\\x83\\xcf\\x96\\x02_a\\xeb\\x88\\xd0\\x0e1\\x03\\xc4\\xc3\\x1e'3-^\\x02n\\xb93\\xe7\\x16\\xa1j\\x92\\xcc\\xa8\\xe1g\\xbc$l\\x91\\xd50\\xca\\xe6\\xed\\x18c\\xc4\\x15f\\xd9\\xc1e\\x00\\x18\\xb6&u\\xe8m\\x10\\xb97\\xf2ds\\xb3<v:6\\xdd\\xc4(?"
  634. },
  635. {
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\x1ci6\\x82\\xf2lc!\\x1cu\\xfb[\\xb9\\x97\\xb3\\xd0\\xc7#\\x07\\x95\\x9c\\xf2,\\x94\\x97\\xf9\\xce\\xca\\x1bj#\\x90\\xeb\\xb2p^;\\x9cw\\xe1\\x1c\\xfb\\xe3\\xc7k\\xd6>bh;c~\\x1a\\xb8\\x10\\xa1\\xf0\\xfe\\x1a\\xd9\\xd2k\\x94\\xa9\\xf4a\\xf1`\\x0f\\x8c\\xc8\\xd7\\xc7\\xe9\\x1f\\xd5e\\x1f\\xa1r\\xd8\\xdbg\\xc1\\x83\\x8c\\x93\\xba\\xdf\\xaa\\xbc\\x85\\xfb\\x16\\x17\\xc8\\xc2\\xdd#:\\x07a\\xe1\\x7f\\\tex\\xae\t3\\xcd.^\r\\xa7t\\x88\\x96\\x01\\x15\\x00u\\xb7\\xff\\xd7\\x13%-\\xe7d\\x0f26\\xc0\\xbb\\xa7;\\xb61\\x7fw\\x98\\x11\n/tm\\x93a\\x87\\xa4;[\\xff}\\xa5\\x96y!b\\x92\\x1f\\xa80a\\x9d\\xd9\\xeaq\\xc2\\xa7,=\\xc7\rb`g\\xcc\\xf8-\\xd9\\xf4d\\x8dlg_j\\x1a\\xc0\\xb6y\\x0cwa\\x83)\\xb7\rel%\"\\xee\\x1c\\x9cp\\xef{3\\x85\\xd9\\x82n\\xacf\\x16\\x07i\\xd9\\xf8<\\x08\\x15\\x01\\xd8r\\x1d\\xcc\\xe0\\x8b\\xe4g\\xff\\x81e\\x03t\\x10\n\\xd64\\xe1\\xeba\\x9c\\xf2\\x83"
  637. },
  638. {
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\\x1d\\xf5\\xfa\\x01\\xea\\xa6\\xea8\\x82hj\\xd4\\xe8\\xb0+\\xe6\\x06$e\\x10}\\xd0\\xe4\\xa8i\\xfd\\xe8\\xa4x\\x82\\xa8\\xd8\\xec\\x10wn\\xaef\\x1e\\x92\\x07v\\xec\\x02\\xcao\\xd9l\\xb4\\xa4\\xfe@\\xbb\\xa3\\xb2\\x82\\xbdhr\\xac_\\xc6/(\\x03\\xf8*\\xd4\\x10#]\\x9b\"c\\xb7\\x06\\xcb\\xdb\\xb6\\xcd\n\\xaf\\xb3o\\x9eb\\xf7t\\x0e\\xe7+|\\xb5\\x129s\\xb2\\x16\\xe1\\x80|\\xbdt\\xecu\\xd9`\\x0e\\xa3{\\xb6\\x0ey\\xa8\\xdd\\x13c9\\xc8:\\x06,@>\\xd7\\x1co\\xf4\\x86\\x82\\xe0\\xbdm\\xfe\\xac\\x1d\\x81\n\\x0f\\x15\tufw\\x18\\xe0\\x1e\\x11%\\x1b8\\xfa\\xa4\\xf0=\\xa7u\\x83)\\xfd\\x19\\xcep\\x89\\x1fvn\\x81\\x82sc\\xf3\\x04\\xa4\\x15'\\x80m\\x02\\x9d\\x1c|\\x16\\xc0\\x9bx\n\\xc6i\\xe1\\xbc1\\xd7.\\xc4\\x07\\xac\\x16u\\x98\\x02\\x0f_\\x08^\\x12s\\xfe\\xdb\\x8e\\x7f\\x89f\\xcbp2\\xce\\x8b/\\xe0\\xd1f\n\\xf9?\\x7f\\xd7s\\x91\\xddk|j@f\\x94\\xfa\\xdf\\xe2z\\xf02\\x1e\\xd07s\\xb3j\\x9c\\xb4"
  640. },
  641. {
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\xe0o\\xbb\\xc8\\x8a\\xbe\\xd3[\\xb4\\x00\\xc7p\\xda\\x98\\x91\\x94\\xbb7d\\xac\\x8fa\\xc8'\\xee\\xb2\\x9f\\x90\\x8b\\x9d\\x06.u\\xbe\r\\xe54\\x92a\\x10r}\\xf1\\xf6\\xbb\\xb7f\\xb6\\xdf\\xda\\x1c\\x90\\x1a\\xbd\\x859y\\xfb\\xbb0\\xf1wd~=j\\x8a\\xa1@y\\x9e\\xbe\\xed\\xd0\\xb7\\x98\"\\x18a\\xf7\\xd9\\x16\t@z1\\x1e\\x97\\x1a>\\xf2v\\x93z`\\xa6\\x83\\xf0u\\xd9\t\\xedn\\xa6\\x94\\xe9?v\\xde\\xc5_m\\x05\\xb8ujm\\xc5\\xc7\\xcb\\x83\\xfb\\x1a\\x0b\\xdb\\x10\\xa5\\xd8\\x98\\xc3;i\\xb2p\\x82\\xbe\\xb136\\x9b\\x97\\x9d\\x02q\\xa9\\x07\\xacf]l\\xbe\\x90\\xf4k\\xbd\\x1b\\xb4b\\xbb\\xa5\\x16d\\x1d\\x9c\\x02t\\xa3n\\x8b.\\xf1v\\x8d\\xbf\\x86d\\x9d\\xe9b\\xcet\\xeb*\\x8c\\xe6\\x94\\xea!\\x15i/=\\x96[\\x19h\\xa0\\x99\\xbf\\x8f\\x0f\\xc6\\xd7(r\\xf5\\xd7\\xf9\\x99\\xb5\\xdeu[\\x1c=`\\x96\\x0c\\xe2\\xe5\\x80\\xf2\\xaf\\xd5q.im\\xee\\xa2\\xe7\"--\\xf3\\x97\\xc3\\x9d\\xc2a\\xfbb\\xa6\\xd4y\\xb7\\xf9n\\xf0\\xa1"
  643. },
  644. {
  645. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\x89\\x96\\xc6\\xc5\\x8d|\\x11\\x8a\\x9c\\xe1\\xfar\\x1bn\\x9cg\\x10\\xac\\x17\\x04 \\x8b\\xb1m\\x0bp\\xc6\\xcd\\xe3\\x13_\\xd4\\x08#\\xb4\\xa7\\xdb\\xf2\\x94\"\\xe9\\x9f\\xb2>abb\\xb7\\x81\\x8c\\xee\\x87\\xe2\\xe6}\\x84\\xdfv\\x18\\x179\\x82r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\xc3\\x94\\xea/\\xadka\\xa0&\\xe9\\xda\\xa8,\\xa8\\xf4\\xa9j\\xe5\\xc2\\xa8-\n3#\\x0e\\x9c\\x98t\\x19\\xb9\\xf0\\x87\\x15\\x9ar\\x957\\xbf\\x91|\\xe9\\x06'\\xa5\\x04\\xc3i"
  646. },
  647. {
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe4\\xf7t\\x8dabfzop\\x13c\\xaa\\xce\\xb7\\x15\\xc4\\x0c\\xd5k\\xed\\xb5q<\\x8d\\x0b\\x0f\\xa9\\xec\\xd8\\x98\\xdei+b\\x0c\\xcc<luf \\xb5\\xde\\xd2\\xa0\\xf2\\xd0\\xdb\\xf9\\xdc:{u\\x82\\xf5\\xa3\\xd5\\xc3\\xc8\\x1ag\\xf1)lz\\x19\\x10fp \\xa36\\x11k\\x00\\xc9\\xb8\\xe3\\xbc\\x95}`\\x84\\xbf\\x87/\\xeeh\\x80i%\\x94\\x9e*?\\xfd7\\x11`\\xb9h>\\x86n?\n\\x9a\\xd98\\xc8\\xf3z\\xae\\xafv#\\xf3hp*\\xd7\n\\xaf\\x11\\x14\\x9a`am\\xb4\\xed\\xfa\\xdb\\xd6\\x90\\x83?$/a}~\\xa7\\x83\\xdb`\\x0en\\xb4i\\x1b\\xedl\\x15s7\\xb8o\\x05\\x1f\\xc1dk\\xcey0%\\xd5[wu\\x15qql\\x12w\\x14\\xa3^d\\xf7\\x10\\xdd\\x1d\\xba&c\\xe9\\xfa\\xe1\\xe4+aq3s3b\\xf9\\x1c$wj$\\x1d\\x11\\x98\\xe0f\\xba6x\\xee\\xdf\\x8c\\xbd\\x9a\\x83f&)3\\xc2=z\\xc4&\\xe8\\x15\\x11\\xcc\\xed\\xa4j\\xad5^\\xe5\\xf4\\xd7ls^\\xccz\\xcc\\xa9\\x16\\x87"
  649. },
  650. {
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16\\xef\\xef\\xc2d\\xc4\\x83\\xcdo\\xce\t$\\xa9\\xcb|d\\x0b\\xc4i\\x01\\xf2\\xfa(}\tk\\xff\\x90\\xeft\\x88\\xb4#\\x8f\\xcbz\\x9f\\xfa\\xb3\\x11p\\x0f\\xf8w4\\xe6a-\\xce\\xfe3\\x00\\xdb\\xdan\\x00\\xd0\\xf8\\xba\\xd5\\xd8\\xc36\\x0f\\x9a}g\\xd5\\xce\\xe9px_\\xcel\\xb1\\x9e0,\\xbeo\"b\\xe5\\x90,.)\\x01m\\xd5\\x7f\\x87\\xd3\\xd8\\x04\\xc5\\x93q\\x97\\xd2h\\xf9\\xfdb\\xa5m\\xcd]\\xfah7\\xa6\\xd6p\\x10\\xbc\\x1f\\xa2\\xe9b\\x9e\\xf4zvkbb\\x103\\x1d\\xcb\\xb6m\\x0e\\xcf\\xd27\\x9d\\x89\\xe1\\x0c\\x954\\x10\\xb1\\x11e\\x9a\\xfarxy\\xd7$\\xd9k\\xbc\"5\\xd4c\\x89\\x83\\xa4\\xa2\\xc7$o05qe\\x99\\x02\\xf8\\x10>\\xb3\\xae\\xdd()m2\\x9ex_\\xe82\\x82\\x7fm\\x8b\\xd5\\xf5*\\xb5;\\xbf\\xf5\\x862d\\xb94\\xa4d\\xc6\\xe3\\x98j\\xa6\\x9alb\\x98k-\\x15\\x95\\x9a\\xe6{\\x9b\\xe65\\xaa\\xfb\\xd6\\x0c$\\x87\\xcc\\x8f&\\xdad\r5\\x1a\\\\xcc\\x1b\\x1fo\\x9f5\\xf1\\x8eu"
  652. },
  653. {
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6!gz\\xa3'`\\xa7\\xd9\\xea4j\\xd6\\x85\\x82\\xf1\\x05g\\xe9\\x93cg\"\\xf2i\\x97%\\xcf\\xe6\\xaa\\xb7a\\xdb\\x84p9\\xa0\\xbee2\\xa7\\xdbej\\x04a\\x1e\\x05\\xdf\\x96\\xce\\xee8gs\\x9e\\xacz\\x80\\xa3\\x15\\xf0\\xf9\\x96\\xeb\\xddj}\\xcf{'sk\\xd3\\xbb\re\\xdb\\x10\\xb5\\xa4%\\xc4\\xbf\r\\x7f\\xa1\\xaa\\x0ed-\\xfevu4k\\xe2\\x1f\\x04\\x9c\\xc9\\xd8ps\\x04\\x85\\x19:k\\x07h/\\xe5t\\x17\\xbb\\xa4\\xfa\\xd2\\xd8\\x0c\\xc5}\\xfe\\xeb\\xb3\\xe0\\xcc\\xf3\\xbfs%\\xbav\\xc6\\xd2e\\x15\\xf3ka\\x1c\\xaa\\xd2\\x8f\\x8ch\\xb8\\xe5z>\\xe6o\\xcf-\\xbc\\xc6n\\xaa!6\\xfc\\x18\\xaas*\\x95\\x91\\xc3\\xda\\xe1an\\x8f\\xf96h\\xf8\\xd6\\xe6ql\\x95q\\x84\\x93x\\x9b\\x04-\\xc1\\xe2m\\xdf#\\xdd}\\xa1\\xd7gw\n\\x81`\\xb2*\\x01\\xdc\\x94\\xcdvn@`\\xc2\\x12\\xfb\\x88\\xf0\\x94/\\xd1t\\xea\\xbaj\\xd1\\xce\\x1ee\\x82_\\x07\\xe6~\\x97\\x84\\x0fg\\xef\\xd4\\x91\\x9d=\\x9a\\xa1\\x89\\xd8\\x84u\\x16"
  655. },
  656. {
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1\\xe3x\\x10\\xd8\\x0e\\xb9\\xf5\\x0e3;;\\xf1!\\xdd\\x98\r\\xb3\\xc4}\\xfc\r\\x92tv6\\xc1\\x93\\x1a\\xb4\\xcd?\\x97\\x96\\xe7\\xc4\\xf6\\xa6`$\\xf4\\xa0\\xd7\\xf7i\\x7f\\xe6\\x17\\xf1\\xf2;\\xf5\\x93\\x97\\xef(_\\x89\\xb3\\xb0ry\"\\x19,\\xef\\x01awd\\xb2j\\x01 \\x8a\\x87\\x0f\\x98\\xf1'gi\\xec\\xf3\\x17\\xab\\xef\\x03\\xe2\\x07\\xce>;\\xf4\\xdf\\xbe\\xd1\\xa87\\x9a\\x8bj<h\\xe608\\x8e:\\xfc\\xd3q&\\xd2o:\r\\x91\\xc0\\x194s\\xf39p3\\x8a\\x05\\xbd\\xe0\\xa4\\x0b\\x02\\xe2\"\\x89\\xba\\x12\\xeb\\x87\\xf4\\xbd\\xc6\\xa0\\x8e,\\xc3\\x16\\xa8\\xa3\\xef`\\xb0\\xc2\\x05spk<x\\xf1\\xedh\\xdej\\x03\\x92\\xa5\\x1e\\x0b\\xc4\\xb4\\x99\\x03p\\x83ss\r\\x02\\xb3\\xa3\\x14\\x16\\x15\\x18\\x86\\xa4\\xa2c:\\x99yc}k\\xf0;2\\xb4rq;c\\x9b\\x93\\xf6\\xfe\\xe6\\xa7\\xe4\\xfcq\\x19-\\x84\\xef\\xf2j\\xa0\\x91h\\xce]\\x85mk]~\\xc59\\xf1\\xe8\\x84p\\x88\\x96\\xa3o\\xad\\xc4+\\xbb6\\xd1y\\x15\\xed&y\\xa5"
  658. },
  659. {
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\x82\\x8dug\\xc9p\\xfb\\xa3\\xd6\\xbd@[\\x00[0\\xc3c\\xb4\\xd9\\xa1hlc\\xd9x\\xc6\\x8a\\x86\\xb7l\\x1b\\x1d\\xd9\\x92*\\xf2\\xad@\\x93\\xed\\x12\\xbfo\\xe2f\\x029m%\\xe4\\x16\\xa5\\x10\\x93\\xfe4\\x93s\\x19\\s\\xa0\\x15>x\\x1bi\\xa7 +\\xe0~a\\x04\\xf62a\\xf2\\x13c1\\xd3\\x06`;6l$\\x1f\\x9d\\xc7\\xf6\\xc9\\xb79<\\xab\\xfd\\xab\\x98>n\\x06\\xae\\xe8k\\xac\\xe0\\xf0\\xb0oszr!\\xbc\\x88\\xf6\\xda\\xe8\\x7f\\xf6\\xb2h\\x9cw\\xd1\\xc3\\xb6\\x84s5y-\\x99:\\x89\r\\xcb\\x0c\\x16\\xfb\\x80kp\\xf7\\x83\\xe6\\x92\\xef\\x1d\\x05]t+v\\xd9\\x8b/\\x02\\x1c\\x95\\xa6\\x06;\\xd3\\x00\\xe9\\xc7\\xf4\\xbb\\x04\\xc9c\\x113!e\\xe9m5\\x87\\xddwbpc-\\xae=\\xd6\\x87\\x0cg\\x06\\x07y\\xbe\\xfe'\\xa9=u\\x93\\xc6\\xebvf\\x1do\\xdbp\\x8bx\\x8d?\\x85g \\x9d\\x80\\x19s\\x16\\xeb\\xd7\\xf4^\\xf0\\x8f5vt\\x03\\xe6\\x0f\\x90h\\xf6\\x19{\\x9c'\\xbc\\x9f\\xc4p)\\xcda"
  661. },
  662. {
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6\nh\\xfb\\xd9j\\xc01\\x08\\xb2%r\\xcf\\xa4\\x07\\x96n\\x0foii\\xd9\\xc1\\x92\\x9c\\x03\\xa8p\\xbf\\x8a\\xb9.\\xe7\\x0f>\\xec\\xees\\x01\\x1dc'\\x86\\x8c\\xdb\\x99\\xeb\\xc4\\x80h\\xe2vv?z\\xf5sk\\x8b\\x03|\\xe0\\xbak\\xa1\\xc7\\xe5\\x13k\\x00w\\xbbb\\x93\\xe8\\x14\\x19\\x93z\\xac\\xfae\\xa4\\x1b\\xe1^\\xbcc\\x16\\xa9\\xc0\\xa8\\xaeo\\xf7\\x05\\xc7l\\x7f\\xc1m3\\xb8[\\x1f\\xad\\xe0\\x8by\\x8d\\x1a\\xa7;\\x1e\\xd63\\xbd+\\xd3\\xef\\x80/a\\xba\\xae\\x086\\xa9\\xbc\\xb3\\xe5ew\\xfb\\xbc{\r\\xe4\\xf0\\xa2a\\xaa\\x85\\x89\\xb7\\x89*\\xeae\\x01\\x93\\xe8h+\\xb3\\xcf\\xcb\\x87\\xb2@\\x00\\xf08\\xa4x\\xc1}\\x94\\xd9\\xee\t\\xd2\\xe7\\xc3{\\x83\\xd4c\\x88\\x18\\xdc\\x08\\xfa1q\\x13\\x99) \\x9b\\xfcf~\\xa2b\\xde\\x86\\xe0\\xcee\\x19\\x1d\\xaf\\xfc#\\xab0\\xbe9x\\x92pr.<\\xf1\\x11\\x89 \\x11\\x13\\x9b\\x86\\xc6\\xf21{\\xd5\\xa0\\x80s\\xe2ser\\xe7~\\x15\\xf4m\\x83\\x9c\\xf1\\x11 id^t\\xf9\\xb6"
  664. },
  665. {
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\x11&\\xfbz]}\\x0c\\x1c\\xf2\\xa4\\x1d\\xdcu\\xae\\xef\\xc7\\xd1\\xfe\\x90\\x14\\xeal%k\\x906\\xdb\\x81\\x15\\xf2\\xbd\\xf1\\xd3\\x1e\\xf6\\x94-\\x8e<\\xa9u\\x19v\\x81\\x8b\\xe8\\x8a|\\x02\\x1d(\\xb53\\x0c\\xaf\\x92y\\x83k\\xb9\\x13\\x96\\xf7h\\xdc\\xe4\\xa2#\\x05\\xbf!\\xa2c\\xa0\\xe1~\\x9b\\xee\\xcc\\xa5y\\x8b\\x16\\x16\\x90\\x17\\xcb\\xa5\\x18g\\xe1\\xec\\xadd\\x9di\\xe4\\x02\\xbd\\xb2\\xe9\\x94\\xa8x\\x95\\xfd\\x8ay\\xa5\\xe9#\\xe0\\xdc\\x8bw\\xca\\x04\\xe0\t\\x1f\\x12\\x89\\xb5\\xcf\\xbb\\xeb\\xcd9\\x05\na\\xc5?\\x1f\\xf7\\xa37_\\x89\\xcc\\xf8\\xc0\\xbe\\xf4p0n`\rx\\xa9\\x013\\x7f\\xb4<\\x0e\\x12@y\\xc4\\xc3\\x83\\xe8\\xda\\xf1f,id\\x1bl\\xfb\\xdc\\xbc\\x19\\xda\\xe3d\\xd9\\xf2\\x8fdh\\xf3\\xf5\\x05x\\x071rl\\x96\\x83\\x99d\\xbd\\x06;}u\\x9dm\\x84\\xc6\\xf3\\x82\\xd6yb[\\xf0\\xdb\\xa1\\x18\\x7f\\xd7\\xe4\\xeba\\xce\\x1f r\\xc0lk\\xcad9\\xa5\\xdah\\x01\\xa2\\xc3\\x81\\x92\\xaf\\x82\\xd5ez\\x1cw\\x0cs\\xb7\\x94\\x15"
  667. },
  668. {
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\x04\\xdf9b\\xd3\\x00\\xcd\\xc3\\x9a\\x14\\xd4\\xe9\\x9d\\x0c\\x1f}4\\x1e\\xf8\\xbe_\\xbc\\xb8_,\\x10\\xc2\\xe95\\xb2-<\\xb1\\xdd\\xbe\\x99#\\x9ek`r\\xa0)\\xd12z\\xec\\xf0y+5p\\xb7\\xa7\\x91\\x14qb\\xcb\\xea&\\xc2\\xe1\\x1a\\xe9-\\x01h\\x7f\\x06\\xc4\\xe2\\xc78ek\\x88m\\xf6\\x91do\\xa2\\xe4\\x06\\xab\\x1f\\xd3\\xf3\\xe3_\\xdf7ga\\x04\\xe6\\xf6\\x886\\x07p\\xb2\\x0fc? $\\xbal\\x14\\xfc\\x9c\\xc5w\\x14\\xf8\\x7faf\\xc3m\\x05\\x15\\x05g\\x7f>\\xf9\\xa8*\\xe8q\\x9ap\\x1d\\xa3\\xab\\x19k\\xc3\\x8ab\\x90>\\xf1p\\xca\\x87\\x07\r\\xc1\\x0e\\xbf@\\xeb]vb\\xcb\\xe84\\xedb\\x81ul\\xfd\\xdf?\\x05g\\xab\\xe4e\\x9fz\\xc4\\xe2\\x8b^\\xc1\\xf3\\x06_[i\\x9f\\xf7\\x1e\\xea7\\x82\\xfd\\x82\\xffs\\xf6`.\\x926\".\\xfac=\\xac\\x19eg\\xbe\\x83w\\xf4\\xbe\r\\x0c\\x07\\x99^\\xa2\\x8cm\\xd1\\xcb\\xaes\\xcay~\\x8c\\x91\\x9a\\xea\\xdfk\\x8f\\x02\\x1c&\\xc0\\xc5\\\\xac\\xdb\\x8d\\xf7\\xde<"
  670. },
  671. {
