API tools faq
paste
paladin316

RTF_1e6bd3a3be1bb1d842ad28b821c3429b_doc_2019-06-28_18_30.json

paladin316
Jun 28th, 2019
2,249
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 218.11 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "RTF_1e6bd3a3be1bb1d842ad28b821c3429b.doc"
  7. [*] File Size: 267405
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "e46b26d1e0c5bd6e5033959ff8a24b3b6b95f75f342aa385c9597ee73940c69d"
  10. [*] MD5: "1e6bd3a3be1bb1d842ad28b821c3429b"
  11. [*] SHA1: "762dfe8d17c527dc5aa14162d18a7d25ddf34aca"
  12. [*] SHA512: "18819b75aa59ed4c1f4fc7534ed974f165e8b830d65bf4553d84c8c6136fde2630265e9c50c0767b64354e608ae9d168cf3c830a29ab731d1d168265aeceedf4"
  13. [*] CRC32: "8D4A32A6"
  14. [*] SSDEEP: "1536:sxxQW3y4vX5TwttpiQiFVo9GURkGtEOLp179+:sxt3vX5TwtLiQI6CGtJF0"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 2428"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  31. "Details": [
  32. {
  33. "IP": "52.109.20.1:443"
  34. },
  35. {
  36. "IP": "65.52.98.231:443"
  37. },
  38. {
  39. "IP": "72.21.91.29:80"
  40. },
  41. {
  42. "IP": "23.12.41.8:80"
  43. },
  44. {
  45. "IP": "23.34.140.38:443"
  46. },
  47. {
  48. "IP": "52.109.2.18:443"
  49. },
  50. {
  51. "IP": "104.18.25.243:80"
  52. },
  53. {
  54. "IP": "184.86.212.65:443"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  60. "Details": [
  61. {
  62. "ioc": "rocess.glox"
  63. },
  64. {
  65. "ioc": "ontent.inf"
  66. },
  67. {
  68. "ioc": "ist.glox"
  69. },
  70. {
  71. "ioc": "gosttitle.xsl"
  72. },
  73. {
  74. "ioc": "nline.xsl"
  75. },
  76. {
  77. "ioc": "harvardanglia2008officeonline.xsl"
  78. },
  79. {
  80. "ioc": "architecture.glox"
  81. },
  82. {
  83. "ioc": "ext.glox"
  84. },
  85. {
  86. "ioc": "chevronaccent.glox"
  87. },
  88. {
  89. "ioc": "gb.xsl"
  90. },
  91. {
  92. "ioc": "turabian.xsl"
  93. },
  94. {
  95. "ioc": "rame.glox"
  96. },
  97. {
  98. "ioc": "adial.glox"
  99. },
  100. {
  101. "ioc": "chicago.xsl"
  102. },
  103. {
  104. "ioc": "set.dotx"
  105. },
  106. {
  107. "ioc": "ieee2006officeonline.xsl"
  108. },
  109. {
  110. "ioc": "e.gu"
  111. },
  112. {
  113. "ioc": "sist02.xsl"
  114. },
  115. {
  116. "ioc": "ccent.glox"
  117. },
  118. {
  119. "ioc": "mlaseventheditionofficeonline.xsl"
  120. },
  121. {
  122. "ioc": "pictureorgchart.glox"
  123. },
  124. {
  125. "ioc": "rc.glox"
  126. },
  127. {
  128. "ioc": "iso690.xsl"
  129. },
  130. {
  131. "ioc": "gostname.xsl"
  132. },
  133. {
  134. "ioc": "quations.dotx"
  135. },
  136. {
  137. "ioc": "iso690nmerical.xsl"
  138. },
  139. {
  140. "ioc": "rid.glox"
  141. },
  142. {
  143. "ioc": "..3b"
  144. },
  145. {
  146. "ioc": "rings.glox"
  147. },
  148. {
  149. "ioc": "content.inf"
  150. },
  151. {
  152. "ioc": "iew.thmx"
  153. },
  154. {
  155. "ioc": "asis.thmx"
  156. },
  157. {
  158. "ioc": "etropolitan.thmx"
  159. },
  160. {
  161. "ioc": "anded.thmx"
  162. },
  163. {
  164. "ioc": "rame.thmx"
  165. },
  166. {
  167. "ioc": "ividend.thmx"
  168. },
  169. {
  170. "ioc": "arallax.thmx"
  171. },
  172. {
  173. "ioc": "eadlines.thmx"
  174. },
  175. {
  176. "ioc": "rop.thmx"
  177. },
  178. {
  179. "ioc": "adge.thmx"
  180. },
  181. {
  182. "ioc": "ype.thmx"
  183. },
  184. {
  185. "ioc": "erlin.thmx"
  186. },
  187. {
  188. "ioc": "uotable.thmx"
  189. },
  190. {
  191. "ioc": "roplet.thmx"
  192. },
  193. {
  194. "ioc": "ircuit.thmx"
  195. },
  196. {
  197. "ioc": "g.n9"
  198. },
  199. {
  200. "ioc": "avon.thmx"
  201. },
  202. {
  203. "ioc": "late.thmx"
  204. },
  205. {
  206. "ioc": "amask.thmx"
  207. },
  208. {
  209. "ioc": "vent.thmx"
  210. },
  211. {
  212. "ioc": "eathered.thmx"
  213. },
  214. {
  215. "ioc": "esh.thmx"
  216. },
  217. {
  218. "ioc": "rail.thmx"
  219. }
  220. ]
  221. },
  222. {
  223. "Description": "Performs some HTTP requests",
  224. "Details": [
  225. {
  226. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  227. },
  228. {
  229. "url": "http://ec2-3-83-64-249.compute-1.amazonaws.com/dllsvr.msi"
  230. },
  231. {
  232. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  233. }
  234. ]
  235. },
  236. {
  237. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  238. "Details": [
  239. {
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3x\\xd0\\x05\\xbe\\xa4\\x91p\\xb5l\\xc0\\xf6\\x15\\xe3\\xfc\\xd5\\xf1\\xe7in\\x92\\x15\\xe5r\\xd7o\tf\\x82\\xaa\\xe6\\xd1\\xe0ub8o\\xbb\\x17{\\xe1u\\xb1\\x05\\xb4v\\xd0a\\xfc\\xd4\\x8ac\\xfe\\xc6:\\xa2\\xd5&%\\x7f\\xf0\\xa7c\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\x18\\xa1\\x90p\\xec,\\x92|\\x8a\\xb6e\\x96sq\\xfes\\xd9\\x03\\xca\n\\xd0\\xee\\xe9\\xa6\\xaf\\xce\\xfb!\\xea\\x1b\\xd8\\xb9\\x9f\\x80kmj+\\x8d\\x9dz\\xb9\\xce\\xbb\\xd4\\x83q"
  241. },
  242. {
  243. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x01\\xc5\\xa2\"!\\x97o\\x85\\x1f\\x1e\\x12~\\xe4o\\xf6b\\x0c\\xe8 \\xdewe\\x15\\x98\\x9e\\xef\\x9f4\\xb5\\xb7\\x05\\xec\\xc6$\\xd7\\xb3\\xc2hh\rw\\x05\\xa1\\xbe\\x0e\\xac\\xd6\\xac\\x10\\x91^\\xaf\\x8a,\\xc9\\xf4c\\xfbe\\x99\\xfars\\x95\\x91\\x84\\xdbq\\x13pp\\xa1\\xc6?\\xf5u\\xa0\\xf6\\x8b6b\\xe1\\x9c\\x0c\\x0c\\xfc\\xe7\\x19l\\xa6we\\xfa\\xf8\\xd0\\xa5\\xfa\\xa6[\\x1bvi\\xed\\xf8\\x13\\xa8\\\\xbe\\x84\\x06~q%bu\\x9f\\x05\\x1b\\x17\\xc7x\\x92\\xf0\\xc0i\\xddsf\\h<l#4wu.\\x02.8c\\xd6~\\xeeb\\x83\\x0f\\xd3y\\xe6+\\x99y\\x89\\xb6\\x8c\\x02\\xcams\\x90m\\x98\\xc1\\xfd\\xf9\\x0e\\xef\\xd4\\xe7*g(\\x1b\\xdf`k\\x02\\xd7ol\\xa6b\\x80\\x00c\\x1c\\x87\\x0f\\xf0e\\xd1\\xd4\\xad\\x05\\x08\\xddw\\xd5\\x97\\xb1\\xec\\xe2\\xee\\x01\\x86r\\x9b3d\\x88\\xb47n\\xf6\\xa8\\xb6\\xe5\\x03\\x8f\\xd2\\x8b\\x92\\x92\\xf73\\xf1\\xe2\\xda\\x86f\\xf5\\x11\\x19\\xee\\xbb^\\xc1\\xd1\\xe8\\xf9\\xb6\\xeak\\x04\\x8ez\\xcd`.\\x1a"
  244. },
  245. {
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x16s\\xf7\\x01d\\xc7\\x9d\\x84\\xb9\r\\x94\\xdf\\xbc\r8i\\x80\\o\\xeb\\xa7\\x91\\xe0\t\\x99\\xa1\\xb0\\xd6\\x9f\\x1c\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247. },
  248. {
  249. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04m\n\t\\xdd>\\xb24\\xc0\\x87~\\xc0l\\xdb\\xea\\xdf\\x85p\\x9b\\xbasj\\xc5\\x13\\xb9\\xcd\\xc5\\x10\\xf4\\xb7\\x92=\\xbcs\\xcf\\xa3\\xa2\\x0f\\x01\\xe9:\\x940\\xe0\\xa4x'f\t~!\\xf1\\x139\\x17&f\\xee*gq\\xb3\\xeaf\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1b\\xe2\\x8ed\\xc7\\xa2)\\xb0i~\\x1c7\tm\\xbc(xh[\\xa7\\xba\\xca\\x8dcxq\\xae\\x95\\xd4\\x93z7\\x1b\\xd9\\x93\\xb8\\x1c\\xfe\\xfc\\x8a\\xb6\\x1e\n\\x9es\\xacm\\xbb"
  250. },
  251. {
  252. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  253. },
  254. {
  255. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  256. },
  257. {
  258. "http_request": "winword.exe_WSASend_\\xc4\\x00o\\x000\\xbfb\\x08\\x84\\xe6\\xb1o\\x0c6\\xe7\\xa5#;n\\x94\\xe8\\xc5\\x8a\\x92\\x1cg#;\\x99\\xf8\\xd9z\\xcd\\x8c\\x81z\\xff\\x8b\\xe1'\\xdf\\xb6e\\xfec\\xb1\\xe6c$'\\x1e\\x876_\\\\xd3o\\x9d\\x99\\xec\\xbe\\xe7\\x04~\\xc7\\xc5#2c\\xed\\xae\\xa3\\xd6\\xfa\\xc5\\x8a\\xef\\x0e!\\xf85\\xac\\x96\\xd0\\xc2b7\\x18\\xf2bl5\\x1f\\x17pe\\x11\\xef\\xbc\\x9c\\xd9fr\\xe0\\p\\xb2\\xec\\x9c\\xb8\\x86\\x11]\\x03e\\x8bq\\xf9\\x88\\xe2\\xdeuog\\xce\\xd7\\xdbdy\\xfe f\\xea-jf\\x9b\\xc4\\xa0xu\\xb1uta\\xdfn\\xaa\\xa6\\xab\\xacctyl\\x9d\\xd1\\xbem#\\xbe1\\xe2\\x02i?\\xf8a0#p\\x9b\\x0c\\xe1\\x1f\\x14\\xedz\\x03\\x06\\xd5\\xe7\\x16\\xc1\\x0f\"\\xc2\\x00\\x10x\\x9a\\xa3mx\\xfe\\xe3\\xf7-\\xe6'0r\\xde\\xe7u\\xd0\\xc5+\\xfe\\xfb\\x8do\\x16\\x95fc\\x83w\\xb9oyy\\xdam\\xe7)\\x97yn\\xd0t\\x90\\xf1\\xd2\\xa5b<\\xec&\\xc7%elk\\xfc\\x0f\\x1b\\x89^e\\xcc\\x14\\x95\\xfc\\x04\\x8c"
  259. },
  260. {
  261. "http_request": "winword.exe_WSASend_\\xc4\\x00o\\x000\\xbfb\\x08>a8\\xbf\\xd3\\xd0\\xd1\\x1b\\xca\\xcc|\\xdf\\xba-\\xfe\\xa5\\xd0\\xe5\\xd8`\\x10ml\\x0b\\xf3\\xd1\\x08\\xb5\\x97jtz\\x80\\x0b\\x9c\\x91\\x8b\\xfa\\xe44\\x18l[\\xdah\\xee\\xf3\\xb7p\\xf3\\xde\\xe2\\x15;i\\xd0\\xac\"f\\xab\\x998\\xff\\xc0=\\xea\\xb9\\xdcm\\x1e+\\xb4ak\\xd9\\xdd\\xd0\\x8a\\xc3)\\xe8\\xc66\\x17\\x03\\xd4\\x82b\\x07\\x9d\\xb6vxn\\xaa\\xdew\\x82m\"\\x85\\xdf4^\\xba\\xa2\\xd3@]e\\xf4eo2o5\\x16\\xb9xz\\xd3\\x8e`z&\\xe5ux\\xcb\\x87\\xba\\x08\\xb6\\x8c0vbf#\\xa6m\\xf9\\x0fu\\x9f\\x11\\x1c\\x1f\\xb4r\\xfc\\x9b\\x19\\x03\\xa1\\xdd@x\\x15u,\\xcf\\xa3\\xc8\\xb2ih\\xecor\\x82c|\t\\xa1\\x9ax,a\\xc2\\xd5\\xa3s.&6\\x81\\x0f\\xbe\\xeei\\xf7t\\xef~\\xa8\\x1d\\x1a\\xb2\\x11\\x99w\\xba\\xbct:\\x9c\\xaf\\x985\\x1d\\xbe\\xaf*\\xe1\\xab\\x8c(\\x030\\xab\\x1d \\xf6\\xf0\\x1fh&\\x91\\xa9\\xd1\\xaa\\x87s\\x93v\\xd9'\\xd9\\xc0\\x01\\x12k\\xda\\xc1\\x10\\x01\\x8b"
  262. },
  263. {
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x16s\\xfa\\x02\\x9d\\x18rx\\x15\\xf3\\xa0\\xa1;\\x8a#v\\xa4\\xf7hk\\xfa\\xa3]\\x8b]\\xc8\\x0ex\\x08\\x99q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265. },
  266. {
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0emxs\\x91\\xfc5\\xc9t\\x85fdv\\x85\\xf5-\\xae\\x0f\\xac9(\\x92\\xa1\\xe3\\xaea0\\x8ap\\xd6}`~\\xe9\\x9f\\xf8\\xc5\\x1a\\xa1\\xc1\\x95\\xa5\\xe8\\x1cb\\x08\\x08}\\xd1\\xa2\\x99hg'\\xd4\\x84g0\\xfa\\xd2\\xb85\\xc1\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\x9f\\xed\\xc3\\x90\\x94(\\x80{\\xe6\\xa3\\xff$\\x02{\\xb0\\x08\\x8b\\x89\\x9f<;\\xfb\\xd3\\x1d\\xe0y\\x14\\xe0'\\x84^k^(%y!\\x97wx\\xb7\\xb9\\xe9\\xb3*w\\x8e"
  268. },
  269. {
  270. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf5\\xbfoi\\x85\\xb6we\\xd468\\x7f7v\\x04\\x08l\t2(y\\xff\\xc0\\xc1t\\xcb\\xc1\\xe9\\x0c\\xc5\\x9b\\xcb\\xa3:q\\x1bp\\x86\\xa8|\\xf2h\\xb4m\\x87\\xed\"\\x95\\xa3\\x83\\x96\\xd3\\xbfi\\x16\\xfb\\x99}\\xe6$i\\xc3\\xc2\\x05\\xfe\\xa7)-!\\x8d\\x7f\\xdf\\x98\\xe3\\xa1'\\xf2\\xa4\\x8erq<\\x0b\\x14\\xcc\\xb1\\xb0\\x94\\x04jh6\\x00\\x9b\\xf6\\\\x03\\x9d\\xb1\\xeb\\xa4\\xd4\\x9a\\xe7[\\x01\\xc0\\x9cv\\x07\\xfa\\xf3\\xdf#b\\xb0\\xdb\\xa8\\x98\\x15\\xff\\xfaz\\xb0\\xf6\\xbf$\\x08\\xb6\\x16#0\\xb90(\\x8d\\xa5\\x822b\\xd5\\xfc2\\xd34\\x0811\r\\xfa\\xbc\\xf4&:\\x01s\\xc3\\xf31y0\\xf0vjv\\x87\\x9b\\x12^\\x8f\\xffw\\x9c\\xaa\\xfd\\x03uc\\xac\\x91\\xf0^3\\x1c\\x13\\x1c\\x19\\xb4\\x10\\xe8\\xabg\\x9c\\xc828\\xecu^\\xf3u\\x82\\xa4\\xe2\\xeevfr\\xb7\\x89\r)@\\xd1j\\x7fl5cd\\x8a\\xe7ax\\xcb\\x01\\xb6\\xbd\\x04\\x0c2\\x8e\\xdes\\x99o\\xf0\\x95n\\xeb\\xf1bw\\xa6c\\xfb\\xb9q\\xc4&\\xdc"
  271. },
  272. {
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x16s\\xfc\\xcb\\x98\\x0b\\xdc\\x1a\\x19\\xfa\\xf3\\xde\\xe6a\\x90lg\\x18\\x82\\x87:\\x97v\\x90y\\xf6\\xacn\\xa4\\xb1r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274. },
  275. {
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95&\\xb8\\x9a\\xaal\\x1dam\\xc1\\xc9\\xf3\\xcc\\xf75\\xa7b~\\x04e\\x9a\\xbdp\\xa6t\\x11\\xd5\\xe2q7h\\x8f\\x9c\\x95u\\xce}\\x1fl\\xef\\x03 \\x99[x\\xc1iz\\xa7\\x93\\xc0\\x91\\x9a\n`\\xf4\\xbd\\x04j~4 (\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1~\\x9dz8\\x96\\xb2b\\xfai\\xe8\\xa61\\x96ul\\x7f\\xbb\\xf9\\xc6\\xb4\\xd2\\xdb\\xde\\x01\\xc0\\xf0rc\\xce\\xd1\\xdbf`\\xe3\\xecq\\x02\\xa3\\xeau\\xdb\\xb8\\xc4?\\x93f\\x00"
  277. },
  278. {
  279. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x14c/mu\\xce\\xb6\\xfb\\x976\\xf7\\xfd\\x16\"\\xc9j*\\xb7t2\\x01\\xd1\\xca\\xe2\\xeb\\x08jy\\xf6\\x95hr?\\xd3\\x99a\\x00@\\x0e{=\\xbc\\xfc\"\\x8d\\xe3bp\\xf4\\xd5\\xdfw\\xb6\\xd7\\xcba/\\xfez6g>\\xdc\\xde?\\xedwhs\\xe2\\xdd\\x0f+\\x9f\\xbbe\\x9an\\x05\\xb7r\\xa3v\\xd2\\xf6\\x00b\\x85\rj\\xd7\\x9bd\ta\\xec\\xf5\\xea\\xbaq4\\xbb\\xce\\x90z\\x88gii\\x024r\\x88\\x18]\\x84\\xff&j\\xd6\\x1e\\xcaj\\x1c\\xa8w\\xdc\\xfb}\\x9c\\xb1\\xcd\\x01&\\x8b\\xe9\\x85\\xf4\\x12n\\xd8\\x14c\\x1e\\xf1\\xe7\\x1e^\\xd65!\\x06\\x06\\x1a\\xf5\\x91t\\x05\\x16n[~{\\xf9\\x0c\\xc7\\xba\\xed\\xbb\\x05\\x0e\\xef\\x02\\x85bz\\xf6\\xc8c\\x1f.\\xac_\\xabq\\xad\\xc9\\xbf\\x97\\x91\\xec\\xb3\\x99?\\xf2%\\x01;\\x1a\\x8c\\x88\\xc8\\xdev\\x04@\\xcc\\xfa\\x1d\\xba\\xd88!\\x18\\xa8\\x10\n\\xdch\\xb0\\x9b{\\x96\\x81\\xd9\\x8cq\"qy\\xeb\\x08^\\xc1t\\x82s3\\xd0b\\xdf\\xac\\xa8\\xa9$\\x85\\7\\xe6z:"
  280. },
  281. {
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfcq\\xee4\\xe4j{0x*\\x81.\\x84\\xee\\x8f@\\xfe\\xf8=u\\x0c\\x86\\xe2\\x14\\x0e\\xf2&\\xd3\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283. },
  284. {
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd}\\xbd\\xfe\\xb9,\\xabh\\xfc\\x90\\xdaj\\x1a\\xb0\\xc3\\x92\\x1f\\x95)\\xcb2\\x14\\xc9\\x18\\x9c\\x98\\xfd,f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286. },
  287. {
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\\\xac\\xd7\\x8a\\xd8*\\xf3u\\x80\\x1e\\x1c\\xc6n0\\xde\\xd2\\xc8r\\xf1%/\\xf8\\xf5\\xdav\\xd9\\xe5[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289. },
  290. {
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdd\\xde\\xad\\x82&hvc\\xce\\xd6\n\\xd1%\\xf9\\xaf\\x07d\\xa9\\xbf\\xe2?\\xf2c\\x12\\x8d\\xb7\\xa3t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292. },
  293. {
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xb3h\\xd7\\x1c\\x9d\\x17q7\\xa9\\x9d\\xa8\\xecb\\x8c>o\\x01f\\xd2\\xce\\x91\\xbd&\\xe6\\xe62\\xd1\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295. },
  296. {
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdy\\x19\\x0fe\\x1b2\\xc0\\xc6vs'\\xc1\\xd85'\\xc2\\xed\\xaafq\\xe62\\x91*\\x86^+\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298. },
  299. {
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdf\\x0b\\x17\\x166\\xfd\\x8c\\x81\\xaa%\n\\xbc\\xe9i\\xd3\\x8b.m\r\\xa3\\xc4{\\x10\\xbc\\x89\\xdc\\xee\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301. },
  302. {
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xcf)\r\\xaf\\xaaw\\xca#\\xeb\\xb7\\xa320\\x07\\xe1\\x18,\\x0c_\\xa8\\x02=6;y\\x99\\xc4\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304. },
  305. {
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xa7\\xa6\\x1fe:\\x1a\\x9e\\x82\\xfb\\x0fg\\x9b\\xc0\\x03co\\xbd6\\xe9\\xb4\\xdf\\xe0!euh\\xd9l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307. },
  308. {
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xd3{\\xb0\\xe9.?\\x192\\xcde\\xfe\\xaey\\x80\\xd6\\x1a\\xe6!\\x10\\x94\\x90\\x1d\\x94\\x15\\x14\\x91\\xbf<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310. },