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xb7\\xdb\\xd4\\xd0\\x9f\\x92\\xfa\\x97i\\x99p\\xd6\t\\xc1\\x82d\\xdf\\xf8\\xab\\xf7\\xa4c\\xb2\t\\xb3\\x83}\\x842d\\xec\\x9f\nz\\x16gj\\x85\\x0e\\xaa\\xba/az\\xd6\\xd1y\\xb5>\\x80\\xfa9\\xae\\xdb\\x80w\\xb7\\xf1\\xb7\\xee\\xaa&6\\xb4\\x8e\\xe8\\x84\\\\xc2!@\\x0f\\x0b\\x04\n\\x86v\\x17\\xe3hy\\xa1\\xc8>e\\xfb#\\x90x\\x1a\\x98\\x85\\x8a\\xdf\\x1a\\xa9\\xa7\\xe8n\\x02\\xff&\\xe9k\\xbf\\x91\\xf6\\x02\\xc0\\xcd\\xb4\\x9d\\xf1y\\xa4\\xab\\xb1\\x05\\xb5\\xc2\\xe7\\xea\\x84\\xf0\\x87l\\xbbo\\x92\\xfc\\xb7\\x9bh\\x1b\\xde\\xfc0\\xc7\r\\x06\\x9e\\xb7\\x88u?\\x0e\\xe4\\xfe\\xbb.\\x05\\x15\\x88\\xca\\xbc\\x0e\\xde\\x83\\xc0)\\xde*\\x04\\x83\\xdc2\\x04\\x82/\\x1e\\xf9\\x9a\\xf6\\x96a\\xcd2\\xc1`#\\x1b\\xd5\\xaaq\\xa9p\\xb9<\\xd8\\xfd1v\\x8f\\xc0b\\xaa\\xbb\\x185\\xa8q\\x16\\x1b\\x12\\x03\\x89\\x1c\\xd2h+\\x9d\\xdamj\\xe9\\x9e1\\x97\\x87\\x9b\\xfa)\\xaa\\x1d=\\x15\\xc0\\x0b\\x0f\n\\xd5\\xbe\\x0ck<\\x9d\\xe4;\\xfd\\xca\\xe1\\xc0\\xd2\\x94@\\xc3i\\x00*\\xbe"
  673. },
  674. {
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\t\\x13x\\xc4pp\\x1e\\x8b\\x16z\\x93\\xcc\\xae[o+\\x10)\\x1dqi^f\\xb2\\xda\\xe1[v\\xc6`)\\xa8\\xc1\\xfe\\x8c\\xe4\\x99\\xa9\\x05\\xb2\\xfc\\x8esn\\x1bl[\\x98\\xd9\\x86\\x88&\\x9a\\x08\\xd9\\xcb\nv\\x15\\x96\\xea.e4\\xc2\\x926\\xa2\\x89\\x16\\xbek\\xee\\x83=\\x1aln@oa\\xf2%\\x11q\\xf5\t\\xab\\xe1bg\\x95\\xb9\\xfb\\xb5\\xf5\\x95\\x0b\\x92g\\xa8y\\xe80\\x10\\x1a3bzlq%\t\\xcf\\xbf\\xb2\\xbf\\xbe\\x83\\x1c\\xa0o\th\\x8f\\x1fl\\xa2\\x82\\x03\\xb9p\\xcf\\x97\\x80\\xf8\\xa8\\x9d[\\xdc!\\xd0b\\x181\\xc2\\xc5p\\x92f\\xd5\\xdbu\\x8c\\xf1\\xe6l+\\xab\\xe1\\x1c\\xcbw\\x16\\x87nk\\x907\\xd5%\\xadm\\xac\\x8d\\xdf\\xf8\\xb2f\\x92\\xee\\xf6z\\xa3\\xb0\\x95>\\xea qg\\x9a\\xfc&\\xb6\\x16-ztv\\xca\\xado\\xc9}\\xc0\\x7f\\xbc\\xf9~\\xb6\\x91\r%w\\xe5\\xd2\\xefx\\xd7!w$\\xd4\\xf2b\\xa8\\xa7suw\\x9f\\x06\\x8b5w\\xc8\\x0f \\xb8<c\\xc5\t\\x8c\\xef\\x07vf\\x1c"
  676. },
  677. {
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010nt\\\\xbe\\x12x}\\xcb\\xe9\\xabr{\\xe3wd\\xa0\\xe4\\x11\\x0f\\xac_\\x02c\\xd9\\xb5\\x98\\x0b\\xc5\\xd4ml\\xfd\\xb9|\\xfbe\ts\\x96\\xd7\\xdc4\\x91\\x90\\xf3\\xdf\\x85g\\xfe\\xd4o\\x99\\xa4\\xc3\\xb7\\x87{n\\x12\\xf9\\x1f\\xc8\\x93\\xf0\\x07j\\x84\\xc8\\x8bf\\xbc\\xbb\\xc5#\\xa5e\\x11z\\x97\\xd8\\xa5\\x15x\\xec+=%\\x90{\\xde\\x88;\\xd1\\xb9\\x8f\\xba\\xa6tn\\x7f\\xf7\\x9az\\x9a\\x03pu\\x7f\\xad\\xcfw\\x84\rmq\\xfd\\xbd\\xdd0i?[>(\\xfd\\x85\\xe2\\x00\\xf4r\\x9d\\xffik\\xce\\xab1\\x96:\\xb3\\xf3\\xa31\\xecr\\xd0\\x8a5\\xe7} f\\x85\\xedwa\\xb6j\\xa3o\\xdb\\x1f\\x91\\x00h\\x0c\\x7f\\x9e`\\xa1\\x0c\\x11\\xee\\x8f0\\xdb\\xfa.\r=\\x7f\\x81\\xc4l\\xc5\\x91s9[\\x9a6ze\\x11\\xf5<\\xb3\\xb6\\xcf\\x9f\\xf1~5)\\x03e\\x1e^\\xc3\\xd7p\\xb8\\x9fj({qb:\\x92\\xcd\\xaf\\xab+\\x9cm~\\x07\\xa9\\x06\\xe3\\xc6{\\xedde\\x99\\x824\\xba\\xad\\x0b\\xc6u\\xdb\\xc7m\\xeb#\\xf5\\x07"
  679. },
  680. {
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>*\\xf94\\xd1\\xc5 \\xbc\\xa49h\\x01\\xa66\\x12ka\\x0c\\x12\\xbc=\\xd6\\x0e%/\\xb1\\xeb\\x9a\\xc2i\\xcc\\x067w\\xe6\\x87\\xa1*k\\xe4h}\\x8e\\xcd&\\xb1\\xfc\\xd3\\xec\\xca\\xd4tw0q4\\x11\\x94\\xf0\\x98\\xe2[42x\\xe88\\x93\\x8b{\\x89fq\\xe9\r\\x9a\\xa7m\\x9a\\xf8\\xc1?\\xe6.\\xca\\xad=\\xb0zt\\xc3\\xc7=d\\x90\\x8d\\x82\\xa8np*\\xb6\\xb1\\x84\\xe9d#\\xf8\\x0e=7\\xac\\xe8c\rfb\\xf3\\xc8\\x87t\\xc8\\xdf\\x89\\xea\\xac\\xd9\\xb1vdi\\xae\\x1ea\\xfb\\x89\\xbd\\x8d\\xc2\\xb3y\\x9d\\xd4\\x83't\\xba\\xb6\\x9e\\x17\\xdb\\x80t\\xd0z\\xf2t\\xfcaf%\\xecj\\xaa\\x0b\\xaa|\\xa8\\xac:kv\\xb3+\\xaa\\xbc\\x98:\\x95\\xd9k\\xa5\\xec\\xb5\\x01\\x02\\xad^l\\x89\\xee\\xb2\\xb9\\xf9\\xb0\\xa7\\xc2\\xef\\xeba<\\x14\\xd9\\xe1\\xb9\\xb2[w\\x03\\xc2s-\\xc3\\x19\\xaf\\xe7v`d2\\xc5q\\x97\\xa2\\xca\\xdb\\x1d\\xf4y\rl9\\x83\\xf2z\\xd2\\x17nfv\\xe3\\x06\\x93q\\xa0\\xd0`\\xb1\\x9a9y"
  682. },
  683. {
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>\\xc9\\xac\\x13\\xac8\\xaag\\x16\\xc2\\b\\x82ol\\xba>bu,\\x91\\xb0\\xa5\\xc2f)sc\\xfa\\xd0\\xf9;}p\\xe5u\\xdev\\xcan\\xc5\\xf7\\xb5v\\x17\\x0e\\x85\\xd6\\xf1\\xffq\"&\\x988z\\xb7rg\\xe3t\\x96\\x9d\\xb6\\x14\\xe5r`\\xa2@\\x87;\\x9c\\xd6y\\xfb\\xf5\\xf4\\xf1nz\\xef\\x8e\\xb8\\x88\r0j\\x10{\\x9f|\\xd9\\xcb\\xaa@\\xab\\xfe\\xdd`\\xec\\x82\\xf4\\xb3\\xa7\\x9c\\x1d\\xf1t#a\\xf4\\x91ly]\\xe4\\x9d\\jw\\xb9\\x95.+\\x02\\xee!z|wd\\xd2\\x005\\xff`oos5\\x0e\\xe5y\\xfb\\xab\\x04l\\xb1\\x18h\\x83\\xb1g\\xa3\\x84\\xeb\\x10:\\xee\\xff\\xdb\\xa5\\x12\\xce\\xe2\\xd0?r \\xdb\\xd3=z\\xd8\\x03\\xddu\\xe6\\x14t5\n\\xfa\\xc9\\x8e\\xeb]v\\xbd\\x12\\xfc\\x8c\t\\x85\\x05gn\\x04\\xdax1,qy\\xad\\xac3\\x0e\\xe4\\x8c`p\\xb0\\x90\\xb8z\\x17\\xcat\\xfd\\xa1l\\xf3\\x91\\x95o\\xaez\\xab\\x8c\\x1d;3\\xca\\xbe\\xed\\x83\\x1e\n\\xd3\\xfc*\\xd1scr\\xf1\\xadm\\xbf"
  685. },
  686. {
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05f@vl&6t\\x84\\xdb\\xb5ft`2\\x18\\xeei\\xef\\xe4}\\xdc\\xe8\\x1b\\x15g\\x88\\xeee\\xe0\\x8c\\x98\\xd9\\x87\\x8c\\xebkkw\\x1c\\xf8-$p\\xa7\\xf8\\xf6\\xfe\\x1c\\xc5\\xd8\\xab\\x9c\\x01\\xad\\x91n/\\xf0\\xd1y{\\xd23\\xbc\\xc9p5\\xbc\"\\xe9\\x85\\x9fl \\xbbi\\xa9\\x10\\xdf\\xe1\"\\x01\\xbd?\\xfc\\xdf\\xd5\\xffz\\x00\\xc5&\\xc7{9\\x89+,\\xcb\\x9cm\\x08\\x83e\\xee;\\xf7\\xf6\\x103\\xda9\\xc6\\xa9r\\xc6;\\xf7\\xe3\\xe4.u\\xb4\\x0e\\xb9#\\x9f\\xe4\\x99\\xef]\\xd3u\\x1e\\xf7\\xbau\\x94ex_\\x95c\\xf5\\x91\\xe2\\xd7\\xb5l\\x90\\xa4m\\xfaw\\xb7w?v]\\x9a\\xc0\\xc0\\xffp\\xed\\xcdp\rv\\xea\\x1d/^\\xb1\\xf9k\\x1e\\xa1k;z\\xa4^w\\xc0j\\xc7?\\x11\\x15#u)\\x9e\\x909e1\\x84\\xbfd#4\\x0e!\\xf8\\xe2\\xd3\\x89$\\x00\\xefv\\xf9\\x12we9?\\xa2\\x8c\\x81p\\xfb\\x95(\\xd2\\x085\\xa9f/\n\\x1e,\\x8c\\xee\\xa9\\xbfw\\xc0\\x988!\\xd6,\\xaa\\x82\\x0e\\xdf"
  688. },
  689. {
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<\\xc7\\xb6&\\xddr\\xbd\\xda\\x13m\\xd6\\x00\\xb71\\x1fec\\x85\\xe6\\xba\\xb4)#\\x11\\xc3\\x03\\x90\\xd0}_kj\\xc4\\x98\\xbc\\x11{\\x91s\\xf6\\x10\\xa1\\xa1\\xb7\\xf3\\x96\r\r'\\xf0\\xb2\\x80\\xb1\\xce\\xd1\\xde\\xa99o\\x99n]do\\x98\\xf4\\x17`\\xc2\\xb3^lq\\xb5\\x00\\xb1\\xcb\\x18\\xe5\\xa8\\x0f&d\\xba5\\x7f\\x9a\\x14co\\x90]\\xe2\\x131mb\\xef5)oo(\\x1b\\xcf\\xa8\\xd7\\x1cr\\xf6\\xbf_$\\x96i\\xbbv\\xaf\\xe7z\\x01d\\xcb\\xfc\\x13g\\xd4\\x93\\xa9@\"fm\\xf3v\\x1ebp\\x92`p<i\\xd0\\x0e\\x17\\xc2io\\x98\\x12\\x1d\\x11\\x99\\xc9\\x88u\\xbc\\xd32\\xb6\\xcf]\\x809\\x8c\\xfb\\xf3\\xea\\x92h\\xf9\\xa3\\xba\\x1d+\\x8c\\x83\\x13\\xb6\\xc06yn\\xc1\\xdc\\xdd/5\\xac\\xcf:\\xcc\\xc8\\xfe\\xa3\\xc1\\x94^\\x93\\xcbi\\xf4\\x1fq\\xa2\\x04\\xd4\\xce$&\\xeb\\xac\\x7f\\xb6n;\\!\\xe6\\x8b\\xec\\x7f\\xb9\\xbfc\\x8d\\xcd\\xbfv\\xb4\\xc1\\x1fp\\xfa\\xb2\\xda\\xb7d-!\\xa5\\xe1\\xd6\\xeb\\xe5\\xc6\\xf1a\\xbeu"
  691. },
  692. {
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x02;\\xba\\xb2l\\xc7\\xde\\xaa=u\\x19hg\\xb3a\\xdd:\\xf8\\x15\\xfe\\x85w\\x8b<\\x1f\\xe2\\x87\\xa5\\xbf\\xeai\\xd6\\xf5@0\\x81\\xf8\\xe5v*\\x89\\xfb\\x89;y:s\\xfe\\xd4\\xe4\\xa3e\\xf6\\xac'\\x9c\\x11\\xd2\\x19!\\xb5\\x17a{r\\x01\\x9c\\x86\\x93\\x8d\\xc9~o\r\\xfc\\x1f\\x08\\xb4,?\\x9b.\\x96\\x1f1\\xf7j\\xe3\\xa2\\xde\\x8cfl\\x953j}\\xe8m0\\xcf%-k0l\\x97@p\\x8dv\\x1b@\\xcav\\x85a\\xbf\\x01\\xbe\\x86\\xc8\\xc5\\xab\\xa8\\x0f\\xe5\\xae\\xfa\\xfa\\xd4d\\x1d\\x11`r7\\xbd\n\\x0bs(i\\x95\\xa6\\xc6\\x9a\\x14'\\xf1\\xa6\\xdb\\xeb\\x03t\\x18\\x1e\\xb7}\\xfa\\x88\\xea\\x02\\xcf\\xf8_\\xa1\\xb6\\x1f\\xa5\\xbb\\xdfq\n\\x0f\\x00g\\xbb\\xe5\\xe4t\\x9d\\xe0i\\x19g\\x18qx:a\\x01\\xde\\xbee\\xf6\\x87\\xc4z\\xd1\\x837\\xb4{\\x9c\\xa2\\xcd\\x8d<&\\xf1\\xbch\\x9c\nx\\xf3\\x8e\\x1f\\xe4\\xc7\\xd6\\xf2;\\xe27g\\x82\\x1fh\\x04,\\xfa\\x8ad}\\x83\\x1a\\xee9\\x9b\\xack\\xe6a\\xb5\\x9c\\xc9p\\x8f"
  694. },
  695. {
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`x\\x0cy\\xe7p\\x03\\x02mr\\xa8+\\xd8\ny;\\x92\\x0b~\\x91t\\x03f\\x99=\\x13\\xc4k\\x8a\\xa6<c\\xee\\x01b\\xf4\\xc6\\x08\\xb6\\x0cf\\xa8\\xd1\\x90n\\xae.-\\xf6\\x8c\\xfc\\xa2\\xa9\\xa0\\xa2\\x80l,\\x10/\\x16\\xdatx@=\\xb7\\x18a\\x05\\xb8\\x1da\\xc7\\xf7\\xe9\\xb1\\xdc>vc\\x18\\x03\\x93g[\\x8e\\xb8j6b_\\x07\"0\\xb30\n]\rt\r\\x01\\x0cx\\xb6\\x0f\\x1f\\x10iw\\xc8\\x95\\xcd\\xabu\\x1e\\x87x%\\xc9h\\x82m|\\x8d(\\xb5x2\\xf4\r\\xc1b\\xe0\\xd8\\xd5\\xf8x\\x85\\xcf$\\x10\\xfd}\\xc2<wce\\x05n\\xd9\\xb6\\x9cw\\xa8\\xad\\xc0o\\xb2\\x8b\\xdd\\xd7\red\\xf9\\xfa\\xdb\\x8co\\xc9%%%|\\xdd\\x88^]\\x9e9\\xb0n'\\xd3\\xf0\\xce\\x96\\xe5\\xe8\\x8fm5\\x1b\\xa5\\xcc\\xf19d\\x8d\\xd5\\x979\\x06\\xe2uf\\x05\\x86\\xdb;\\x86\\x89\\x0cjp#\\xe9\\xc3\\x0c\\xd9\\x99\\xbel\\xc5@\\xb7\\x187\\xd4'\\x18\\xf8\\x05{\\xe0\\xffk\\xb0\\x92\t'\\xe1\\xbe\\xcd\\xe4\\xbe\\xd8\\xa1"
  697. },
  698. {
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010yz\\x98\\xd9%*e\\xe5=\\x95}\\x8a^\\xd1h\\xdd]\\xa6\\x80l]m\\xe8\\x1e\\x86\n\\xcal\\x89\\x19\\xd0\\x8elq\\x06\\x92x\\xc0\\xd2\\x9fg\\xd1q\\x1d\\x02(c\\xf6\\x8f&n\\x96\\xd4\\xb5y\\x15\\xe3\"\\x16kx<\\xb1\\xe5\\x95c \\xba^ze\\xc9\\xd5)\t'\\x94p09\\x19\\x96\\xebu\\xa0i2c\\xd5z\\xe0\\xfd\\x0b\\xa5\\xef\\xd3\\xa4)\t8\\xa6\\x9ay\\x94\\xdc\\xfe\\xd9\\x922\\x1b\\x8a[\\x88\n\\xef\\x888\\x8e\\xea\\x0f\\xf0\\xa3\\x13\\xffpkh\\x14\\x89}\\x1d\\xe0\\xd2\\xa5k\"\\xfd]\\xa6 l\\x89\\x85\\xdeb\\xa6\\x8d\\xfe\\xbe\\xf2s,\\xf5f\\x9c\\xd7cs3tt\\\\x97<\\xa3f\\x11yg]ri\\x80\\x06\\x8fp\\xcb\\xf6\\xbe%\\x0f\\x1b\\x94\\x82\\xb5w]\\xfe\\x91\\x1f\\xea}h\\xea\\x80\\xc4\\x1c\\x19\\x93[\\x8c\\x81\\x00\\xce\\x8c\\x98\\x90\\xa8\\x1c\\xb2uo\\x9b\\x13\\x1c\\xb2\\x01\\xd2\\xe7\\x1bd\\xfcr.:6\\x9f\\xef\\xa4z\\xa64\\xd1{\\xbe\\x97\\xdc\\xc4eqfv\\xec\\x16\\xfc\\x1b\\x94\\xc1_\\xf5\\xe2"
  700. },
  701. {
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2\\xca\\xbd\\xc59\\xba\\x00\\xd5\\xe2\\xda\\x01\\x02\\x86%m.\\xd9)>\\x8c\\xd4\\xde\\x8e\\xba48\\xbc\\xcb\\xc5e\\xd1\\xafk\\xa7\\xdav_\nz\\xf7\\xaa\\x14\\x05\\xae\\x03\\xfb\\x80b\\xee\\xecb9\\xab\\xf0\\xbd\\x9a\\x92un<\\x9cr\\xb5:9\\x8e\\xf7\\xf1q^\\xe8jz\\xf4=\\x7f\\x1d\\xa5bgfo\\xec\\xe0y\\xbd\\xf7\\xd5\\x04\\xa0\\xbd3\\xa5\\x15\\x89\\xbb \\x1bg1\\x19\\xbc\\x87\\xa0\\xa3\\xab\\x15\\xd0e\\x9b\\x8d\\x9et!\\xa9\\xe0._g\\xc0\\xa3\\xa1l\\xe2y\\xf4\\xff\\xa5\\x11\\x19\\xdc\\xa4\\xaa\\x12h\\x1a4\\x7f\\xd8\\xcd\\xba\\x91k\\x97\\xdd\\xba\"]\\xea\\xe3\\xb0\\x81<z\\x80'r\\xff\\xb8\\xad\\x04i\\xf1\\xa7do\\xa8mmi\\x87\\x00\\x96\\x00\\x1e\\xd9p\\x81=\\xc2\\xd6-\\xbc\\xa3\\xe1\\xac\\x91\\xeb|1\\xc3q\\x96\\x1c\\xe7\\xb5\\x07lab\\x03\\x93h5\\x97\\x84\\x98\\xbc\\xf4\\xe8\\x8b\\xd42j\\\\xf4\\xda<^1\\xda\\xfb\\xef\\xcd\\xff;\\xb1\\x9824z n\\xe9\\xe6l/tb\\x80\r\\xe0f\\xd7 \\xf9\\xc1\\xf7\\xa07\\xf4"
  703. },
  704. {
  705. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?\\xadlob\\x1c\\xb9|-,\\xaf\\xd1x\\xd3\\x07\\xa7\\xe6\\x17\\xb9\\xc1-\\xe1in\\xc3\\x02\\xc2/m\\xfb\\xbc\\xc40\\x16\\xd8\\xd5@\\xcbp\\x94\\xe2\\xc8d\\x1fo^\\x92\\xee\\x9ej\\xe2\\xbd\\xc4\\x8a\\xf1\\xde\\x8f\\x1bxk\\xe9u\\xf1h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbfh-\\xdd^w\\x9e\\x19\\xf5f\\xb2\\x05m\\xad\\x99\\x06\\x88\\xe4\\x90\\x83\\xd8\\xf2\\x96\\xef\\x19\\xd1\\x87\\x0fk\\x8e\\xde\\xfe7\\x1d\\x13\\xf3\\x9a\\xcd\\x92\\xd1v\\x19\\xf3>\\xd7mo\\xc0"
  706. },
  707. {
  708. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9j\\xfa\\xd1?\\xdd)\\xbc\\xb7\\x90\t7j\\xa5qj*\\xab\\xfc\\x11v\\xe3c\\xca\\xd5\\xf5\\xe7\\xc6u\\xdd\\xfb\\xf7\\x10\\x95\\x92=\\x18\\xf7\\x1ck\\xc2$\\x88r\\xde\\xe4jc\\xa4\\xe0\\x17\\xf3r\\x18\\xba\\xdbv\\xf8\\xb8qa\\xbbbz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xddan\\x8f\\xe8(\\x084mprm\\xe9\\xf1\\xa1\\xac\\xa3\\xdc\\xf4bf\\xe0\\xa55d\\xf3\\x95\\xd2u+\\x91f\\x9f\\xd1\\x1b\\x0c\\x7f\t;f]\\x9bw;\\xf9(\\x1e"
  709. },
  710. {
  711. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\xc5<\\x99\\x9a\\xff\\xb6\\xa1\\xec\\xe3+s\\x9cmb\\xb8\\xcc~\\xd2\\xc4\\x0crw\\x80h\\x06$~\\xc3\\xf6i\\xf7\\xcc\\xa2wb\\xaf:\\xa3\\xf3\\x88\\x84\\x97\\xc7\\xe3\\xaa\\xd2\\xe5g\\xe9\\xacf0\\xd9%\\x82$\\xd3\\x9e\\x9c\\xe0\\xaen\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4r\\xac\\xe9\\xc5\\xf8%\\x91\\xa8\\x8d()7se\\xdf7\\xea\\x8a\\xbf\\xe2\\xdc\\x96\\xa6\\x11o\\x90j\\xca\\x86fg\\x08\\xa8\\x83\\xda\\xe8\\xacz\\x99\\x93`\\xd6\\x84\\x1a\\xfc\\xaf."
  712. },
  713. {
  714. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\xadj\\xc0h3\\xf7/n\\x80\\xdf\\xf3\\x85\\xfa\\xe0\\xe9\\xc4j\\x90\\xf4\\xce\\xa3c\\xd8zqsx\\x00\\xca$\\xa2s\\xb3\\x95_mgq\\\\xcd \\xda\n\\x97\\xf8\\x1a\\xae\\xd4\\xae\\x9d\\xe4\\xa2\\x15\\xdfu\\x11\\xe2\\xa4f\\xef\\xe0e<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xed8\\xcat9v b\\xe0\\x88\\x97\\x9aofb_0\\x14\\xae~c]\\x87\\xba\\xac\\xd2\\xd1t\\xf6\\xce\\x1d(\\xc3\\xc7li\\xb7t`j\\x87\\z\\xec\\xb8\\xd9r"
  715. },
  716. {
  717. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xf9l\\x18\\x0f\\xb0\\xc6\\x9ay\\x18\\x17\\xda\\xed$\\x06j\\x89i#\\x9c;\\x82\\xb1\\xf9\\xa6#0\\xec\\x80\\xbd\\xe2\\xa1z\\xb8hd;\\xa2\\xa5\\xd0\\x93\\xd4\\xf5\\x1f\\xe4d\\xacy\\x1d\\xc8\\x91\\x8c\\xec)x\\xa0\t\\xd7u\\xa70\\xde.\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xeev\\x9e~\\xd7\\xad\\xd1\\x98\\xae\\x9b\\xd3\\xd2\\x9122\\x1e\\xd9vs\\xec\\xce\\x0c\\xbf\\x02\\x91u8/\\xf7z\\xd0\\xda\\x019w\\xc7\\xe7!.\\xec\\xdavq\\xab$\\x82\\xf0"
  718. },
  719. {
  720. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\xb4\\xd7\\x0f\\xb1\\xcd\\x85\\x05\\x03\\x08}\\xcb\\x8dr$?\\x836\\xe4\\xaf\\xdf9\\xfc\\xc0*\\x96\\xfd\\x17\\xcd\\xe7\\x81\\xf04\\xba\\xec^&\\xe9\\xbf%;a\\xbd\\xbc\\x15\\xe9j\\\\xbc\\x8c\\xac\\xf2tk\\xfeo\\xae\\xe8lx2\\xd5g1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x87{\\x01\\x02\\xaf\\xc1h\\x89\\xac\\xdc\\xc7\\x01h\\xda\\xbd\\x1a\\x94c\\x91`\\xd3\\xe0&d\rm\\xd2-\\x8bx\\xc5k_?\\x89\\x99\\xc3\\xb3\\xcf@\\x82~g\\xdaf\\xbf\\x8c"
  721. },
  722. {
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[ \\xa1k\\x96\\x9bh\"hf+\\x8d\\x0f\\x1ba\\xf0\\x14\\xb0\\xf7\\xc3\\xfe!gw\\x01\\xfezba\\xef\\xa5a\\xfb\\xd4\\x17m\\xa8\\x88d\\x14\\xf9!\\xc5\\xe4\\x8b\\xadw\\x0eu\\x8b\\x03z\\x12\\x17\\x04l\\x9e\\xc5\\xa0\\xf7\\x8b\\x1c<1}\\x1b\\xba\\x03\\xb0l[\\xc3)\\x92\\xc8\\xb9\\xe9\\x1fe<\\xf0\\x10m2\\xf1\\x00\\xe9\\x97\\x1b\\x9f\\x06j\\xbfm\\xfd\\xb6h\\xd7\\xb7r\\xf5\\xab\\xf5 \\xf6>\\xe2.\\x01\\xdd\\xees\\x15\\xd9\\x9ag\\x92\\xbc-\\xd5p\\xa4\\xbc\\xdc\\x08ev\\xf4f\\xd9\\xbbk\\x1e\\x94\\x90\\xa4\"\rxj\\xd4n_\\xa1k5\\x89\\xb2 \\x19b\\xd2p\\x16\\xd7\\x83\\xff,\\xd5\\xb9\\x8c\\xc8k\\x17\\xeap\\x8e m\\x80\\x8bo\\xfel\\xcc\\x88x\\xab\\x02/\\xc4\\xdd\\xaf\\xfb\"zbj+\\xd8\\x95\\x92b\\xbf4ifz\\xa7\\xael~\\xe8\\x85\\x86*\\xa9\\xa3w`\\x0f\\x98b{p\\xd0\\xbb\\xa5\\x8c\\xdb\\xbf\\x1a\\xc1\\xf8\\x1d\\x17\\xfcek\\xd5\\xc8\\x0b\\xad0\\xd3\\xee\\x12\\xaah\\xf5x\\xb1\\xc8\\xa0=\\x0b\\x15a\\x9dv\\xa9"
  724. },
  725. {
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x81\\x83\\xe3(!\\xc7&1\\xb5dhg\\xa6\\xdd\\xac\\xd0t\\xf7\\x02\\xf2>]\\x9eg/\\xb4vk\\xf3\\xd5z\\x1b\\x1e\\x8ea\\xa4\\xb1 \\xe0 \\xcc\\xd6pz\\x10\\x8f\\xd22\t\\xe36\\xe8y\\xce\\x0b\\xa6\\xdf\\x8a\\xe1]\\xc8\\xc4'\\xb2\\xf3\\xe3\\xce\\x02\\xbaq \\xab\\xc1\\x13\\xeehb\\xc1 \\xe9q\\xb2\\xcb$\\xb7\\x81\\xae\\xd2\\x81\\xdf\\x14\\xe3\\xe8\\x9d\\xb0\\x7foj\\xc9\\xaa\\x04s=\\x07m\\xc9\\x16\\x12\\x8c\\xed\\x89\\x06\\xe7\\xba\\xe4\\xc7\\x9aq\\x00e\\x95\\xb6@r\\x95x\\xc3\\x92\\xa8\\xaad\\xdf\\xbax\\x10\\xa5\\xc3;\\xda\\x84\\x07\\x8dv9\\xbf\\x94\\xeb_\\xe2h\\xce\\xac\\xe7.]\\x11ttsq\\x93\\xcd\\x9ankle<r\\xfb\\xd6\\xf2\\xc9d\\xe7\\xbe\\x93\\xbe\\xab\\xf5\\x83\\xf1\\xce\\x9bvm\\x10>o\\xdc\\xc0\\xdb\\x110\\x98xz\\x10pnt\\xac\\x04c\\xb9c\\xe8\\x96\\x8a\\xa0\\xae]\\xd7\\xfaq\\xd1\\x91lx\\xce\\x1f.{x\\xf7\\xec\\xef\\x06\r\\xe8qtyfqo\\xe7\\x87\\x19\\x10e\\x90&o\\x84\\x9d?n\\xcc\\x12"
  727. },
  728. {
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\xe0\\x9a-+p)ns\\x1c\\xa1g\\x9c76\\xdf]\\xf0\r\\xd4\\x91\\xab\\x83\\xff\\x07\\x1a\\xa5\\xa4o\\xd3\\x133e\\xd2]\\x96\\x93\\xc9p\\xda\\xe1\\x15\n\\x89\\x16\\xdf\\xe4\\z\\xe4\\x03e\\xba_{;\\xec\\x11\\xdav5\\x0b\\xb2\\xcb\\x7f\\xfc\\xea\\xe5\\x11\\xba\\x8a\n\\xae\\xeel\\xf1\\xbb\\x17f\\xaf\\x0ct\\x0e\\x8c\\x1c\\x97\\xa0\\x80\\xa4\\x1b\\xbb\\xc5\\x0c}u\\xb9\\xbe\\xa0\\xcad\\xcah\\x92\\xda\\xef\\x89\\xd5yv\n\\xf9\\xc0\\xe4\\x1d\\l\\xd0\r\\xcaq? \\xd0\\x00\\xb1;%\\xe1d+\"\\xe3\\xc7/'\\xa0g\\xd47hzqw\\x95%m\\xdb\rx\\xf9.\\xab\\xdbh\\x19\\x0cd\\x0c1g\\x03]\\xc7o,\\x16\\xea\\x9c\\x15\\xf2d\\x8af\\xaa\\xf4\\x82v\\xd9\\x1f\\x918\\xa3 \\xc4\\x84s\\x8b5\\xd8l#p\\x06c\\x9b.\\xff\\xe5w\\xb2='\\xa6\\x02y\\x9e\\x12\\x0f\\x8a\\xaeh\\xae\r\\xf4\\x9a\\x8b'\\xad\\xe1\\xf6\\xa9\\xf8y\\x07\t\\x97\\xe4\\xad\\xb8\\xd9a;\\x9e@fy\\xe7m\t\\x0c}\\xc3\\xfb\\x0f\\x92>2y\\x9f\\xeb\\x12"
  730. },
  731. {
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\x9b\\x18\\xb33ia\\xed\\xa5\\x8e\\x17.!q[\\xb5gv\\x91\\xe4\\xb0\\x0b\\xba^i\\x1e+\\x99\\xc4\\xe9\\xca\\x8a\\x8b\\x950\\xf2\\x89\\x1e>\\xa4]\\xcf;\\x87\\xa3d\\xd3\\xb6\\xea\\x88t\\xd4\\xda\na\\x99+>xxk\\x85o\\xb5\\x1f5?\\xed\\x0e1g[nh=x'l\\xf9\\xae\\xb7\\xef\\xcb \\xb3\\x15\\xd9\\xc0b\\x15\\x813v\\xb7\\x8a\\xa8^0\\xf3\\x18\\x19q\\x82\\x8d5o\\x14zp\\x90\\x17\\x8f\\xa5\\xac\\xa1\\xf6\\x8b\\x8fn\\xa0\\x15\\xe8o\\xa8\\x1ar\\xc7z\\xb1\\xa1y\\xbd\\xda\\xb2\\xb3u\\x99\\xe2_\\xeb+oq\\xd0\\xb6t\\x97\\xe0\\x81\\x12\\\\xb9\\xbfvt\\x07d\\xc8z&\\\\xfd\\xc5\\xad\\x8c\\x0e\\xfb=o\\x12\\xec\\ \\xb7\\x87\\x86\\xf0\\xe0g_&\\xd2g+\\xd5-\r\\x88\\x9f\\x85\\xc8k\\xa9!\\xe0\\x1d\\xb6f\\xc9\\x8a\\xc8:\t\\xfa\\xd7\\x8aj\\x80\\xa8\\xdd.r\\xc4\\xb7\\xb7\\x9dj\\xa3\\x9ap^\\xca\\x16b\\xbe\\xd9\\xb3j^\\x86\\x9f\\xc2\\xd8\\xdfi\n\\xea\\x8b\\x1f\\x1a\\xb8\\xcfg\\xf8\\xae\\xf0sw\\xc7s\\xbb"
  733. },
  734. {
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x94\\\\x12)\\x86ybz\\x12i\"\\x8eg\\x876\\xf5\\xd3\r9\\xe7lf\\x81\n\\x87k&\\x83\\x8a\\x94\\xbe\\xcd\\xdf\\x10\\xee\\x1bifn|\\xab\\xa1\\xe0u9\\x8d\\xa5\\xee\\x86\\xc3\\xbb\\xc5\\x91&\\x9c\\xc2\\xce\\x99$zvyok\\x07\\x89b\\xd2\\xcb\\xb0d,\\xe4\\xc1m;\\xfc:t\\xf9\\xa4\\xcc\\xee\rn\\xb3~ $\\xf7\\x90\\x0e\\x19\\xd3,\\x0e\\x9d\\x15\\x9f\\x8e\\xdd\\xbe\\x96ha})\\x0fi\\x95\\xa4!k\\xa1xz\\xc70\\xc4\\x9az+j\\xe0x\\x00\\x1f\\x17\\x94yr\\xb8\\xf5\\xa3*\\xfb\\x1c\t\\x9f\\x03\\x07ze\\x82fe\\xdfk\\xa5\\xc0d=\\x94\\x80\\x0f&\\x07>\\x03y\\x89}\\x19dlu\\xbf\\xf1v\\x90\\x9b\\x94t\\xe6b\\xfe:)#\\xb7b\\x87g\\xc0m\\xe1\\x01!wn\\xabdl\\xa9\\x83|\\xcfw\\xbaq4\\xe9\\xda8\\xb4=ad { \\xff\\x01\\x18\\xd3\\xf7sr\\x85g\\xcb\\xd4ttz\\x83\\xe3\\xcdz_\\xd6\\xfa\\xdd:<\\xa7\\xec\\xa6\\x90\\xebx\\xfd\\x9a\\xba\\x8a'\\x86\\x8b\\x98t\\xf1"
  736. },
  737. {
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19k/\\x03\\xa8cn,\\x11w\\xf8\\xbffl%\ni\\xfc\\xbbf\\xcd\\x16\\x8d\\xd45k\\xb2\\xca\\xc3}\"\\x12s\\xd3\\x93\\x9dq\\xa1\\x84\\x8e\\xebj\\xca\\x90\\xd3y\\x19\\x10j\\x1d\\xa5:7-\\xefvx\\xc1\\xe0\\x01\\xc2/\\xdc\\xe0\\x06\\x95\\x8c!w\\xc8\\x1b\\x8b\"\\xeds:\\x16\\x92\\xae\\xef\\xbd\\x82\\x1ermu\\xb1\\xcd\\xa7,+\\x90\n\\xd3\\xea\\xb6\\xb7.\\xd0/\\x17h\\xafx\\xbd\\x01\\xbd\\xe2\\xe5\\x1bh\\xe5\\x04?\\x16%\\xc8i\\xadt\\xb4\\xbfd\\xa8\\xa0y\\xf3n\\xea*\\xa7v\\x92z\\xf6\\x92\\xafp{=),lo\\xb8\\xa2\\xa3\\x0c\\xe0\\xd3\\x1b\\xf2\\xa0\\x87\\x00\\xe4\\x9e\\xc4u/\\x85g\\xf2\\xd6\\x1a\\xfe@\\xd7c\\xd6\\xf1\\x92\\x83$\\xc1\\xd3\\xd0\t\\xa35\\xe2#vg\\x05\\xcb\\x02ab$t\\xa6yw\r\\xc0\\x98o\\xf1+\\x99\\xe8mf\\xed\\x87\\xeb\\x19\\xf1\\x15\\xf6\\x8a\\xc5\\xd9g\\xb0\\xfed\\x02\\x17z\\xec\\x8a\\xeb \\xc9\\xe6x%\\x16d\\x8c\\xf9\\xef&\\xd4\\xd2\\xa3\\xe0|\\xb61\\x81\\x08p8*\\xed?\\xbf\\x13"
  739. },
  740. {
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xa5~\\x85\\xc4\\x10\\xb2\\x869\\xb1\\xd0fa\\xdb\\xfc_o\\xfalj\\x12\\xd9\\x03\\xba\\x11\\xdc\\xa2\\xc5\\x87\\xa5\\x18]*\\x1a!\\x96d\\xfc\\x19'wn*\\xd1\\x1c\\x84\\x7f(\\x12\\xff\n\\xa3\\xe3ce\\x89/%.$(n\\xf8w0\\xff\\xce\\xfay\\xd6\\x9b\\x0b\\xb8+\\xe7\\x19\\xf1\\xf28\\xd5\\xcc\\xf7\\x8aj\\xd8\\xfa\\xbe\\x9a\\xa7\\x16\\x89\\x93\\xa53'\n\\xca\\xffd\\xf6b\\xb5\\xf5\\x80\\xab;\\x02\\xf9\\x02r\\xcd\\xbf\\x8e\\x94q\\xdc\\xe1\\xc9\\xfcv\\xa8\\x83w\\xde\\xffx`\\x89?\\x80\\xb7nl\\xcct\\xe4\\xfa\\x9f\\xa5l\\xea\\xc4\\xa2\\xaff7&fu4\\x15\\xeb\\x9a\\xc2\\xac\\x10\\x7fzy\\xa5\\x12\\xef&zk5s9#?=\\xf5\\\\xb0\\xd6\\x02\\xbc\\xf7\\xaca\\xa2\\x18\\xc4\\xf0\\xa9w|\\xe4\\xebz\\xdf\\xd2\\xc6^\\x06x\\x0cx\\x8cm\\xe3.#\\xfd\\xd5\\xc1\\xe6\\x18\\xed\\x00\\xc02\\x9fd\\x82\\x00\\x8a\\x8du\\x06\\xa4\\x1fp\\xbfs\\xf9\\x9az\\x8c\\xa9\\x96\\x91\\xb7&'>2$fa\\xeeh\\xf49\\xb5\\x02\\xcb8\\xb0i\\xb3"
  742. },
  743. {
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xa1\\xe8\\xd6\\xbev\\xf0\\xca\\x0b\\x8b\\x83@\\x8c\\xc5j]\\xe6\\x8a$\\xf8h2\\xc0\\xb7\\x96\\x08\\xb6\\xb7\\xf04\\x88\\xe8\\x97\\x91\\xdd\\xfd$\\xa8\\xab\\x06\\xac\\xa09\\xb8||\\x00\\xe27\\xa9\\xac\\xd1\\xf2\\x13\\xbfw\\x13k\\xc9\\xb4\\xa9\\xa9fs\\xa8\\xe7\\xe8\t\\x00\\x83z\\xd9\\xc8\\x1bfv\\xe2q+[+v\\xe6\\xd4y\\xce\\x84\\xe3\".*/\\xc4\\xdf\\xe8\\x80g\r'\\xee\\xed\\xe4\\xc1\\x91\\x99\\xcc\\xd4)\\xeb\\xb0k@*\\xc9\\xa4b\\x1c\\xce\\x12\\x07\\xb3\\x96f\\xdctdi\\x10=\\x976\\xa7\\x01p\\x80\\xe1!]\\xd6\\x17\\xe5\\xf3\\x86\\x90+j\\xf0-m]\\x80\"\\xeb\\x9a\\xcc\\x1e\\xb34|\\x1fz\\xdfd\\x9d\\xa0f,\\x17#\\xd4\\x94\\xa6\\xf6\\xcap0\\x9b\\x06l\\x14{%\\x02\\xb4^\\x94\\x80\\x15\\x11u\\xf3\\x81\\xf0a\\x1di\\xb8\\x15\\xb6@.\\x11;\\x0c\\xb0\\x82\\x0b\\xbc\\xdemx\\x1c\\x9c\\x89\\x990\\xb8\\x0bl\\xac)\\x0b'\\xda/ +/\\x11ou\\xad\\xc7\\x89\rcz\\xd1\"m\\xf3\\xa3\\xec\\xf7=dh\\xf0e\\xbd\t"
  745. },
  746. {
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\xd7|\\xc4\\xe1\rt(e\\xcau\\x8d\\xde\\xb8\\x08j\\x83\\xc2\\x8c\\xf5\\xb9yv\\x9ez\\x0b\\x0f.\\xa6\\xc5>\\xad\\xdb\\xc02\\x95\\xa93\\x17\\xc2\\x88\\x11[\\x98u9?~\\xd6\\x88y\\x99of_\\xf2,s\\x9e6\\xd4\\xae\\xf2\\xe4}\\x12\\xc2u\\x0f\\xbf\\x92\\xddx\\xbe\\x17p\\xa2\\xc2q\\x1a\\xa5,^\\x1d\\x82\\xa7\\xf4\\x97y\nn\\xb8\\xc5\\xc2\\xe3u\\xe5n\\x8f*\\xc2\\x88\\xdb\\xf7[tt\\xdf\\xb7\\x80_\\xae\\xce=\\x9du[m$uy\\xf6gk\\x1e\\x111\\xf4\\x1c\\xf9\\xdd\\xf6\\xdf\\xf83\\xc1z\\x86\\xd6\\x86\\x0f\\xdcl\\x8a\\xd3\\xce\"\\xa0\\xb8o\\x0cm\\xd4>z\\x10\\xca$&\\xe2\\x8bp1\\xca\\xde\\x9f0\\xf4\\xd0f\\x99\\x00\\xc8\\xec`\\x88k=\\xde\\xb3\\x13t8\n\\xa6\\xf9p\\xe2\\x11=\\xb5phk\"\\x159\\x94e\\xf8,'\\x811%\\x05@\\xf8\\xd6\\xb2\\x7f\\x9f,\\x8ff~\\xab>[\\xf5-0m\\x9d>$g\\xcf\\x9e\\xcd\\xdd\\x1b\\xd7\\xb9?\\x9d\t<\\xef\\xeb\\xe8\\xcb\\xf3+b\\xe3$\\x1fru\\x8c"
  748. },
  749. {
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7\\x88,q\\xb4\\x8au\\xc8vn\\xdbb}\\xda\\xf0y\\xb8\\xba\\xf9\n\\x85@\\xfd\\x00\\xe3_\\xc0/\\xbbw\\x8c\\xb2\\x89\\xfb\\xb8\\x85\\x08\\xb6l5\\x80}\\x81\\xfb.:\\x9e~/\\xae0\\x0e\\x02x\\x9c\\xb1\\x02\\xf1\\xb1\\xd7m\\xb8\\xf1\\x15\\x80\\xba_\\x90\\x1c,\\x97\\x0fp~\\x80g*\t\\xb8k\\x8c\\xcc\\xcbp\\x89\\xb7\\x88\\x0b#\\x08\\x04\\xba\"\\xb3\\xfd&1h\\x16}\\xa0xc%\\xfd\\xeb\\xd7l\\xe6\r\\xd4\\x0b\\xbd\\x0fh2\\x8bs~'\\x08\\x89n\\xb4/\\x94\\xf85\\xa6\\xde@\\xae\\x98\\xacyo4\n\\xfa\\x1e\\xa4\\x19\\xc0\\xbcn\\x94\\xa8\\xa0\\x1a\\x9d#\\xb0l{\\xae\\xe5\\xcb\\x9fz\\x04\r\\xed>\"\\xde\\xffv\\xc7\\xf4\\x1dt\\xfe\\x95\\xf9\\x12w\\xe5 m\\x8b\\x10\\x8bu{\\xd6\\x0c\\x17\\xd0\\xd3\\xbe\\xfc^\\xa6@\\x01\\x1bu\\x00vx\\xe14\\xa3\\x93f\\xfc*'\\x18,\\x85|\\x1f\\xd4\\xfe\\xd7\\x19\\xceg\\xc0\\xc0\\x94\\xb6e\\xa2<\\xa0\\x0c\\xfc\\xde[=h3tp\\xd7:\\x823\\x80\\x9f\\x18s\\x89\\xb51\\x95{\\x0e\\xea"
  751. },
  752. {
  753. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7\\xe8\\xe6\\xee\\xfe\\xf5\\xd8\\x0b2\\x91a@\\xff?\\xfb\\xe5\\xbb_\\x80\\xf8\\xf43>o\\xda\\x96\\xa4\\xef\\xa5r\\xa6&\\x01\\xc3>\\xa9\\x97\\x80r\\xf5\\xd9\\xff\\x87d\\xba\\xed|z\\x96\\xcc@\\x84u\\xa7|~\\xd2\r\\xe6d\\x0c\\xa4\\xf9\\xf1\\xa5\\xf8g\\xc2\\xb7\\xca\\x96\\x02uc\\xd0z\\x87>u\\x9f\\x9e\\xe9_ii\\xf4\\x12|,\\xef`\\xb5\\xd7\\xfc\\xc8\\x1cd\\x88\\x80i\\x83\\x1c\\x14(\\x9dk\\x187\\x968/-f\\x1b\\x17gx\\xce\\\\xe8\\xa0\\x1d\\xebr-v4\\xd2&\n\\xe2\\xa7#\\x18\\x90\\xa0f\\x14\\xc8\\x95\\x7fy\\xac\\xc1\\x03\\xea\\xf5\\xf5\\x83\\x9b\\x00\\x9d\\xe8\\x186\\x072\\x92\\xe1'e\\xdc;r\\xe5\\x08\\xf7\\x18\\xd5\\xe6\\xb0yg*\\x17h\\xf3\\xf0=\\x8d\\xd1.''\\xb9n\\x15\\xceg\\xd1#\\xb4\\xb1b\\xc2\\x12qm~/\\x1e\\xa9i\"t\\xb8\\xb45^\\x9a\\xaa\\xa5\\xcf\\xa6\\x12\\xff\\x97rvx\\xcex\\xb3\\x92\\xc3/&\\xee\\xc0t\\xd5\\x10\\xc6\\xe3rn\\x80\\xc2\\xa6\\xcb\\x8b\\xd6\\x9a\\xb5o~q\\x81$\\xa6\\x1a"
  754. },
  755. {
  756. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!s\n\\xb6t\\xd8\\x05\\xc7\\xf0\\xd1#\\xa4r\\x13\\xa3x*t\\x1f\\xde#=\"\\xe3\\xef\\xa8\\xd5w\\xd9)o\\xd35b\\x17\\x1ah;\\xdb\\xc6\\xa7\\x02\\xd9/\\xa5\\xa43\\x03\\xc4x\\xe3\\x19y\\x05t\\xa9\\x04\\x9b\\xd3\\xc7\\xab\\xe4\\x1c\\x95\\x89*\\xd4t\\xdf\\xac\\xac\\xfc2;\\xcd\\xaawn7\\xa3\\xbb\\xd4\\xa2\\xb5\\x0c\\x01c]\\xe7\\xbe\\x10jv\\x1e\\xa8t,h\\x0c\\x7f\\xdeq\\xe5\\x81\\xd5\\xfc\\x85\\xca\\xdd\\xb4q\\xde\\x9d\\x11\\xb3\\xe8\\x9f+\\xbd\\x93g\\xc0b\\x86\\xf8\\x0e\\xa8\t\\xae\\xe4\\x81\\xc4\"\\xd2\\x16@\\x80n\\xddv\\x83zn\\x0e\\xf1\\x0b7v\\x04\\xa1k'\\x0f\\x86\\xb4\\xf3\\x9a\\xb8\\x9b\\xd7\\xe8\\xee\\xaak\\x84\\x97\\xba\\x00\\xach\\xd4\\x1a\\xa4\\xdc\\x9d\\xa6>\\xf3\\xc2\\xa1\\x90a\\xa7\\xf7\\xd6\"!\\xb56\\xfet12l\\x9f:\\x03b\\xa4\\x1f?\\x8c\\xf5\\x85\\x0c`\\x9e\\x0e]\\x8d\\xc0\\xb0\\\\xc7x\\xb7\\x84\\xef\\xb5\\x96\t\ne\\x07\\xf6\\x84&ip\\x92ph\\x85\\xcc%&\\xaf\\x1b/\\xfdi\\xc6\\x13j-\\x1e\\xf5\\x81sd\\"
  757. },
  758. {
  759. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\xfa\\x9e\\x08\\xa8&%i\\x19\\x01>\\xb5\\xb4)\\x9em\\xba;\\x1bx\\xc8r\\x95qog\\x8f\\xfc\\xab\\xa6\\xc6e\\xa2\\x17\\x106,{3\\x03e\\x15\\xc6\\xff\t;\\x89\\xa2\\xecz zsnk\\xf3f\\xf8\\x90bj\\x9a/\\xfb\\x8f\\x86\\x96xz\"\\x9f\\x03\\x8cl\\xcc\\xedj\\xd2jp[\\xd9\\x98\\x8ff\\xf2f:\\x83.^\\xb6\\x9b\\xe3 4\\x0f\\x98k?\\xe1\\x1c\\xc7\\x95\\x1e\\xd8y\\xda\\xaf\\xe9x\\xb6' \\x96%\\xf72\\x8b\\xdb\\\\xcf&\\xd2oc\\xa0u\\xb2\\x8f\\x12\\xf0\\x7f\"\\xabh\\xdba\\xc6\\xec\\x01\\xf0t\\x9b\\xb3\\x91\\xb5\\x80m\\xbe\\xd1)\\x83\\xf1\\xd8\\x81\\x0e\\xe4e\\x95\\x11\\xe9\"x\\x1ba\\xc1\\xe1\\xba~\\xbf\\x9au`\\xf6w\\x88[qm\\xae/tt\\x14\\x91\\xe4~\\xb4a\\xa6.\\x00\\xaez\\xd32\\xdb\\x04\\xcek\\x9ave`\\xc0[\\x1e\\xa8\\xea\\xf3+8\\xd5n\\xf7\\xdcv\\xb2\\xa1\\x07\\xcd\\x83\\xf6\\xac\\xd9'e*\\xfa\\xd0\\xc9*\\x0b\\xa6~\\xdd\\b\\xd8\\xa2\\xeb\\xden\\x95*\\xb5o\\xa2\\x87}"
  760. },
  761. {
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\x80x\\x7f\\x1b\\x17\\x8b\\x88c\\x10\\x1f\\x93\\x13\\x0c\\xf5}\\xa0\\xec\\xb9\\xf7\\xe9cw\\xe6\\xd5\\xa7\\xfdu\\x01;\\x16\\x1eu\\x8b\\xb5\\x83\\xd33\\xcca(\\xc0{x\\xa12\\x14\\xdfvgowd\\x891*\\xea\\xc7\\xc2\\xc7\\xcc\\xeb\\xe0\\x88\\x1b\\x1d\\xd8v\\xb6\\xf0\\xe3wn\\x8e\\x8b\\xe4\\xfds\\x15\\xf0\\xae\\xeb:\\x82\\x92j5\\xb8\\xa1z\\xe7\\xef\\xe1\\xfbo\\xd3a\\xfd\\xd8\\\\xe9pmd\\xb7\\xf4[\\xf5v\\x1c~c\\x9d\\xd4\\x14\\xf3\\xeb\\xfb\\x9f\\xc7\\xa6\\x8c\\x82\\x80\\xe9\\x82k\\xbb\\x82&}\\x9b\\x97\\xed\\x03\\x8b\\x90\\x9a\\xbe\\xc1\\xf8!m\\xc0\\xda\\xd3\\x10\\xa8nix\\xc0_\\xbac\\xa6\\xf2\\x12\\xdb\\xc77\\x87:\\x06wl\\x84\\xcd\\x0b\\xd8\\x9b\\xc6\\xf2\n\\xfc\\x90\\xa9\\x15\\xfcm\\x0c\\xb3\\x9fnp\\xd2=k\\x01\\x1d\\xb5t\\xf5t\\x9c\\xaf\\x8d<\\\\x85\\x17n,\\xfe\\x1c0g\\x99\\xa2\\x8a\\xd8\\xb2\\xd8\\xbb\\xbeq)\\xee\\x06\\x1b\\xe3\\x17i\\x80\\xc7[\\xd1\\xeb\n\\x1bc\\xbd\\xc6\\xcd\\xa5\\xfb\\xb7oz\\xb5*u\\x83\\x12zm8c?\\xf6n"
  763. },
  764. {