  311. {
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xd4\\xa5\\xe2spm\\x82\\xb7\\xc8n\\xe1\\xf8\\x0e\\xd7q\\xa8\\xa7\\xb5\\xb8_\\xaa*\\xe6\\xa5\\x91\\xb5\\xa9?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313. },
  314. {
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\x97e\\xad\\xb7cgm\\x16g:%{\\xb8\\xa8\\x0e\\xd4\\x97\\x0fl\\x10r\\x1d\\x84~\\xeeta^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316. },
  317. {
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\x15b\\xa3\\x86h6jc\\x90m\\xe1\\x03#\\x10\\xdf\\xc8/{nt\\x84\\xe5\\xc3\\x9e\\x8b\\xa8\\xb0^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319. },
  320. {
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdf\\x1f\\xeb{\\xae\\x0e\\x8du\\xbd\\x0fu\\x997\\xfd\\xdd>y\\xc3\\xcd,\\x1fm[i\\xb9]h\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322. },
  323. {
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\x060\\x8f\"d]\\xf0\\x9a'\\x0f\\xe7\\xae\\xc7\\xe4h\n\\xca\\x03g(\\xc8\\x91\\xf2f\\xda\\x9a\tx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325. },
  326. {
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdv-\\x1a\\xdap\\xaf\\xc5oy)\\x91\\xa5n\\xad\\xa8(\\xb4\n\\x9e\\xfb\\xf7\\xb3=x*\\x13;x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328. },
  329. {
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\x93\\x8a\\x90\t=\\xa9\\xc7\\x90\\xef\\xf7\\x03\\x10\\xdb\\xa5s\\x0b\\xc5/+\\xa9\\xd2\\x87_-\"ew\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331. },
  332. {
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd/e\\xf0a\\x02v\\x96\\xb0\\xca\\xe6=8u\\x98\\xf5\\xd8.\\x9a\\xb7\\x88.zl\\xb9\\xfc\\xd3\\x1c\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334. },
  335. {
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd 8\\xea\\x91\\x8e@k\\xe3\\xd5on!\\xc1\\xbf\\xc8\\xa1\\xb2\\xb5,\\xae\\xac\\xbb\\xf0j\\xda\\x05\\x08\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337. },
  338. {
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdrv|_\\xab\\x83hz0\\xfc\\\\xce\\x91\\x8f\\xf81h\\xd9\\x89hu\\x0c\\xf9\\xacom\\xd2j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340. },
  341. {
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xfd\\x9ds<\n\\xc2<\\xc2{\\xca\\xd3\\xf0\\xfb@^c\\x0e\\x9d\\xfe\\x86\\x7f\\xcauj\\xf1\\x0fg\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343. },
  344. {
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i.\\x13\\xc3c\\x00(\\xa4\n\\xe0\\xcd\\x17\\xc3'l\\x7f\\xcc\\x8d\\xa9\\xe1\\xef\\x9di\\xb6\\xd2\\x9f\\xce\\x88\\xe6\\xdf\\xe3\\x18\\x1d\\xc7\\xa4.\\xc0\\x071\\\\x1f\\xf0s\\xd8\\x8f\\xc8!\\x82\\x0cf\\xb8;f\\xcau\\x90\\x98\\x92\\x01\\x81\\x1b\\xd3?\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x05{\\x91\\xcd\\xec@\\xa8\\xd1\\xfaxx\\xe7c\\xe5x&_,&k\\xd5\\xce\\xa5n\\xb4\\xd7\\xde\\xca.#b\\\\xb3n\\xf7\\x8e8\n@f.\\xa8\\x9e!\\x91\\x9f\\xe0"
  346. },
  347. {
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\x87l\\xd7\\x15\\x88\\xf7\\x1e\\x03j\\xf9\\xd9\\xb2\\xc5\\xcc@b\\x1dy\\xae\\xa3\\xd4.\\x13\\xe1v\\xd1\\xccf?\\xf7\\xbb\\x07n\\xf9i\\xe7\\x01\\xdc\\x86\\x8a\\xad\\xde\\x01\\x14r\\x99`[\\x90\\x06\\xd0i\\x1a\\xf6\\x19\\x9a\\x13yk7d\\xb2\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<o\\x8a\\xcc\\xc9\\x80#\\xdd76\\xeb\\x96a*~\\x97\\x9e\\xaa\\xc9\\x98x\\xb4\\xc0\\x0c;qde\\x08\\xc2\\x04g\\xe1\\xf8,oz\\x1ce\\xf8\\x87\\x96m\\xfe\\xc5r\\xe8\\xa8"
  349. },
  350. {
  351. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04)\\x81x\\x9a\\xf2\\xaa[b6\\x11\\xbd\\x9b'u8\\x9f\\x9c\\xa6\\bj\\xe1\\x97\\x90\\xd9\\x14\\x13\t\\x85\\xec\\x03\\x0b\\x99\\xe1h\\xa4\\x06\\x19\\xf9\\x1f</\\xd6k\\xba\\xd3\\xe2\\x02\\x93\\xe1\\xb8\\x16w\\x1f\\xf0\\x0b\\x15\\x8eq\\xcf\\xb9\\x12\\xb8\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9`\\xf2n\\xa4c\\xcdd\\xea\\xff\\xa0\\x0e\\xd9\\xa8\\x93\\xc4\\xfa@ss`:\\xe3u\\x16\\x88z&\\xe6\\xb0\r\\xc2\\xe1o\\xf0\\xf0\\x95\\xa0\\x9a\\xe8\\xd0fvrcr\\x9a\\x19"
  352. },
  353. {
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca%\\xba!\\x9d'hsg\\xaba\\x96\\xb8\\xc6,z\\xcbh\\xfe\\xb7\\xb1u\\xef\\xdd7\\xd9\\xdd\\xfe\\x04m@\\x9b\\x9f\\xb6\\x03\\xd7\";\\x92\\x041r\\xac\\x86\\x0c)\\x91\\x12q\\xb0\\xc4\\xa0\\x15\\xd74\\x06\\x9d*\\xd9i3\\x15\\x82\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa18\\x8a\\x96\\x03\\x89\\x01\\xde7\\xc3\\x19'-\\xfda\\x93!\\x84\\x83\\x8afk\\xd4_\\x86\\xb9zf\\xd1,\\xbaftk\\xabw\\x12;\\x9f-<\\xa7\\x11\\xd4\\x11vs\\x83"
  355. },
  356. {
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8f%r\\xed\\x0epq\\xdb\\xc3x@\\xf1\\xe6\\xc18\\x90m\\xdf\\xe2\\xf4\\x90n\\x8aa\\xca\\xb2\\xf0c\\xa8\t\\x93\\xbfcr\\xdd\\xce\\x9f\\x14\\xa2\\xeb\\xf1l\\xd2a^\\x08*\\xc0\\xfb\\xb3h\\xe1\\x00\\xac1!wv\\xb4\\x95\\xd8\\xd1s\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(l\\x97\\xe9l\\x0co\\x91\\xe3$\\xdd\\x9b&\\x91\\x16\\x0e;\\x9d!\\xf4l\\x9bg\\xf2*\\x96\\x92\\xb4g\\xed\\xc5y\\xd8\\x97k\\xa7\\x120\\xa5\\x04\\xf7\\xbe\\xfa\\xbf\\x1b\\xaa\\xfbd"
  358. },
  359. {
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d\\x01\\x93\\xf8\\x83\\xfc\\xbb\\xbe\\xb7\\x9e\\x9c\\x9f\\x86\\xe5\\x03\\x03\\x04\\x1f\\xfd\\xb1'\\xe7\\xb8\\x03\\x82\\xb4\\xa4\\xd5\\xae\\xa1r[\\x91\\x18n6\\xf3\\xf0{xw\\x90\\x05(\\xe1,\\xd8\\xed\\xeb\\xb3\\xe3\\x1bx\\x91\\xba\\xb8i`or\\xaa(\\xff\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000[\\m\\xb6\\x12\\xa3\\xea\\xde\\xe0\\x02\\x93\\xbf\t\t\\xbe2\\x12\\xc8\\x86\\x99\\xd0\\x08f\\x1d\\xf9\\xa4\\xa8fg[\\x12\\xd6 \\x07k\\xd6\\xa1\\x98\\xd8\\xaf|w9!\\x7f\\xba\\x1d\\xb0"
  361. },
  362. {
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1\\x13\\xb4\\xae;\\x9f{\\xaa\\x9af\\xde\\xc1a\\x8fvgi\\xd2a\\x00\\x8d\\xed.\\xfa\\xf6\\xe6\\xe3me\\x1d\\x8e\\xd2_\t\\xa6r\\xbc\\xe8\\x03}\\xce \\x9e\\x7f\\x9a\\x96\\x03m\\xea\\x0c\\xfb\\x9c\\xa2\\x14\\x1bzk\\xfac\\xe5\\xbcp#{\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00^\\xb0\\xbc\\xd7\n\\x89\\xcf\\x86`\\xdesi\\x14\\xe1:\\xa1\\xf3:r\\x0b]f\\x06\\xe9\\x88[k\\xf5\\xb2o\\xc4\\xf0\\xf5\\xdc\\xed\\xb0;\\xe5\\x96\\xf0\\xc8\\xea\\xcdz\\xa0>\\xa0"
  364. },
  365. {
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xfb\\xa6\\x12\\x0f\\x9a\\xd3:\\xa5\\x12\\x91\\x81\\x03`\\xc8\\x8c\\xd3\\x04 c\\x86\\xa3\\xf5\\x1c\\x84\\xcb\\x94\\xbe%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367. },
  368. {
  369. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xc5\n\\x8c\\x8bo\\x90\\xd4s\\xd2\\xac\\x1f]\\x14\\x0e\\xc2\\x8a:\\xd7-j\\xa3\\x07\\x80#bf\\xe6\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370. },
  371. {
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xf9\\x0e0\\xb5\\x11\\x1b#kx\\xf9\\x00\\x04\\x05\\x03\\x80p\\x0f\\xf4\\xaaj@\\x03\\xd2&\\x19\\x87\\xf1\\xa5\\xe3)\\xc6ck9k-\\xa4\\xad\\x94\\xea\\x11\\xc4\\xc7g\\x08i\\xa8y\\x80\\x82\r\\xc9.&r\\x1e\\x9f\\x05\\xdb\\xd1j\\xe3\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xfe{\\xe2\"\\x01\\xa1\\xbe\\x1b\\xb0\\xd4.\\xb2d\\x9f\\xb6\\xa5\\xa2\\xbd\\\\x16\\xd2\\xe9\\x05j\\x11\\x8d'\\xfa\\xfatrf\\xc9n\\x1cq\\xf5n\\xf3@o\\xc4\\x87s\\xdc<\\x8c"
  373. },
  374. {
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd}\\x1f\\xbas\\x00\\x1cl\\x10\\xf9\\xb2o\\xe1<2\\xb9l\\xf38\\x0e\\xa6\\x0e\\x83\\xab}'\\xbd\\xd3t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376. },
  377. {
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xa8\t!\\x02f\\x83\\xfd\\x1f\\x10\\xac3\\x81\\x82,\\xc6\\x94\\xd1p\\xc0}\\xeb\\x88\\x0f\\xaa{\\x8f\\xd2\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379. },
  380. {
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdm\\xda\\xfeq\\xd0\\x14\\xeb3\\xc2fc1h/b:\n\\x859\ra\\x0f\\x07\\x90j[\\x00f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382. },
  383. {
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdtw\\xd2 \\xe3a\\x06\\xf0\\xdb\\x1f\\xde\\x8e<\\xc6\\x8ap\\x1d\\x9e9\\xdc\\xb67\\xbe=\\xcd\\xaetl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385. },
  386. {
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3iw\\x9a+\\xca\\x81\\xc2\\xe6\\xc19\\xd2\\x88\\xd2y\\x8ey\\xa6e\\xc6\\xb0\\xf1\\x98\\xb0\\xe6\\xeayl\\xf1\\xc7\\xdb\\xf2\\xc5i\\xf6\\xcd\\xfa\\xca\\x08\\xe5\\x12\\xdf\\xfc\\xd1t\\x8f\\xcf\\xd8\\xc9\\xae\\x80\\xc9\\x1e\\xb9\\xfb15\\x8b9\\xee\\x17q\\x92\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\s\\xcb2)\\x83\\xea.4\"c\\xf7e\\xab\\x13\\xfc\\xf7u\\xd2\\xe2[a\\xc5ml\\x8c\\x96?*\\xc8\\x07d\"\\xa6fi/qe\\x0f\\xf4\\x91i(_\\x94\\xc0"
  388. },
  389. {
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\x82\\xb1\\x1c>\\x82\\x8b\\x8a\\x15a\\xc8\\xd19\\x97\\xa0\\xf3\\xa1\\xe2\\xf2\\xc2l\\xdc\\xd7\\x19\\x08z\\xfb\\x93/i\\xa5\\xbctvf\\xd6w\\x0c\\xd8\\xe48i>\"8\\xf9uc|\\xfdq?@s:\\x9c\\x19\\xac9\\x85-\\xa3k\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:s\\xe0\\x128a\\xdb\\xff\\xd7$>\\x11\\xcd\\x9dy\\xcf\\xb5\\xa6\\x85\\x90\\xfc\\x995\\x87\\xb0\\xee`\\xda\\xb1\\x06\\xc7\\xdb\\xcc\\xd9\\x1c\\x1b\\xcb\\xf9\\xaa$\\xf9oh\\x1b&\\x03\\xadb"
  391. },
  392. {
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb2\\x1e\\x08\\x894x\\xce\\xdb\\x8f5\\xd5\\xa0\"|\\xaf\\x15m\\x8f\\xca\"\\x8al\\x08\\xdd\\x86i\\xa4x\\xb5\\x83\\xaf \\x1ax2l5<3\\x9a\\x935\\x9a\\xf6cv\\x16{\\x1f\\x02\\xd0i\\xfa\\x11\\xc7\\xe2rs\\x8be\\x8d\\x9b\\x9ft\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\r\\x83\\xff\\x1e\\x9bo\\xd9`y\\xadc\\xbd\\x10\\xee1r\\x06\\xbc\\xfa[\\xc7:\\x8f.u\\xfej\\xf3\\x1d/\\x05\\xf7\\xf1\\x85\\xc2\\xff\\x97\nc\\xc1\\x85\\xe7\\xabl\\x0f\\xf1v"
  394. },
  395. {
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047tn\\x0e\\xab_\\xf7\\x97\\xa9\\xb3g\\x1d)!,\\xe9\\x94\\x97h\\xc8g\\xfa\\xd1\\x9d\\x8d2\\x99\\xff\\xf1lnp+p\\xde\\x1a\\xfd#\\xf4;\\xech\\x1a\\xfed\\x88\\xc6\\x9ck\\xfd\\xfb!i\\x99\\xae0\\xed[j\\x9b\\xc6\\x843l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfbm%\\xb1\\xc2\\x84\\x82}\\x99\\xf3im\\x16\\x84nf:\\xec\\xf0gi\\x0b\\x9cc\\xad\\xff\\xe9\\x9d\\xf6\\xea-t!\\x99\\x0b_\\x01\\x96\\x8e\\x91,1\\xcc*kh\\x0e\\xc0"
  397. },
  398. {
  399. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xc4\\x1e\\xb4\\x8f$\\xf4h\\xb9ihp\\x98\\xde$\\x99l\\x92\\xd3\\x04|\\x1d\\xf5\n\\xa1\\xff\\xab/{\\xdfnx\\xda\\xff&;p\\xe8@\\xaf=\\x1da\\xf5%>~\\x91\\xc7b\\x0fg\\xd2\\xc7\\xb2y\\xf4\\x8a\\xbb\\x8fd\\xd7\\xcch\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x94\\x15k@\\x89+\\x0er\\x0f\\xa9\\xb9\\x18k\\x87\\xdf\\xf2^\\xe0k@c\n\\xa3\\x87e\\xebs`\\x839=|1(\\xe9\\xf6c\\xfa\\x9f\\xaf\\xf02\\x9f\\xd0\\x9f8\\xabq"
  400. },
  401. {
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5w\\x80\\xec5\\x97\\x00\\xb6\\x82\n\\xdb\\x1ftc\\xda|\\xd6\\xab~\\x85/\\xd5\\x03\\xef\\xc2h\\xa6\\xd5\\xe4>a\\x9a\\xf9\\xf8\\xa9\\xe8<\\xcd\\x1fz\\x17\\x18\\xed\\xeb\\x13~\\x05\\xa2\\x1fo\\xec\\xed|\\xf1p\\xda1\\xc01\\xcc\\x83\\xed\\x14\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\x81\\xbb\\xed])/\\x1a\\xa9v8\\xac\\xdd\\x0f&\\x05\\xec4q\\xa8a\\xed\\xfd[\tp\\x16 \\xc8\\xd6\\x88\\xee\\x92d\\x90#{\\xb4\\xc8\te\\x9f\\x9bt\\x98\\x0f:\\x04"
  403. },
  404. {
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0n\\xeb%\\x05\\xef9\\xe8\\xb0\\x1d*`\\xb9\\xc17{\\xd4\\x9bax\\xe1l\\x94\\xe8q\\\\x99\\xfbe\\xaf\\x9ccp/\\x00\\xdc\\xf4x\\xd1\\x01{,5\\xa1\\xaa\\xc4$\\xa9\\x89d\\x834t\\xc6\\xbb\\xf5;pq]\\xaf\\x11-n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000]\\xf8s\\x07\\xdb\\xeb<\\xf05\\xfa\\xc4\\x146\\x9b\\xb2\\xb1u}z\\xcc\\xff\\xfe\\x8epx\\x13t\\xcb\\xbdg\\xd6\\xff\\xfa~\\xa5\\xf9\\xa8>.x\\xbf\\xf3\\xce*]?\\xb5f"
  406. },
  407. {
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xbbw\\xed\\x7fd\\x08v\\xa5(\\xfc\\x12v'ub5\\x03\\xdcf<d\\xbb\\xf69\\xac\\x82\\xec\\xf15\\xa0z\\xd9\\xde\\x9fe\\xa2\t8\\xaa\\xcdy\\xa1\\xb0\\xb6\\xdb\\x91\\xaf\\x883m\\x1b\\x9a6\\xf5\\x8eh\\xc1ip\\xe0s\\xee\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xfby6\\xb69\\xc9\\xca\\xa5\\x7f\\xa1.q\\x18\\xc1\\xff\\xb1w\\xb7(\\x0f\\xd2~}?%\\xdb0\\x17p\\x14\\x18xo\\xbb\\xa1/}3l\\xc0\\xc7\\xfa\\xdf\\x07}\\xbe\\x8a"
  409. },
  410. {
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\xfb\\xed\\x9d\\x84[\\xec\\x17o\\xd4av.\\xc7sf\\xff\\x9f\\xec\\xc6\\xf0\\x98\\x1f4\\x170\\x8f\\xf4\\xd4\\xd0=\\xd9p\\xbf\\x80u,\\xd6\\x82\\x16\\x95\\xf6\\xea\\x87\\xaf\\x1b\\xae!u\\x08d\\xf1\\xc56\\xb3\\xd9q\\xee\\x1b\\xed3\\xbcs\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15)\\x82\\xe1\\xa9\\x82g;\\x7f\\x9d\\xac\\xa8e3\\xd0\\x1c\\x9f]\\x1fw\\xbe\\x9a\\x96m;\\x86_\\xef\\xf2k\\x19\\?/h\\xea\\x81v\\xf0\\x88!-\\xfc\\x8b\\t\\xf2\\x91"
  412. },
  413. {
  414. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103b\\xfd\\xa5mq1cai\\x0f\\xb9\\x18\\x8a\\x90 \\x92\\xb4<\\xb5\\xba&\\x1e\\x8d\\xe5\\x15k\\xcf\\x03\\xa0\\x87\\x9e\\xb9\\x88\\xc74\\xfe#\\xd9e\\xe7\\xbac\\x13\\xb9p\\x95\\xd3\\xd3e\\xc2\\i\\xa73\\xd9\\x96\\x84\\x11 %\\xa8\t+\\x94\\xb5\\x9b\\xda\\x16]$\\x9f\\xff\\xf5t\\xd1y\\x9c\\xf1&\\x0f\\xe8\\xdb3\\xe5i\\xf8\\x80\\x0c\\xcf\\xf9\\x84\\xf8\\x8c\"k\\xebpb\\xe5\\xad\\x9bv\\xf7\\xe2\\xdc\\xf1^\\x1d\\x7f\\xa8\\x90\\x93ka\\xfd\\xfc?ccf\\x16v\\xf6\\xdb\\xa2k:\\x97\\x0c\\x8bd|=\\x85\\xf4\\xde\\xe3jp9\\x97\\x9b\\xdb*\\xea\\x9b\\xe3\\x10\\x94\\xa4}\\xdbk\n\\xd8\\x96c\\xb7\\x8a}!x\\xe6\\x88\\xd3c\\xf4\\xbf\\xbf\\x89*\\xb4\\xf9o\\x1cp\\x13u\\x95\\xe8\\xd8r \\xdc\\xf7\\xe3\\x08\\xcc'%u:\\x9b9\\xe8\\x17\\x9d}\\xff\\x86s\\x94_v\\xde$r\\x01b\\xd3d\\xcfbcks\\xedr\\xefs\\xae\\x11\\xaf\\x1a\\x1bo3\\xf8\\x0f\\x1d\\x8cw^\\x85c\\xfb[\\xd6@(\\x8a\\xad\\xba=-8;>\\x1ae"
  415. },
  416. {
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g]\\x81(gn\\xff;\\xb0!\\xd4)u({\\xef\\x92\\xb1\\xae\\xaa\\xce\n\\xc8w\\x01\\xbad\\x85\r\\xfbh\\xad\\xc1\\x16\\x0c_\\xc1rk\\xf0\\xc9\\xd4\\x82\\xf0\\xcby\\x90\"9^\\xf2\\xaf\\x90\\xdeud\\x06\\xf3e\\x04\\x01f\\xb4\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i>\\xccz<5\\xcf\\xa6]\\xb7\\x10\\xde\\x01\\xdb\\x15\\xf5\\x85\\x87\\x99\\xe8\\x17\\xab_(3~\\x9f\\xb7\\x8f\\x0e\\xa1%0\\xbem$h\\x11\\xad\t\\xb4a\\xb719\\x8b\\xf9\\xaf"
  418. },
  419. {
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xe1j4\\x80n3\\xe7&b<\\xc4\\xbc_{\\xa7\\x98\\xf7p\\qd&[\\x82\\xeb\\x88\\x1d{\\xc5\\x0fw\\x89\\xf9z9\\xae*\\xdd\\x06z\\x19\\x96\\xc7\\xdd\\xe5\\x85\\xa9\\xce\\x90\\xc8+\\xb1)\\xee\\x85\\x968am\\x8d\\xc2\\x13\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b(\"\\xb0\\xf2i\\x89\\xf2\\xe1h\\xec\\xf2z(\\xc5\\xd2\\xfd$d\\x15i\\x86k{\\x06\\xecx\\xd8\\xf5\\xd3\\xf03\\xcdv\\xbf\\xa9?\\xf7\\\\xa1g\\xc5\\xebt\\xaa\\xe5\\xe6\\xcb"
  421. },
  422. {
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4,\\xb7\\xb8\\xb86jxi\\xa9\\xb7\\x1b\\xa7\\xb9\\x8b\\xe2\\x8a\\xad\\kw\\x9f)\\xce\\x11\\xd1\\xf5\\xc1\\xf1-\\xd1p\\xbb~\\xe5\\x16\\x03w\\x7f!-a\\xf8<`\\xa8\\x9f\\x9b\\x7f\\x1b\\xfdr\\xf3\\x05\\x96l\\xd5\\x89\\x8f\\xd19\\xe1\\xbdt\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\xf7\\x9dc\\x83\\xe9\\xe4\\x07\\x82]\\xc5w6\\x81\\xfcq\\xa2.\\x80\\xa6\\xb6\\x9f\\x13\\xe5~\\x07c\\xd4p\\x1a\"\\x83\\xaa0\\xad\\xc6\\x85\\x19m\\xf4}\\x10\\x96>\\x7f\\xdc\\xa9\\xf3"
  424. },
  425. {
  426. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x01\\xf0\\x8b\\x18a\\xab=\\xd7\\xa8\\x86\\x11\\xcf\\xfc\\xb3^\\xc9&\\xd4\\xc4\\x04\\x81\\x8a+\\xbe\\xf5-(\\xcd\\x88\\x94\\xa2v\\x0c\\xe4\\xeel\\xa1b\\xd1\\x85y\\xc5\\xb5\\xad\\xea1\\xfc\\xd6\\xa0\\xa87\\xca\\xbe\\xab\\xe8\\x95\\x8a$\\xc3vr#\\xebo\\xb4\\xc0s\\xd8j\\x1f\\xee\\xc5x,=k\"f\\x9e\\x1a\\x01\\xf8d?u\\xa8a\\xa9\\x81\\xe5\\x06e\\xe7x\"x\\xb8{\\x06\\xb2\\xdbn\\xa8.\\xf49}\\xee\\xa9z;\\x93\\xf4]\\xb2\\x15?\\xfe\\x13\\xcb`^\\x1f\\x08\\xee\\xd8\\xc7\\x85\\xfb\\xc4\\xe0'v\r\\xf3\\x84$\\xf4\\x8f\\x8c$\\xf3\\xcd\\xfc~0\\x18lj\\xcdgs\\xd0\\x1f\\x9a\\xf3lo\\xbby\\x8b\\x060\\xbd<\\x9a&\\x88\\xd4\\x1e\\xa7)\\xc2\\xaa6\\xe1\\xde\\xf6\\xdf\\xa1\\xc7(%`(fa\\xce\\xc2\\xa0\\xbb\\xbd\\x04\\x86s(\\x91w\\xa2\\x9c\\xe5\\xa0%\\xd2\\xb4\\x92w\\x0e\\xa4\\xe1\\xf6\\x19%y\\xf7\\xaf\\xa0\\xed\\x7f\\xb7n\rc\\xc9\\xa8\\xd7\\xc5\\x15a\\xb0\\x93u\\xfe(\\xd2\\x8b\\x17vv\\x13\\x96b\\xf7c\\xd9\\xa8\\xee,\\xf2\\x1b"
  427. },
  428. {
  429. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\xcbt\\x19\\xc1\\x9dd\\xfbs(i\\xf9_<\\xd2\\xe6\\x01\\x04=\\xf3$w#f\\xf1s\\xb6r\\xd7\\x90\\xdb\\xa8\\xa4\\xe9\\\\xcf\\x050\\xb6\\x80\\xdb$k\\xc4\\x99p\\x07\\xe9\\xd1\\xbc2\\x10j\\x0c\\x87!\\x80k\\x9b\\xfd/\\xe4\\xdf\\xed\\xf2\\x040\\xa2s\\xd7\\\\x85\\xc3\\x13\\xcfr\\x8a\\x01\"\\xdd\\x81~\\xc9\\xb0\\xe9\\x8f&fc\\xcfr\\xb5\\xa2\\xf4\\x9a\\x99\\x8dt\\xe9\\xe2\\xcdu\\x81/}\\xfa\\xfb\\x84\\xbe\\xde\\x88r[\\xd5\\xc6j0\\x03\\xcci\\xf2#\\x81o6\\xd01\\xa8\\xfetl\\xca^'u\\x9d\\xa7\\xea\\x13d\\xfcw4y>k\\x19\\x91\\x90:\\x90\\x96\\x15\\xe0\\xd1c\\x0cl\\xa8v5\\x7f\\xc9&\\xe9\\x1a\\xd5e\\xcef\\x92\\x9b\\xd2\\xe6\\x81\\x16\\xb8|i\\xb9g\\x8f%f\\xbaq,\\x19$\\xb2\\x02\\xf6d\\xde\\xf5;\\xe0\\xc7\\x07gh>^3\\x1cl\\xb3\\xa3f\\xf6\\xcf\\xf9\\x1d\\xf1\\xa8\\x01\\x1du]\\x8b\\xa2\\xb8`\\xacrl\\xee\\xe43 \\xa6ve\\x02\\xbd\\x9d\\xee9\\xcd8\\x1c\\x98_\\x05\\xc4~s\\x90nz+"
  430. },
  431. {
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeeh\\xd3o\\x99\\xe3t\\x97\\xf6`\\xcb\\x92;\\x06\\x93\\xcb\\xe5\\xa0\\xa75\\xb9\\x08z~\\xe0$\\xec\\xc0\\xfdh\\xc2\\x00\\x9d\\xe9e4/u\\xa91(u\\x8e\\xd4\\x11\\xd2f\\xdf\\\\xb0\\xc9i\\xc2\\xc8[\\xf3\\xc7t.\\x80\\x7f\\xe4\\x80\\xb5.\\x8emm\\xa8\\x8fl\\x8ee+,kt\\xcb\\x1a\\xc4,\\xfec\\x13%\\xfd{=c\\x16\\xbah\\x95\t\\xf9\\x85&:\\x1c$f=\\xa3\\x84%trt\\xf3>9g\\xcb5\\xf9\t\\x0e\\xeb\\xd0m\\xb3\\xc2\\x8a\\x98&\\x10\\x1a\\x81\\x92\\xcc\\xc7\\x9f\\xf8\\x85\\xeb\\xe37a|f-\\xa7\\xa8\\xa694<\\xc2\\xfe\\xca{d\\x05m\\x0e\\x8a\\x17\\xfa|\\xd1u%s'*\\x84=\\x84\\xfa\\xe4\\x90\\xeem6\\xa7w\\\\xe6#\\xf6\\xcd\\xf4\\x1dm\\xac\\x1f\\x12]d\\xb5y\\xbb\\xea\\xf8\\x88bc]l-j` \\xfe\\xb3\\x7fx\\x89'jq\\x02\\xe0\\xa3\\xc1{\\xb45\\xe6\\x00\\xd1e\\x9a'\\xb0\\x1e.\\x80qo\\x1c\tx\\xa0\\x1b`\\xca\\x13\\x06\\xba\\x80\\x92\\xda\\xb6\\xfbo\\x1f\\xe4\\xd1j\\x9c"
  433. },
  434. {
  435. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0n71^\\xe5s\\x8a\\x0c\\x19\\xdbvx\\x88\\xbf\\xae\\xb5\\x08\\x90o\\x9a\\xc4\\xbf\\x84\\xb9\\x844)\\x94\\xa0k^\\x88\\xa3\\xbe\\xa1ue?\\xb8v\\xbc\t\\xe6\\x0e\\x91`\\xbd]f\\xc0\\x19\\x10\\xdbn\t\\x92n\\x97\\x99\\xe4\\xdd\\xda\\xa8\\xcc>\\x12px\\x90:q'wk\\xb1\\xb4\\xff\\xdf\\xd3\\x90'\\x13nc\\x18^\\xe5\\x95|\\xf64}\\xbd\\xd0\\x0fp\\xd7\\xe3r\\xd8\\xe6\\x13\\x8b\\xe3\\x8e\\xcc\\xa09\\xa49\\xa0\\xa2y|\\x05\\xbdev\\x99\\x97*:v}\\x04\\xc9\\xa1\\xd3\\xcc\\x88\\x11g&\\xde\\x81\"\\xdc\\x8a\\x8c\rd\\xdb\r\\x03\\xdd4\\xfd\\xdcc\\xec\\xc9p\\x1a\\xdb\\xad\\xb1\\xb8\\xe7\\xdc\\x8cx\\x0c\\xd8\\xf9\\xb7\\xcf\\xa3sr\\x0b\\x8c\\xce\\xab\\xdfje\\xdc\\xe8\\xb4\\x85\\xdb\\xff\\xd4\\xedf\\xc0\\xa8j\\x92\\xe6\\x9c\\x7f\\xae\\x82\\xef{'\\xa5\\xcb\\xa9h\\x04cl\\xf7\\xa0bq\\x82h\\x1a\\xef\\xaf\\x94;s\\x02\\x90\\xc9\\xe3\\xc7\\x9f\"\\xbf\\x86\\xe9\\x86\\xf1y\\xa2\\xba\\xf5^\\xaf\\x10\\xba_\\xa7\\xcc\\x17\\xe7\\x9f\\xa6\\x9c\"\\xb3\\xc8\\xc9\\xc6x"
  436. },
  437. {
  438. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xcf\\x0e\\xf2\\xdd\\x17\\xd1\\x07\\xa1\\x84\\xe4^\\xe2\\x1489w\\x84b\\x85\\xb393 &7\\xd3\\x13\\xf8\\xae\\x9e+\\xbf\\x13\\xf9\\x94\\x081\\xd5\\xcd\\xa9\\xb8x\\xd9i\\xb6\\x1b\\xdf\nufd\\xcd[,\\x17\\xa8l\\xa2\\xd4\\x98\\x96\\xac\\xe6v\\x93v\\x7f\\xd4\\x80w\\xfey\\xc7\\x83+\\x1f\\x80'\\xcbqnuipm\\xe0\\xea\\x1a8\\x0f\\xa4{y\\x16\\xbf\\xb4xs\\xc1\\x10\\x8d\\x1c\\xad\\x1dw\\xe5tc*=\\xad\\xa8\\xf1nu\\xbc\\xbc\\xd23^4&\\xafkt\\xc6n\\xb4o\\xf9imj\\xc2x\\x0fgs\\x9c\\x16\\xed\\x8d\\xd6\\xd0\\xef\\xe3&\\xae\\x1d{9\\x1b\\xc7z\\xd5l\\xe2\\xf5\\x8d\\x98wh\\x14\\xdfz\\xd2\\x1c\\x814\t\td\\xafjp-\\xddl\\xd1\\xf4\\xa1.\\xd1l%\\xdd\\x94&p\\xb9q\\xa5\\xdf.e\\7\\xe9a\\xd5\\x06\\x06\\x067*;{\\\\xab\\xa1\\x923\\xe3\\xe8\\xfe\\xe8_\\x88\\xa0\\x19\\xab\\xf0\t\\xbc\\xbau\\xe1/\\x9f\\xed\\x8d\\xcd\\x03\ndvc\\xadk\\xf7b\\xbf\\xd0u\\xcf\\x13\\x13\\xc8w`"
  439. },
  440. {
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t}\\x84\\x0b\\xd5\\x9b-\\xd9r5\\xf0\\xc6\\xd8\\xd9\\xc1\\x95n\\xde\\x19+\\xd5\\xc2\\x97\\x94\\xda|y=\\xf7\\x88 \\xac<\\xd3{c\\xdb\\xf0h\\xbby\\x9c\\xd0\\xce\\x16\\x96u@\\xb9l\\x90\\x02+t\\x94e\\xfd\\x0c=\\x1a\\xc0\\x80j\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9bfh4\\xd1\\xb5\\x02\\xaf\\xff\\xf0\\xc30\\x8ap\\x01>;\\xd9d]v\\x1dk&n;\\xb8\\x15r\\xb3)\\x9c\\x11-\\x16\\x96z\\xf1\\xe9{\\xf1\\x98\\x11\\xf0\\xa1s\\x92\\x1c"
  442. },
  443. {
  444. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xe7z\\xee^q6\\xf8\\xd4\\x02\\xaf\\xbc\\xb2\\xaf\\xfd\\xa8h\\xb9\\xe7p\\xb6\\x97\\xc72\\xb7u\\xd3\\xa1h+\\xb34\\x11\\x01\t\\x8f\\xee)|\\x9b\\xb2\\xc2\\xb0\\xdd\\xf779\\xc8j\\x1fw\\xad\\xed\\x82\\x83\\xf3\\xf8\\xb5ug\\x90'\\xb9\\x8a$\\x1d\\x8e9w\\x97(\\xcf:z\n\\x07\\x95i\\x9f\\x0b\\xb5\\xfdv&=\\xfa'\\xc1\\xb4y\\xa4\\xd5\\xdbopu\\xd0\\x1a\\xfb\\x81\\x90\\xac\\xdf\\xbb\\xaa\\xaa\\x17\\xa0\\xe7\\\\x96\\xe2\\x1fg\\xe4\\xdf\\x8f\\xd9\\xd4\\x15\\x8a]\\x95\\xcaflq|iv\\xc92\\x98=n\\xfd\\xbf\\xfb\\xa7[\\x14=\\xb8\\x95\\xf7n w\\xd6\\x88\\xb4\\xcan\\xf8\\x0e\\x013p\\x1b\\xa3\\x15k9\\xeeum\\xb1a\\xfa5\\xecg,g\\x88\\x9b\\xfc\\x99s\\xa1\\xd5(\\xc7\\xe4\\x82\\xf5*g\\x02le\\xe0\\x94\\x00\\x131ed\\x8f\\xc8\\xdf\\x867({\\xea22\\xcf\\xfe[\\\\xd85z2k\\xdc<g#\\xc3k\\xd3uxv\\xf8\\x93\\xb6\\x8b,p\\x85^x\\xce}\\xba']\\x0e\\x12y)\\xc8\\xd5\\xb9\\xedy\\xb1"
  445. },
  446. {
  447. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8\\xf7\\xe9\\xff1\\x9e\\x0c`\\xd8\\xde*cs\\xcc\\x9d\\xc4\\x94\\xd4r\\xaa\\xfbn.\\xa20a\\x8b\\xc1?n\\xd9v\\x04\t\\x80\\xc1o\\xbd\\xf7\\xaf\\x1fk\\xae\\x02\\xad\\xab\\xc9\\x01\\x1f\\xf0\\xc9\\xe89qv\\x1a\\xbe\\x94\\xc9n\\xe8\\xeb\t|-y\r\\xa4h\\x15\\xfc\\xbe\\x8fy<\\xd4m\\xf8\\x10u\\xf0\\xbc\\x97os\\x91\\xb1\\x94\\x03\\x8b\\x86\\xfa4\\x0eg\\xe6m\\xaf\\xb6\\xddtk\\x87\\x9b6\\xcd\\x95\\xf6\\x01\\xe2\\xdfw\\xcch(\\x04'0\\x80\\xb1\\x95\\xf9\\x0c\\xba%\\xec\\x8d51\\x9a\\x01\\x15\\xcb5\\x1at]&3q\\xbc1\\xec\\xfc[\\x9c\\xd9,\\xe15\\x9c\\xff\\x8b\\xean~\\x0e\\xb8h\\x86\\xaf\\xd9\\xb8t\\x1c\\xc1k\\xa6-\\xc4\\xac\\x87\\x81!wa1\\x1ea\\xee\\xbc\\xce\\xaa\\x07\\x1b\\x95\\xc4m&\\xdc\\x8b\\xfd\\xb4\\xa3\\x15\\x90^;&q\\xcfy6\\x1d\\xe3\\xcau\\x08@\\xc2\\x10\\x9a\\xb4p\r\\xa8)u\\x03\\xba\\xf8\\xad\\xa9\\xea\\xfb\\xc3l\\x9f\\x07\\xd5q\\xd6\\xc4\\x8a@\\x17\\x19\\xaf\\x83\\xcae\\xb3s\\xc3\\xb1\\x1d}cw]("
  448. },
  449. {
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\x12\\xda\\xfe\\x91]\t\\xdf\\xc4\\x1d\\xabyr\\xd615\\xac\\xce\\x96\\x89\\x0e\\x8d\\x9b\\xbf\\x0cg\\x04\\xde<\\x8e\\xeep\\x15vn\\x91\\xdd\\x0b(\\x10x\\m\\xbdr\\xa6\\xb9\\xb9\\x1a\\xe6\\xe8\\xde\\x7f\\x98\\xcdn\\x98\\xbf\\xba\\xe8\\xac\\x17\"!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a,\\xf0\\xba\\x15&\\xa4\\x15\\xb8[\\x1d=\\x17\\xc9\\x1d\\xb5o\\xc3\\xd2npix\\x11\\x9b\\x96\\xe4\r\\x1e6i\\x8e\\x88t\\xff+|ay\\x9f\\xe8\\xc4zo8g\\xec\\x88"
  451. },
  452. {
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ne,\\xb5@l\\xb5\\x9a\\x07jc\\x9ed\\xfa\\xe5\\xc8.\\xe5\\xeb\\x0e\\xbb\\xe7\\xda\\xf8\\xf9\\xccs\\xfb\\xf4\\xaa\\xbf\\xcc#\\xd3\\x00b\\xc1&\\xa9\\xe9\\xb9'_g\\x14%\t\\xba\\x17\\xac\\x18\\xa2\\xe3\\x94\r\\xb96:w\\xf7=\\xeb\\xea0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\xbcit\\xf5\\xa3\\xda;\"\\xde\\xddo#\\xdb\\x81;{&\\x01\\xa6.\\xadj\\xd9x\\x0e\\xae\\xda\\x89\\xbb\\xf9\\xaa\\xf1\\x92\\x9d\\x01\\xe3\\xfag\\x07\\x01}\\xfa\\x8fdf\\xc2\\xaa"
  454. },
  455. {
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xbes*p=\\x91\\xc1\\x0c\\xed\\xff\\x91\\xb36bp\\xbd\\x1f-y\\x9e\\x1dxwi\\x10\\x86\\xbae\\xb9\\xda4\\x030\\xa6\\x8d\\xa3r\\xefn\\xe0\\x94\\x85r\t\\xb0\\xc8+\\x9a\\xb1\\x93\\xfco\\x94\\xb30\\xa7\\xd4\\xa4m\\xc9\\xd8\\xb8\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\xbc\\xfa\\x03\\xfb\r\\x1anm\\xcanf\rv\\xbc\\x9bw\\xf8\\xa6de\\xc2r\\xa2\\xce\\xbf\\x1d\\x91o\\xfe\\x90\\x7fa\\xe6\\xd2d\\xe8\\xb54\\xee\\xb0`\\x1f\\xb7\r\\x03\\x19>"
  457. },
  458. {
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\x12\\xb3\\xe3*\\x87h8\\xd8\\xd0\\xe2\\xf6q\\xacw2\\xfe\\x15\\xe9\\xf4\\x94&\\x07\\xa8q*j?>&\\x12\\x10\\xe1n\\xa9\\x99\\xdcu\\x81v \\x837e\\xc0\\x98\\xc7\\xbd\\xda+o\\xb0\\xac\\xb5l\\xfd\\x92\\x17\\xfe\\x9f\\xa1s\\x91t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1cwc\\xf6\\xbc~\\xbd \\x82w\\xb6\\xef7\\xa6&d\\xe60\\x9a\n\r\\xfa\\xf4\\xea,\\xfcsc\\x16\\xe9\\xca-2\\x81\\xdc\\xcae\\xcfd(k\\x86ni\\x9c\\xb0\\xd1]"
  460. },
  461. {
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd=\\xad\\x89\\x13d\\xb2\\x832\\xc4l\\xbb\\xf8\\xe3\\xda}\\xb4\\x14\\x0e5\\x8en?k\\xabb\\x90i\\xe8_\\xcf3t\\xbf\\x86r?f[:d8\\x8a\\xefs\\xd4k\\xd6\\x9ba\\x93\\x0f\\xbf\\x94\\x9d\\xf7tg\\x80\\x9d\\x14\\xffo\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?to\\xabe\\xe8\\x89\\x83\\xddo\\q\\x15\\xc3d\\xb9cx\\x83\\x85\\xf0w\\x1ac\\x9f\\xa2\\x9f54\\xd1\\x9a\\x06\\x1fm\\xa7\\xba\\xfa\\x07\\x84\\xeacke\\xf3v\\xc5:_"
  463. },
  464. {
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#g5\\xd8\\xf6q\\x9f\\xe7/\\xe4\\xaeg\\xd6\\x80\\x9d\\x87\\xb9\\xd9\\x17\\xb5)\\xcd\\x00\\x9dgc\\xbe\\xe4\\xdd\\x81\\xbd\\x1b\\x1d\\x8b\\xce\\x97w\nf\\xc0\\xd8d\\xec\r[;\\xae\\x99\\\\xc8\\xe9\\xf3se\\xddl\r\r\\xeaf{\\xb4:\\x1b{\\xdd\\xb9\\xe3\\xe8\\x92xs\\xd2]t\\x05\\xf0mr\\x9e\\xdb\\xd1\\x9d\\x98\\xaa\\xa6\\xb7\\x85\\xd5\\xe6\\x00\\xd9\\x97\\xee\\xd0\\x8b/q/\\xb5a\\xe6\\xb4\\xd6\\xdd?\\xf4\\xe9\\x16\\xf3\\xc4\\x08,\\xce\\xcb\\xde\\xbd\\x1fp)2\\x89\\xb9\\xfd\\x8f\\x80\\xeby\\xbbp\\x94j_\\xe8e\\xa6\\xc86l\\xa5'n%\\x08\\xc20@x\\x11v=\\x12\\x90\\xefa\\x94\\x81\\xc1\\x98\n\\xaf\\xe9<4\\x1a\\x18\\xb6\\x9c>\\a\\xa9e\\xa92\\xd8\\xc3\\xdcix\\x07\\xdb\\xea\\x1c\\xec\\xf1\\x01\\xefa\\xfe&\\xde\t\\xa5\\xbe=\\xb5\\xecp.\\xbd\\x80\\xb3\\xc8\\x11\\xbb@\\xd8\\x9d>=&\\xdf\\x95\\xb15\\x8dgxs\\xd4\\x03\\xd7\\xae\\xdb\\xa3\\xff\\x95*h\\xa9\\x10\\xd7\\x15c\\x87\\xd6\\xc0\\xa9u\"f\\xe6<\\x0e\\xe2\\xc7r\"\\xe5\\xaa"
  466. },
  467. {
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=o\\xef\\xcf\\xc3\\x8b\\x8f&[\\x83\\x84\\xda\\x9exu&\\xb5\\xea\\x87xjte\\xed\\xbe\\xe1\\x01y3\\x99\\x8b\n\\x91~\\xc7\\xa1n\\x87\\x18\\xc5\\xe5\\xb6r\\x99;\\x90\\x9d\\xd5\\x05\\x13o>\\xf9@i\\xebg\\x96\\xcb>\\x0e]\\xc7\\x1c[\\x1f.x\\x92\\xc9\\xe5t\\xf3_l\\x05\\xc9ld\\xf3\\\\xfa\\x13\\xb4\r\\xce\\x00l\"\\x94\\x91a\\x94\\xae\\xf8\\x032\\x96\\x1c\\xb2\\xe2\\xa3\\x1bytu\\xbf\\xed\\xff#\\x9fm{\\xcd\\x90i\\xdc\\xd5\ti\\x96!]\n\\xc8%b\\xdd\\xfc\\xba\\xad\\xebc\\xf3\\x10t\\x18\\x81\\xf6`\\x1e$\\xa5\\xeb\\xc5x\\xc0\\xf1\\x9f#\\xeey\\xc3\\x15\\x85\\x16em\n\\xf2\\xa9umo\\x0f(3#\\xc2\\xdf\\xf6\\xd6d\\x19\\xda\\xd4@\\x11}\\x1a\\xad.\\x96\\xa2\\x8f\\x15-\\x0e\\xbfu\\xe44\r+-\\xa1dt\\xe2\\x10\\x9et\\xcc\\xbf\\xe3gdi\\x80\\x91\\xc9\\xfb\\xeek7q\\x84\\x8f\\xf3\\x8b\\xf5\\xabx\\xb1\\xdb}\\xb3\\x00\\x10\\xbay\\xf5\\x92&\\x94\\xe3\\x9cxh\\xeaf\\xecx\\x91i\\xb7\\x95l\\xfa\\xa4\\xfa"
  469. },
  470. {
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc12\\x8d\\xb2%(\\xb0\\xe6.\\x84 \\x18\\xcf\\x07\\xcei\\xe0\\x97\\xb0\\xa3c\\xe4\\xc4\\xf4\\x86x5\\x03g4\\x17\\xffr\\xb25\\xfa/h\\xac\\xf8u\\xcc\\xe8w\\xf5~f\\xec\\xe8\\xc9o\\x19\\xc2\\xe9c\\xc0;\\x18\\xa8c\\xba(\\x03p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\x1b|b\\xe1i\\x9b0\\xea\\xa7\\xbd\\x94p\\x9e\\x83d\\xdc\\x9f\\x8c\\x0cu#\\xa6\\x15\\xfc\\xf3w\\xbc6\\xefy\\xaf\\x7f\\x04\\xf2\\xef'k\\xd5\\x85\\xe4\\xaf\\xd6\\xc46~\\xf8z"
  472. },
  473. {
  474. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08d\\xc0\\xcasq\\x9a\\x1e\\x8fe\\x99\\xdd\\xa0\\xbe7\\xd0m\\x8a\\x9d\\xb8\\x15\\xe8\\xb4\\xd9\\x88\\xfc\\xb7\\x1c\\xd9\\x19\\xa2\\x1d\\xda.\\x82\\xdd\\xbd\\xb4&\\x0c\\xa6\\xfb\\xa1\\x93\\xe6\\xbc\\xbb\\xec\\xc4\\x19+\\xec9-\\xbd\\x9a|\\xfeh\\xebsw3\\x8d\\xde\\\\xab\\xd4\\xddc\\xb4t\\xc2f\\x15\\xc1sh\\xbfk\\x13\\xbc\\x7f\\xd2o\\xb4\\x7f\\xb6\\x94\\x05\\x11g\\xdf\\x8c,\\x06\\x19\\xe3#\\xe9hwb~}\\xd3\\xee\\x1d?\\xdc^xc\\\\xfa\\xeb?\\xeb6\\xd7\\x9c\\x93\\xba\\xab\\x88\\xf4j.\\xa7^1\\x90\\xd0\\xea\\x84\\x8f\\xe0\\x8bz\\x95jp\\xe8d\\xc6\\xe4\\x1e$\\x88(\\x1b\\x82\\x9d\\xb3\\x1clr\\xa7p\\xbd\\xa1\\xcd/\\x11\\x1f_u\\xed#\\xb6\\x1d\\xe4\\xf0\\xe1\\xb2o\\x9e\\xba\\x8b\\xaf\\x95\\xd0\\xf5j\\xf8\\x89*\\xdc\\xa1=\\xa1\\x9f\\x0c\\xf6\\x0b\\x87\\xa3'f\\x82d\\xaa(\\xba\nfj\\x7f#t\\x8f\\xeb\\xca\\x97\\x985:)\\xf0\\xd8\\xbf\\x93l\\xf0\\xd8\\xac\\xda\\x7f\\x8d\\x8f\\xb4k\\xa9\\x1a{e\\xb73\\x8dm`^_}\\x1b\\x0c\\x18\\x1ac~\\x9f"
  475. },
  476. {