  765. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0e\\x078/\\x9b\\xbd\"++&\\xe5\\xa1a\\xddt\\xbf\\xcd\\xf9\\xdf\\xf1\\xc4\\xa9dn\\xb0\\xc9\\xe1\\x05\\x90\\xe9\\xd0\\xa4\\xe4\\x94\\xb5\\xe5\\xed\\xd0\\xc5\rk\\x0ce\\x86j\\xa8\\xe9w^\\xc8\\xbee\\x9a\\x85$\\xe9\\xb0\\x08\\x9d\\x17\\xa3;v\\xdf\\xb86\\xc2\\xb2\\xb6d\\x1a\\xb6@\\x11;\\xa7\\x8f\\x05\\x14'\\xeaq\\xd7\\xafk&vp\\xba\\xd4\\xd2\\x19\\xe6\\xe65\\x925\\xf6\\xba%\\x19\\xf5\\xce\\xc88z\\xbbw\\xaff\\xceg\\xdb\\xe0\\x815\\xe5\\x96\\xfb\\xc6\\x1flh\\x0c\\xb9_\\x8a\\x85\\xef!0%;\\xde\nd\\x9da\\xd1\\xba\\xbd(\\xc8\tv`\\xcb/\\x02\\x17\\xd3\\xce\\xd0r<@\\x87\\xc9\\xact\\xe1\\xfd\\x92f\\xf4\\x11&\\x14\\xdfgs\\x00\\xf8\\xf0ql\\xa9\\xd3\\x1a\\xa0\\xa0\\x9f\\xa7m\\xd5n\\xdcv`\\x9b\\xac\\xa5\\xbd\\x0c?\\x05\\x98cr\\xa5q\\x98\\xa9o\\x1f=\\xcfe\\xfd\\xeb0e\\xb1\\x00\\xe6\\xc7\\xa3=/\\xcf~_#j\\xa36!\\x88,u\\x7f\\x1a\\f\\xba\\xfayo#\\xbb}\\xa5\\xf0:c;\\xbf\\xec/\\xbf\\x9e"
  766. },
  767. {
  768. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe2\\xd0\\xdecj\\xfd\\xa0\\xaa\\xd3w\\xa6\\x0c\\xa9d;\\xc2a&q\\xb54\\x93\\xf6\\x8a\rz\\xfa\\xea\\xa5\\x9a\\x83x\\xd7\tek\\xf1\\x9e\\x9f\\x95\\xf0\\x15\\x03y\\xbdvxc;4f\\xee\\xcehx\\xa3ux\\x1fy\\xc7\\xf5#\\xaat\\xe0\\xc8\\xec0\\xbed\\xb6e\\x96w6wj\\xca\\x7fa\\xdba\\xe0o\\x9d*l[(%\\xa4\\xd3\\x89\\x89p\\x19\\xf21\\xd1\\x99\\x95\\xf9\\xfb\\x12\\x18\\xd5n\\xab\\x84\\xbd6kzih\\xbd\\xd0:\\xef}\\xa4\\xc6x\\x16<\\xde\\xf1@-j\\x93t\\xa8u\\x7f\\xc3\\x03\\x97\\xd0\\x83#\\xe1\n\\xbd\\xaf\\x9b\\xdcs2\\x97\\x9cm\\xe7=\\xf3\\xdd\\xd3\\xf1ee\\x00\\xc7??\\xf4\\xe9$\\xc5\\xd2\\xf0\\xb46$\\xc3z\\xf4\\x1d\\xc9'\\xe7ery\\x01\\x81u\\xe2\\x85\\x99\\xdbgi$\\xe3eo\\x98\\x1e\\xb8\\x0e\\xb5e6l[\\xe1[\\xa7\\xd2\\xae;\\x19\\x1e\\xbc\\x82\\x0f\\x13\\xa1\\x07j\\xb5\\xd4\\xce\\x06zj\\x9ck\\xcd\\xc4\\x85\\x99\\xbf\\xa3\\x0f\\x7f\\xcc\\xc1\\x99\\xa3\\xe6\\x8f\\x14\\xc6pnq\\x0bp"
  769. },
  770. {
  771. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\xe0+\\xd2\\xb0\\xf1\"n\\xde\\xd4$\\x89\\xed\\xd1\\xa9\\x0fj\\x80\\xd50`\\x81 \\x05\\xe8\\xb4\\xa8\\xf6\\xec\\xa0\\x96\\xaetu\\x8c\\x9d\\x02\\xf3\\xc4\\xa2o\\x0f\\xa1h\\xaa\\x96\\xa0kv\\xce?m\\x13\\3\\xe9\\x8b\\xbe\\xca\\xac\\xe6c\\x8ft\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7c\\x1f|\\xb0\\xb6oq\"\\xd0\\xb0p\\x81\\xe1\r\\xafuvym\\xf1\\x14\\x85\\xeco\\q\\xfe\\xeeyy\\xde.\\xf0\\xc1rroxc\\x80\\xdcc_\\x8al\\x0b\\xb2"
  772. },
  773. {
  774. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85\\x11_\\xf3)\\xc7?\\xa4\\xe4\\xb6\\xc5\\xf5\\xd8\\x12\\xefv\\xac\\\\x99\\xf6\\xa6\\xb07\\xcc\\xdcv\\x94\\x1ew\\xe9\\xf6\\xf8$\\xfa\\xaa+-t>\\x17\\xdf\\xd4(\\xf3\\x92\\x9a\\xb4k\\x93\\xb9\\xd4o\\x18\\xf6`\\x86\\xc4\\xeczw\\x18\\x97\\xd8yfa\\xed\\xe9,\\xaeum%\\xcb\\xad\\xf9\\xd7\\xb7\\x1f\\xac\\xa0\\xae\\x82\\xc8\\xe2w\\x96o\\x03\\xb8c%\\x950\\xb5\\xaf\\xa2j\\x9d@\\x1b#\\xbb#\\x93g\\xd2\\xa1\\x81\\xe6\\xb3h_wh\\xec\\xfdu\\xfe\\xb4\\x16\\x1d\\x06u\\xc0\\xefi\\xa3@\\x8e$\\x85\\x8f6b5f\\xc2\\x92;\\x90\\x9e1\\xef~.\\xd1%$\\x97\\xcd\\x0f\\xe9\\xb6e\\xcf\\x83\\x0cdz\\x1f\\xcb\\xdc\\xb4p@\\xfc\\xed\\x7f\\xbb\\xe5\\x06m\\x04\\xb6\\xe4\\xa8\\xd0\\x8e\\xc4/\\xcbp\\xedh\\xf6\\xfey\\xf4\\xaa\\x11\\x15.\\xbe0w\\xa0\\xdbytv\\xc4\\x96\\xd6g\\x9e7\\xef\\x8d\\xa9\\x0f|\\xa8n\\x8e\\x84k\\xc4\\xea\\x98\\xb1\\x1e\\xdby\t\\x91\\xa2\nl\\xd9n\\xcd\\xde:\\xea\\x02\\xca\\x02;\t\\x95\\xd8\\xbc\\xfc \\xf7\\x8a\\x1a\\xd9\\x99v"
  775. },
  776. {
  777. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\x80-\\xde\\xf31\\xc5\\xcch\\xe6a\\x95\\xcc\\xc7\\xed\\x19\\x96c\\x11\\xc0\\xfb\\xd6\\xa1\\xe8\\xf79a&\\xc7\\x9az\\xcfp\\x84-\\x91\\x8e<z\\x98\\xab\\x08!\\xed\\xed\\xed\\xa4\\x9e\\xabm\\xcd\\xf3\\x98\\xb9f\\xccs\\xe2\\x1fd\\xf3 \\x7f\\x02`\\x16\"d\\x94ng\t\\x1d\\x12\\x98\\x9e\\x8a\\xb4\\x86#z\\xb6\\xccgz\\x93\\x15\\xab\\x06\\xa2\\xa2\\xfa\\xcc+jz3~\\xc2\\xc1\\x8d\\xb96-sq\\xeb1f\\xe3\\xfb\\xc2\\x8b\\xbf\\x0ej\\x00\\xa8$\\xc2\\x08\t\\x03\\xc1\\x06\\x90\\x02\\x94#\rne\\xcd\\xe5)s\\xa3\\x17\\x03\\xa3\\x99\\xad1\\xd6\\xa9\\xe7\\x84\\xe3\\x1e*\\xb3\\x8d\\xb6\\xba\".\\xa7\\xd7q\\xa3\\x8fy\\xb1\\x16\\x9d\\xc8j\\xb2\\xd2\\xd6a\\xef\\xfb+\\xca\\xb1g'\\xa2\\xda\\xbc\\xf4\\x81>\\x0cn\\x19\\xc8\\xd3\\xb5h\\x1e\\xce6\\x13\\xd56\\xef9\\xf8&j\\xfe\\xd3?\\xd5\\xe4~\\x19`\\x92\\xee\\xa2_\\x9c\\xaac\\xcf\\x97v\\xa3/\\x1c\\x1a\\x1a\\x9b\\xb1\\x8a\\xcd\\xac\\x8fh\\x1d\\x14bi\\xb8\\x1d[\\xcfev\\x03\\xa3\\xe0\\xcfxq0\\xaaf"
  778. },
  779. {
  780. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe4\\x85oj~\\xf7\\x1a\\xfb\\xc5\\xb8\\x93\\x02h\\x1em\\xeb\\xe4\n\\xd4\\xdb\\x82j\\xd3n\\xdf\\xa9\\xbbl\\xc3\\xae\\xe1\\xdb\\xce\\x8e\\x98t\\x84:1\\xd4i\\x0e\\xff\\x8dn\\x9b\\xd2\\xcf\\xda\\xb6\\x1e\\xb1\\x11\\xd8y\\xa8\\xcac\\xcd\\xb7/\\x99\\xe0\\x04c^\\x9e\\xeb\\xf8\\x19$\\xe26\\xf6\\xef\\x18a\\xa43\\x8b\r\\xb1\\x15\\xbbq\\xd8\\xdeq2\\xcc\\xb2s\\xb2n\\x90\\xa3\\xd6e\\x08\\xd1\\x06\\xd6\\x88\\x9e!r\\xbc*\\xdb\\xbd\\x11l\\x8c\\xef\\x1c\\xc4\\xfb\\xfbw>\\xe1\\xee){fu\\xcb\\x0c\\x83yb\\xe4c\\xf3\\x12\\x10\\xe3m\\xb3m;\"\\xc7\n>\\x14\\xaaw[\\xfa\\xac\\xc7-jn\\x93gtt\\xa1\\xc2\\x1el6\\xe7\\xa6\\xb9*d\\xa9\\x97\\xadv\\xbf\\x0e}\\xa9\\xb7\\x0f\\xce\\xa4k\\x9d\\x04\\xd9|7\\xa0\\xf1\\xb2y\\x809(\\xdb\\x0e;e\\xf6\\xd0w*\\xf2\\xb6~\\xdf\\xc2\\x0ew\\x13\\xbeee\\xa3\\xc4\\x8ec\\x1d\\xb7\\x7fot\\xad\\xf0\\xf5\\x87*\\xf7\\xb6\\x90\\xb6q\\x10\\x11}\\xee]\\xab\\xab\\x16~\\xf3\\x10\\xf2\\x12\\xe4\\x9e2\\xe1b\\x96"
  781. },
  782. {
  783. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101\\x7ft\\x90\\xd0_\\xa1{\\xddj\\xba\\x1bgv`\\xd0\\xf6e\\x81>\\x88\\xd0\\x19z \\xff\\xc6h_+\\xfcm\\x06go\\x15\\xcb\\x8d\\xaf2\\xed,\\xa6v\\xd6\\x9a\\x8f\\xed_\\x84\\xa2i\\xe3\\xa1\\xdb\\xeb.&\\x00\\xac0\\xf9x\\x15g\\x8d\\x8a3\\xf5\\x11r\\xc3:\\xfd\\xae\\xc3\\x1f7\\x19 \\x04a4\\xddh\\x8f\\xa8\\xb2a+\\x92nu\\xe9\\x8cz#\\xdavd\\x8e\\xd3e\\x7fb\\x97\\xfe\\x89m\\x03k\\xa4\\xb1=\\xa8o\\xb1\\x00\\xf2\\xb8\\x0cs\\xca\t)\\x12\\x92q\\x96(\\xccxit\\xb91\\xe8\\xc6\\xd1\\xd90\\xd5\\x19\\x14\\x10\\x88\ng\\xfbwrv\\x85\\xa9\\xe4\\xb0\\xb5p\\xbd[\\xa8\\x83\\xe0\\xfb\\x8a\\xbf<o\\xfa{\\x8d.\\x93\\x9f\\x8e\\xdf1\\x07\\xe6\\x8a\\x93\\xd26a\\xa1h\\xc31\\xfd\\x8d\\x872\\x83\\xf7\\x0bsq(\\xb2\\xd4<\\xc1\\xb8\\xccm\\xa5z3\\xa6\\x91\\xcc\\xed\\x0e\\xb0\\x82\\xae8r\\xa5\\xad\\xbe\\x11a/\\xf6\\xf3\\x0f\\xff\\x15\\xc9\\x8c]_wt\\x88?\\x91\\xb2=h(\\xa5\\x87)\\xb2\\xedq\\xe6\\x8a\\xdc"
  784. },
  785. {
  786. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5 \\x074l\\xff\\xa4\\xa1lk6`\\x1d\\xd0.\\x8du\\xd7+\\xc0&?%)\\xee9\\xb33\\xaa\\x1b\\x91\\x015f\\xf0t3\\x00\\xd3\\xc0\\x81\\x85i\\xfei\\x02h\\x02\\xa1\\x08\\xae\\xdf\\xcb4y4\\x97d\\x8d\\x05<\\xbf\\xdbzg\\x07\\xb5\\xe3y\\x9f`\\x9f\\x1bm71\\xa2\\xe4\\xa0|d``$\\xd9\\x8ffb>\\xe7f\\xfb\\xd7\\x1bd\\x88\\x8c1\\xba>/\\xc7\\xc0\\xaa\\xed\\xa4\\xfc\\xcc\\xa8\\x92\\xf0\\x1c\\x9b\\xcc\\x90\\xddi\\x1ekg\\xe1\\x10\\x84\\xc4\\xa4\\xe6j-(v\\xb4\\xe4u\\x10\\x00i\\x1e\\x8f-\\xa6\\xaa\\xedtl\\xcaw\\x9a&\\xcd9e\\xc8su_\\xad\\x147\\xd5\\x82\\xb7+\\xa5$\\xd8\\xba,\\x83#\\x976\\x11\\x07\\xc5\\x00+l\\xa7q'\\x0e\\x081\\xe6\\xa9\\x01\\xbb\\xab\\x0bs,k\\xb5\\xb2\\xbc\\xba+\\xf5<\\x95\\xf2\\x01k\\x1b\\xc0\\x9a\\x81n\\xcd\\xde\\x16\\x9d\\xe6xl\\xd1\\xc2\\xd8\\xe7\\xcc\\x06c\\xb1r\\xfc\\xf4\\xe8we\\x80\\xbd\\xce\\xf6\\x8e\\x9dz\\xf0\\x954\\x01\\xd1\\xc7\\xcf\\xbc]\tv\\x8b\\xcb >"
  787. },
  788. {
  789. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xcc=\\xb6\\x1bk\\x9b\\x15\\xc8\\x94\\xf6x\\xb89\\x15]\\x95\\xcb\\xb5\\xf3\\xa3\\x85\\xd4\\xd8\\xdf\\x84c\\xa93\\xd0\\xe4w\\x96c\\x0e\\xa5\\xf8f\\x11\\xe9\\x8dr\\x1d\\xc3\\xf9\"e-\\xdc\\xe7\\xfd\\x1fw\\x81\\xa5\t.:\\xd2\\x8b1\"\\x1b\\xc8\\xea\\xb3t0\\x86\\x19)\\x8bj\\xf4`\\xe7m\\xbfc\\xdc\\xdbol\\x19$\\xdd\\xea?\\xf3\\xacw\\x8c\\xd0\tr+kf\":)\\x85\\xa9{\\xa4^\\xb5n\\xed\\x93\\xf6y\\xd5\\xac\\xda\\xea2\\xda\\xd4\\x9e\\x87\\xe8\\xbc\\xef\\x88l\\xc1\\xe6\\x1a\\x87\\x93\\xde\\xee\\xbdn\\x02+\\xc2\\xe8f\\xe0\\xa6t\\xff**h^\\xb9\\xb6)\\xa7v\\x88\\xbfx\\xa9\\x98ub\\xb3ck@\\xbe\\xa2r%\"z\\x13j\\xa9gj\\xc5+\\x1aw\\xb3\\xb2\\xf4#+q\\xb1wr\\xad=\\xbd\\xcao\\xe9\\x80\\x08\\xe6g1n\n\\xff!\\x08iu\\x18>,\\xa4)\\xc2j\\xb0{1/\\x8e\\xdc\\xa0\\xa6\\xd5x\\xd4\\x8aiy\\xc9\\xd8\\xca\\xfc\\xf8\\x9f\\x8c4\\xe8\\x95\\xe0\\x1ez\\xd5b\\x12\\x1b\\xa3\\x08\\x1bh\\xce\\xf5v"
  790. },
  791. {
  792. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x84\\xdbd\\x16yww\\xae\\xaa\\x85\\xdc\\xaa^dw+\\x85\\xf1\\xf0\\x94\\xee\\x1f\\xeb\\xde\\xfcr\\xc7\\xe0xm\\xf0s\\xb1\\x9b\\x0en6=\\xeae\\xa8\\x9c5\\x9b\\x12\\x94\n\\xf7z\\xd5\\xe0\\x07\\x93\\xc5\"%\\xbf\\xf2\\x11=\\x8d\\x0b\\xa4\\xd6b\\xe8w\\xbe*\"\\x8b\\xda_\\xbd2d\\xa1\\xdfo\\xbbs\\x83i\\xbclbzj\\x9f\\xfe\\x84\\xde\\xc0c\\x9eh^:\\xebz&$&?\\xb1\\x8c\\xda\\xa8\\xdcv\\xe6\\x9d\t(\\xfa\\x1ac\\xbb\\xf6d\\x90q=\\xcd\\x9c\\x06s\\xe2u\\xe4\\xdf\\xd1\\xd0\\x1b\\x15\\xcc\\xd3_n-4vw8\\xb3\\x13\\xdf\\x991\\x05\\xe7\\x86\\xfc\\x86\\x0f 3\\xf4z\"\n\\x910v(\\xfev\\x0f6qu\\xd3\\xbdh\\xf3wr\\xfc\\xf2\\xf7\\xc9\\x86\\xb3xu}\\xb5\\xac\\xc4\\x06\\xb5\\x16\\xc2\\x0b\\xb3\\xc2\\xdd\\xafh\\xa7\\xb6\\xd7\\xbe\\x95%n\\xdc^\\x00~#\\xa8\\xc3b\\xa9\\xbdz\\xa1'\\xaa(wsu\\xf8\\xb7\\x07\\x96<q\\xff\\xc2\\xb3\\xc6\\xf8\\xc5r\\xbb\\xbb\\xa8)\\x9b\\xaf^\\xe8z\\x80\\x01\\xc1\\x1e"
  793. },
  794. {
  795. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3z\\xcc\\xd7t\\xe73\\xc0\\x86d\t\\xe64j\\x9f\\xd8\\x83\\xd0,u\\xf7\\x11y\\x03\\x83\\xffv\\xc50\\x9a\\x15\\xf8`v\\xe1 |\\xdc\\x93y\\x8b5|+s\\xd3f_\\x01\\x01\\xc7\\x84\\x08\\xfd\\xb8\\xca\\x8b9\\xf7\\xc9\\x8e\\xc1\\x93(oi\\xcdrf.\\x98\\x89\\xfcmr\\x87\\xa7\\xed\\x03\\x08\\x86\\x94\\xa64\\x9d\\xc1\\x9c@\\x98\\xe4\\x84\\xa4ib\\x9f\\xf1\\x16?9\\x8a\\xe2\\xc3\\xa2\\x11bn\\xcd\\xa7a\\x0bp#e\\xf9\\xa5\\x95\\xd5\\x15\\xbd\\x8c\\xc7\\xa8zrt2\\x9f\\xb7\\xb4r\\x839\\x92\\xb7\\xd1\\xf4\\x03\t\\xd9\\x13\\xfc\\xf16w\\xae\\xa2h\\xe4\\x19\\x9d\\x00y<\\x00\\xc9\"\\x9e\\x17:\\xdb4\\x94\\xf4\\x06m;g_z\\x1e\\x89\\xc1\\x15\\xf8\\x1d4`\\x07\\x92\\x0f|l{\\xbc\\xce\\xb4\\xf3\\x15y2\\xbd\\xb0^\\xd1{\\xf53u&\\x1e=n\n-n\\xa5\\x18\\x7f\\x9e\\xec\\x87\\xc9\\xab\\xd2\\xee\\x86\\xab\\x9ab\\xfa\\x0ba\\xd81\\x9ac\\x91\\xbf\\x02\\xe9ur\\xda\\xd4\\x85\\x0e\\x02>5\\xc4\\xcbe\\xd5\\x91]\\xb0\\wuc\\x91"
  796. },
  797. {
  798. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\x87\\x1c]|\\xf8\\xa4\\xe3\\xa75d|\\x94tzr\\xd3\\x90\\xb9\\x1dz\\x08{\\x88\\x15 \\x9d\\xe6\\xd2c\\x19\\xb1\\xf9\\x0e\\xc2\\x01`z\\x80\\xed\\xe5\t_\\xb5\\xf87'\\x9c\\xfd\\xa8\\xdb\\xcd\\x9f\\xcb\\xbem\\x91\\xf3\\x06\\xe8\\xe83v\\xefq\\xe83pv\\xe0nhr%^\\xe8i\\x15\\xb8(\\xee\\xfdj-tc&2}l\\xcc.\\x0f \\x8ddn=\\xbfa\\xd6\\x19\\x0c4k\\xfb\\xa6\\xed\\xde\\x8a\\x04y\\x82\\x9csu\\x1ar\\xd7\\x8f\\xf7\\xd6y\\x99n\\xbdl\\xd5f%w\\xa3\\xad4\\xa9\\xb4|\\xb1\\x87&3~\\x8d\\xf1\\x93\\x13\\xa2\\xa5\\xe1}\\xa5\\x14\\xfewo\\xb3z\\x9ex\\xa5\\xef\\xa1\\x95 \\xf2q\\xbeax\\xa2\\x19\\x8f\\x0fg\\xf0}\\x02\\xb2\\xacg=\\xe8\\xc4&\\xce4\\xbc-\\xb0|e\\xc3\\xbe\\xb2\\x83?\\xef\\xf4\\x0e8\\xf3\\x8b\\xb9\\xc8u\\xcc\\xe0\\x04\\x98xtk\\x0f\\xaa\\x08\n\\x16\\x9b\\xc1w\\x07\\xeef\\xe1)\\xfa\\x02\\xf1\\x89\\x19q\\x18gp\\x87\\x1a\\x85\\xac*\\xe5\\xba\\x8d\\x0e\\x94\\xf8+m\\x1d\\xa5\\xfcw"
  799. },
  800. {
  801. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\x1a\\xd7&\\xb2\\xe0~0l\\xee8\\x0f\\xaa\\xa9\\x12\\xd1\\xa8z\\x97(\\x92&ii\\xfc\\xb1e06\\x80\\xc1ed=\\x8e\\x8a\\xcc\\xfa\\x89\\xcd&\\xb5#\\x83\\xff\\xb1pa\\xd0\\x83\\x99g7\\xe9,\\xe3[\\xc0\\xa4\\xae(\\x8cq\\xcb\\x10\\x178l\\x11\\xe3\\x9bi\\xcd\\xba\\x9d\\xf4w\\xb7-k\\xc3s\\x1c\\x85\\x860\\x82\\x83\ty\\x11\\xb9g\\xdf\\xbf\\x1f\\xe4\\x1e\\xd2\\xd6\\xb7\\xfa\\xec^\\xfdz\\x9c\\xect\\xc7%\\xf4\\x8c\\xc4\\x8435\\xc0f\\xebgz\\xea2 \\x9d\\xfc\\x0c\\x9d\\xe5u\\xf0\\xd1h\\xd4f\\xbcj\\x1b\\x10o\\x90n*\\xde\\xc9u\\xe4\r\\x1d\\x1f\\xa1\\xc25\\xf6\\xd6\\xaf\\xb7\\x81\\xd9p\\x192\\x17\\x93\\xb8\\xb5\\xf2\\xf2\\xe7z\\xd1\\xfc\\x1f\\xe9\\xc8\\x9b+ \\x8cz\\x08\\x8d\\xc4_\\x80\\xc4\\xea)\\xc1d\\x12\\xa8\\x92\\xdco\\x15\\xe18x\\x9c\\xabj\\xe5\\xab*\\xb8\\x8a\\x8d\\xb7(\\xd8d\\x83\n|}\\x1c\\xb5.\\xced\\x056\\xf2\\x0ce\\x00\\xdaht\\xe2`4\\xd9\\xf5\\xe2\\x81\\x9fy\\xe5\\xe8\\xd41i\\x88\\xcb\\xa19\\x12u"
  802. },
  803. {
  804. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1-\\xef\\xf6fl\\xd4\\x08\\x01h\"5m-\\xe3\\xc7\\xf4\\x17\\x16\\x80o6\\xf1\\xc8m\\xcbc\\xd6\\xcdy1\\xdc~\\x8c<\\xa0\\x93\\xb2\\xd8\\xb0\\xc2.g\\xcda\\xc2\\xb9\\xda\\xf5\rg)\\xe8\\xecg\\x1a\\x9e8\\xab\\xc8\\xb7\\xc9p\\x8d}\\xc7\\x89!4gj\\xf1\\x9b\\xb1\\xe32\\x7f2\\xeb0\\xd1\\xa9^;\\xf4\\x13\\x8f\\x12\\xa1`\\x04\\xa2>\\xa6\\xea\\x81\\x081\\x8f\\x06\\xf5\\x99\\xb0\\x8b\\x0c\\xf8\\xe1tek\\x98\\xd3\\xc9\\xdb:\\x81\\x8f\\x8e\\x8f\\xee\\xa0d\\x95\\x8d\\x05\\x1e\\xb3\\x8d\\xf0\\xfby-\\xe8\\x98\\x03\\x9c\\xfaj\\x15n\\x155\\xff\\xa8\\xdc':t\\xb8\\x1f\\xcc\\xc8\\xc5\\x11\\xe4#y\\x834~q\\xaa\\x91\\x82\\xdc\nu)\\xa5d\\xed\\x08\\xd0sa\\xfe3\"lp,\\x86\\xf0\\xf4\\x01j\\xf15\\xa8\\x11&\\xd0#\\x82b]'\\xfa\\xcd\\xec\\x102f\\x1ch\\x93\\xa6\\xc629\\xd1\\x90a\\xe2d\\xaf\\xe5\\x0f\\xf7b\\xd7?>2\\x14\\xe8/t\\xcc\\x8b\\x9e2\\xfc\\xd5)\\x17\\xfc\\xc0$\\x90\\xa5^nr\\xdc\\xe4\\xddzi\\x03\\xe6"
  805. },
  806. {
  807. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xb8\\xf4\\xac]h\\xb8\\xbf\\xdb\\xee\\xf3\\x1a\\x0cw\\xd3\\x1ey\\x91\\xd6q\\x0e\\xeb]z\\x9d\\x14m\\xcb\\xba\\xbe?\\xaa\\xcd\\x8fo1)[\\x06\\x13\\x8e1\\x02.\\xcf<b8\\xd9{\\xd9\\x9d\\x1c\\xff\\xbc{o\\xf0)\\xe7\\xb5\\xbf\\xd8)}\\xb0\\x8c\\xd6\\xa9x\\xdd|!\\xa5\\xed\\xf2jt\\xe21v\\xa6\\x15\\xd7;\\xc5c\t\\xcb\\x84\\x85\\xdf\\xe7\\x14\\x11\\x15c\\x1cv\\x9e\\x83\\x8a\\\\xfb6&\\xdb\\xc9\\xf6\\x0e\\xa6nrv\\x08q\\x13d\\xb1\\x1d\\x96#\\xc2/\\xa0\\x89\\x19\\xa8 \\xad\\x1a\\xab\\xaf\\xd7x\\xa3\\xcen3\\xd8\\xde\\x8e2)\\xaf\\xbb\\xc4\\xe5)\\xf7+b\\xd2*a.\\x95\\x9a\\x98\\x87%\\x99\\xe0\\xc9\\x17\\xc4\\x80\\xb9\\x1d\\xca+3d.\\x8e\\xbf\\x7fmf/#\\x99\\xaa\\xebr\\x81'\\x95\\x9e\\xd8\\x17+\\x96\\x00\\xcax\\x1c\\xf9\\xbf}\\xbe\\xd3y&iz:\r\\x94\\xedx\\xfd&\\xee\\xcf\\xaf$\\xd3\\xe0\\x8am\\xadbm\\x12\\xd1\\xadr\\xa5~%\\x7fu\\xfb \\xbd\\xaep?\\xf6]\\xf4\\xe2\\xe4-\\xb7\\xb3\\xf4)\\x03*"
  808. },
  809. {
  810. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xf1du\\xca=\\xb1\\xcb\\xfbu\\x16\\xcbj\\xdf7_y\\xffy\\xedon\\xcc\\xb5\\xa8\\x089\\x13tf_\\xa6\\x15\\x96a\\x85\\xde9\\xb0\\xd2\\xab\\xee8\\xab\\xfb\\x17\\xc1\\x15j\\x8a\\xaf70\\xf6\\xa3\\x07\\xb0[\\x9d<\\x0c\\xd0\\xb9\\xe8\\xf2\\xcb\\x9ci\\x12r!]\\x99\\xdbz\\x9cmi\\xe5\\xb2l\\x04\\xf1\\xd4\\xa4\\xf8n\\x9d\t\\xd0\\xa8\\xa9bstg::\\x1ds\\x15[\\xd6\\xc3\\xaf}ivrc\\x95\\x93#\\x85\\xdf'v\\xf7\\xd6\\xbb0\\xe3\\xb7\\x95\\xa1)\\x94\\x15}\\xdb\\x01t=r\\xde\\xf5|kb\\xba\\xec\\x7f\\x17o\\xf1\\xdd8\\xbe\\x1a\\xaf(d\\x9a\\x1a\\xe0\\xf4n\\\\xcby'\\xb9\\xad\\\\x93e1\\x04\\xc9\\xdb\\x82\\x04t\\xcc5\\xa0\\x17#\\x83]&\\x9a_\\x035\\x89jo\\xe7t;\\xac\\xfaj1l&ehn\\xd1\\xf5\\xe0\\x07:\\x9d\\xc1z\\xcbn\\xc7s\\xbc\\xe6@\\x00z\\xe9\\xea\\xa7u\\x14\\xe8\\x9a\\x16\\xdbirk\\x9c\\xa7\\xb2\\x11\\xfa!v\r\\xd1\\xa8\\xfc\\x9ac\\xe1uq\\x06\\xcf\\xb1\\x9a\\xea\\xdd"
  811. },
  812. {