  477. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab`\\xba\\x08\\x8e'\\xe8\\xe7\\x10 \\x15\\xad\\x8c\\xd8\\xa5\\xa4\\xc9.\\xa9]\\xde^\\x19\\x8ad|\\xddo[`\\xa9\\xe8\\xee:\"8\\x9bc\\x9c\\xa2\\x18\\x87yh\\x1a@\\xbeq\\x07'c\\xb5\\x01\\xb8y\\xce\\x1d\\x05\\xa8\\x99\\xff\\x1a;s\\xb3\\xbf\\xaf\\xd4#u#el\\xb9\\xd3\\xf1\\x80r>'\\xd6.n\\xe5)\\xf6hc\\xbb\\xf4\\xadc\\xf5\\x0c\\x99\\x90\\x1d\\x15>\\x0e+lz^\\x8em \\x9c4}o\n\\x14q\\xe8\\xbe\\xf3c\\xd1\\xd5wf\\x15\\x18\\xd4\\xeb\\x06\\x90\\xac}dz4\\x87\\xa9\t\\x03\\xb7<\\xc7vb\\xce,4\\xd0\\x9c8`\\xfdn\\xaf\\x99\\xf7\\xa3yj\\xd0/t\\x9aa\\xfb\\xdb\\xa2\\xa5\\xd1!\\x93\\x93\\xb7\\xbd\\x03\\xac<\\x89h\\x96sw\\x8b\\xdd\\xee\\xa4_\\x0e\\xb0\\x7f!\\xcd\\x9cwtt\\xca\\xa6\\xe6\\xfdn\\xa5\\x92ec\\x03-\\xe7z\\x17\\xbb\\xd4\\x1a\\xd89\\xeb+\\xd5`\\xe1&\\x9b\\xc1\\xf8\\x90/p\\xc5\\xe1\\x13\\xb4\\xc8v\\x8f\\xd3\\xb3\\x12\\xc2p\\xc9\\x8a\\x02<\\x06v\\xfa\\xec\\xcay\\xa5\\x90\\x94\\xd4"
  478. },
  479. {
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\x83%\\xe3[w\\xd6\\xb3\\x0e\\xad\\x84\\xaev>k=\\xe69\\x19\\x067\\xb8\\xc3(\\xebu8^\\xdf\\xf5n\\xa90\\x03&yp2pp\\x86\\xd1\\x8d\\xd9\\xe8/b\\xed\\x08\\x8f\\x9fc\\x8a\\x10f\\x8ce\\xd7^\\xa4\\x0b-p9\\x7f\\x80\\xbc\\xd8\\x0b\\xeeo\t\\xab0z\\xd9\\x07\\xd1\\xbe\\x03r\\xfbne\\x9d}2\t\\xf9\\xb8\\x03w\\xfaz\\x02\\xa6iqbc\\xd19t\\xa5f\\x96\\x03\\x10\\xb1\\xbev\\xf7\\x15dxh\\xcc\\x0e\\x8a*j\\xdc\\x14\\xcc\\xc8\\xaa\\xfb?\\xbd\\xd457k\\x14\\x8c\\xbc\\x89_%\\x86\\x84\\xaa\\x1b\\x966o7\\x94\\x15\n\\xe4~\\xdb@\\xa0\\x1dki\\xac\\xa9ci<\\xe5t\\x02\\x08#s\\xbf\\xdb\\xc0%7\\xfdu\\x82?\\x9fk\\x1c\\x1ag\\xe0l\\xf6\\x96\\xab\\xfe\\xbf3\\xef0@*'\\xb8\\xe6\\xab\\xb40\\x8c\\xd60md\\xa2k\\xf7\\xf2ypr\\x83\\x0e\\x9d\\x8c\\x9cw\\xbe\\xe2v4\\x11d\\xe0&\\x1d\\xa7\\xbe\\x1c3\\x8d\\x0c8d\\xf9f\\xa8\\x9ee\\xb0\\xaa\\x0ed\t1d\\xdb\\x1a\\x13"
  481. },
  482. {
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc5\\xe8;\\xe7n3\\xbd\\x9as\\x92\\x1e\\xc0\\xc6a\t\\x90\\xe9 rb\\xebnui+t\\xef\\xffq\\?y\\xc5y\\x89c\\x9c\\x17\\xc8\\x94\\xba=\\xba\th\\xaad\\xc1i\\xf9\\xad\\xd8\\x0c\\xdca\\xb0)\\xf3s\\xe7+\\xf0\\x9e\\xc4c/\\xb2l\\xb5\\xba\\xab\\x965\\x00\\x8bk\\xa34\\xd7b\\xa4\\x7f\\xff4\\xc0\\x1f\\xcaa\\xb6\\x0c}]r\\x1d\\xeeqf\\x10\\xf2- q\\x9bw)\\x94`\\xf0\\xbf\\x91ux\\x8b\\x13h\\x19\\xa1\\xabv\\x8bnr\\x03\\xe6ph\\xaat\\xea\\x06\\x9ax\\xac\\xbc\\x1deu\\xac\\x1c\\x82\\x1a\\xd2\\xdd\\xf4.\\xf8\\xc1@t\"\\xe4>\\xf6d&a\\x9c\\xb3\\x90\\x15.\\xd3\\x05\\x8d)}\\xcb\\x89]$\\xa1\\xf8\\xab\\x83\\x1d\\x93\\xc9\\xd5\\xa0<\\x18^\\x04\\xa6a'\\x8bb\\xb4\\x8a\\xfc9\\xd6\\x1c(\\xda\\xe3?\\x17\\xfc\\xcb4\\xe7\\xfc<\\x8a\\xa3\\xc6\\x1d_3\\xab\\xff3\\xd7,\\xbdf\\x13\\xebu\\xb6\\xac\\x1b\\xb44a\\x8ddl\\xb7\\xf9#?(\\xd8\\xfd\\xfd\\xaf\\x9c\\xb7\\xb1h\\xc7\\xf0\\x82\\xea7m\\xb3\\xaf"
  484. },
  485. {
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0\\xc6{\\xbb\\xad\\xa3\\xc0\\xaf\\xc8\\x83\\xe2z]nl`:ue\\x1es~yg\\x94\\xa4+40\\x18\\xcak>\\xe6] \\xb9\\x98:a\\xb4\\xe3\\x07]r\\x07ol\\xa1\\xe0\\g\\xf2\\xa8\\x8a4\\x81h\\x10w\\xbb\\x99\\xa2h/o|?\\xe45\\xe9s\\xd2*\\x82\\xd7!\\xf2wyal\\x19\\xe2\\xa1\\x86\\xea\\x08\\x17/s9\\x90e\\xfch\\xed\\xeda&\\x91\\x81\\xb3a\\xa7\\xed\\x99\\xfa\\xf3uf~q\\xc7\\x1d\\x9f\\x00\\xee\\xc4\\xf9\\xb2\\xb2-\\xdf\\x19q\\\\xac+w\\x86\\xb2\\xf6+\\x88\\xf3\\xcf\t\\xe1j\\xb7+o.\\x926uyc1gc6\"%\\xa8\\x91\\xa2'\\x8b\\xe1c\\xdf\\xf5h6\\x06\\x1e\\x8a\\xfa\\x85\\x94\\xef\\x94\\x05ry\\x9f`}\\xd0t\\xf1\\xe5n\\xf4\\x97\\x17\\xaa#\\xfc\\xfd\\xab\\x1b\\x98\\x03c\\x927\\x9e\\xaf\\x7fm\\x06\\x85*\\x9e\\xba\\xd2\\xbbk\\xddq\\xd3\\xd0]\\xeck0b\\x1f\ru\\xebj\\xddc\\xc0\\x8e\\x04\\x1ay\\xcd\\xc7\\x19\\xa0\\xf8t\\x14\\xc8\\x95#\\x14\\xfeb\\xe5\\xdd\\xecb.\""
  487. },
  488. {
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\x9d\\xfb\\x03\\x93|n\\xa5_^a\\xe7e\\x96\\xcdm\\x9c\\x94\\x95\\xed/\\x10h`\\xfc\\xc8\\xf1#f`\\xaf\\xf0(\\x021\\xf9\\xb4\\xa6\\x87\\xba\\x80\\xe2^6\\x17\\x08\\x94h\\xfd\\xd38\\x99\\xfb\\xda\\x86\\x94\\xd256\\xac\\xc7\\xcf\\x8b\\x98pr'\\xd2\\xefx\\xec+m-i\\xcb\\x1d8v\\xd9\\xd4\\xd3\\xc7\n\\x07\\xc2\r\\x8eny\\x9b\\x90c\\xcf\\x98n\\x03\\x07(ne\\x0e(\\xbb\\x89\\xaa\\x89\\xca=_\\xc9\\xc4\\xc5rq\\xf0\\xbc\\x05qtg\\xcc\\xc7u\\x13e,\\xab\\x97^+g\\xf5d\\x9c\\x81\\x12b\\x8d\\xb1\\xfc\\xd3}\\xf2\\x88\\xc6\\xa4\\xea\\x15\\xd1\\xa0\\x92\\\\xab\\x1cf-\\xa1\\xc4vs\\xc6;rx\\xc3\\x9f\\x01\\x9f\\xf1\\x88l\"]\\xfd~\\xfd\\xcc?7\\x85ja\t\\xd3\\xf1\\xe1c\\xff\\xb1\\x05c\\xf0\\xe9\\xe2\\xfd\\xeaz\\x1e\\x88=j\\x830\\xc5\\xbfk\\x7f\\x18\\x12\\x13}\\xc8\\x8e\\xe4<\\xa9\\xd0\\xf1\\x04\\x06l\\xac\\x16\\xf65\\x8bj\\x13~\\xbd\\x8fn\\x89\\xcc>f\\x90\\x96\\xad\\x95a\\xe2\\xe7\\x9f\\x88\\x95\\x7f\\x8c\\xf8\\xd9"
  490. },
  491. {
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010tuy\\x88\\xb4\\xc3\\xe7%y\\xb4\\x81\\xe8q\\x1a\\xebd\\xee&\\xf3\\xa4c_\\x12\\x92t\\xea\\xa6\\xd3\\x10\\x9f\\xeee\\x87r\\x10\\x99\\xe8?\\xd8\\x01\\xa3\\xcd\\xd2\\x954\\x93/\\xc1\\xc8\\xaa\\x85\\xa6r~\\x0bb;\\xc7\\x98\\x8fh\\xbf\\xa7\\xfe<\\xe3>~h\\xdc\\xfb\\xdf\\xe7t\\x112\\xce&7k\\xdcx\\xff\\xd6<\\xec\\xc1o\\x91\\xba\\x9dx\\xf58\\xd1?\\xb9\\xe3f\\x1f\\xdac\\xcca2.mt\\xe7\\xb4g\\x9f\\xfa\\x01\\xc0?,1'g\\x10\t\\x9bg\\xdb.\\xae\\xb5\\xcd\\x18\r\\x18\\x94\\xe98\\x82\\xdd\\xc8\\x00\\xd3\\xf2\\xbc\\x12\\xfb\\xa4 \\xad\\xa3a\\xbbsn\\x1a\\xe4b\\x15f\\x9083\\x8dh1,\\xf8'\\x87\\xd2{kl#\\xf9\\x86qq\\x19tngi\\xd1\\xde\\xae\\xb80\\x0f\\x06\\x97\\xfa\\xfe\\xa3\\x80\\xc1\\xc2,\\xd0\\xdb\\xf9\\xd2w\\xa6\\xc4\\xd5\\x05\\xd2\\xcd\\xeefh\\x933\\xa2\\xc6f\\x1b\\xe1\\x8fb\\xf8\\xf0\\xaf\\x8f\\xc8|a\\\\xd6c\\x8a\\x06d'\\xb6\\xd7\\xaa\\x876\\x10\\xf15\\xd8\\xd7\\xb2y?\\x89\\x80vet"
  493. },
  494. {
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\xf1\\xd7\\x80\\x9c\\x0c\\xe7\\x02\\x01\\xe5\\xce\\x1c\\xd5\\xef\\x18r\\xdcb\\xd1\\x85s\\xae\\xf9\\x815\\x8f2\\x85w\\x1a\\xb7\\xce\\x86p\\x1f\\x00%\\x15\\xe4\\x9f\\x92\\xb5=\\xcc\\xda\\xd8\\x89[\\x82*x\\xe3\\xfcyc\\xac\"ve\\xe6\\xf5\\x8f\\xd3\\x16\\xf3\\xce\\xd7f@\\xb3\\x898\\x87\\x12i/\\xfad\\xde;\\x90\\xd2p\n\\xe7i\\x99\\xa5o]x\\xe3\\xa2\\x9e\\x18\\xf1a\\x93\\xa0\\x8d4\\x15\\xc5 \\x0f\\x14\\xd1\\k\\xd4\\x06i!\\x11qi\\x14\\xc2\\xaa^\\xe48\\xf6\\xa2\\xbao\\xd8\\xa7\r\\xaep}\\xc8\\x11\\xed\\x1a\\x06\\xa1ln\\x03\\xa2\\xa6\\xfc\\xe9\\xf6\\x86\\x00\\xc6\\xe0'\\xbe)\\xbel-\\x04\\xd3\\xa3\\xe5\\x91r\\x82l1\\xfe\\xb9\\xb0\\xe9,\\xc3\\x14\\xc0\t\\x95\\x93^\\x1f\\x18\\x16\\xfa\\xab\\xe5\\xdf\\xa7\\xc3\\xcej\\xba\\xff8\\\\xed(\\xef\\xb06\\xfej\\x89a\\xf6b\\x90m\\xd9\\x19brc\\xd7\\xef\\xf4<\\xb4\\xa2\\xdd\\x94r\\x9c\\xfb w.\\xd1\\xbe\\xacb\\xc1\\xf9\\x0b(\\x14\\x05\\\\x97\"w\\xa7\\xf1\t\\xb92\\xeb\\xb5>\\x9d\\x89)\\xf4\\xcd"
  496. },
  497. {
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\x9d/-\\x7f,\\xa9\\xa5)\\x83pf6\\x92udh\\xc3^\\xa26\\xa2i\\x97\\x84\\xc45\\x15\\xd9\\x06\\xb6\\x89\\xb6\\xd5:\\xebo\\xd72\\xba\\xdc2\\xf3\\x00\\x9c\\xaa*\\x8e\\x90\\x11\\x8a\\xb48\\x14\\xc7\\xe6\\xd3\\xe5#\\x88^\"\\x90k\\x19\\xbf\\x0bf\\xfd?75]\\xe5\\xa9\\x9b;\\xed\\x80\\xcd@vlp\\xa8vh{\\xc3]c\\xfd*\t\\xa3.\\x8b\\xc8\\xe4\\x07\\xd9q\\xe2}\\x96\\x1a\\xcd\\{\\xcef|\\x99c\\xc7/\\xe9w\\xb0'8\\x97\\x9d=\\xdc?\\xff\\xf4\\xba\\xa3azi\\x9f\\xae\\xb8\\xcf\\x8b,\\xc5c\\xa1\\xbb\\xc6\\x82k\\xc6\\xc1\\x9b\\x0b\\x97\\xe7\\xa4\\xe2\\x15\\xd9\\xdd\\x96\\xd9\\xe6h\\x96\\xc6\\x7fs\\xd1\\x8f5`\\x00\\x13l\\xb3h~\\xf4\\xb8\\xfb\\xeap\"\\x9d\\xe5^\\x08a\\xcd\\x99\\xd2\\x02\\x07\\xed\\xeb\\xa5\\x13\\x08q\\x02\\x08\\x9a\\xa2>\\xe6n\\x9a\\x0bdwh\\xec\\xbf\\xed\\x96s\\xfd3\\xee7\\xdc+!\\xae\\x0b\\x9b\\xb6y\\x16\\xbf\\xab\\x99\\xd1<\\xfe\\x0c$\\xc6|\\x1cl!\\x1c<\\xf8\\xa1b\\xfd\\xa6\\x03\\xda\\xa5\\xb9"
  499. },
  500. {
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9b\\xfa{(tr)\\xc3\\x0e\\xf9\\x0c}8]$n3\\xa8\\x97\\xc0\\xd5v\\x98\\xea\\xb2\\x8b\\xff\\xde\\xed6\\xa7\\xb3m\\xfb\\xc5!\\xdb\\xb3\\x81jr\\x87\\x94\\xf1\\x9392.\\x92\\xf7a\\x87\\xb5%\\x96*x\\xc4p\\xa7]\\xc3\\xc5\\xb4o\\x03\\xba\\xdcm\\xc3\\x1dd\\xe4\\xd9io\\x89\\xe0$\\xc5\\x0c\\xf94:\\xcf,u\\x02\\xaf\\x17hbu\\xa7\\xd5\\xb9%\\xd4%c\\xd9\\x9bl\\xdf\\xa2\\xaa\\x9esp&\n\\xf04\\x9e\\xa92bz\\x05\\x98\\xa7\\xc3\\xc1\\xb4\\x1d\\xbb|\\xa5\\xee_\\x95\\xb1h\\xa6\\xff\\xe1@:]\\xafu\\xd4\\xff\\x9ff\\x18/%\\xcd\\x82z1\\x8b\\xf7\\x9f+\\x08u\\xc9\\x96v\\xa8\\xaa\n#\\xdc^0w\\xc0\\x17\\x11\\x87\\xb8\\xfd\\xa1\\x13\\x8b\\xa5\\xb1z\\x15\\x1d3\\xdb\\x9c\\xc8v7\\x82i\\xafcn\\xcb\\x08#e\\x0bt\\xf0%\\xc0.\\xcf\\x11\\x052spr\\x03\\\\xc2qsmnj\\xd9\\x14\\xa9d\\x14d\\x1a\\xaet^i\\xd7\\xe5\\xac\\xa1r\\x08\\x96=\\x16\\xa5#\\xf93\\xc4\\xd1\\x93@\\xfdmmk"
  502. },
  503. {
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[\\x1d\\xd1\\xab\\xed[.\\x172\\x920\\x9d\\xa6\\xb6\\xdc^\\xf5\\x91\\xd8\\xa7\\xa0\\xe1\\x1c\\xfc\\xd4j\\xc91~\t\\xf9<\\x8b\\x9c\\x8d/\\xe9\\x1d\\x87\\x03\\x11\\xe0\\xa5\\xfc,\\xda\\xe8\\x1c\\xc3\\xe96\\x99\\xe9d(\\x11\\xd7ebr\\xcf\\xc1@\\xd1\\xd8\\xc9\\xbd\\x7f\\x17\\x95\\x81\\xd3\\x88\\x82\\xed3\\xb3\\xb5q%^f\\xbc^(\\xea\\x98^\\xac\\xba?\\x87\\xa2\\x96\\x99\\xc8\\x1al\\xb0\nj\\xcbc\\xfb\\x9b\\x81m\\xab\\xf5\\x16_\\xc1\\xb1\\xcf\\x04:\\x08\\xb3\\xc2\\x97{\\x13\\xact(\\xca\\xde\\xe9\\\\xe1c1-\\x9e\\x15\\xde\\x8b\\x01\nx\\xc2wiq\\xd6\\x9b\\xfd&_\\xac\\xf9g\\x8d.\\xce\\x0c\\xb0\\xcb.\\xacu\\xdf6y\\x02\\xf8\\xc3e\\xcd|e\\x86\\x8f\\xef\\xe0\\x8d\\x85\\xd2\\xb0qps\\x00\\xd3i\\xfd\\xf8p3\\xfe\\xc5m\\xa9[c\\x98\\xfc\\xf5c8\\xd6b\\x93\\x07\\x0f\\xcbbv\\xc5\\xa4\\xa1`\\x04\\xf6\\xc4\\xcf\\x98\\x10\\x11k\tq\t`v\\xfe2|c\\x9d\\xafb\\xeb\\xff\\x9ed\\xde\\xad2!\\x84\\x94\\x8d\\xdc\\x1fx:\\xf6\\xe7f\\xae"
  505. },
  506. {
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b0\\x15\\x93\\x8e\\xd68\\xd2\\xae\\xc7k\\x01\\xf6h\\xb3\\xa6p\\x82\\xd3\\xbf\\x9d\\xfd(j\\x0b\\xd2\\x87\\x9d\\xc3&\\x8c}@9\\xd0d\\x02\\xf3;?\\x10\\xe6d\\x1e\\x8dj\\xdej\\x8c\\x91\\xdd\\x07\\x80\\x16(6y\\xf1\\x91$\\x88\\xc0\\x13\\xd7\\x97i\n*#\\xba\\xba\\xd5\\x88k\\xb6c\\xe1t{\\x05?5[4\\xae\\xf7\\xd2{es\\xf9ec\\x02\np\\x82\\xe7\\xe2;\\x84\\xb8[q\\x17.\\xa8q\\xea\\xad\\xc5x\\x18=\\x03\\xef*td~o\\x83x\\xb6l9p\t\\x97\\xd1a&cm\\x14;\\x19\\xac\\xae\\xde\\xbc\\xa0m\\xb7o^\\xdcjk\\xb5s\\xccq\\xb2\\xdd\\xc2\\x93:4\\x01\\x05\\xd5r\\xac\\xa6\\x97\\xc0\\xdb.\\x93\\x068\\xa5%\\xcad;\\x11\\xeb5$2\\x7f\\x9c\\x00\\xd3\\x0f\\xf3\\x91\\x8e\\xb0\\x11\\xa0#\\x16\\x90\\x80\\xb43q(:[\\x11\\xd2q\\x10\\xa4\\x8cv\\xcf\\xc3\\x8f\\xcd\rn5\n\\x11\\x9f\\x07\\xab\\x94\\x97\\x07e4\\xd1cuph^<l\\xd6\\xfa\\xe1\\x06bag\\x8ckp\\x83?7m\\x94\\x18"
  508. },
  509. {
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91\\x0e\\xf6gk\\x9e\\\\x15\\xb2\\xc4\\xe6ui\"\\xf0g\\xdf\\x96\\xbf\\x01.p\\x8bv\\xfe\\x06\\xac\\x81\\xc4]\\x18n\\xee\\x92\\x92\\xab:\\xa5\\xaa\\xe4\\xfd\\x10~\\xd9\\x86r\\x90\\xe8k\\xa5\\xbap\\xe0\\xc7\\xf1\\xd3 \\x9e\\xd4\\xaf\\xfb\\xc8>\\xab\\x07\\x18\\x05f\\xbc\\xa9\\xbf\\x10\\x1d\\xf7\\xc3\\xc5\\xb5y\\x06\\xff(\\xae\\xa3>n\\xad\\xe3\\xaa`af\\xa4\\x98\\x8d\\xe1\n\\x03 \\x87\\xcc\\xdb+=h\\xe3\\x03s\\xf7#\\x95\\xec\\xdd\\xb3\\xae\\x9c\\xa5\n\\x0f\\xb3\\xc4\\x8c\\xa8\\xfa\\x02\\xa9) \\xcb\\x1e[\\xf8\\xe8='\\x8c\\x97\\xfb'\\x06\\x8b\\xe0b\\x97\\xc7\\xcc\\x9a}\\x85\\x90\\x9a\\xfc\\xc7\\xf9?i\\xcd^\\xc5\\x93\\x82*o}\\x9dl>~\\x12=2\\xea\\xc1\\x00\\x01\\xd4\\xb7[\\xf0\\x8er4\\x88\\x1ec\\x9fl\\xf2\\x12\\xef\\xea;\\xc1\\xfd>\\xddm_\\xb8\\x8cw\nr} \\xd7\\xf0\\xd1\\x88\\xb16p\\x87\\xb3\\xf7\\x11\\xad\\x89\\xf1\\x95\\xff\\xe4\\x87p\\x95\\xdal\\x10g\\xcc\\x89d\\xa6&\\xd8\\x1dj'yn\\x88\\xa3\\x02\\xc3\\x97\\xa0\\xfe\\xffci\\x93"
  511. },
  512. {
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xeb\\xa0\\xc1d\\x90\\x8b\\xb4\\xed\\x85\\xc5k\\x83\\x07\\x19\\xa7\\xac\\xf1\\x13cm\\x8ck0\\x04(\\xfd\\xfc0\\xe8ogp\\x1c\\x00g\\xe04\\x1e\\xd3\\xd3\\xd3\\x88\\xed\\xb2r\\x11\\x91t\\xa5\\x96h\\x0el,\\xfc\\x9c\\x19#\\xcc{\\xa0\\xda)\\x0b#\\xec\\xd8g\\xb2\\x83\\xf3\\xab\\xeb\\x19y<\\xbfza\\xce \\xc8\\xa1qjd\\xea\\x0041\\xcb\\xae.\\x17\\xbe|\\x87\\x023o\\x8b\\xb3\\xea\\x9a\\xdf6\\xdb\t\\xd9\\xd8\\xbfx\\x0f\\xd8i\\xea\\xdb\\xaf\\xb4\\xbbkb\\x9c\\xa3#\\xeb\\x16\\xe4\\xc4\\xda\\xcadw\\x07t,\\xe1\\xb5\\x89;\\xcegv:{\\xb8\\xbb\\xa2\\x02\\x97\\xbf\\xcbzur\\xcf)_\\xc2\\x9dna\\xab\\x98\\x1bv\\xfb\\x19h\\xdax\\xf6r\\x10\\x9b\\xab\\xd2\\xb4#\\xc3u\\x95\\x91\\x1f\\x95\\x84uhwbo\\xdd\\xb7b>\\xeea\\x01\\xdco\\xa6\\xae\\xa6\"\\xaa\\xc2,\\x7f\\x86\\xfc\\xb7:\\xac\\x0026[<\\x1a\\x08\\xf5x\\x1cut\\x14+\\x087\\xba\\x15\\x92\\xf0slw\\x14\\xb4\\x17\\xc8\\xdc\\x90%:\\x95^z\\xb2\\xebu"
  514. },
  515. {
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd` \\x82\\x7f\\xc8\\x95;\\xc7\\xc1\\x9b\\x00a\\x96\\xcaw\\x12t\\x94\\x88^\\xadbs\\xdbw\\xa09\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  517. },
  518. {
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xce\\xfe\\x98{1\\x19\\x1b\\x10\\xbe\\xdb|\n\\xe4\\xad5\\x85r/\\xa9\\x15\\x84\\x91\\x89\\xc5p\\xf6\\x1d\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  520. },
  521. {
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xcb\\xf5\\x10*of\r\\xbf\\xa4\\x01\\xd9\\xac{~:g\\xaag*\\xc2\\x1d\\xa8\\xcag\\x08\\x01\\xa1n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  523. },
  524. {
  525. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\x84\\x88\\xeae\\x94\\xb5a\t\\xe4\\xc28\\xaf\\xc2_~\\xc7\\xb1\\xad3\\xec\\x0e\\x0b|g/\\xfb\\xf4\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  526. },
  527. {
  528. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd(7\\x1b\\xe7\\xdfe\\xf2\"\\xa3\\xaf\\xbe\\xf9\\xa4\\x84\\x82\\xc3d\\xb6g\\x0ca\\xd7\\x17r\\xbc\\x15^x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  529. },
  530. {
  531. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xb9+\\x81\\xb8\\x10\\xd7\\xbc\\xae(\\xe9\\x8a!\\x88gj\\x9e\\x17 \\xe7%b\\xc9rl\\xdc\\x8e\\xf0\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  532. },
  533. {
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xd3\\xf5\\x11za\\x921\\x13\\x14\\x9d\\xb2j\\x93h\\x8f\\x1au\\x88]\\xce=l\\x10} `\\xe6\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  535. },
  536. {
  537. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb10,y\\xb6\\xda`]@x\\xf9qh\\xf7\\x1a\\xaa.\\x96\\x9d\\xf0\\x9e\r\\x8b\\x87~ic-\\x7f\\x0fl\\x1de\\x82\\xecu\\x93f\\xa8\\x16r\\xc9\\x81\\x18\\x9c?\\xc2\\xd4\\xa2\\xf4\"\\xbd\\xa0i#uq\\xe2t$\\x1b\\xa3\\x9d\\b\\x8e\\xa2\\xf2a\\x7f\\xc4\\x10\\xc0\\xd8^\\xa0x\\xa3 \\x19\\xed\\xa2a\\xa5\\xe4\\xf6\\x92\\xde>\\xb9\\xc8\\xf2\\xde&\\xe9\\xab\\xde=\\xbf\n\\xe1\\xd6\\xdd!@ ~\\x98h.*7\\x8e\\xfc\\xfd\\x90\\xe68\\xe7q_mh\\xbf\tm\\xdf\\xc0n\\xaao\\xe1\\xban\\xbc\\xf1\\xab\\x83\\xdd\\x03\\xca|\\xf0\\x902\\xaf|w8\\xfd\\x9a=ttty\\xf1 \\xfc\\xaav\\xc4\\x8f%\\x1e\\x16\\x90h\\x00\\xc7\\xd5\\xda\\xb3\\x02\\xfaw\\xc40\\xad0\\xed\\xa9\\x05\\xbc\\xb4\\xc6\\xe2\\x8a\\xf6j\\xd9z\\xe6\\x8a\\x7fv\\xfc\\xf2>f\\xbc\\xd9+\\xa4@>q\\x8b<\\x11\\xf9u\\x14\\x0b\\x95\\xabhb\\x90u\\x99-\"/\\xc8\\x89\\xdd\\xd5\\xcb\\x9e\\x1b\\x1cus\\x12\\xb0g\\xde\\xc5\\xac\\xef\\xfa\\x17\\xfb\\xaca\\xb1\\x8a\\xa0\\xcd\\xab"