  813. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010{\\xd9<w\\xa8\\xff\\x08aq.\\xfb\\xf4\\xed\\xca~\\xb9b\\xde\\xf2\\x15n.o\\x14\\x8f\\xc2\\xdd\\xf6\\xc0#\\xcb\\xba\\x1cc\\xe7\\xce\\x8f\\xfeb\\xb4\\xadk\"\\x95\\x97[e\\x0e\\xda\\x9b\\xbe8\\x9cw2\\x8a3\\x98\\xf1\\xbda\\xe3c\\xeabg\\xc1\\x85\\xa2\\xedm\\xd8\\x16\\xe9`q\\x99\\xb8\\x1bir\\x9d\\x04\\xbdw\\x7f\\xed\\xb0\\x96n(\\xf0\\xd1\\x8f\\x17dv\\xb48\\xdai\\xc9\\xad7\\xc9\\xf8\\x84\\x1fk[;g\\xfe\\x07m\\xc4p\\x8eg8'\\xc8\\x16\\xb3|w\\x96\\xcd\\xeb\\x84\\xe8\\x8f\\xba\\x95\\xb2x\\xda\\xe6\\xc9\\xca\\xc3\\x99\\xcf\\xf6wu\\x87\\xc6%\\xf3\\xbe@~\\xff\\xb11>\\xd9\\xbax\\xc5\\\\xc9cn\\xe1\\x03f\\xbbw \\x80\\x06\\x9c\\x97\\xabm\\\\x17\\x1c\\x86\\x9f\\xad8\\x8e\\x93z\\xcc\\x17\\x10\\x8e\\xcb\\xaf\\xa6q\\xeey\\x00+\\x04n\\xc1\\xdb\\xb2\\xd3\\xedp\\xaa\\x0b&\\xd3\\xa8\\xc7\\xbb>\\x19\\x17\\xbb\\x16\\xfa]g#\\x1d\\xb3\\xc3^s\\x07\\xbe!\\xaem\\xc4f\\xbdwx\\xdf\\xb4q\\xe8\\x1c\\x9f\\x0c\\xc1\\xc7\\x0f\\xe0\\x96\\x13"
  814. },
  815. {
  816. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  817. },
  818. {
  819. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  820. }
  821. ]
  822. },
  823. {
  824. "Description": "Creates a hidden or system file",
  825. "Details": [
  826. {
  827. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  828. },
  829. {
  830. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  831. }
  832. ]
  833. },
  834. {
  835. "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
  836. "Details": [
  837. {
  838. "McAfee": "Exploit-CVE2017-11882.cb"
  839. },
  840. {
  841. "Symantec": "Exp.CVE-2017-11882!g3"
  842. },
  843. {
  844. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.E"
  845. },
  846. {
  847. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  848. },
  849. {
  850. "TrendMicro": "HEUR_RTFMALFORM"
  851. },
  852. {
  853. "McAfee-GW-Edition": "Exploit-CVE2017-11882.cb"
  854. },
  855. {
  856. "Sophos": "Troj/RtfExp-EQ"
  857. },
  858. {
  859. "Cyren": "CVE-2017-11882.D.gen!Camelot"
  860. },
  861. {
  862. "Microsoft": "Exploit:O97M/CVE-2017-11882.AF"
  863. },
  864. {
  865. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  866. },
  867. {
  868. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  869. },
  870. {
  871. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  872. },
  873. {
  874. "Zoner": "Probably RTFObfuscationD"
  875. },
  876. {
  877. "Ikarus": "Exploit.CVE-2017-11882"
  878. },
  879. {
  880. "Fortinet": "RTF/CVE_2017_11882.A!exploit"
  881. }
  882. ]
  883. }
  884. ]
  885.  
  886. [*] Started Service: [
  887. "osppsvc"
  888. ]
  889.  
  890. [*] Executed Commands: []
  891.  
  892. [*] Mutexes: [
  893. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  894. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  895. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  896. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  897. "CicLoadWinStaWinSta0",
  898. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  899. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  900. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  901. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  902. ]
  903.  
  904. [*] Modified Files: [
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_9fbcfe645282669e8825a84680c2011c.doc",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_9fbcfe645282669e8825a84680c2011c.doc",
  907. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{1D431C6C-0E19-4215-A93E-E0A797F919FF}.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  909. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{674858EC-2F57-4FD9-8F76-1CB660C4509A}.tmp",
  910. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  911. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_9fbcfe645282669e8825a84680c2011c.asd",
  913. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  914. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab118F.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar11A0.tmp",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF94765BECDF5CC88B.TMP",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CDC.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CEC.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CFD.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7B.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7E.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7D.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7C.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7F.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D9F.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DA0.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DB1.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DC2.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DD2.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DE3.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E32.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E44.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E33.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E93.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1EC3.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F41.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F61.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab202D.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20CA.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20FA.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2159.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2189.tmp",
  946. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  947. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2284.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2311.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2312.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2333.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2353.tmp",
  953. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  954. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  955. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  956. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251B.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CC.tmp\\VaryingWidthList.glox",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CB.tmp\\Element design set.dotx",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab256B.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab257D.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251C.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CC.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CB.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cab25EC.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar257E.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar256C.tmp",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2745.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2756.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2746.tmp\\BracketList.glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2757.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD27B6.tmp\\PictureFrame.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2746.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD27B6.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2805.tmp\\Crop.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2806.tmp\\RadialPictureList.glox",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2806.tmp\\Content.inf",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29AD.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29BE.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29CE.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2805.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B18.tmp",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B59.tmp\\Basis.thmx",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B47.tmp\\iso690.xsl",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6A.tmp\\ThemePictureAlternatingAccent.glox",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B58.tmp\\content.inf",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6B.tmp\\gostname.xsl",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B59.tmp\\content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C18.tmp\\Headlines.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6A.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B47.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6B.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C19.tmp\\gb.xsl",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B58.tmp\\Metropolitan.thmx",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C29.tmp\\Badge.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2D83.tmp",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E50.tmp",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C18.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2D84.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D82.tmp\\content.inf",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3101.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3111.tmp",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C19.tmp\\Content.inf",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D82.tmp\\Frame.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C29.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3112.tmp\\turabian.xsl",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3112.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab325B.tmp",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar326C.tmp",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3338.tmp",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3405.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3378.tmp\\content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3406.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3378.tmp\\View.thmx",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A3.tmp\\Banded.thmx",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A3.tmp\\content.inf",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab34F3.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3503.tmp",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3552.tmp\\content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3552.tmp\\Quotable.thmx",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36F9.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3796.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3797.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37D7.tmp\\content.inf",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37D7.tmp\\Slate.thmx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3855.tmp",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab397F.tmp",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3980.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39CF.tmp\\Feathered.thmx",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39CF.tmp\\Content.inf",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B28.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE4.tmp\\content.inf",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE4.tmp\\Mesh.thmx",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D1E.tmp\\harvardanglia2008officeonline.xsl",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D1E.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2F.tmp\\ThemePictureGrid.glox",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2E.tmp\\InterconnectedBlockProcess.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D51.tmp\\pictureorgchart.glox",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2F.tmp\\Content.inf",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D50.tmp\\ConvergingText.glox",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2E.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D72.tmp\\mlaseventheditionofficeonline.xsl",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D82.tmp\\ieee2006officeonline.xsl",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D71.tmp\\CircleProcess.glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D51.tmp\\Content.inf",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D50.tmp\\Content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D83.tmp\\sist02.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D71.tmp\\Content.inf",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DB3.tmp\\Equations.dotx",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DB3.tmp\\Content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D82.tmp\\Content.inf",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D72.tmp\\Content.inf",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D83.tmp\\Content.inf",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\cab40B3.tmp",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40A2.tmp\\gosttitle.xsl",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4112.tmp\\TabList.glox",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4221.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4191.tmp\\APASixthEditionOfficeOnline.xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4201.tmp\\iso690nmerical.xsl",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4113.tmp\\rings.glox",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4112.tmp\\Content.inf",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41C1.tmp\\chicago.xsl",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4113.tmp\\Content.inf",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E1.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40A2.tmp\\Content.inf",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E1.tmp\\Content.inf",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD433C.tmp\\content.inf",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD433C.tmp\\Wood_Type.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4201.tmp\\Content.inf",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4437.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41C1.tmp\\Content.inf",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4191.tmp\\Content.inf",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4495.tmp",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4496.tmp",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4497.tmp",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46CB.tmp\\content.inf",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472B.tmp\\Insight design set.dotx",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472A.tmp\\Circuit.thmx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46CB.tmp\\Vapor_Trail.thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD477A.tmp\\Content.inf",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472B.tmp\\Content.inf",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5834.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58E1.tmp\\content.inf",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58E1.tmp\\Main_Event.thmx",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  1134. ]
  1135.  
  1136. [*] Deleted Files: [
  1137. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab118F.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar11A0.tmp",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_9fbcfe645282669e8825a84680c2011c.asd",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  1145. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464[[fn=Dividend]].eftx",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921[[fn=Damask]].eftx",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464[[fn=Dividend]].xml",
  1150. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925[[fn=Droplet]].eftx",
  1151. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925[[fn=Droplet]].xml",
  1152. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464[[fn=Dividend]].xml",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921[[fn=Damask]].xml",
  1154. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925[[fn=Droplet]].xml",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921[[fn=Damask]].xml",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917[[fn=Berlin]].eftx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2311.tmp",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917[[fn=Berlin]].xml",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2312.tmp",
  1163. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917[[fn=Berlin]].xml",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CC.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CB.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CB.tmp\\Element design set.dotx",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24CC.tmp\\VaryingWidthList.glox",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251B.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab257D.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251C.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab256B.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2746.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DD2.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2284.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar257E.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar256C.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD27B6.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2805.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2806.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2756.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2757.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2805.tmp\\Crop.thmx",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2806.tmp\\RadialPictureList.glox",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD27B6.tmp\\PictureFrame.glox",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2745.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B47.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B58.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6A.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1EC3.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DC2.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B59.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2746.tmp\\BracketList.glox",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6B.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C18.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C19.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C29.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7F.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B59.tmp\\Basis.thmx",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6B.tmp\\gostname.xsl",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B6A.tmp\\ThemePictureAlternatingAccent.glox",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D82.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B47.tmp\\iso690.xsl",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2353.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C18.tmp\\Headlines.thmx",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E44.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DE3.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3112.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7D.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\cab25EC.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B58.tmp\\Metropolitan.thmx",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2D83.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3101.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2D84.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29AD.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3111.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C19.tmp\\gb.xsl",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E32.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C29.tmp\\Badge.thmx",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D82.tmp\\Frame.thmx",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3112.tmp\\turabian.xsl",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29CE.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3378.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2333.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab325B.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B18.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar326C.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3378.tmp\\View.thmx",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A3.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3405.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\cab29BE.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3406.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab34F3.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3503.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A3.tmp\\Banded.thmx",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3552.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E50.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3552.tmp\\Quotable.thmx",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3338.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3796.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3797.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37D7.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37D7.tmp\\Slate.thmx",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36F9.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab397F.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3980.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39CF.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39CF.tmp\\Feathered.thmx",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3855.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE4.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE4.tmp\\Mesh.thmx",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B28.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D1E.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2E.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2F.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D51.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D83.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D71.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D50.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D82.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DB3.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D72.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D1E.tmp\\harvardanglia2008officeonline.xsl",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab202D.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D50.tmp\\ConvergingText.glox",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D9F.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D51.tmp\\pictureorgchart.glox",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D82.tmp\\ieee2006officeonline.xsl",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20FA.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CFD.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2E.tmp\\InterconnectedBlockProcess.glox",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40A2.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D2F.tmp\\ThemePictureGrid.glox",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2189.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D71.tmp\\CircleProcess.glox",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20CA.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D83.tmp\\sist02.xsl",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D72.tmp\\mlaseventheditionofficeonline.xsl",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DB3.tmp\\Equations.dotx",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7B.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4113.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4112.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4191.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E33.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2159.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41C1.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E1.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F61.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4201.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD433C.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4112.tmp\\TabList.glox",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4113.tmp\\rings.glox",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7E.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F41.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4201.tmp\\iso690nmerical.xsl",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DA0.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E1.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E93.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD433C.tmp\\Wood_Type.thmx",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40A2.tmp\\gosttitle.xsl",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4191.tmp\\APASixthEditionOfficeOnline.xsl",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41C1.tmp\\chicago.xsl",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\cab40B3.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4496.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46CB.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472A.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4497.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472B.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DB1.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D7C.tmp",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CEC.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD477A.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472A.tmp\\Circuit.thmx",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD472B.tmp\\Insight design set.dotx",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46CB.tmp\\Vapor_Trail.thmx",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD477A.tmp\\chevronaccent.glox",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4495.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4437.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CDC.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4221.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58E1.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58E1.tmp\\Main_Event.thmx",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5834.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{674858EC-2F57-4FD9-8F76-1CB660C4509A}.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_9fbcfe645282669e8825a84680c2011c.doc"
  1326. ]
  1327.  
  1328. [*] Modified Registry Keys: [
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\/|4",
  1330. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2E\\52C64B7E\\LanguageList",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2324F22",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2324F22\\2324F22",
  1350. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1351. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2324F22\\2414051",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1654. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1955. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1965. ]
  1966.  
  1967. [*] Deleted Registry Keys: [
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\/|4",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\*?3",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2324F22\\2414051",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2324F22\\2324F22",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1987. ]
  1988.  
  1989. [*] DNS Communications: [
  1990. {
  1991. "type": "A",
  1992. "request": "yogh.eu",
  1993. "answers": [
  1994. {
  1995. "data": "164.132.62.98",
  1996. "type": "A"
  1997. }
  1998. ]
  1999. }
  2000. ]
  2001.  
  2002. [*] Domains: [
  2003. {
  2004. "ip": "164.132.62.98",
  2005. "domain": "yogh.eu"
  2006. }
  2007. ]
  2008.  
  2009. [*] Network Communication - ICMP: []
  2010.  
  2011. [*] Network Communication - HTTP: [
  2012. {
  2013. "count": 1,
  2014. "body": "",
  2015. "uri": "http://yogh.eu/richmore/richmore.exe",
  2016. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2017. "method": "GET",
  2018. "host": "yogh.eu",
  2019. "version": "1.1",
  2020. "path": "/richmore/richmore.exe",
  2021. "data": "GET /richmore/richmore.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: yogh.eu\r\nConnection: Keep-Alive\r\n\r\n",
  2022. "port": 80
  2023. },
  2024. {
  2025. "count": 1,
  2026. "body": "",
  2027. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2028. "user-agent": "Microsoft-CryptoAPI/6.1",
  2029. "method": "GET",
  2030. "host": "ocsp.digicert.com",
  2031. "version": "1.1",
  2032. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2033. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2034. "port": 80
  2035. },
  2036. {
  2037. "count": 1,
  2038. "body": "",
  2039. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2040. "user-agent": "Microsoft-CryptoAPI/6.1",
  2041. "method": "GET",
  2042. "host": "ocsp.msocsp.com",
  2043. "version": "1.1",
  2044. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2045. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2046. "port": 80
  2047. },
  2048. {
  2049. "count": 11,
  2050. "body": "",
  2051. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2052. "user-agent": "Microsoft-CryptoAPI/6.1",
  2053. "method": "GET",
  2054. "host": "crl.microsoft.com",
  2055. "version": "1.1",
  2056. "path": "/pki/crl/products/microsoftrootcert.crl",
  2057. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2058. "port": 80
  2059. },
  2060. {
  2061. "count": 9,
  2062. "body": "",
  2063. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2064. "user-agent": "Microsoft-CryptoAPI/6.1",
  2065. "method": "GET",
  2066. "host": "crl.microsoft.com",
  2067. "version": "1.1",
  2068. "path": "/pki/crl/products/microsoftrootcert.crl",
  2069. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2070. "port": 80
  2071. },
  2072. {
  2073. "count": 1,
  2074. "body": "",
  2075. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2076. "user-agent": "Microsoft-CryptoAPI/6.1",
  2077. "method": "GET",
  2078. "host": "crl.microsoft.com",
  2079. "version": "1.1",
  2080. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2081. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2082. "port": 80
  2083. },
  2084. {
  2085. "count": 2,
  2086. "body": "",
  2087. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2088. "user-agent": "Microsoft-CryptoAPI/6.1",
  2089. "method": "GET",
  2090. "host": "crl.microsoft.com",
  2091. "version": "1.1",
  2092. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2093. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2094. "port": 80
  2095. },
  2096. {
  2097. "count": 2,
  2098. "body": "",
  2099. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2100. "user-agent": "Microsoft-CryptoAPI/6.1",
  2101. "method": "GET",
  2102. "host": "crl.microsoft.com",
  2103. "version": "1.1",
  2104. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2105. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2106. "port": 80
  2107. },
  2108. {
  2109. "count": 1,
  2110. "body": "",
  2111. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2112. "user-agent": "Microsoft-CryptoAPI/6.1",
  2113. "method": "GET",
  2114. "host": "ocsp.digicert.com",
  2115. "version": "1.1",
  2116. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2117. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2118. "port": 80
  2119. },
  2120. {
  2121. "count": 1,
  2122. "body": "",
  2123. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2124. "user-agent": "Microsoft-CryptoAPI/6.1",
  2125. "method": "GET",
  2126. "host": "ocsp.digicert.com",
  2127. "version": "1.1",
  2128. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2129. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2130. "port": 80
  2131. },
  2132. {
  2133. "count": 1,
  2134. "body": "",
  2135. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2136. "user-agent": "Microsoft-CryptoAPI/6.1",
  2137. "method": "GET",
  2138. "host": "ocsp.digicert.com",
  2139. "version": "1.1",
  2140. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2141. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2142. "port": 80
  2143. },
  2144. {
  2145. "count": 2,
  2146. "body": "",
  2147. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  2148. "user-agent": "Microsoft-CryptoAPI/6.1",
  2149. "method": "GET",
  2150. "host": "ocsp.pki.goog",
  2151. "version": "1.1",
  2152. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  2153. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2154. "port": 80
  2155. },
  2156. {
  2157. "count": 1,
  2158. "body": "",
  2159. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  2160. "user-agent": "Microsoft-CryptoAPI/6.1",
  2161. "method": "GET",
  2162. "host": "ocsp.comodoca.com",
  2163. "version": "1.1",
  2164. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  2165. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  2166. "port": 80
  2167. },
  2168. {
  2169. "count": 1,
  2170. "body": "",
  2171. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  2172. "user-agent": "Microsoft-CryptoAPI/6.1",
  2173. "method": "GET",
  2174. "host": "ocsp.pki.goog",
  2175. "version": "1.1",
  2176. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  2177. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2178. "port": 80
  2179. },
  2180. {
  2181. "count": 1,
  2182. "body": "",
  2183. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  2184. "user-agent": "Microsoft-CryptoAPI/6.1",
  2185. "method": "GET",
  2186. "host": "ocsp.digicert.com",
  2187. "version": "1.1",
  2188. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  2189. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2190. "port": 80
  2191. },
  2192. {
  2193. "count": 1,
  2194. "body": "",
  2195. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  2196. "user-agent": "Microsoft-CryptoAPI/6.1",
  2197. "method": "GET",
  2198. "host": "www.download.windowsupdate.com",
  2199. "version": "1.1",
  2200. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  2201. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  2202. "port": 80
  2203. },
  2204. {
  2205. "count": 1,
  2206. "body": "",
  2207. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  2208. "user-agent": "Microsoft-CryptoAPI/6.1",
  2209. "method": "GET",
  2210. "host": "ocsp.digicert.com",
  2211. "version": "1.1",
  2212. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  2213. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2214. "port": 80
  2215. },
  2216. {
  2217. "count": 1,
  2218. "body": "",
  2219. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  2220. "user-agent": "Microsoft-CryptoAPI/6.1",
  2221. "method": "GET",
  2222. "host": "ocsp.digicert.com",
  2223. "version": "1.1",
  2224. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  2225. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2226. "port": 80
  2227. },
  2228. {
  2229. "count": 1,
  2230. "body": "",
  2231. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  2232. "user-agent": "Microsoft-CryptoAPI/6.1",
  2233. "method": "GET",
  2234. "host": "ocsp.digicert.com",
  2235. "version": "1.1",
  2236. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  2237. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2238. "port": 80
  2239. },
  2240. {
  2241. "count": 1,
  2242. "body": "",
  2243. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  2244. "user-agent": "Microsoft-CryptoAPI/6.1",
  2245. "method": "GET",
  2246. "host": "ocsp.pki.goog",
  2247. "version": "1.1",
  2248. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  2249. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2250. "port": 80
  2251. },
  2252. {
  2253. "count": 1,
  2254. "body": "",
  2255. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  2256. "user-agent": "Microsoft-CryptoAPI/6.1",
  2257. "method": "GET",
  2258. "host": "ocsp.pki.goog",
  2259. "version": "1.1",
  2260. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  2261. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2262. "port": 80
  2263. },
  2264. {
  2265. "count": 1,
  2266. "body": "",
  2267. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  2268. "user-agent": "Microsoft-CryptoAPI/6.1",
  2269. "method": "GET",
  2270. "host": "ocsp.digicert.com",
  2271. "version": "1.1",
  2272. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  2273. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2274. "port": 80
  2275. },
  2276. {
  2277. "count": 1,
  2278. "body": "",
  2279. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2280. "user-agent": "Microsoft-CryptoAPI/6.1",
  2281. "method": "GET",
  2282. "host": "ocsp.pki.goog",
  2283. "version": "1.1",
  2284. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2285. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2286. "port": 80
  2287. },
  2288. {
  2289. "count": 1,
  2290. "body": "",
  2291. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  2292. "user-agent": "Microsoft-CryptoAPI/6.1",
  2293. "method": "GET",
  2294. "host": "ocsp.thawte.com",
  2295. "version": "1.1",
  2296. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  2297. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  2298. "port": 80
  2299. },
  2300. {
  2301. "count": 1,
  2302. "body": "",
  2303. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2304. "user-agent": "Microsoft-CryptoAPI/6.1",
  2305. "method": "GET",
  2306. "host": "ocsp.usertrust.com",
  2307. "version": "1.1",
  2308. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2309. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  2310. "port": 80
  2311. },
  2312. {
  2313. "count": 1,
  2314. "body": "",
  2315. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  2316. "user-agent": "Microsoft-CryptoAPI/6.1",
  2317. "method": "GET",
  2318. "host": "th.symcd.com",
  2319. "version": "1.1",
  2320. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  2321. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  2322. "port": 80
  2323. },
  2324. {
  2325. "count": 1,
  2326. "body": "",
  2327. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  2328. "user-agent": "Microsoft-CryptoAPI/6.1",
  2329. "method": "GET",
  2330. "host": "ocsp.digicert.com",
  2331. "version": "1.1",
  2332. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  2333. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2334. "port": 80
  2335. },
  2336. {
  2337. "count": 1,
  2338. "body": "",
  2339. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2340. "user-agent": "Microsoft-CryptoAPI/6.1",
  2341. "method": "GET",
  2342. "host": "ocsp.digicert.com",
  2343. "version": "1.1",
  2344. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2345. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2346. "port": 80
  2347. },
  2348. {
  2349. "count": 1,
  2350. "body": "",
  2351. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2352. "user-agent": "Microsoft-CryptoAPI/6.1",
  2353. "method": "GET",
  2354. "host": "ocsp.pki.goog",
  2355. "version": "1.1",
  2356. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2357. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2358. "port": 80
  2359. },
  2360. {
  2361. "count": 1,
  2362. "body": "",
  2363. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  2364. "user-agent": "Microsoft BITS/7.5",
  2365. "method": "HEAD",
  2366. "host": "redirector.gvt1.com",
  2367. "version": "1.1",
  2368. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  2369. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  2370. "port": 80
  2371. },
  2372. {
  2373. "count": 1,
  2374. "body": "",
  2375. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2376. "user-agent": "Microsoft BITS/7.5",
  2377. "method": "HEAD",
  2378. "host": "r4---sn-tt1eln7l.gvt1.com",
  2379. "version": "1.1",
  2380. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2381. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2382. "port": 80
  2383. },
  2384. {
  2385. "count": 1,
  2386. "body": "",
  2387. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2388. "user-agent": "Microsoft BITS/7.5",
  2389. "method": "GET",
  2390. "host": "r4---sn-tt1eln7l.gvt1.com",
  2391. "version": "1.1",
  2392. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2393. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-7061\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2394. "port": 80
  2395. },
  2396. {
  2397. "count": 1,
  2398. "body": "",
  2399. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2400. "user-agent": "Microsoft BITS/7.5",
  2401. "method": "GET",
  2402. "host": "r4---sn-tt1eln7l.gvt1.com",
  2403. "version": "1.1",
  2404. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2405. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7062-17491\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2406. "port": 80
  2407. },
  2408. {
  2409. "count": 1,
  2410. "body": "",
  2411. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2412. "user-agent": "Microsoft BITS/7.5",
  2413. "method": "GET",
  2414. "host": "r4---sn-tt1eln7l.gvt1.com",
  2415. "version": "1.1",
  2416. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2417. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=17492-31851\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2418. "port": 80
  2419. },
  2420. {
  2421. "count": 1,
  2422. "body": "",
  2423. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2424. "user-agent": "Microsoft BITS/7.5",
  2425. "method": "GET",
  2426. "host": "r4---sn-tt1eln7l.gvt1.com",
  2427. "version": "1.1",
  2428. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2429. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=31852-42347\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2430. "port": 80
  2431. },
  2432. {
  2433. "count": 1,
  2434. "body": "",
  2435. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2436. "user-agent": "Microsoft BITS/7.5",
  2437. "method": "GET",
  2438. "host": "r4---sn-tt1eln7l.gvt1.com",
  2439. "version": "1.1",
  2440. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2441. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=42348-64856\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2442. "port": 80
  2443. },
  2444. {
  2445. "count": 1,
  2446. "body": "",
  2447. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2448. "user-agent": "Microsoft BITS/7.5",
  2449. "method": "GET",
  2450. "host": "r4---sn-tt1eln7l.gvt1.com",
  2451. "version": "1.1",
  2452. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2453. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=64857-111782\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2454. "port": 80
  2455. },
  2456. {
  2457. "count": 1,
  2458. "body": "",
  2459. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2460. "user-agent": "Microsoft BITS/7.5",
  2461. "method": "GET",
  2462. "host": "r4---sn-tt1eln7l.gvt1.com",
  2463. "version": "1.1",
  2464. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2465. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=111783-205489\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2466. "port": 80
  2467. },
  2468. {
  2469. "count": 1,
  2470. "body": "",
  2471. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2472. "user-agent": "Microsoft BITS/7.5",
  2473. "method": "GET",
  2474. "host": "r4---sn-tt1eln7l.gvt1.com",
  2475. "version": "1.1",
  2476. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2477. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=205490-353661\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2478. "port": 80
  2479. },
  2480. {
  2481. "count": 1,
  2482. "body": "",
  2483. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2484. "user-agent": "Microsoft BITS/7.5",
  2485. "method": "GET",
  2486. "host": "r4---sn-tt1eln7l.gvt1.com",
  2487. "version": "1.1",
  2488. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2489. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=353662-476473\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2490. "port": 80
  2491. },
  2492. {
  2493. "count": 1,
  2494. "body": "",
  2495. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2496. "user-agent": "Microsoft BITS/7.5",
  2497. "method": "GET",
  2498. "host": "r4---sn-tt1eln7l.gvt1.com",
  2499. "version": "1.1",
  2500. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2501. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=476474-619192\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2502. "port": 80
  2503. },
  2504. {
  2505. "count": 1,
  2506. "body": "",
  2507. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2508. "user-agent": "Microsoft BITS/7.5",
  2509. "method": "GET",
  2510. "host": "r4---sn-tt1eln7l.gvt1.com",
  2511. "version": "1.1",
  2512. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2513. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=619193-857929\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2514. "port": 80
  2515. },
  2516. {
  2517. "count": 1,
  2518. "body": "",
  2519. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2520. "user-agent": "Microsoft BITS/7.5",
  2521. "method": "GET",
  2522. "host": "r4---sn-tt1eln7l.gvt1.com",
  2523. "version": "1.1",
  2524. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2525. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=857930-1044826\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2526. "port": 80
  2527. },
  2528. {
  2529. "count": 1,
  2530. "body": "",
  2531. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2532. "user-agent": "Microsoft BITS/7.5",
  2533. "method": "GET",
  2534. "host": "r4---sn-tt1eln7l.gvt1.com",
  2535. "version": "1.1",
  2536. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2537. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1044827-1238935\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2538. "port": 80
  2539. },
  2540. {
  2541. "count": 1,
  2542. "body": "",
  2543. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2544. "user-agent": "Microsoft BITS/7.5",
  2545. "method": "GET",
  2546. "host": "r4---sn-tt1eln7l.gvt1.com",
  2547. "version": "1.1",
  2548. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2549. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1238936-1537888\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2550. "port": 80
  2551. },
  2552. {
  2553. "count": 1,
  2554. "body": "",
  2555. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2556. "user-agent": "Microsoft BITS/7.5",
  2557. "method": "GET",
  2558. "host": "r4---sn-tt1eln7l.gvt1.com",
  2559. "version": "1.1",
  2560. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2561. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1537889-1870227\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2562. "port": 80
  2563. },
  2564. {
  2565. "count": 1,
  2566. "body": "",
  2567. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2568. "user-agent": "Microsoft BITS/7.5",
  2569. "method": "GET",
  2570. "host": "r4---sn-tt1eln7l.gvt1.com",
  2571. "version": "1.1",
  2572. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2573. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1870228-2105293\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2574. "port": 80
  2575. },
  2576. {
  2577. "count": 1,
  2578. "body": "",
  2579. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2580. "user-agent": "Microsoft BITS/7.5",
  2581. "method": "GET",
  2582. "host": "r4---sn-tt1eln7l.gvt1.com",
  2583. "version": "1.1",
  2584. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2585. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2105294-2350867\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2586. "port": 80
  2587. },
  2588. {
  2589. "count": 1,
  2590. "body": "",
  2591. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2592. "user-agent": "Microsoft BITS/7.5",
  2593. "method": "GET",
  2594. "host": "r4---sn-tt1eln7l.gvt1.com",
  2595. "version": "1.1",
  2596. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2597. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2350868-2727702\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2598. "port": 80
  2599. },
  2600. {
  2601. "count": 1,
  2602. "body": "",
  2603. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2604. "user-agent": "Microsoft BITS/7.5",
  2605. "method": "GET",
  2606. "host": "r4---sn-tt1eln7l.gvt1.com",
  2607. "version": "1.1",
  2608. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2609. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2727703-3111697\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2610. "port": 80
  2611. },
  2612. {
  2613. "count": 1,
  2614. "body": "",
  2615. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2616. "user-agent": "Microsoft BITS/7.5",
  2617. "method": "GET",
  2618. "host": "r4---sn-tt1eln7l.gvt1.com",
  2619. "version": "1.1",
  2620. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2621. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3111698-3527917\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2622. "port": 80
  2623. },
  2624. {
  2625. "count": 1,
  2626. "body": "",
  2627. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2628. "user-agent": "Microsoft BITS/7.5",
  2629. "method": "GET",
  2630. "host": "r4---sn-tt1eln7l.gvt1.com",
  2631. "version": "1.1",
  2632. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2633. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3527918-3821204\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2634. "port": 80
  2635. },
  2636. {
  2637. "count": 1,
  2638. "body": "",
  2639. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2640. "user-agent": "Microsoft BITS/7.5",
  2641. "method": "GET",
  2642. "host": "r4---sn-tt1eln7l.gvt1.com",
  2643. "version": "1.1",
  2644. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2645. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3821205-4124744\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2646. "port": 80
  2647. },
  2648. {
  2649. "count": 1,
  2650. "body": "",
  2651. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2652. "user-agent": "Microsoft BITS/7.5",
  2653. "method": "GET",
  2654. "host": "r4---sn-tt1eln7l.gvt1.com",
  2655. "version": "1.1",
  2656. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2657. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4124745-4602338\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2658. "port": 80
  2659. },
  2660. {
  2661. "count": 1,
  2662. "body": "",
  2663. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2664. "user-agent": "Microsoft BITS/7.5",
  2665. "method": "GET",
  2666. "host": "r4---sn-tt1eln7l.gvt1.com",
  2667. "version": "1.1",
  2668. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2669. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4602339-5038810\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2670. "port": 80
  2671. },
  2672. {
  2673. "count": 1,
  2674. "body": "",
  2675. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2676. "user-agent": "Microsoft BITS/7.5",
  2677. "method": "GET",
  2678. "host": "r4---sn-tt1eln7l.gvt1.com",
  2679. "version": "1.1",
  2680. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2681. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5038811-5356967\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2682. "port": 80
  2683. },
  2684. {
  2685. "count": 1,
  2686. "body": "",
  2687. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2688. "user-agent": "Microsoft BITS/7.5",
  2689. "method": "GET",
  2690. "host": "r4---sn-tt1eln7l.gvt1.com",
  2691. "version": "1.1",
  2692. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2693. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5356968-5691320\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2694. "port": 80
  2695. },
  2696. {
  2697. "count": 1,
  2698. "body": "",
  2699. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2700. "user-agent": "Microsoft BITS/7.5",
  2701. "method": "GET",
  2702. "host": "r4---sn-tt1eln7l.gvt1.com",
  2703. "version": "1.1",
  2704. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2705. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5691321-6205812\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2706. "port": 80
  2707. },
  2708. {
  2709. "count": 1,
  2710. "body": "",
  2711. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2712. "user-agent": "Microsoft BITS/7.5",
  2713. "method": "GET",
  2714. "host": "r4---sn-tt1eln7l.gvt1.com",
  2715. "version": "1.1",
  2716. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2717. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6205813-6697220\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2718. "port": 80
  2719. },
  2720. {
  2721. "count": 1,
  2722. "body": "",
  2723. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2724. "user-agent": "Microsoft BITS/7.5",
  2725. "method": "GET",
  2726. "host": "r4---sn-tt1eln7l.gvt1.com",
  2727. "version": "1.1",
  2728. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2729. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6697221-7276150\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2730. "port": 80
  2731. },
  2732. {
  2733. "count": 1,
  2734. "body": "",
  2735. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2736. "user-agent": "Microsoft BITS/7.5",
  2737. "method": "GET",
  2738. "host": "r4---sn-tt1eln7l.gvt1.com",
  2739. "version": "1.1",
  2740. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2741. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7276151-7889890\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2742. "port": 80
  2743. },
  2744. {
  2745. "count": 1,
  2746. "body": "",
  2747. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2748. "user-agent": "Microsoft BITS/7.5",
  2749. "method": "GET",
  2750. "host": "r4---sn-tt1eln7l.gvt1.com",
  2751. "version": "1.1",
  2752. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2753. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7889891-8536800\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2754. "port": 80
  2755. },
  2756. {
  2757. "count": 1,
  2758. "body": "",
  2759. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2760. "user-agent": "Microsoft BITS/7.5",
  2761. "method": "GET",
  2762. "host": "r4---sn-tt1eln7l.gvt1.com",
  2763. "version": "1.1",
  2764. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2765. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=8536801-9237738\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2766. "port": 80
  2767. },
  2768. {
  2769. "count": 1,
  2770. "body": "",
  2771. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2772. "user-agent": "Microsoft BITS/7.5",
  2773. "method": "GET",
  2774. "host": "r4---sn-tt1eln7l.gvt1.com",
  2775. "version": "1.1",
  2776. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2777. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=9237739-9775642\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2778. "port": 80
  2779. },
  2780. {
  2781. "count": 1,
  2782. "body": "",
  2783. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2784. "user-agent": "Microsoft BITS/7.5",
  2785. "method": "GET",
  2786. "host": "r4---sn-tt1eln7l.gvt1.com",
  2787. "version": "1.1",
  2788. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2789. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=9775643-10699177\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2790. "port": 80
  2791. },
  2792. {
  2793. "count": 1,
  2794. "body": "",
  2795. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2796. "user-agent": "Microsoft BITS/7.5",
  2797. "method": "GET",
  2798. "host": "r4---sn-tt1eln7l.gvt1.com",
  2799. "version": "1.1",
  2800. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2801. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=10699178-11385566\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2802. "port": 80
  2803. },
  2804. {
  2805. "count": 1,
  2806. "body": "",
  2807. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2808. "user-agent": "Microsoft BITS/7.5",
  2809. "method": "GET",
  2810. "host": "r4---sn-tt1eln7l.gvt1.com",
  2811. "version": "1.1",
  2812. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2813. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=11385567-12162562\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2814. "port": 80
  2815. },
  2816. {
  2817. "count": 1,
  2818. "body": "",
  2819. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2820. "user-agent": "Microsoft BITS/7.5",
  2821. "method": "GET",
  2822. "host": "r4---sn-tt1eln7l.gvt1.com",
  2823. "version": "1.1",
  2824. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes",
  2825. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560923619&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=12162563-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  2826. "port": 80
  2827. }
  2828. ]
  2829.  