  538. },
  539. {
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd3\\xc2\\xbf\\x1f\\xf99\\x0c-\\x88\\xe4n\\xc8ze\\xb3v\\xad=\\x06\\xecn_\\xd4c\\x9d\\x9a\\xadp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  541. },
  542. {
  543. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xf2z\\xa5a\\xb9d\\x02\\xc5\\xa0\\xaa\\x12\\xe6\\xfdy\\x99q\\xd9\\xd9\\xc2p\\xa7s=\\x08\\xf8&e?8\\x100\\x06\\x11\\xc4\\xb2e)\\xaf\\xd1a\\xfdzc\\x863\\x9a\\xe0*{o\\x8c\\x89\\xab\\x06\\x98r\"i\\xf3\\x02\\xdd\\xea\\xc7\\x94}\\xcd\\xf1c.>u\\xcat\\xd7\\xfe\\xe08\\xdf\\xc1\\xb8\\xec\\xd9\\xf8g\\x80\\x1a\\x81q\\xfb\\x07xc\\xbb\\xe7f\\xe5w9st[ed.dg\\x88\\xf9\\xce\\xf9!\\x98,\\xa2\\xa9\\x87\\xc8v\\x81k\\xf4\\xf5sq\\xcd\\x8ej\\xbd\\xe6\\xa5$>\\xb8wtg\\x84\\xd7\\x92\\xcb*\\xe9\\xff\\xce\\xcc\\xd8\\xc6bw\\x95w\\xdcw)p\\xb8\\x8d\\xbejz\\xdf\\xba \\xcf\\x93\\x80o\\x148\\xb4\\xd3t[\\x11\\xb1\\x08m\\x94\\xe6\\xa9\\xe4\\x83~\\x82r\\x0f\\xd0\\xd3\\xfax#3;\\xb2f\\xe0i\\xdb\\xd51\\xaf\\x87\\x9d\\xa4\\xd1\\x9ce\\xc0\\xaa\\xcb\\xbd\\x9dxknt\\@\\xf6u\\xf1\"\\xc18\\xab\"t1\\x96ljf,\\xbb\\xa4\\xad.\\x00yya\\xfb\\xf2e\\x1e$\\xa2\\xf1\\xfa_"
  544. },
  545. {
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h#\\xdd\\xb1\\xa6\\x19k\\x96pm&u\\x88<\\x7f\\xe6\\x80'|\\x9b\\xbbn\\x84}c=o\\x95\\xade\\xae\ryh\\x1c\\x82\\xe8\\x0f8\\xcfg\\xff\\x92\\xaf\\xb4$\\xdcv\\x8dr`+#`\\xb5h7\\x11\\xc9b\\x83\r\n4@z\\xd9\\xdb\\xbb\\x80\\xef\\xf5\\xe7\\xfb\\x163\\xday?!\\xeds>\\xa6\\xeb?\\xdch\\xa8\\xcb(\\xef\"^\\xe8\\xbc\\xbb\\xb9ua\\x12h\\x85\\xbb\\xdf\\xb4\\xa2\\xf0\\x7f\\x9b?g\\xda\\x1c\\x1f\\x86\\xba\\x90\\x9bf\\xe5\\xb6f\\xbf\\xbd\\xd9\\x13\\x80\\xa4c\t\tb\\xbdu\\xe6j\\xe7\\x05\n?\\k\\x93*y|o$h\\xadv\\x90\\x0e8\\xa16u\\x05\r \\x9a\\xa2!\\xa2[:\\xe55\\x91\\x85\\x0e?\\xa8\\x7fi\\x1auk\\xebg\\xbb\\x\\xb4c\\x80\\x13\\xdb\\xd3\\xbd\\xe9\\x02\\xab7\\xcc\\x16g\\xb6c\\x80\\xef\\xea6udf\\x99\\xa5\\xf6\\x11\\xbb\\xfd_\\x02\\x10\\x01\\xc5\\xd8\\x89\\xd1p\\x1e\\x16\\xf1b\\x0e\\xe0\\xdc\\xb8\\xf8\\x9f\\xeb\\x98\\xa1\\xd5\\xa9\\xcfe\\x8e\\x06\\x1cv\\x9ba\\x18\\xd1\\x99\\xea\\x90s"
  547. },
  548. {
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)4\\x92b\\xb5\\x82-\\xb2\\xd2p\\xd3\\xa1\\xa7\\x95\\xcfc\\x1cz\\x86l\\xaa\\xab\\x8d\\x91\\xa4d\\xd6f\\xaf\\xf8\\xc4\\xff\\xf8\\xfb\\xf8da4n\\xe8\\xddjd\\x97\\xdb\\x0eun%n~\\xddb\\xbdz\\xb4\\xd2m\\x8a\\xde\\xba,\\x81l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11n<\\xb7k\\x9f7=\\xd9\\xe2\\xef\\x14h\\x0b\\x1a9\\xf8\\xe4\\xb2\\xbb\\x98?\\x10\\xc5f\\x80\\xb8[ 3\\x86\\x0cj5k\\xbf\\xc3\\xedk\\xfe\\xb8\\xde\\xae.;\\xa8\\xd28"
  550. },
  551. {
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@x\\xeb\\x05z:\\xe2<f\\xff\\xf6\\x97\\xb7\\xe7\\x8fw\\x04hm\\x1c&\\xdc\\xd6\\xcb\\xe2;\\xb0\\x87\\xdf1y\\xca\\x9d\"\\xf1\\x87\\x8ci~\\xf3e\\x87*\\x80\\xee\\xaej)\\xc8\\xdev\\xf0\\xef\\xd9~\\xe5\\x97\\xa1\\x1a\\xb0-\\x0c}\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\xa3\\xc0\\x1d\\xfc\\xa2\\xceb\\xb7\\xff\\x83=\\xb3#c\\xb6\\xfe\\x08\\x83x\\xb3x\r~\\xb8\\xdf\\xde\\xd5f\\xd3\\x82g\\xeb\\x04*.\\xccs\\xe53$\\x8e\\xbe?a4\\x90\\x1b"
  553. },
  554. {
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xbae\\xd6\\xeb\\x1cy\\xafj\\x89\\xa0\\xbd\\x9c})\\x9f\\x8d\\x9b6\\xe6\\x9f\\xd8\\x80\\xc7\\x87za1f\\xc4\\xd1\\xb1@\\xf8qt{\\xee\\x01\\x0b\\xd6\\xc0g5\\x80w\\xce\\xfa\\x9ee\\xa6p\\xb9\\x9e\\x90\\x8e.\\xdd\\x9c\\xc7\\xfb\\xc5$\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000wby\\x1e\\x7fxf\\xbbv\\xe1\r\\x8dm#\\xb1\\xf4\\x8f\\xf8\\xf1\\xbc\\xa6c\\xe5\\xd0\\xc0o\\xef:\\x1c\\x95\\x04\\x9fq\\xab\\xc3_\\x1e;m\\xe5\\xd4\\xbdb`\\x91\\x9fl\\x13"
  556. },
  557. {
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xd7e\\xf7pq\\x15\\x82\\xe6m\\x08\\x12j\\x94\\xa0\\xc2x/4/\\xd9!\\xc2\"l<\\xece\\x10\\x1dh\\x84f(\\xa8x\\xb1\\xf0\\xdf0\\x1cghl-q\\x04og\\xe3\\xaf\\xc5'\\x8f\\x9f\\x94\\xbe@\\xb1\\xa1\\xc0\\xe4\\xb7=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000jd\\xf6@\\xec\\x98\\xeb\\xfa\\xbe\\xd3\\xf9n\\x90\\x11\\x97s\\xcaa^\\xa3\\xb9\\x9d\\x8d\\x9c{z\\xads\\x0f,\\xc2\\x08h\\xc2\\x9a\\x1d\\xc0\\xcf\\xf2\\x9b=yx\\xf7\\x913\\x8ed"
  559. },
  560. {
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xdf\\x1ac\\xe9\\x9c\\x8bew3\\xa4y\\x02\\xdd2\\xe7\\x18\\xfb\\xbdswai\\x92i\\xe6\\xed\n\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  562. },
  563. {
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd#\\xdc\\xba\\x11\\x96ew\\xd5\\xe0\\xf8c\\x96x\\xf3\\xd6\\xebb\\xb4\\xb5\\xf3\\x18\\x03#9e\\x1fe[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  565. },
  566. {
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdx(\\xe4\\x81\\x97\\x83\\xbd?\\xbayml/\\xf3\\x84\\x1c\\xe9v\\x86\\xca\\xfb^\\xa1\\xff\\xff\\x13-\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  568. },
  569. {
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfdip\\x86&\\x8f\\xb6\\x89\\x12\\x81\\x9e -\\x85\\xc8\\xf3s6e\\x80\\x10\\x9b\\xb9(\\x07\\xfd\\xc0\\x03m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  571. },
  572. {
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xd4\\xd4\\x08f\\xb6\\xb6\\x1f\\xb3a|\\xc9\\x99\\xfelco\\x06/\\xbfhp\\xbc\\xff\\xb2\\x85\\xcb\\xca\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  574. },
  575. {
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\x9e|g\\xf8!\\x1c\\xb5|`\\xef\\x8c\\x80d\\xc4\\x19\\x12\\xd63\\x99\\xbd\\xba\\xd4\\xa9\\xc7\\xee\\xf0o\\xea\\xbbq\\xe6#\\xfc\\xaab\\x99\\xfa=9\\x1b\\xee\\xa9\\x99pz\\\\xb1w\\x82|5~\\x84\\x96\\xc1\\x11e\\x06\\xbf\\xd4\\x8b1\\xf1\\xc6\\xbbg[\\xee\\x10\\x84\\xb02>\\x82\\x9df\\xfb\\xb4\\xc89\\x0c\\xd5\\xb3\\xd5\\xd1\\x84\\xa8e\\xc0\\x07\\xbeglb\\x86{\\x9c\\x9d\\xf2&\\xc7e\\xd6\\x01\t\\x95\\xff\t\\xfa\\x95i\\xdc\\x10\\x9a/\\xb7\\x86\\xa6?\\xbf\\xc8\\xc0;=\\xe2e\\x1f{\\x98\\x953\\x03\\x86\\x95\\x16\\xbb\\xff6\\x0e\\x87{\\x94f\\xff\\x9a\\x9f\\xeabhir\\xf2.\\xe1\\x9b\\xfd\\x98\\xbe\\x91q\\xcev\\xa0\\xfb\\x14\\xc5\\xae\\x10xj\\x8e(6v\\x8a\\x9fr\\x93.\\x80\\xbe\\xc8\\xa7\\xc8]\\x8e\\x92b\\x9b\\xa7\\x0b\\xd81\\xa9\\x01\\x8c\\xa9\\xc7\\x8ec\\xef\\xb4\\x9ed\\xa2\\xcf5\\xda\\xb7\\x8a\\w\\x03n\\x83\tx\\xfb%\\xa9y\\x16\\xfc\\xd9\\x1bsr\\x91,\\xadp\\x95\\x9e\\xfbq\\x84\\xcd*j\\x8c,\\xc6\\xb5\\x94\\xa3\\x17\\x00\\x83\\x08k"
  577. },
  578. {
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97\\xd0\\xfch\\xf8\\x00\\xb9\\xc8u7\\xb9\\x8a\\xdc.t\\x88\\xab\\x9an\\x80\\x03\\xf2t\\xd7t\\x88\\xd9\\x948\\xf2sy\\xfb}>\\xed\\xa4e\\xbcv\\x809\\x85rt\\xe1-8\\xee|7\\xbd`7'\\xc3%+\\xba\\xedk\\x8a\\xc3\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000qs\\xcfc\t\\xac;t\\x10n\\xe7j\\x04\\xcb\\xde\\x1ehqh\\xc7\\x13v>\\xd8\\xa8\\x07f\\xa2\\xc3\\xb2\\xff:\\xa2\\xf5*f\\xf5\\x13\\xb2\\x8c\\xcd\\xfd\\x0f\\0\\x98\\xba\\xbf"
  580. },
  581. {
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\x99\\x85\\xf3e\\xa7\\xb8\\xb7\\x10\\x0fsr\\xc3'\\x0c\\x03\\xc7\\xc5\t\\xd12e'f\\xbar\\x08py\n~\\x1f\\x02\\xc5\\xc6\\xb2;\\xfa ,o\\xb0\\xc5\\x8a\\xef\\xf5\\x83\\xfdf\\x19\\xa5\"\\x91\\xc9!\\x18\\xba\\xab#\\x035\\x8dbu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\x8f\\xf6\\xafh\\xd8e\\xc7\\x7f\\x9a\\xb4g\\x9a\\x1c\\x8f<xk\\xea\\xd0\\x00%t\\xc9\\xfdx\\xaf`\\x0c\\xa1\\x98j<\\x9et\\xe2\\x91#\\xff\\x9fa\\xc2\\xe5\\x12\\xc14\\xfa\\xc1"
  583. },
  584. {
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\"\\x83\\xc3l\\x811\\xa0\\xd7/\"\\x1ex\\x9b?\\xcde\\xc91>i\\x8dk\\\t\\xdbt\\xf8b_x\\xa3\\x87\\xa4a#i1ar\\xe88dv\\x05\\xa7(\\xbc\\x1ba\\x13\\xb6\\xa7\\x15\\xf3\\xda=\\x7f(w\\xb1\\xe5$\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8ai2\\x0f\\xae\\xe5\\x9b\\xe6\\xc0\\xfb\\x1d\\xee\\x93al\\xe1\\x8d\\xf5\\xdf]\\x89\\x91c\\x00,=+&f\\xe0oq\\xb8\\xdd\\xdb?m\\x80\\x81\\x83\\xa5h\\x93y\\xbbc\\xb4\\xd5"
  586. },
  587. {
  588. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xdb\\xc6\\xfc\\x0f\\xff\\xc7\\xe99\\x107\\xe9\\x84\\xd3\\x00&\\x17l\\xe3\\xad \\x00u`x\\x13\\x96km9\\x01:m\\xe5\n\\xc8b\\xb9\\xbc\\x16\\xc3l\\xf0^\\xd6\\xb5\\xf2[\\x80\\x9e$\\xb7\\xb0l\\xc1k\\xc4\\xd2\\xd5p\\x7fk\\x18\\x1e\\xc3\\xed?\\x05,o<u\\xa4\\xb3r\\x11w\\x1f\\xd6\\x8c\\x92\\xf8f\\xf3o\\x17\\xf14\\xd5\\x08\\x9e^\\xd1\\x81m\\xaf\\x99\\x8e\\xbf$'\ty,_n\\x96\\xf7k\\xbbr\\x1c\\xbd\\x8a\\xa4\\x911\\x13\\xb8\\xfed\\xf4\\xc7\\xdf\\xeb\\xec\\x8f\\x9ee\\x0f\\x9fp$\\x8951w\\x84ya\\x89\\xed\\xd8d-\\xbc\\xc3v\\xd1\\xd0\\x0f\\xc9\\xd8\\x17\\xa5\\xa8\\x14\\xb3\\xa8\\x93\\x0e\\x8c\\x95\\xbc\\xca\\xbb\\xa4[\\\\xd2\\xa9p\\x18\\xbd\\xae9\\x14\\x115\\xf8h\\xf2\\xce\\xe0\\xd9\\xd3\\x03\\x0b\\xf5\\xaf\\x88\\xe5\\x9e\\x0cvz\\xd0x\\xcf\\xd7h\\xf25\\x89\\x7f\\x92\\x93\\x85\\xeau,o\\xf2tr\\x14\\x99f\\xd3\\xd9\\xc3\\xa4.\\xb9]\\xa5:\\xb0j\\xf37\\x8c\\x9br\\xe7\\xa7lvxg\\x93\\xc7\\x18\\xc8o7\\xce\\\\x8b^\\xaf"
  589. },
  590. {
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfd\\xfe\\xb6\\xe1$w&\\x82\\x94\\xb9\\x83\\x94!\\xec\\x9d\\xae\\xc7+\\xf3g\\xf7f\\xd2\\xb8\\x90\\xfc\\xfc;\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  592. },
  593. {
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xee\\x18\\x8e/3\\xe4\\x8d\\x06'\\xbf\\xa7\\xae\\xf5\\xce\\xcf\\xce\\xbc\\x1a\\x15\\xc4s]e\\xf6\\x87\\xc4c\\xc6\\x7f\\x9d\\xd7\\xccl\\x0c\\xa0\\x92\\xdd\\xc4%\\xb7\\x02\\x91\\xf1\\xc5[hmi05\\xb6qvtc\\x0b+\\x80i\\x99\\xce,\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xc6\\x8ew\r\\x9b9x\\x80\\xedks\\xe08\\xe1\\xf7\\x8d\\xee\\x05\\xc6\\xe5\\x10w\\xf3\\xb0i1~9f\\x97\\xc0[\\xe39>\\xc8\\x97\\xa0d2\\xbe\\xb7\\xf8\\x13\\x898\\xab"
  595. },
  596. {
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\x82\\xb8\\x94\\xf8\\xdad\\xaf\\xba\\x8b\\xa6cm\\xf5!\\xc8`u\\x86\\xbb\\x1be\\xbc\\xf3\\xf6\\xe0\\xc6\\x80\\xd2\\x8c\\xa1r+\\xafq\\x8b\\xd3ei@\\x89$\\xe7\\xfc+x\\xe5\\xc3\\xdco\\x8a1x\\x8b\\xc1\\xdd\\xe9\\x1b\\xeek\\x0f\\xf5\\xb7e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1dnb\\x8el\\xf9\\xc7{\\xea\\x0f\\xef\\xcc\\x19_t\\x12\\x99w\\xf6c\\xc8=\\xfc\\xdd}zq=\\xb9y\\xceo\\xf7s\\x0e\\xde\\x82\\p\\xf4\\x81gfo\\xfc\\xd5x\\xeb"
  598. },
  599. {
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01012\\xed\\x90<:\\x9al\\xfe\\xd6\\xb7/fl\\xfc'\\xff\\xa9# \\xde\n\\x06\\xa6\\xba \\xbb\\x07(l\\xef@\\xe3\\xa6\r\\x19x\\xa8\\xaa\\x8fvkd\\xc2\\x07\\xcbca\\x97p\\x91\\xa6\\x1b\\xfe}?\\x1ezl\\xd1b\\x99\\\\x92\\xcf\\x03\\xd3\\xb2bz\\x9c:\\xb5p}\\xe3!\\xe2\\x85y\\xd0\\xf2\\xdb^\\xb9\\xf0\\xb3\\x06\\xb0\\xf2t\\xa9z\\x8c\\x84\\xf2\\x945\\x153\\xa0\\xfd\\x8f9o\\x9c\\xda\\xa2\\xc8\\xfe4\\xf1\\x89\\xcdh\\xd3\\x13g\\xa3\\x02\\x0c\\x922\\x90\\xa4\\x06\\x85\\xaak.?\\x14\\x9b\\x8dl\\x91\\x8b?^a\\x9e*k\\x12\\x88\\x0es\\x0fw+/\\xe1\\xbb\\xb61\\xd7\\xe8\\\\xce\\xc8v\\x96\\xaa\\x9fa\\x86m\\xd9<]\\l\\xe2+jn\\xb8e\\x83\\x95\\x94^\\xbe\\xba\\xaey\\xd5\\x10kz0?\\x19\\x11\\x0e\\xdc9\\xfc]\\x80j\\xd0\\x9f9\\x7f\\xeby\\xf9\\xc8\\x1ci\\xe6u\\xf3\\xce0\\x89\\xb4z\\xd6\\x82_\\xa9\\x830\\xb9\\x83?\\xf2p\\xf1\\x0b*~\\xb6\\xab\\xa0\\x17\\x97\\xd4\\x8c\\xbf\\xe3f0\\xdd\\x00\\xcd\\x88\\xf0\\x9c"
  601. },
  602. {
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc61*\\xa2\\xa1\\x18+\\xad\\xb9>\\xb4l\\xe1yg#{\\xdf\\xe6\\x93#\\x15\\xd3\\x00\\xf8\\xea\\x1b\\xe4\\x18gr<w\\xdb\\x92x\\x11,b\\xae \"\\xd2_=>\\xcb\\xb1\\xfc\\\\xe9\\x00\\xac\\xce\\xc8\\xbc&c\\x1e\\xdft\\xf0=\\xe1)\t5\\xfer\\xaba\\x9e\\x04\\xc05\\x92\\xb9\\xc4tz\\x15\\x97c\\x06z@\\xa0[\\x10\\x13%\\x07\\xe7d\\xa3\\xd3b\n'\\xe0?{a\\xc5!\\xdf\\xd4\\xe6j\\xc8\\xe5z\\xd6\\xee^\\x10/d\\xc6a\\xc8\\xef\\xc4\\xcd,-mbxx\\xf0>k\\x01\\x90\\xfd\\x7f\\x8d\\xa5f\\xdf#\\xb5\\xaf\\x82\\x1a\\xdf\\x80\\x1du!3\\x1a\\x97\\xd5\\x1b\\xa9\\xb8\\xc1\\xadfn|\\x85,\\x0b}\\x06'\\x1b\\xc2x\t\\xc2[^\\xbar\\xea|\n\\x96p\\xa5\\xd4\\x98c\\x12\\xfe\\xb8\\xd6\\xa2\r\\xd0\\x18\\x8b\\xb7\\xda\\xbd\\xb1\\xe1\\x84$n\\xeeu\\x17\\x8e1\\x19!\\xf2\\xc1(\\x17\\xd9n\\xec|#qh\\x19\\x1b\\xc3%q\\x87v,p\\x9b\\xd9\\xbec\\x143j\\x10\\xe8\\xc9\\xef\\xe2\\xd1l\\xdf\\xf8\\xf2\\xeb\\xf0\\xfe"
  604. },
  605. {
  606. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010}\\x14y\\xdf\\x01)\\xa8']\\xee\\xd0*\\x86\\x8bc\\xacu\t\\x0fo\\x9dw\\xaa\\xcb\\x93\\xf9\\xeah\\xa9\\x9b}\\xb0s\\x08gsbc\\xb9\\xb1\\x00\\x19\\x8cr\tg\\x8b\\xb2'\\xca4\\xf9\\xa8\\x1d4\\xa3\\xb5\\x9f\\xb3 \\xb6\\x10])\\x99\\xde\\xe6\\xde\\xc0=}\\xc9\\xdc\\xdc%\\xaab2\t\\xadx@\\xb8\\x12\\xf8\\xe8\\x800\\xc3?\\xd1vku\\xd8\\xd6v\\x88\\xad\\x1e\\x03<\\xf7\\xa3m\\x86\\xc2\\xd0\\xe3\\xc6\\xcd\\xb6=\\xbf\\xee:}\\x90d3r\\xc5a\\xe0\\xabq\\xccw\\xab\\xb0|8[\\x0bx\\xc5\\x9e>h\\xd6k\\x93\\xb3q\\xc3\\xb1\\x07\\x8d\\xc2\\xee\\xbe\\x14\\\\xe6\\x95[y\\x1f\\xb6\\x8e\\x02a5\\xf4x\\xeavv\\xd44\\xac\\x97\\x7fq%\\xabf~\\x9fo\\xfb\\xe2\\x1c\\xe87$j\\xcajc\\xbe\\xe0\\xb3\\x90\\xd9_\\x7f\\x94t\\xdcz\\xbb\\xefi\\x14\\xbf\\x9e\\xaf\\xa5lo\\x00\\xb8\\xeb@e\\,{]\\xc12yqb\\xe6\\x1f\\xe4u\\xfa\\x11_i4x\\xabz_\\x03\\xd0\\xabq`\\x10<{d\\x06\\xbf\\xfc\\xc9"
  607. },
  608. {
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x8e\\x8f\\x86\\xed\\xe7\\x83\\x1e\\xebm\\xa0\\x96l\\x95\\xab\\x84\\|\\x06>b4i&\\x1e\\xce\\x83\\xf1\\x00\\xfa\\xd3\\xf49\\xd9\\xef\\xdb\\xc1\\xc8\\xb0cp\\x15e\\x0f\\xf4\\xed\\x8e\\xb8!\r\\xd2\\x85y\\xdf2\\xb1\\xf5\\xfag\\xf5sm\\xcb\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87l\\xcb\\x04\\x90\\x1f7/`w\\xd0\\x87fz\\x80\\xcd\\x9e\\x15\\xf8\\xd7\\xe4/v\\xaf\\xfcvc\\xf1\\x14\\xb38\\x07\\x19f\\xb1'\\x0c\\xde\"y\\xe7\\xbe\\x9a\\x7f\\x8d\\x80\\xd5\\xe0"
  610. },
  611. {
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\x83\\xbf\\xd2\\x99k\\x8ec\\xcb\\x81#\\xff{\\xfd6\\xd1l\\xe5\\x97\\xb4\\xad\\xb7\\x90\\x06\\xf2o\\xa0\\x85\\x95\\xf1\\x00\\xe2|\\xc8r\\xaa?%ya\\x8d\\xb9|h?\\xff[\\xfe1\\xa5`\\xd5\\xc6:\\x18o)\\x9e\\xa9\\x89\\x85\\x9a1\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\x81\\x1b\\x10\\x8b\\xcc\\xe2lb \\x138\\xf4\\x86\\xe7|\\x178\\xcev\\xfbp\\xe0\\x9a\\xa5\\xe1n\\x9f\t\\xa6\\x8c\\xb2\\x9c\\xa3z\\xdcwi|\\x1f\\x0b\\x1bn\\xef9\\xbe\nb"
  613. },
  614. {