  2830. [*] Network Communication - SMTP: []
  2831.  
  2832. [*] Network Communication - Hosts: []
  2833.  
  2834. [*] Network Communication - IRC: []
  2835.  
  2836. [*] Static Analysis: {}
  2837.  
  2838. [*] Resolved APIs: [
  2839. "mso.dll.#1443",
  2840. "mso.dll.#9214",
  2841. "mso.dll.#199",
  2842. "mso.dll.#1073",
  2843. "mso.dll.#4255",
  2844. "mso.dll.#3459",
  2845. "mso.dll.#1262",
  2846. "mso.dll.#5709",
  2847. "mso.dll.#7353",
  2848. "mso.dll.#5228",
  2849. "mso.dll.#2155",
  2850. "mso.dll.#7762",
  2851. "mso.dll.#1725",
  2852. "user32.dll.RegisterWindowMessageW",
  2853. "secur32.dll.FreeContextBuffer",
  2854. "ncrypt.dll.SslOpenProvider",
  2855. "ncrypt.dll.GetSChannelInterface",
  2856. "bcryptprimitives.dll.GetHashInterface",
  2857. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2858. "ncrypt.dll.SslImportKey",
  2859. "bcryptprimitives.dll.GetCipherInterface",
  2860. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2861. "user32.dll.LoadStringW",
  2862. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2863. "ncrypt.dll.BCryptGetProperty",
  2864. "ncrypt.dll.BCryptCreateHash",
  2865. "ncrypt.dll.BCryptHashData",
  2866. "ncrypt.dll.BCryptFinishHash",
  2867. "ncrypt.dll.BCryptDestroyHash",
  2868. "crypt32.dll.CertGetCertificateChain",
  2869. "userenv.dll.GetUserProfileDirectoryW",
  2870. "sechost.dll.ConvertSidToStringSidW",
  2871. "sechost.dll.ConvertStringSidToSidW",
  2872. "userenv.dll.RegisterGPNotification",
  2873. "gpapi.dll.RegisterGPNotificationInternal",
  2874. "sechost.dll.OpenSCManagerW",
  2875. "sechost.dll.OpenServiceW",
  2876. "sechost.dll.CloseServiceHandle",
  2877. "sechost.dll.QueryServiceConfigW",
  2878. "cryptsp.dll.CryptAcquireContextA",
  2879. "cryptsp.dll.CryptCreateHash",
  2880. "cryptsp.dll.CryptHashData",
  2881. "cryptsp.dll.CryptVerifySignatureA",
  2882. "cryptsp.dll.CryptDestroyKey",
  2883. "cryptsp.dll.CryptDestroyHash",
  2884. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2885. "ncrypt.dll.BCryptImportKeyPair",
  2886. "ncrypt.dll.BCryptVerifySignature",
  2887. "ncrypt.dll.BCryptDestroyKey",
  2888. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2889. "crypt32.dll.CertFreeCertificateChain",
  2890. "crypt32.dll.CertDuplicateCertificateContext",
  2891. "ncrypt.dll.SslEncryptPacket",
  2892. "mso.dll.#4314",
  2893. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2894. "mso.dll.#6484",
  2895. "mso.dll.#8499",
  2896. "mso.dll.#9871",
  2897. "mso.dll.#4743",
  2898. "mso.dll.#5452",
  2899. "mso.dll.#2088",
  2900. "mso.dll.#5274",
  2901. "mso.dll.#3195",
  2902. "mso.dll.#8165",
  2903. "mso.dll.#9175",
  2904. "mso.dll.#5315",
  2905. "mso.dll.#8140",
  2906. "user32.dll.IsWindowEnabled",
  2907. "ole32.dll.CoGetCallState",
  2908. "ole32.dll.CoGetActivationState",
  2909. "advapi32.dll.RegisterWaitChainCOMCallback",
  2910. "ncrypt.dll.SslDecryptPacket",
  2911. "winhttp.dll.WinHttpReceiveResponse",
  2912. "winhttp.dll.WinHttpQueryHeaders",
  2913. "winhttp.dll.WinHttpQueryDataAvailable",
  2914. "winhttp.dll.WinHttpReadData",
  2915. "webservices.dll.WsCreateError",
  2916. "ntdll.dll.EtwEventWrite",
  2917. "ntdll.dll.EtwEventRegister",
  2918. "ntdll.dll.EtwEventUnregister",
  2919. "webservices.dll.WsCreateHeap",
  2920. "webservices.dll.WsCreateReader",
  2921. "webservices.dll.WsSetInput",
  2922. "webservices.dll.WsFillReader",
  2923. "webservices.dll.WsReadToStartElement",
  2924. "webservices.dll.WsReadStartElement",
  2925. "webservices.dll.WsReadType",
  2926. "winhttp.dll.WinHttpCloseHandle",
  2927. "crypt32.dll.CertFreeCertificateContext",
  2928. "rpcrt4.dll.RpcBindingFree",
  2929. "webservices.dll.WsFreeReader",
  2930. "webservices.dll.WsFreeError",
  2931. "webservices.dll.WsFreeHeap",
  2932. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2933. "winhttp.dll.WinHttpOpenRequest",
  2934. "winhttp.dll.WinHttpAddRequestHeaders",
  2935. "winhttp.dll.WinHttpSendRequest",
  2936. "winhttp.dll.WinHttpConnect",
  2937. "winhttp.dll.WinHttpCrackUrl",
  2938. "winhttp.dll.WinHttpSetStatusCallback",
  2939. "winhttp.dll.WinHttpOpen",
  2940. "winhttp.dll.WinHttpSetOption",
  2941. "winhttp.dll.WinHttpWriteData",
  2942. "winhttp.dll.WinHttpSetCredentials",
  2943. "winhttp.dll.WinHttpQueryAuthSchemes",
  2944. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2945. "winhttp.dll.WinHttpGetProxyForUrl",
  2946. "winhttp.dll.WinHttpQueryOption",
  2947. "webservices.dll.WsOpenServiceProxy",
  2948. "webservices.dll.WsCall",
  2949. "webservices.dll.WsAddCustomHeader",
  2950. "shlwapi.dll.StrStrA",
  2951. "shlwapi.dll.UrlUnescapeA",
  2952. "cryptnet.dll.CertDllVerifyRevocation",
  2953. "profapi.dll.#104",
  2954. "sensapi.dll.IsNetworkAlive",
  2955. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2956. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2957. "rpcrt4.dll.NdrClientCall2",
  2958. "mso.dll.#25",
  2959. "mso.dll.#1056",
  2960. "mso.dll.#8136",
  2961. "mso.dll.#8931",
  2962. "shell32.dll.SHGetFileInfoW",
  2963. "winhttp.dll.WinHttpSetTimeouts",
  2964. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2965. "mso.dll.#5362",
  2966. "mso.dll.#6044",
  2967. "mso.dll.#6516",
  2968. "mso.dll.#6221",
  2969. "mso.dll.#5780",
  2970. "mso.dll.#4870",
  2971. "mso.dll.#6046",
  2972. "winhttp.dll.WinHttpTimeFromSystemTime",
  2973. "mso.dll.#1241",
  2974. "mso.dll.#2821",
  2975. "mso.dll.#2340",
  2976. "mso.dll.#7287",
  2977. "mso.dll.#5290",
  2978. "mso.dll.#1508",
  2979. "user32.dll.IsZoomed",
  2980. "user32.dll.GetWindowPlacement",
  2981. "user32.dll.GetWindowRect",
  2982. "mso.dll.#821",
  2983. "user32.dll.GetSystemMetrics",
  2984. "user32.dll.MonitorFromWindow",
  2985. "user32.dll.MonitorFromRect",
  2986. "user32.dll.MonitorFromPoint",
  2987. "user32.dll.EnumDisplayMonitors",
  2988. "user32.dll.GetMonitorInfoA",
  2989. "user32.dll.EnumDisplayDevicesA",
  2990. "mso.dll.#2378",
  2991. "user32.dll.SetWindowPos",
  2992. "user32.dll.AdjustWindowRect",
  2993. "mso.dll.#5912",
  2994. "mso.dll.#9719",
  2995. "mso.dll.#8824",
  2996. "mso.dll.#6117",
  2997. "mso.dll.#3307",
  2998. "user32.dll.SendMessageW",
  2999. "user32.dll.DestroyIcon",
  3000. "mso.dll.#3813",
  3001. "mso.dll.#1815",
  3002. "user32.dll.PtInRect",
  3003. "mso.dll.#1613",
  3004. "user32.dll.SetWindowTextW",
  3005. "user32.dll.GetClassLongW",
  3006. "mso.dll.#8572",
  3007. "gdi32.dll.CreateDIBSection",
  3008. "gdi32.dll.CreateCompatibleDC",
  3009. "gdi32.dll.GetViewportOrgEx",
  3010. "gdi32.dll.SetViewportOrgEx",
  3011. "gdi32.dll.SetBkColor",
  3012. "gdi32.dll.ExtTextOutA",
  3013. "mso.dll.#1573",
  3014. "mso.dll.#8612",
  3015. "user32.dll.SetScrollRange",
  3016. "mso.dll.#2509",
  3017. "user32.dll.BeginDeferWindowPos",
  3018. "user32.dll.DeferWindowPos",
  3019. "gdi32.dll.DeleteDC",
  3020. "user32.dll.EndDeferWindowPos",
  3021. "user32.dll.OffsetRect",
  3022. "user32.dll.EnumChildWindows",
  3023. "user32.dll.GetScrollInfo",
  3024. "user32.dll.MapWindowPoints",
  3025. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  3026. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  3027. "mso.dll.#6126",
  3028. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  3029. "gdi32.dll.GetFontRealizationInfo",
  3030. "gdi32.dll.GetFontFileInfo",
  3031. "gdi32.dll.GetFontFileData",
  3032. "mso.dll.#7261",
  3033. "mso.dll.#9540",
  3034. "usp10.dll.ScriptGetFontScriptTags",
  3035. "user32.dll.IsHungAppWindow",
  3036. "usp10.dll.ScriptGetFontLanguageTags",
  3037. "usp10.dll.ScriptGetFontFeatureTags",
  3038. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  3039. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  3040. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  3041. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  3042. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  3043. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  3044. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  3045. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  3046. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  3047. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  3048. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  3049. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  3050. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  3051. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  3052. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  3053. "user32.dll.SetRectEmpty",
  3054. "user32.dll.InflateRect",
  3055. "mso.dll.#1100",
  3056. "mso.dll.#7047",
  3057. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  3058. "user32.dll.GetCursor",
  3059. "user32.dll.GetClientRect",
  3060. "user32.dll.SetScrollInfo",
  3061. "user32.dll.SetScrollPos",
  3062. "mso.dll.#3747",
  3063. "mso.dll.#8218",
  3064. "mso.dll.#5394",
  3065. "mso.dll.#331",
  3066. "mso.dll.#6829",
  3067. "mso.dll.#539",
  3068. "mso.dll.#4959",
  3069. "mso.dll.#6463",
  3070. "mso.dll.#4987",
  3071. "user32.dll.GetWindow",
  3072. "mso.dll.#7195",
  3073. "mso.dll.#7573",
  3074. "mso.dll.#445",
  3075. "user32.dll.GetCaretBlinkTime",
  3076. "user32.dll.CreateCaret",
  3077. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  3078. "user32.dll.IntersectRect",
  3079. "user32.dll.DestroyCaret",
  3080. "user32.dll.GetCaretPos",
  3081. "user32.dll.SetCaretPos",
  3082. "mso.dll.#5932",
  3083. "mso.dll.#2071",
  3084. "mso.dll.#1024",
  3085. "mso.dll.#6245",
  3086. "mso.dll.#9041",
  3087. "mso.dll.#1767",
  3088. "mso.dll.#9369",
  3089. "mso.dll.#4617",
  3090. "user32.dll.FillRect",
  3091. "mso.dll.#343",
  3092. "mso.dll.#9636",
  3093. "mso.dll.#2022",
  3094. "mso.dll.#4750",
  3095. "mso.dll.#4577",
  3096. "mso.dll.#850",
  3097. "mso.dll.#1776",
  3098. "shell32.dll.SHAddToRecentDocs",
  3099. "mso.dll.#9026",
  3100. "mso.dll.#4497",
  3101. "mso.dll.#4647",
  3102. "mso.dll.#8926",
  3103. "mso.dll.#7212",
  3104. "mso.dll.#5407",
  3105. "mso.dll.#5152",
  3106. "mso.dll.#3327",
  3107. "mso.dll.#6333",
  3108. "mso.dll.#420",
  3109. "mso.dll.#1335",
  3110. "mso.dll.#2041",
  3111. "mso.dll.#7834",
  3112. "mso.dll.#239",
  3113. "mso.dll.#6357",
  3114. "mso.dll.#7026",
  3115. "mso.dll.#1671",
  3116. "oleaut32.dll.#7",
  3117. "mso.dll.#8263",
  3118. "ole32.dll.PropVariantClear",
  3119. "oleaut32.dll.#9",
  3120. "mso.dll.#9307",
  3121. "mso.dll.#1441",
  3122. "mso.dll.#9223",
  3123. "mso.dll.#6453",
  3124. "mso.dll.#8044",
  3125. "mso.dll.#3698",
  3126. "mso.dll.#8565",
  3127. "mso.dll.#8373",
  3128. "mso.dll.#9741",
  3129. "mso.dll.#478",
  3130. "mso.dll.#479",
  3131. "mso.dll.#340",
  3132. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  3133. "bcrypt.dll.BCryptGetProperty",
  3134. "bcrypt.dll.BCryptCreateHash",
  3135. "bcrypt.dll.BCryptHashData",
  3136. "bcrypt.dll.BCryptFinishHash",
  3137. "bcrypt.dll.BCryptDestroyHash",
  3138. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  3139. "mso.dll.#8633",
  3140. "mso.dll.#5213",
  3141. "mso.dll.#6163",
  3142. "mso.dll.#552",
  3143. "mso.dll.#5630",
  3144. "mso.dll.#2513",
  3145. "mso.dll.#1607",
  3146. "mso.dll.#791",
  3147. "mso.dll.#1848",
  3148. "mso.dll.#8735",
  3149. "mso.dll.#9374",
  3150. "mso.dll.#5286",
  3151. "mso.dll.#6368",
  3152. "mso.dll.#4262",
  3153. "mso.dll.#1010",
  3154. "mso.dll.#7979",
  3155. "mso.dll.#8549",
  3156. "mso.dll.#8970",
  3157. "mso.dll.#9198",
  3158. "mso.dll.#4795",
  3159. "mso.dll.#1865",
  3160. "mso.dll.#9688",
  3161. "mso.dll.#320",
  3162. "advapi32.dll.RegDeleteKeyA",
  3163. "user32.dll.DestroyCursor",
  3164. "mso.dll.#7173",
  3165. "mso.dll.#8511",
  3166. "mso.dll.#3299",
  3167. "mso.dll.#7001",
  3168. "mso.dll.#3913",
  3169. "user32.dll.PeekMessageA",
  3170. "mso.dll.#1380",
  3171. "mso.dll.#9500",
  3172. "user32.dll.TranslateMessage",
  3173. "user32.dll.IsWindowUnicode",
  3174. "user32.dll.DispatchMessageA",
  3175. "user32.dll.DispatchMessageW",
  3176. "user32.dll.UpdateWindow",
  3177. "mso.dll.#999",
  3178. "mso.dll.#287",
  3179. "dwmapi.dll.DwmIsCompositionEnabled",
  3180. "mso.dll.#1575",
  3181. "mso.dll.#5034",
  3182. "mso.dll.#1517",
  3183. "mso.dll.#718",
  3184. "mso.dll.#4708",
  3185. "mso.dll.#8046",
  3186. "mso.dll.#4175",
  3187. "mso.dll.#8672",
  3188. "mso.dll.#1990",
  3189. "mso.dll.#3051",
  3190. "mso.dll.#1819",
  3191. "mso.dll.#1419",
  3192. "oleaut32.dll.#147",
  3193. "kernel32.dll.WerRegisterMemoryBlock",
  3194. "dwrite.dll.DWriteCreateFactory",
  3195. "advapi32.dll.RegQueryValueW",
  3196. "apphelp.dll.ApphelpCheckShellObject",
  3197. "gdi32.dll.GetCurrentObject",
  3198. "gdi32.dll.BitBlt",
  3199. "gdi32.dll.GetClipBox",
  3200. "gdi32.dll.StretchDIBits",
  3201. "riched20.dll.REExtendedRegisterClass",
  3202. "user32.dll.GetWindowLongW",
  3203. "user32.dll.GetSysColor",
  3204. "user32.dll.SetWindowLongW",
  3205. "user32.dll.RegisterWindowMessageA",
  3206. "user32.dll.RegisterClipboardFormatW",
  3207. "user32.dll.GetDoubleClickTime",
  3208. "user32.dll.SetCaretBlinkTime",
  3209. "user32.dll.SystemParametersInfoW",
  3210. "user32.dll.GetKeyboardLayoutList",
  3211. "mso.dll._MsoGetFidUspDll@0",
  3212. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  3213. "usp10.dll.ScriptGetProperties",
  3214. "usp10.dll.ScriptItemize",
  3215. "user32.dll.LoadCursorW",
  3216. "user32.dll.IsWindowVisible",
  3217. "user32.dll.GetKeyboardLayout",
  3218. "user32.dll.PostMessageW",
  3219. "user32.dll.DefWindowProcW",
  3220. "uxtheme.dll.IsThemeActive",
  3221. "uxtheme.dll.IsAppThemed",
  3222. "uxtheme.dll.OpenThemeData",
  3223. "user32.dll.GetDC",
  3224. "user32.dll.ReleaseDC",
  3225. "user32.dll.IsIconic",
  3226. "user32.dll.GetParent",
  3227. "usp10.dll.ScriptGetCMap",
  3228. "user32.dll.InvalidateRect",
  3229. "user32.dll.HideCaret",
  3230. "user32.dll.ShowCaret",
  3231. "user32.dll.NotifyWinEvent",
  3232. "user32.dll.GetWindowTextLengthW",
  3233. "user32.dll.EnableWindow",
  3234. "msctf.dll.SetInputScope",
  3235. "user32.dll.GetWindowRgn",
  3236. "gdi32.dll.CreateCompatibleBitmap",
  3237. "gdi32.dll.SaveDC",
  3238. "gdi32.dll.SetPixel",
  3239. "gdi32.dll.GetPixel",
  3240. "gdi32.dll.RestoreDC",
  3241. "imm32.dll.ImmAssociateContext",
  3242. "ole32.dll.CoRevokeInitializeSpy",
  3243. "comctl32.dll.#388",
  3244. "mso.dll.#806",
  3245. "mso.dll.#4908",
  3246. "user32.dll.SetRect",
  3247. "mso.dll.#8439",
  3248. "mso.dll.#2736",
  3249. "gdi32.dll.GetTextAlign",
  3250. "gdi32.dll.ExtTextOutW",
  3251. "mso.dll.#8122",
  3252. "mso.dll.#2114",
  3253. "shlwapi.dll.StrStrIW",
  3254. "mso.dll.#6558",
  3255. "gdi32.dll.GetFontData",
  3256. "usp10.dll.ScriptItemizeOpenType",
  3257. "usp10.dll.ScriptShapeOpenType",
  3258. "usp10.dll.ScriptPlaceOpenType",
  3259. "mso.dll.#8395",
  3260. "mso.dll.#379",
  3261. "mso.dll.#6338",
  3262. "mso.dll.#7964",
  3263. "mso.dll.#1437",
  3264. "mso.dll.#1427",
  3265. "mso.dll.#6137",
  3266. "winmm.dll.timeGetTime",
  3267. "mso.dll.#5940",
  3268. "usp10.dll.ScriptPlace",
  3269. "usp10.dll.ScriptShape",
  3270. "usp10.dll.ScriptJustify",
  3271. "usp10.dll.ScriptTextOut",
  3272. "usp10.dll.ScriptCPtoX",
  3273. "usp10.dll.ScriptXtoCP",
  3274. "usp10.dll.ScriptFreeCache",
  3275. "usp10.dll.ScriptCacheGetHeight",
  3276. "usp10.dll.ScriptLayout",
  3277. "usp10.dll.ScriptBreak",
  3278. "usp10.dll.ScriptIsComplex",
  3279. "usp10.dll.ScriptGetLogicalWidths",
  3280. "usp10.dll.ScriptApplyLogicalWidth",
  3281. "usp10.dll.ScriptGetGlyphABCWidth",
  3282. "usp10.dll.ScriptGetFontProperties",
  3283. "usp10.dll.ScriptApplyDigitSubstitution",
  3284. "usp10.dll.ScriptRecordDigitSubstitution",
  3285. "usp10.dll.ScriptGetFontAlternateGlyphs",
  3286. "mso.dll.#7578",
  3287. "mso.dll.#8483",
  3288. "mso.dll.#2613",
  3289. "gdi32.dll.GdiIsMetaPrintDC",
  3290. "mso.dll.#7848",
  3291. "user32.dll.GetForegroundWindow",