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\t\\xe4\t\\xa8\\x97s\\x0e\\xc2\\x92\\x17\\xd0\\xc1\\xc8\\xa0@\\xd0\\xb1>\\xb5\\xb7\\x0f\\xc2\\xfd\\xd3\\xc3\\xff{\\xec\\xea\\x88\\x84\\xd9-\\xcat\\x0e\\xd2\\xf9p\\xd3\\xa0\\xac\\x98re\\xcf\\xb1\\xfdg\\xd7\\x93\\xef\\x8e8\\xf4\\x01\\x8c6\\x1d}%\\xaff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7\\xf4\\xcf\\xe9gw`\\xeb\\xfa=\\x0b\\x00k\\xcf\\xd1\\xb5\\x81j\\x94\\xc3\\x03\\xbb\\xbes\\xbb\\xb7k\\xf6*\\x10\\xf2@g\\xf4\\xc3w\\xeezm\\xd7u\\x1c\\x18[\\xc3\\xc6\\xb7\\xc0"
  616. },
  617. {
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8bm\\x03\\xa7\\xa09\\xd4c\\x8d\\xe23\\xfaz\\xfc\\xee0\\x94\\x1ab\\xd18\\xa8\\xef{\\x02\\x90\\xcd-\\xd9\\x8e\\x04\\xf6\\xd2\\xad\\xe6<\\x99\\xbbk\\x87\\xb4\\xdd\\x9dby-\\xa3jq\\x9cr\\xaa\\xfa\\xe1q|s.\\x88e\\x18\\xbdagw\\xea \\x1a\\xf8\\x1f\\xaa\\xfc\\xc7x\\xfc\\x94\\x85\\xde\\xf2y\\xa5\\xf7\\xf41\\x17*\\xb3l\\x1cc\\xfd\\xdf\\x8f\\xa1\\x10u\\xe8_\\x18)\\xe2\\x14u\\xd2,&\\x9d\\x15{\\xfe\\xa2\\xab\\xdd\\x8d_\\xd8\\x8a\\xa2\\xc5\\xd74r\\xf4$$\\xbc\\x10\\x15\\x8c4\\x85\\xe5\\xa9\\x97t\\xc78\\x95m\\x0b\\x89\\x85\\x88i\\x0c\\xf3\\xf5k\\x19<ce\\xd25\\xc4f\\x87\nn\\x8a\\x94(\\xb4\\x8e&\\x11\\xfee\\xf8\\x0c\\xf3|\\xfe\\x90v$\\x04,\\xbb\\x87\\x1b-\\x0byt\\x1a+\\x89\\xa4\\xe0{\\x0b\\x859\\x96\\xb6\\xcf\\xeb\\x8ap8d%\\x0f\\xa7\\xdd\\xfe\\x97\\xb7\\x97\\x8f\\\\xc4vr\\.0\\xbf\\xdc\\xcbm\\x1fd\\xa0\\xd0u\\x9c\\x983\\xf6\\xb7\\x17\\xcb\\x16\\x1d\\xa7'k\\xb1k\\xe6:\\xd8\\xf4\\x9b\\xf2\\x81\\xfe(\\xd6"
  619. },
  620. {
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*=la\\xa7\\xea\\xdem\\x1b\\x1d\\xba~cb\\x8d\\xc4\\x06\\xa3\\x91\\xb8\\xc5\\xb8\\xdbb\\xce\\xcb\\x96r\\x94\\xa59\\xff\\xfd5\\xba\\x9c\\xd5\\x0c%\te:w,\\xd91@\\xa2\\xc9\\x1bb\\xdb`\\x99b\\xd0\\xaed\\x99zk+\\x89\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\x9a<\\xf9l\\xb2\\xa0j\\x1c\\xba\\xa2k\\x80()zs\\x93\\xc1q\\xe7\\x95\\\\x82y\\x99\\x0b\\xa4\\xd0!\\xe9\"|\\x9ct\"\\x19\\xf3tf\\xe3ed\\xab\\xf6\\xd5j{"
  622. },
  623. {
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97s\\xc48\\xea\\xeb\\x00 \\x7f\\x84\\xd4\"v\\x84\\x1b\\x89\\x0e\\xf1\\xb8n\\x07\\xaa\\x9a,^\\xfe\\x86\\x12q\\xe5\\x1d.\\x92\\x1a`\\xbc\\x7f0\\x87\\xfa\\x93=\\x1a{\\x1e\\x988#\\xa3\\xee\\x81\\xc7\\xa4v\\xf1\tu\\xd5\\xc4o2\\xc6\\xa1\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x89\\x04\\x0e\\xc52\\x96\\xe2\\xfa?\\xdf2\\xc0\\x8e\\x04\\x1bm\\xb1\\xf3\\xf6/&\\xff\\xaf f`j<\\x082\\xc0\\xean\\x99pwp`\\x84\\xedwn\\x17\\xd7\\xc6d\\x1b"
  625. },
  626. {
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xffs\\xa5zt\\x97\\xc7il4\\xcay\\x8b\\x82\\xc2\\x1b\\xfe\\xbd(\\x15g\\x1crw9\\xd73\\x1dm0\\xf97\\xe1p\\xc5\\xffwq\\xe8x_*\\x0f9z\\x15\\xc1\\xe4u\\xd0\\xdfs\\x0ca\\xdb\\xbb!'n\\x1a\\xf2\\xcf\\x1etl\\x15\rn\\xabu9^3\\xd4=y\\xd0\\xf4\\xd2\\xb9\\xf3\\xdd\\xa5\\x1c\\x12b\\xef\\xfb\\x0fk~!j\\xbcw\\xb4g\\x9bw\\xcf%u\\xed\\x10a\\xf4\\xb4\\xbd\\x8d\\x92\\xe9^#2\\xec\r\\xd7\\xb1\\xdez\\xe7s\\xb1~\\xbc#\\x8dk\\xa9\\x9dk\\xc3\\xec8x\\xf2\\xc8\\x81\\xd8\\x90)\\x92{v09\\xbe\\x06\\xe1#@m\\x08\\xf2\\xd0\\xe5p\\xf0\\x90\\x92\\xdb\r\\xa1\\xac\\x97c\\x87\\x92\\x82y\\x80h\\xd8r\\x90\\xf4pf\\xb2\\xf4\\xd5\\x1d\\xff\\xca\\x89,\\xaa\\xc5#\\x8c\\xbf\\xf3\\x81\\xeb\\xf47;\\x0e\\xa8b\\xaf\\xe7wgh;{\\xdf\\xc9ca\\xcd\\xe0\\x1a\\xce\\xae\\xfd\\xe3\\x12td\\x87\\xe6oz~\\xbd\\xf1ow\\xe020^\\x89\\x9f:\\xdf/\\x9e\\xbe\\x89\\x12y\\x1e\\xdf#d\\xd9b\\x9c"
  628. },
  629. {
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0105s\\xdb\\x18d]\\xe1\\x8c;\r\\x89\\x8e\\x05\\x900\\xfde\\xdc\\xfe\\xbb\\xa4q\\xc9\\x9e\\x8d\\x8d\\xaa\\x04;\\xef\\xc8\\x82\\xc7\\xb7\\xaf\\x93q\\x9f\\xa7x\\xa1d\\xc3b\\xee\\x81\\x03w\\x81h\\xab\\xc0\\xcdb\\xac\\xc4j\\x9b\\x01vg9<\\xd2\\x02%\\x08-\\xe0\\xcb\\x15\\x8a\\x1a^\\xf7+\\x17\\xb7a \\xbd\\xd7\\x8ap@|\\xa4x\\xc1i\\xf85h}\\x87w[\\xdb\\xa4\\xca\\x8f\\x8e\\xa6\\xa4\\x82x\\xb8e\\xe19\\xe0^\\xd3\\xb3\\x12n\\xc1\\x82j=6@k\\xc3\\x83\\xf6\\x04\\xe0\\xa9\\xdfz|&\\x8f\\xd1\\xc4\\x8c<\\xba\\x07\\xcap?\\xaau\\x8575\\xec\riix\\x91\\x05\\xd1+\\xfe\\xd5\\xb0/\\xc8\\xfc\\x81\\x94!e\\x01\\xa9\"b\\x10\\xfc=\\xbdv\\xa9\\x01\\xf8\\x9e\\x99\\xaf\\xe5_\\xe5$gm\\x95pp\\xfe\\xdd\\xef\\xc8m\\xc0\\x1b\\x0c\\x14\\x88p\\x87\\xc2j1\\xdd\\x122s\\xfa\\x04\\xff\\xf8x\\xfc\\xf3p\\xff\\x1ctm\\x83\\xa1\\x8a\\x97!x\\x14q\\xd8\\xa1\\x87t){)$\\x0bj`3\\xf2\\xcc\\xe0g.\\xd4\\x9e\\x0e\\xda"
  631. },
  632. {
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7h%\\xde\\xc3\\x9d\\x13\\xca\\x94\\xb5\\xb9]\\xec\\xa6q\\xb9\\xe0??\\x1b\\x0f\\x92\\x04#\\x18\\x89\\x95/\\xbf\\xef\\x84\\x0b%;\\xea\\\\x11\\xb7p\\x835y}\\xb0\\xbb\\x14v\\xbf\\xd7rk\\x14\\xb2u\\x8c\\xb0\\xc14\\xed\\xd2e\\x82\\xf3\\x89\\x9b\\xb9\\xa2\\xbf\\x9b\\xcc\\x19\\xaf\\xe1\\xe6\\xea\\x0e\\xc6\\xd3\\xd2\\xa6\\xe0t\\xcd\\x88\\x15>[l\\xd9u8r\\xa4\\xd7\\x132\\x1an\\xbc4?{!\\xaf\\xef\\x94\\x18\\xbe\\xb7\\xb7~\\xba\\xa8\\xfe\\xc0\\xe1\\xcb*2\\xcapy\\xf8\\xff!\\xcd)\\xfd\\x91\\xbd\\x9f\\x17eq)\\xed\\xa6d\t\\xe6\\xcey\\x88\\xc1\\x86v\\x14/\\xde\\x0b\\x83\\x90m\\x8eo\\xbc\\xb8bj\\xf4u\\xc3.,\\xc6\\xcd\\xbd\\x96\\xb8\\xec[\\xa96\\x89\\x9d\\x81\\xa6\\xd7\\xd9\\x81x\\xb2hi\\xf6ao\\x1b\\xe2\\xb8\\x0e\\xb7\\xb3j\\xcf\\xdb\\xc7\\xbe\\x17\\x96\\x89\\x9c\\xf5\\xb5\\xb5\\xcb&\\x83\\xabk\\x05\\xaf\\xd8c\\xbf\\xcb\\x9e\\xc0\\xceu\\\\x06\\xea\\x11\\x101\\xc4d#m-\\xe0\\xebn\\xbf\\xec\\x7f\\{u\\xa1\\x88f\\xa5\\xb7\\x01\\x19\\x17xgz"
  634. },
  635. {
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16\\xc5\\xad@ \\xb8o_\\x85\\xac\\xb0\\x93\\xe6\\x0by\\xeb\\x1f\\xa0\\xcbsf\\x95\\x19d\\xdf\\xc1e\\x82\\xe9'\\x1b\\x8f\\x9b~\\x01z\\xc9\\xe4mj\\xc0\\x03#a*1\\xa7n\\xd2v\\x84\\x1a\\xd4!\\x97\\xa3\\xc7m#\\xd8\\xd1\\xe2;\\x0b\\x83k\\xa4\\xcd\\xa7\\x9a\\x8b\\x95\\xf3ww\\xc0v\\xd9\\xdcx\\x91\\xc4{(\\xc8i4\\x96\\x7f\\xbb=p\\xcd\\xfb\\xdc\\x08\"~\\xc4\\x13\\xabp=\\xd0i\\xd0\\x8dd?\\xae\\x81\\xeax.y'@d+\\xaf4\n|\\x8d\\xeb\t(e7\\x04\\xe0;\\x86\\x8f\\xe3o\rk\\x14\\x17\\x8e\\x0c\\xf8\n\\xef\\x89\\x97\\xc9\\x80\\x0f\\x8c\\xf6xp\\xd2\\xc5\\x98\\xb3\\x82i\\xb4\\x8f\\xbf\\xdf\\x9f\\xe93-s\\xcb\\xaf{\\xba\\xeb\\xee\\xc5\\xf0;5^-~\\x9e\\xd6\\x9c\\xbc\\xd3~\\xba\\xe0t\\xf9f\\xff\\xd7@1\\xdf)\\x7f\\xacg\\xb2g\\xef\\xaa\\x88\\xb5\\xb0\\xa7u?\\x04\\xcb&\\x15v\\xebw\\x89\\xaa|\\x1a^i\\x92'u\\xcfw\\xb7\\xd2f\\xef+\\xe4\\x9f\\xa9\\x87\r-*\\xd2\\xa5\\xce*\\xe2\\xa0k\\x08\\xb1"
  637. },
  638. {
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\xe5\\x8dv\\xe5\\x06\\x92\\x9cn\\xf2\\x88\\xd3fq\\x8bdgt\\xa5\\x12\n~\\x0e\\xb5v<,\\x15\\xec~#\\xb4\\xf0}]\\xd4/\\xf2\\xf8\\x7f\\xffn\\xb6\\xb31zip4ej\\x81b\\xb5\\xd6\\x9a8\\xf4j\\x83\\xd1-\\xdf\\xd0@\\xd1\\xa2\\xa2\\xeb$tj\\xd0\\x1cy\\xc6x\\xb8z\\xa7\\x1cf\\xe0lc\\x91ch\\xa6v9\\x17'\\xc8\\x03\\x1c\\x98b\\xb0\\xd7\\xc5\\x91\\x8b\\xf3\\x85\\xf0\\xd4\\xf2\\xe3\\xb4\\xbd\\xd0\\xb6\\xcf\\xbb)\\xd8\\xf9\\xaf\\xe2w}%h\\xbe\\xac\\xc8\\xa1\\x9a\\xd2g\\xe1\\xc6=j\\xf8p*$7b\\xe5\\xb9\\xda,\\x87\\xa4\\xbd%\\xc5\\xb78gd]h9\\x1b\\xec\\x8a\\xa5:#\\xf0\\x8d\\x15$\\x1d\\x8d0\\xac\\x9f\\xba\\xc7)\\xd8\\x94f\\4\\xba\\x9a\\x16\\xed\\xad.\n\\x04\\x99\\xb2\\xaarc\\x08\\xa0\\xb3\\xd2q-\\x19\\x8d\\xb4\\xadb\\xfev\\xed=\\x91\\xbe\\x16\\x0b\\xdek]\\xee\\xcc\\x8f\\xe8\\xd3s\"}\\xea\\xc5\\xd3\\xcd`\r$\\x9f\\xad\\xf2dp6\\xc4;b\\xb2:\\x83g\\xf2\t\\x94&ia\\x8b\\xa6"
  640. },
  641. {
  642. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  643. },
  644. {
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;\\xed\\xa7j\"\\x0b\\x8d\\xb1d]\\x08\\x88\\x9c\\x8e\\x84\\xf0\\x18\\xae\\xc0\\x8aw\\x89\\x13\\x95\\xd8m@\\x06\\xbc\\xf7(\\xabk\\x81}m`\\xdeg\\x9e\\xfe\\xb9\\xd6o\\x1b\\xd1#\\xbc\\xf1\\xc6\\x82\\xcc%\\xd6\\x92\\xac\\xf0\\x8evq\\xff\\x1fs\"r\tw\\xa3t\\xd6\\x10\\xbb{\\xed\\xad\\xbb\\x80\\x9c\\xd9\\xac}\\x16hs\\xedsob~\\xb0\\x9a\\xddz\\xd6\\x89y_\\x80\\xd9u\nr\\x9c0\\x83\\x97\\xcd\\xb3\\x8e\\xe9\\x95\\xfa\\x81\\x87\\x86\\x89\\x97\\x0e\\xe5$6?s\\x99j\\x82{r\\x86-=\\ /\\xfagbuc\\x92\\xea\\x9f\\xdb\rd\\xd0\\xe5\\xdfw\\xd7\\x8b\\x97\\xa6(o\\xec{9)?\\xdb@\\x15\\xbft\\x9a\\xc1\\xe4d\\xba\\x8fk6\\x9a#g\\xbc\\xde\\x1c\\xa2+\\x97\\x9bt\\xe2{\\xf2\\xbf\\xaf\\x8b\\x037\\xd2\\xde\\x8f\\xdb%\\xff{\\x08+j_\\x0c\\xea<\\x82\\xaa7\\xf8\\xaf@\\x8c\\x0e^\\xba\\xb6\\xb6\\xbe\\x8as\\xfe\\x82sz\\x9a\"\\xfe\\xd8ahmn\\x8fe\\xb5o^\\xab0\\xf3\n\\x91m\\xe1\\xbd\\xb9?\\xb8\\x14\\xb8"
  646. },
  647. {
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde\\x89\\xc3\\x8c\\xc7\\xf4=\\x08\\xea\\xb6w$\\x1c\\x17a?\\xac\\x1c\\xc3\\xaf\\x1b\\x9b\\xfd0(\\xe7\\xd7\\x86\\xa1\\xaa}d\\xe0k?\\xe5\\xd4\\x1b\\x9f^\\x1c\\xee\\x7f\\xce\\x16qv\\x02\\xda{'7\\x0c\r\t*|\\xed\\xb0p\\xb4\\xcb\\x1b\\xf8\\xe8\\x8729p:{:\\x96\\x10\\x1d\\xae\\x8e\\xda`\\x04;$'\\x1cs \\x00\\xfc\\x17\\x10,\\x0f'\n}\\x03\\xa8\\x820\\x0c\\xd2c\\xf5-k|\\x96-\\xa0\\xfba\\x1a\\xe9\\x11\\xc5\\x0e\\xde\\x8bp\\xe7tf\\xde\\x8d\\x08\\x95<\\x99\\xb4t\\x9c\\xe7\\xc6\\x92$%\\x83\\xcdx\\xbd\\x0f\\x92cp\\xc8\\x82\\xad\\xab\\x93\\xec\\xed=2eb\\xbf6!\\xf7kc\\x99\\xd16a\\xa9\\xe7fh\\xcce\\xc6\\xed\\xd9.\\xec\\x9b\\x82/\\x07\\xfd\\xc5f\\xa8\\x1bp\\xdc\\xd8\\xa6\\x81p\\xc6\\xde.^\\xf7\\xda\\xc6yq\\xac\\x1a\\x93\\xe7!7\\xe3\"\\xba|\\xaawa\\xa8\\xa5\\x02\\xbc\\x16\\x87\\xc79\\xd8z\\x8e7\\xa9r\\xfb\\x12\\x82&\\x8e\\x10:\\xb9\\xb5\\xf9z\\x04p4|4\\x9d\\xc2\\x99\\x97\\xf5d\\x96\\xd4"
  649. },
  650. {
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xe4\\x0e\\x9f\\xaf\n\\xff/5\\xb1\\xb1\\xe93\\xacv=\\x16~\\xa0\\xc7\\x7f\\xe2v\\xc7=_v\\x8d\\xc0\\x03\\xb7\\xf8\\xc6\\x9ap\\xa9\\x9e#b.p}(\\x9c\\xfa\\x97lt\\xae\\xe7\\x92\\xcdkq\n(\"z1]\\xb3\\x9a\\xc78\\x1c\\xc0\\xf8k\\xd2\\x1fq\\xf3l\\xb5\\x9b\\x97\\xfa\\xe6t@\\xa2\\xf9\\x85\t\\xce%;\\xb0\\xf5-\\x01\\xc5\\xf8\\x803\\xdf\\xa9\\xcb\\xee\\x1eo\\xbcdu\\x82#t\\x84\\x1c1\\x12\\x82z\\xa6\\xb9\\x17\\xbd\\x82\\xcd)\\xe3\\xb2\\xf0-\\x89m\\xd0b\\x02\\xb2|\\xf1\\x15\\x83t4\\xc7x!\\x857\\xf0l\\xcb\\x80/r\\xfa\\xe7\\x13w{sj\"\\x01\\xe0\\xb0\\x03\\xe2~\\xcb\\xb3\\x02h\\x90\\x87\\xfe\\xa8\\x1c!u\\xd3$n\\xf2\\x8b\\xac\\xb1^\\xc1.\\x8a\\xa1?\rg,i\\xccgkk\\x8c\\xd3bk\\x01\\x02\\x863\\x8e\\x9e[\\xe8\\x8a)(\t6\\xa7?j\\x8f\\xc0\\x19\\x03e\\x00\\xac9|msy\\xe1\\xc4\\xfc\\xff\\xf2y\\xce3ih\\xd5\\xf7\\xcb\\x03!\\x93\\x99\\xd6,u\\x19\\xab\\xfc`\\xd1\\xa5"
  652. },
  653. {
  654. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x16s\\xfe\\x1a6\\xf2i\\xa9\\xfb\\xb1\\x06\\x8f\\x98;\\x80\\xfe\\xee\\xce?yxor\\xf8\\xbc\\xa6o(w\\xda\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  655. },
  656. {
  657. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\^\\xe4 \\xcd\\xaf\\xf8.d\\x9b\\x9f.|v\\xe6\\x1aii\\x94\\xdb`\\x90\\xa3\\x1e\\x19\\xf9\\xca\\xce\\xd6\\x12\\x8c\\xb1\\x9a*\\xa3z\\x8b\\x91\\x901\r9\\x87,\\xcb\\xc5\\x8b3\\xf2\\xe0\rn\\x96\\x7f\\xa9\\xb6tdb\\x00\\x88\\x15\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8si\\x18\\x8f\\xeau\\x02\\x02\\xb7\\xc1+\\xabb\\x10v\\xba\\xf5xz\\xaf\\xbd\\xa7\\xfe\\x8b\\x155\\x979\\xbdc\\xceo\\xcft\\xbe\\xa1\\xe52\\xdf.\\x05p0\\xa7w\\x13\\x0e"
  658. },
  659. {
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\xb6\\x87\\xb3\\x06n\\x88ws\\x19\\x99t\\xd9\\x837\\xb7i\\xe1$\\xd9\\xa6=\\x1b\\xfc\\x12k\\x93d\\x0cg}\\x0c\\xf4us\\x9bl\\xcc{\\xd9u\\xd4\\xb5\\x8e\\xc4\\x8f\\x93ke\\xf6`\\x1e\\xc7!\\xb3\\x88!-\\xe5\\x94x\\xe0\\\\x8a\\x97\\xd4}y\\xfd1t\\x9b\\x0e\\x05\\x1a\\x1e\\xd18\\xb3md\\x8arh.\\xc8\\xdd2\\xb1o\\xeaz\\xffg\\x83t\\x0c\\xba\\xb5\\x9b\\xdd\\xd1\\x95\\x9ay\"\\xdb\\xd3\\xdd\\xce\\xbb\\xc7\\xa0\\x99o\\x07?\\xfa\\xe8\\x8e\\xa6\\x81\\xf6y\\xde\\xa1\\xc2\\x85\\xdf\\\\xbdo\\x0e\\x9a0d-\\xa3\\x10\\x8c\\xa11\\xb7\\xc8\\xa1\\x0el\\xea;\\x99h\\x8a\\x88\\x93\t_*#\\xd8o\\xab,\\xbd\\xdez=g.\\x1b\\x88xp_\\x10\t<x\\x14\\xc8\\xce\\x16p\\xa0\\xf7\\xa7\\x1a\\xa2\\x00\\xda\\xac\\\\x06w;\\xe1\\x0e\\x8c.}\\x9e\\x10\\xa0kb>r\\xa2`[q_v\\xf0\\xd2\\xc5f\\xddq\\xc9\\x0co\\x9em}\r\\x13f[wk\\xbb\\x0f \n\\xd2\\xf8\\x0e\\xcd.:}y\\xdc\\xac\\xaa\\x1b\\xcc\\xbf\\xdc\\x9d\\x83"
  661. },
  662. {
  663. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x16t\\x06\\x81{\\xbdb)\\xb2\\xfc\\xe3\\x82\\xce\\x1e\\x96\\xfc\\x1f\\x7f\\x92\\x15i\\x81\\xc8\\xdc\\xa2]b\\x8e\\xa8\\x00\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  664. },
  665. {
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`h\\xee\\xe7gjn\\xd6*\\xc1\\xdax\\x9e\\xb2%\\x8bq\\x801\\xb1\\x99\\xe5\\xcd8d\\xee/*\\x1d\\xfdk\\xc67\\x0f\\xf4\\x9aw\\xaa\\xe6al\\x98%\\x1c\\xfd\\xc6\\xdb\\x11\\xfa\\xf2\\x12\\xd8\\x05,\\xec\\\\x0f\\xb1\\x8fl\\xca\\x15\\xc7.6d\\xb9\\x9b\\x11}4f\\x8c\\xb7\\x89!\\xc9\\xbe/e\\x9d\\xa8\\xf0\\x9b\\x15\\x8cmh\\xe5v\\xb6n\\xb8\\xb7g\\xfc\\x86(\\x91\\xbd\\xc2\\xce\\x05\\x80\\x83\\xc15\\xa9\\x15\\xbb\\x03\\xdc\\x96l\\xd7\\xb7\\x0f\\x9b1\\xf5-wl\\xf1#\\xe8u\\xfc\\x14chg_\\x82\\xd32r\\xd2\\xfa\\x02i\\xc2\\x7f\\xfb\\x1bo\\xc5t\\x13\\xd2\\x07\\xe6j0ll\\xc2\\xb2l00\\x10e`>o\\xa3\\xe5\\x86\\x93\\xd8\\x90\\xd5\\xa7\\x0e\\x99:\\xa8~\\x90b\\xd9\\xb8\\x9c06\\x8a\t[\\x8d`/o\\xfb\\x188|s\\xd8\\x0fe\\xa7\\x0bvm\\xd8\\xca\\xf6\\xde]\\x81\\xc5\\x1e\\xd3>\\xce\\xb5\\xca%\\xa66\\xc5\\xaby\\x83gk\\xeeb\\x15\\x7f\\x98\\xce`\\x0f\\xe2\\x8d\\xb9\\xab\\xa4\\xfd\\xa0\\xf7.\\xbe\\xa4\\x18h0)k\\x1b"
  667. },
  668. {
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x9f\\xb9l\\xbd\\xa1`\\xf4\\xac\\x079}\\x7f\\xbf!\\x13\\xfb\\x10\\xff#i\\xbc\\xe42\\x0f\\xe9o\\xf9\\xa9\\x9d \\xef\\xd6\\x8b\\x8c\\x0f7u; ho3\\xe1a\\x03l\\x0e\\xc5w\\x99\\xa2\\xc2c\\xef\\xb3\\xfc\\x10,>7\\xccr'n5\\x86w\\xa4\"w28e\\xaf\\x86\\xdb\\xecz+u\\xc7\\xa2\\xd5\\xf5\\x86\\xca\\xb4\\xeb\\xa7i\\x9eetqo\\xa3n\\xf0b3^\\x10\\x93\\x00\\x82\\xb1\\x81\\xceh\\xdd\\x9fms\\xe6\\xa8\\xb6m?\\xd8\\xdb\\xc4\\xed\\x96\\x7fj\\x9c\\xab\\xb8\\x1b\\xe4\\xfb\\xe5\\xcb\\x08o\\xb7\\xc0\\xcc\\xb8\\xce\\xe5[\\xf8\\x9a4\\x8di\\x86\\xbah\\xe9\\xf7nmd\\xd2\\xf1\\x1e\\x87\\xd6\\xbf\\xb0m\\xd7\\x1e\\xa9\\x02me#\\x80\\x0b/\\x1c\\xc1\\xcb\\xc4\\x00\\x01\\xb9\\xf8\\xc0\\xc3\\xa1\\xbf\\x1d,w\\xd37\\xfa\\xe3\\xb7/\\x19\\x98\\xcb\\x14%%\\xcbz\\xd2p\\x96u9\\xebub\\x03\\xe9n\\x88\\xa63\\xad\\x17\\xbd\\x93\\xdc\\x147k\\xf7{\t\\xf5\\xb0)\\xbd=\\xbcf.\\xe0\\xae<\\xd5\\x16iu\\xc9\\xf9\\xbbe\\xa7\\xa00\\x07c"
  670. }
  671. ]
  672. },
  673. {
  674. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  675. "Details": [
  676. {
  677. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  678. },
  679. {
  680. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  681. },
  682. {
  683. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  684. },
  685. {
  686. "McAfee": "Exploit-CVE2017-11882.ah"
  687. },
  688. {