  3292. "user32.dll.GetFocus",
  3293. "user32.dll.GetClassNameA",
  3294. "user32.dll.IsWindowRedirectedForPrint",
  3295. "gdi32.dll.CreateRectRgnIndirect",
  3296. "user32.dll.GetUpdateRgn",
  3297. "gdi32.dll.GetRgnBox",
  3298. "user32.dll.ValidateRect",
  3299. "user32.dll.GetUpdateRect",
  3300. "user32.dll.BeginPaint",
  3301. "user32.dll.EndPaint",
  3302. "mso.dll.#3624",
  3303. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  3304. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  3305. "gdi32.dll.TranslateCharsetInfo",
  3306. "mso.dll.#3300",
  3307. "mso.dll.#7465",
  3308. "mso.dll.#6247",
  3309. "gdi32.dll.SetWindowOrgEx",
  3310. "mso.dll.#732",
  3311. "mso.dll.#5804",
  3312. "ole32.dll.CoCreateInstance",
  3313. "mso.dll.#434",
  3314. "user32.dll.GetMessageExtraInfo",
  3315. "user32.dll.TrackMouseEvent",
  3316. "mso.dll.#4746",
  3317. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  3318. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  3319. "user32.dll.IsWindow",
  3320. "user32.dll.GetInputState",
  3321. "mso.dll.#8461",
  3322. "user32.dll.GetClipboardOwner",
  3323. "user32.dll.SendNotifyMessageW",
  3324. "user32.dll.GetActiveWindow",
  3325. "user32.dll.GetAncestor",
  3326. "mso.dll.#3544",
  3327. "mso.dll.#900",
  3328. "mso.dll.#1422",
  3329. "user32.dll.MsgWaitForMultipleObjectsEx",
  3330. "advapi32.dll.NotifyServiceStatusChangeW",
  3331. "mso.dll.#9465",
  3332. "mso.dll.#8202",
  3333. "mso.dll.#5360",
  3334. "mso.dll.#8574",
  3335. "msi.dll.#39",
  3336. "mso.dll.#8318",
  3337. "mso.dll.#1283",
  3338. "mso.dll.#8705",
  3339. "mso.dll.#9685",
  3340. "mso.dll.#3579",
  3341. "mso.dll.#8747",
  3342. "mso.dll.#2880",
  3343. "mso.dll.#7615",
  3344. "mso.dll.#4219",
  3345. "mso.dll.#3244",
  3346. "mso.dll.#408",
  3347. "mso.dll.#2714",
  3348. "mso.dll.#8622",
  3349. "mso.dll.#3380",
  3350. "mso.dll.#2566",
  3351. "mso.dll.#1429",
  3352. "mso.dll.#6502",
  3353. "mso.dll.#2968",
  3354. "cryptnet.dll.I_CryptNetGetConnectivity",
  3355. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  3356. "setupapi.dll.SetupIterateCabinetW",
  3357. "kernel32.dll.RegOpenKeyExW",
  3358. "kernel32.dll.RegCloseKey",
  3359. "cabinet.dll.#20",
  3360. "cabinet.dll.#22",
  3361. "devrtl.dll.DevRtlGetThreadLogToken",
  3362. "advapi32.dll.RegDeleteTreeW",
  3363. "mso.dll.#709",
  3364. "mso.dll.#5913",
  3365. "mso.dll.#8051",
  3366. "xmllite.dll.CreateXmlReader",
  3367. "mso.dll.#6505",
  3368. "cryptsp.dll.CryptSetHashParam",
  3369. "user32.dll.GetWindowDC",
  3370. "gdi32.dll.SetLayout",
  3371. "gdi32.dll.RectVisible",
  3372. "gdi32.dll.GetClipRgn",
  3373. "gdi32.dll.ExcludeClipRect",
  3374. "gdi32.dll.SelectClipRgn",
  3375. "user32.dll.WindowFromPoint",
  3376. "mso.dll.#3901",
  3377. "user32.dll.IsClipboardFormatAvailable",
  3378. "user32.dll.GetCursorInfo",
  3379. "sechost.dll.QueryServiceConfigA",
  3380. "user32.dll.GetCapture",
  3381. "sechost.dll.QueryServiceStatus",
  3382. "user32.dll.GetMessagePos",
  3383. "user32.dll.ScreenToClient",
  3384. "rpcrt4.dll.RpcStringBindingComposeA",
  3385. "rpcrt4.dll.RpcBindingFromStringBindingA",
  3386. "rpcrt4.dll.RpcEpResolveBinding",
  3387. "sechost.dll.LookupAccountSidLocalW",
  3388. "user32.dll.SetFocus",
  3389. "user32.dll.GetDesktopWindow",
  3390. "user32.dll.FindWindowExW",
  3391. "rpcrt4.dll.RpcStringFreeA",
  3392. "uiautomationcore.dll.UiaClientsAreListening",
  3393. "mso.dll.#8662",
  3394. "mso.dll.#424",
  3395. "advapi32.dll.ConvertSidToStringSidW",
  3396. "msi.dll.DllGetVersion",
  3397. "msi.dll.#111",
  3398. "mso.dll.#7009",
  3399. "mso.dll.#6429",
  3400. "mso.dll.#5667",
  3401. "mso.dll.#86",
  3402. "webservices.dll.WsResetHeap",
  3403. "mso.dll.#2052",
  3404. "mso.dll.#7778",
  3405. "mso.dll.#5127",
  3406. "mso.dll.#7590",
  3407. "mso.dll.#2687",
  3408. "webservices.dll.WsCloseServiceProxy",
  3409. "ws2_32.dll.#3",
  3410. "ncrypt.dll.SslDecrementProviderReferenceCount",
  3411. "ncrypt.dll.SslFreeObject",
  3412. "webservices.dll.WsFreeServiceProxy",
  3413. "user32.dll.GetQueueStatus",
  3414. "mso.dll.#8060",
  3415. "mso.dll.#5925",
  3416. "mso.dll.#3638",
  3417. "mso.dll.#3258",
  3418. "mso.dll.#7974",
  3419. "mso.dll.#2609",
  3420. "mso.dll.#3500",
  3421. "mso.dll.#3347",
  3422. "mso.dll.#1905",
  3423. "mso.dll.#2812",
  3424. "mso.dll.#4416",
  3425. "mso.dll.#4008",
  3426. "mso.dll.#7366",
  3427. "mso.dll.#7546",
  3428. "mso.dll.#1406",
  3429. "mso.dll.#4926",
  3430. "user32.dll.GetScrollPos",
  3431. "mso.dll.#629",
  3432. "mso.dll.#676",
  3433. "mso.dll.#8644",
  3434. "mso.dll.#3141",
  3435. "mso.dll.#8472",
  3436. "mso.dll.#2281",
  3437. "mso.dll.#2628",
  3438. "mso.dll.#3425",
  3439. "mso.dll.#5291",
  3440. "mso.dll.#1718",
  3441. "mso.dll.#4777",
  3442. "advapi32.dll.CryptAcquireContextA",
  3443. "advapi32.dll.CryptGenKey",
  3444. "cryptsp.dll.CryptGenKey",
  3445. "advapi32.dll.CryptImportKey",
  3446. "cryptsp.dll.CryptImportKey",
  3447. "advapi32.dll.CryptExportKey",
  3448. "cryptsp.dll.CryptExportKey",
  3449. "advapi32.dll.CryptDestroyKey",
  3450. "advapi32.dll.CryptCreateHash",
  3451. "advapi32.dll.CryptSetHashParam",
  3452. "advapi32.dll.CryptHashData",
  3453. "advapi32.dll.CryptGetHashParam",
  3454. "cryptsp.dll.CryptGetHashParam",
  3455. "advapi32.dll.CryptDestroyHash",
  3456. "user32.dll.RegisterPowerSettingNotification",
  3457. "powrprof.dll.PowerSettingRegisterNotification",
  3458. "user32.dll.GetWindowThreadProcessId",
  3459. "user32.dll.GetWindowTextW",
  3460. "msi.dll.#90",
  3461. "kernel32.dll.FlsAlloc",
  3462. "kernel32.dll.FlsGetValue",
  3463. "kernel32.dll.FlsSetValue",
  3464. "kernel32.dll.FlsFree",
  3465. "ieawsdc.dll.HrExtractTemplateToPath",
  3466. "mso.dll.#8837",
  3467. "mso.dll.#1455",
  3468. "user32.dll.LoadImageW",
  3469. "user32.dll.CreateWindowExW",
  3470. "comctl32.dll.HIMAGELIST_QueryInterface",
  3471. "comctl32.dll.DrawShadowText",
  3472. "comctl32.dll.DrawSizeBox",
  3473. "comctl32.dll.DrawScrollBar",
  3474. "comctl32.dll.SizeBoxHwnd",
  3475. "comctl32.dll.ScrollBar_MouseMove",
  3476. "comctl32.dll.ScrollBar_Menu",
  3477. "comctl32.dll.HandleScrollCmd",
  3478. "comctl32.dll.DetachScrollBars",
  3479. "comctl32.dll.AttachScrollBars",
  3480. "comctl32.dll.CCSetScrollInfo",
  3481. "comctl32.dll.CCGetScrollInfo",
  3482. "comctl32.dll.CCEnableScrollBar",
  3483. "comctl32.dll.QuerySystemGestureStatus",
  3484. "uxtheme.dll.#49",
  3485. "uxtheme.dll.CloseThemeData",
  3486. "user32.dll.EnableScrollBar",
  3487. "user32.dll.ShowScrollBar",
  3488. "user32.dll.ShowWindow",
  3489. "user32.dll.SetParent",
  3490. "user32.dll.KillTimer",
  3491. "user32.dll.ClientToScreen",
  3492. "user32.dll.MoveWindow",
  3493. "user32.dll.DestroyWindow",
  3494. "gdi32.dll.GetViewportExtEx",
  3495. "gdi32.dll.GetWindowExtEx",
  3496. "gdi32.dll.GetTextCharset",
  3497. "gdi32.dll.GetMapMode",
  3498. "gdi32.dll.GetLayout",
  3499. "oleaut32.dll.SysAllocString",
  3500. "oleaut32.dll.SysStringLen",
  3501. "oleaut32.dll.SysAllocStringLen",
  3502. "oleaut32.dll.SysFreeString",
  3503. "crypt32.dll.CryptQueryObject",
  3504. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3505. "uxtheme.dll.GetThemePartSize",
  3506. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3507. "cryptsp.dll.CryptGetDefaultProviderW",
  3508. "cryptsp.dll.CryptAcquireContextW",
  3509. "crypt32.dll.CertEnumCertificatesInStore",
  3510. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3511. "cryptsp.dll.CryptReleaseContext",
  3512. "wintrust.dll.WinVerifyTrust",
  3513. "wintrust.dll.WintrustCertificateTrust",
  3514. "wintrust.dll.SoftpubAuthenticode",
  3515. "wintrust.dll.SoftpubInitialize",
  3516. "wintrust.dll.SoftpubLoadMessage",
  3517. "wintrust.dll.SoftpubLoadSignature",
  3518. "wintrust.dll.SoftpubCheckCert",
  3519. "wintrust.dll.SoftpubCleanup",
  3520. "wintrust.dll.CryptSIPVerifyIndirectData",
  3521. "user32.dll.GetMessageW",
  3522. "wininet.dll.InternetGetConnectedState",
  3523. "rasapi32.dll.RasConnectionNotificationW",
  3524. "sechost.dll.OpenServiceA",
  3525. "gdi32.dll.IntersectClipRect",
  3526. "osppcext.dll.SLActivateProduct",
  3527. "advapi32.dll.RegDeleteValueW",
  3528. "sechost.dll.NotifyServiceStatusChangeA",
  3529. "gdi32.dll.SetTextColor",
  3530. "osppcext.dll.SLGetTokenActivationGrants",
  3531. "gdi32.dll.SetBkMode",
  3532. "gdi32.dll.SetTextAlign",
  3533. "gdi32.dll.ExtSelectClipRgn",
  3534. "uxtheme.dll.DrawThemeBackground",
  3535. "osppcext.dll.SLGetTokenActivationCertificates",
  3536. "osppcext.dll.SLGenerateTokenActivationChallenge",
  3537. "osppcext.dll.SLSignTokenActivationChallenge",
  3538. "osppcext.dll.SLDepositTokenActivationResponse",
  3539. "osppcext.dll.SLFreeTokenActivationGrants",
  3540. "osppcext.dll.SLFreeTokenActivationCertificates",
  3541. "gdi32.dll.GetTextColor",
  3542. "user32.dll.WaitMessage",
  3543. "mso.dll.#5070",
  3544. "mso.dll.#6899",
  3545. "user32.dll.GetClassNameW",
  3546. "mso.dll.#1885",
  3547. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  3548. "mso.dll.#832",
  3549. "advapi32.dll.SaferiSearchMatchingHashRules",
  3550. "wintrust.dll.WTHelperProvDataFromStateData",
  3551. "wintrust.dll.WTHelperGetProvSignerFromChain",
  3552. "crypt32.dll.CertCloseStore",
  3553. "mso.dll.#3702",
  3554. "mso.dll.#3484",
  3555. "mso.dll.#1966",
  3556. "mso.dll.#6960",
  3557. "mso.dll.#7892",
  3558. "advapi32.dll.CryptReleaseContext",
  3559. "cabinet.dll.#23",
  3560. "mso.dll.#7931",
  3561. "mso.dll.#3837",
  3562. "mso.dll.#8398",
  3563. "mso.dll.#2477",
  3564. "msproof7.dll.DllGetClassObject",
  3565. "msproof7.dll.DllCanUnloadNow",
  3566. "mso.dll.#4172",
  3567. "mso.dll.#1439",
  3568. "mso.dll.#9566",
  3569. "mso.dll.#111",
  3570. "mso.dll.#4191",
  3571. "mso.dll.#3802",
  3572. "mso.dll.#6982",
  3573. "mso.dll.#8800",
  3574. "mso.dll.#3572",
  3575. "mso.dll.#167",
  3576. "mso.dll.#5737",
  3577. "mso.dll.#590",
  3578. "mso.dll.#3758",
  3579. "msgr3en.dll.CheckVersion",
  3580. "msgr3en.dll.#29",
  3581. "msgr3en.dll.#30",
  3582. "msgr3en.dll.#31",
  3583. "msgr3en.dll.#32",
  3584. "msgr3en.dll.#33",
  3585. "msgr3en.dll.#34",
  3586. "msgr3en.dll.#35",
  3587. "msgr3en.dll.#45",
  3588. "msgr3en.dll.#46",
  3589. "msgr3en.dll.#47",
  3590. "msgr3en.dll.#48",
  3591. "msgr3en.dll.#51",
  3592. "msgr3en.dll.#50",
  3593. "msgr3en.dll.#49",
  3594. "msgr3en.dll.#43",
  3595. "msgr3en.dll.#41",
  3596. "msgr3en.dll.#42",
  3597. "msgr3en.dll.#44",
  3598. "msgr3en.dll.#39",
  3599. "msgr3en.dll.#40",
  3600. "msgr3en.dll.#36",
  3601. "msgr3en.dll.#38",
  3602. "msgr3en.dll.#37",
  3603. "msgr3en.dll.#56",
  3604. "msgr3en.dll.#52",
  3605. "msgr3en.dll.#53",
  3606. "msgr3en.dll.#57",
  3607. "msgr3en.dll.#58",
  3608. "msgr3en.dll.#59",
  3609. "user32.dll.LoadStringA",
  3610. "mso.dll.#2561",
  3611. "mso.dll.#9080",
  3612. "mso.dll.#5154",
  3613. "mso.dll.#2907",
  3614. "msspell7.dll.SpellerVersion",
  3615. "msspell7.dll.SpellerInit",
  3616. "msspell7.dll.SpellerSetOptions",
  3617. "msspell7.dll.SpellerGetOptions",
  3618. "msspell7.dll.SpellerTerminate",
  3619. "msspell7.dll.SpellerOpenLex",
  3620. "msspell7.dll.SpellerCloseLex",
  3621. "msspell7.dll.SpellerCheck",
  3622. "msspell7.dll.SpellerAddUdr",
  3623. "msspell7.dll.SpellerAddChangeUdr",
  3624. "msspell7.dll.SpellerDelUdr",
  3625. "msspell7.dll.SpellerClearUdr",
  3626. "msspell7.dll.SpellerGetSizeUdr",
  3627. "msspell7.dll.SpellerGetListUdr",
  3628. "msspell7.dll.SpellerBuiltinUdr",
  3629. "mscss7en.dll.FreeGlobalObjects",
  3630. "mscss7en.dll.GetContextSpellingSession",
  3631. "shell32.dll.SHGetFolderPathW",
  3632. "css7data0009.dll.NlsLangDataCall",
  3633. "shell32.dll.SHGetFolderPathAndSubDirW",
  3634. "mso.dll.#2100",
  3635. "mso.dll.#1911",
  3636. "mso.dll.#8802",
  3637. "mso.dll.#9528",
  3638. "mso.dll.#5341",
  3639. "mso.dll.#1266",
  3640. "gdi32.dll.GetStockObject",
  3641. "mso.dll.#6501",
  3642. "riched20.dll.REMSOHInst",
  3643. "mso.dll.#511",
  3644. "mso.dll.#8118",
  3645. "gdi32.dll.GetGlyphIndicesW",
  3646. "mso.dll.#7531",
  3647. "mso.dll.#6420",
  3648. "mso.dll.#844",
  3649. "user32.dll.SetCursor",
  3650. "mso.dll.#4702",
  3651. "mso.dll.#1414",
  3652. "mso.dll.#7651",
  3653. "mso.dll.#5071",
  3654. "mso.dll.#2802",
  3655. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  3656. "mso.dll.#4111",
  3657. "gdi32.dll.GdiFlush",
  3658. "mso.dll.#2386",
  3659. "advapi32.dll.RegisterEventSourceW",
  3660. "advapi32.dll.ReportEventW",
  3661. "advapi32.dll.DeregisterEventSource",
  3662. "mso.dll.#816",
  3663. "mso.dll.#2620",
  3664. "shell32.dll.SHGetKnownFolderPath",
  3665. "mso.dll.#9748",
  3666. "mso.dll.#3496",
  3667. "mso.dll.#2901",
  3668. "mso.dll.#7830",
  3669. "mso.dll.#5396",
  3670. "mso.dll.#6895",
  3671. "mso.dll.#8986",
  3672. "mso.dll.#7945",
  3673. "mso.dll.#988",
  3674. "mso.dll.#5177",
  3675. "mso.dll.#3334",
  3676. "mso.dll.#7320",
  3677. "mso.dll.#9639",
  3678. "mso.dll.#9436",
  3679. "mso.dll.#5541",
  3680. "advapi32.dll.GetFileSecurityW",
  3681. "advapi32.dll.SetFileSecurityW",
  3682. "advapi32.dll.GetSecurityInfo",
  3683. "advapi32.dll.SetSecurityInfo",
  3684. "advapi32.dll.GetSecurityDescriptorControl",
  3685. "mso.dll.#2955",
  3686. "mso.dll.#1914",
  3687. "mso.dll.#1401",
  3688. "mso.dll.#5919",
  3689. "mso.dll.#4597",
  3690. "mso.dll.#7189",
  3691. "mso.dll.#2738",
  3692. "mso.dll.#8691",
  3693. "mso.dll.#6079",
  3694. "mso.dll.#7167",
  3695. "mso.dll.#7163",
  3696. "mso.dll.#333",
  3697. "mso.dll.#1785",
  3698. "mso.dll.#8693",
  3699. "user32.dll.RemovePropW",
  3700. "mso.dll.#5973",
  3701. "mso.dll.#2014",
  3702. "mso.dll.#9668",
  3703. "mso.dll.#2294",
  3704. "advapi32.dll.RegDeleteKeyW",
  3705. "mso.dll.#235",
  3706. "mso.dll.#9398",
  3707. "mso.dll.#1442",
  3708. "mso.dll.#4388",
  3709. "mso.dll.#8022",
  3710. "mso.dll.#6889",
  3711. "mso.dll.#3633",
  3712. "gdi32.dll.GetTextExtentPointA",
  3713. "user32.dll.MessageBeep",
  3714. "user32.dll.DialogBoxIndirectParamW",
  3715. "comctl32.dll.RegisterClassNameW",
  3716. "uxtheme.dll.EnableThemeDialogTexture",
  3717. "uxtheme.dll.GetThemeBool",
  3718. "user32.dll.GetDlgItem",
  3719. "mso.dll.#6900",
  3720. "user32.dll.CallNextHookEx",
  3721. "uxtheme.dll.BufferedPaintInit",
  3722. "uxtheme.dll.BufferedPaintRenderAnimation",
  3723. "uxtheme.dll.GetThemeTransitionDuration",
  3724. "uxtheme.dll.BeginBufferedAnimation",
  3725. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  3726. "uxtheme.dll.DrawThemeParentBackground",
  3727. "uxtheme.dll.GetThemeBackgroundContentRect",
  3728. "uxtheme.dll.DrawThemeText",
  3729. "uxtheme.dll.EndBufferedAnimation",
  3730. "user32.dll.GetDlgCtrlID",
  3731. "user32.dll.IsDlgButtonChecked",
  3732. "user32.dll.EndDialog",
  3733. "uxtheme.dll.BufferedPaintStopAllAnimations",
  3734. "uxtheme.dll.BufferedPaintUnInit",
  3735. "user32.dll.UnhookWindowsHookEx",
  3736. "user32.dll.SetActiveWindow",
  3737. "mso.dll.#3144",
  3738. "mso.dll.#1213",
  3739. "mso.dll.#4220",
  3740. "mso.dll.#3214",
  3741. "mso.dll.#6521",
  3742. "mso.dll.#6489",
  3743. "mso.dll.#613",
  3744. "mso.dll.#1541",
  3745. "mso.dll.#6344",
  3746. "mso.dll.#9099",
  3747. "mso.dll.#8320",
  3748. "mso.dll.#7770",
  3749. "mso.dll.#6216",
  3750. "ole32.dll.CoTaskMemFree",
  3751. "ole32.dll.CoTaskMemAlloc",
  3752. "ole32.dll.CoInitializeEx",
  3753. "ole32.dll.CoUninitialize",
  3754. "user32.dll.EnumThreadWindows",
  3755. "user32.dll.EnumWindows",
  3756. "user32.dll.GetLastInputInfo",
  3757. "ws2_32.dll.#116",
  3758. "gdi32.dll.CombineRgn",
  3759. "user32.dll.CopyRect",
  3760. "gdi32.dll.SetStretchBltMode",
  3761. "user32.dll.UpdateLayeredWindow",
  3762. "mso.dll.#1923",
  3763. "mso.dll.#3784",
  3764. "mso.dll.#4317"
  3765. ]
  3766.  
  3767. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!