  689. "Symantec": "Exp.CVE-2017-11882"
  690. },
  691. {
  692. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  693. },
  694. {
  695. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  696. },
  697. {
  698. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  699. },
  700. {
  701. "AegisLab": "Hacktool.MSOffice.Generic.3!c"
  702. },
  703. {
  704. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  705. },
  706. {
  707. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  708. },
  709. {
  710. "Sophos": "Exp/201711882-P"
  711. },
  712. {
  713. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  714. },
  715. {
  716. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  717. },
  718. {
  719. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  720. },
  721. {
  722. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  723. },
  724. {
  725. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  726. },
  727. {
  728. "Ikarus": "Exploit.CVE-2017-11882"
  729. },
  730. {
  731. "Cyren": "CVE-2017-11882!Camelot"
  732. },
  733. {
  734. "Avira": "HEUR/Rtf.Malformed"
  735. },
  736. {
  737. "Antiy-AVL": "Trojan[Exploit]/OLE.CVE-2017-11882"
  738. },
  739. {
  740. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  741. },
  742. {
  743. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  744. },
  745. {
  746. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  747. },
  748. {
  749. "AhnLab-V3": "RTF/Malform-C.Gen"
  750. },
  751. {
  752. "MAX": "malware (ai score=100)"
  753. },
  754. {
  755. "Zoner": "Probably RTFObfuscation"
  756. },
  757. {
  758. "Tencent": "Office.Exploit.Generic.Eanz"
  759. },
  760. {
  761. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  762. },
  763. {
  764. "GData": "Exploit.RTF-ObfsStrm.Gen"
  765. },
  766. {
  767. "Qihoo-360": "susp.rtf.objupdate.gen"
  768. }
  769. ]
  770. }
  771. ]
  772.  
  773. [*] Started Service: [
  774. "osppsvc"
  775. ]
  776.  
  777. [*] Executed Commands: []
  778.  
  779. [*] Mutexes: [
  780. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  781. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  782. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  783. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  784. "CicLoadWinStaWinSta0",
  785. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  786. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  787. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  788. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  789. ]
  790.  
  791. [*] Modified Files: [
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_1e6bd3a3be1bb1d842ad28b821c3429b.doc",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_1e6bd3a3be1bb1d842ad28b821c3429b.doc",
  794. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{60650BC7-1A4F-45C6-9D98-099F6A769148}.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{4543BB02-5674-4B6F-B5AB-EC5DA8870FD0}.tmp",
  796. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{31D1CB7B-9770-4068-8E7E-4E8F9AB0AD4B}.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  798. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  799. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  800. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  801. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar25.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1209.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1208.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121B.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121A.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121C.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cab123D.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\cab123E.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cab122C.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cab124F.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cab127F.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cab127E.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cab12BF.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cab130E.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cab132E.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13BD.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cab137D.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13CE.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13DE.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\cab140E.tmp",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\cab140F.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cab147E.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cab144F.tmp",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14DD.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14EE.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14EF.tmp",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14F0.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cab161A.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\cab164A.tmp",
  832. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1735.tmp",
  834. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17C3.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17E3.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1842.tmp",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18EE.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\cab194D.tmp",
  840. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A0A.tmp",
  842. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A2A.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A5A.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A6A.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AF8.tmp",
  847. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B38.tmp",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1BC5.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C38.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BD6.tmp\\PictureFrame.glox",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C15.tmp\\ThemePictureGrid.glox",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C26.tmp\\content.inf",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C59.tmp\\TabbedArc.glox",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BD6.tmp\\Content.inf",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C15.tmp\\Content.inf",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C26.tmp\\View.thmx",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C59.tmp\\Content.inf",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D38.tmp\\ieee2006officeonline.xsl",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D27.tmp\\TabList.glox",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CC8.tmp\\turabian.xsl",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C27.tmp\\iso690.xsl",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C98.tmp\\Basis.thmx",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DD9.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C48.tmp\\Equations.dotx",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D27.tmp\\Content.inf",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DA8.tmp\\content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D78.tmp\\pictureorgchart.glox",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D48.tmp\\iso690nmerical.xsl",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF9.tmp\\gostname.xsl",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E19.tmp\\content.inf",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DA8.tmp\\Dividend.thmx",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D38.tmp\\Content.inf",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F38.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E19.tmp\\Metropolitan.thmx",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DC8.tmp\\ConvergingText.glox",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E97.tmp\\Banded.thmx",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CC8.tmp\\Content.inf",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D78.tmp\\Content.inf",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F17.tmp\\Element design set.dotx",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C48.tmp\\Content.inf",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ED7.tmp\\gb.xsl",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C98.tmp\\content.inf",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F17.tmp\\Content.inf",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D48.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF9.tmp\\Content.inf",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DC8.tmp\\Content.inf",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\chevronaccent.glox",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F16.tmp\\content.inf",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F16.tmp\\Frame.thmx",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\Content.inf",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C27.tmp\\Content.inf",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E97.tmp\\content.inf",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  896. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ED7.tmp\\Content.inf",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2218.tmp\\gosttitle.xsl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22B5.tmp\\ThemePictureAccent.glox",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2324.tmp\\harvardanglia2008officeonline.xsl",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22B5.tmp\\Content.inf",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  903. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  904. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD248D.tmp\\Headlines.thmx",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24AD.tmp\\CircleProcess.glox",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2218.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D0.tmp\\content.inf",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24AD.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2324.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2599.tmp\\architecture.glox",
  915. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D0.tmp\\Parallax.thmx",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28E6.tmp",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2720.tmp\\Crop.thmx",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29B2.tmp\\VaryingWidthList.glox",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2599.tmp\\Content.inf",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD248D.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2720.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A51.tmp\\content.inf",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29D3.tmp\\Berlin.thmx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C29.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C3A.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B5B.tmp\\content.inf",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A51.tmp\\Wood_Type.thmx",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B5B.tmp\\Quotable.thmx",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CB8.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BDA.tmp\\content.inf",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CB9.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29B2.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BCA.tmp\\Badge.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BDA.tmp\\Droplet.thmx",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29D3.tmp\\content.inf",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E12.tmp",
  954. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BCA.tmp\\Content.inf",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  960. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3111.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30D2.tmp\\Circuit.thmx",
  963. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3152.tmp\\content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3132.tmp\\content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3152.tmp\\Savon.thmx",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3191.tmp\\mlaseventheditionofficeonline.xsl",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C2.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3132.tmp\\Damask.thmx",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31B2.tmp\\chicago.xsl",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3191.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3290.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31B2.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD328F.tmp\\InterconnectedBlockProcess.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3240.tmp\\HexagonRadial.glox",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30D2.tmp\\content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32C1.tmp\\BracketList.glox",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD328F.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32A1.tmp\\content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab336E.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32C1.tmp\\Content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3240.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32A1.tmp\\Slate.thmx",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD365D.tmp\\rings.glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366E.tmp\\ThemePictureAlternatingAccent.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD367E.tmp\\content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366E.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD365D.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD368F.tmp\\APASixthEditionOfficeOnline.xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD367E.tmp\\Main_Event.thmx",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36DE.tmp\\sist02.xsl",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD368F.tmp\\Content.inf",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36EF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD381A.tmp\\Feathered.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F9.tmp\\content.inf",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36EF.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F9.tmp\\Mesh.thmx",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36DE.tmp\\Content.inf",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD381A.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3982.tmp\\content.inf",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3982.tmp\\Vapor_Trail.thmx",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C33.tmp\\Insight design set.dotx",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C33.tmp\\Content.inf",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1027. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{BFFE76B7-BA66-4EE9-B99E-CEF0E361871C}.tmp"
  1028. ]
  1029.  
  1030. [*] Deleted Files: [
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar25.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BD6.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C15.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C26.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C27.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C59.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C98.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C48.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CC8.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D27.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D38.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D48.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D78.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DA8.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DC8.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF9.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E19.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E97.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ED7.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F17.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F16.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2218.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BD6.tmp\\PictureFrame.glox",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\cab130E.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22B5.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2324.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D27.tmp\\TabList.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C59.tmp\\TabbedArc.glox",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18EE.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\cab140F.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D0.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD248D.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24AD.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C26.tmp\\View.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D78.tmp\\pictureorgchart.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C48.tmp\\Equations.dotx",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2599.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cab132E.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14EE.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1842.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\chevronaccent.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C15.tmp\\ThemePictureGrid.glox",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2720.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab123D.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C98.tmp\\Basis.thmx",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14DD.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab194D.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DA8.tmp\\Dividend.thmx",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2218.tmp\\gosttitle.xsl",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ED7.tmp\\gb.xsl",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F17.tmp\\Element design set.dotx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22B5.tmp\\ThemePictureAccent.glox",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF9.tmp\\gostname.xsl",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2324.tmp\\harvardanglia2008officeonline.xsl",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A5A.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D38.tmp\\ieee2006officeonline.xsl",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F16.tmp\\Frame.thmx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DC8.tmp\\ConvergingText.glox",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab140E.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab164A.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CC8.tmp\\turabian.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E97.tmp\\Banded.thmx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab124F.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1209.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab144F.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121A.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29B2.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A6A.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D48.tmp\\iso690nmerical.xsl",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A51.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab147E.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29D3.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13CE.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A2A.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E19.tmp\\Metropolitan.thmx",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D0.tmp\\Parallax.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1208.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B5B.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24AD.tmp\\CircleProcess.glox",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C27.tmp\\iso690.xsl",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BDA.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17C3.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BCA.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\cab127E.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\cab127F.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A0A.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD248D.tmp\\Headlines.thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1BC5.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2599.tmp\\architecture.glox",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab12BF.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29D3.tmp\\Berlin.thmx",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C38.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2720.tmp\\Crop.thmx",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1DD9.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B5B.tmp\\Quotable.thmx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F38.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30D2.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BCA.tmp\\Badge.thmx",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B38.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3132.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD29B2.tmp\\VaryingWidthList.glox",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3152.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\cab161A.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3191.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31B2.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3240.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD328F.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32C1.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32A1.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A51.tmp\\Wood_Type.thmx",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AF8.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BDA.tmp\\Droplet.thmx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28E6.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32C1.tmp\\BracketList.glox",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD328F.tmp\\InterconnectedBlockProcess.glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30D2.tmp\\Circuit.thmx",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3191.tmp\\mlaseventheditionofficeonline.xsl",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab123E.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13BD.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31B2.tmp\\chicago.xsl",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121C.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CB9.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14EF.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD365D.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD367E.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366E.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD368F.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36DE.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3152.tmp\\Savon.thmx",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36EF.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C3A.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD32A1.tmp\\Slate.thmx",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CB8.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3132.tmp\\Damask.thmx",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3240.tmp\\HexagonRadial.glox",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C29.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F9.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14F0.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD381A.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD365D.tmp\\rings.glox",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD368F.tmp\\APASixthEditionOfficeOnline.xsl",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17E3.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab121B.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366E.tmp\\ThemePictureAlternatingAccent.glox",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1735.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3982.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36DE.tmp\\sist02.xsl",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab137D.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD367E.tmp\\Main_Event.thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E12.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3982.tmp\\Vapor_Trail.thmx",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD381A.tmp\\Feathered.thmx",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F9.tmp\\Mesh.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD36EF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3290.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3111.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C33.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C2.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab122C.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C33.tmp\\Insight design set.dotx",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cab336E.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_1e6bd3a3be1bb1d842ad28b821c3429b.doc",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1198. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{BFFE76B7-BA66-4EE9-B99E-CEF0E361871C}.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{4543BB02-5674-4B6F-B5AB-EC5DA8870FD0}.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{31D1CB7B-9770-4068-8E7E-4E8F9AB0AD4B}.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRF44C.tmp.cvr"
  1202. ]
  1203.  
  1204. [*] Modified Registry Keys: [
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\`cj",
  1206. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4271EF",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4271EF\\4271EF",
  1229. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1532. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1537. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1538. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1539. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1551. ]
  1552.  
  1553. [*] Deleted Registry Keys: [
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\`cj",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\{&i",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4271EF\\4271EF",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1563. ]
  1564.  
  1565. [*] DNS Communications: [
  1566. {
  1567. "type": "A",
  1568. "request": "ec2-3-83-64-249.compute-1.amazonaws.com",
  1569. "answers": [
  1570. {
  1571. "data": "3.83.64.249",
  1572. "type": "A"
  1573. }
  1574. ]
  1575. }
  1576. ]
  1577.  
  1578. [*] Domains: [
  1579. {
  1580. "ip": "3.83.64.249",
  1581. "domain": "ec2-3-83-64-249.compute-1.amazonaws.com"
  1582. }
  1583. ]
  1584.  
  1585. [*] Network Communication - ICMP: []
  1586.  
  1587. [*] Network Communication - HTTP: [
  1588. {
  1589. "count": 1,
  1590. "body": "",
  1591. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1592. "user-agent": "Microsoft-CryptoAPI/6.1",
  1593. "method": "GET",
  1594. "host": "ocsp.digicert.com",
  1595. "version": "1.1",
  1596. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1597. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1598. "port": 80
  1599. },
  1600. {
  1601. "count": 1,
  1602. "body": "",
  1603. "uri": "http://ec2-3-83-64-249.compute-1.amazonaws.com/dllsvr.msi",
  1604. "user-agent": "Windows Installer",
  1605. "method": "GET",
  1606. "host": "ec2-3-83-64-249.compute-1.amazonaws.com",
  1607. "version": "1.1",
  1608. "path": "/dllsvr.msi",
  1609. "data": "GET /dllsvr.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: ec2-3-83-64-249.compute-1.amazonaws.com\r\n\r\n",
  1610. "port": 80
  1611. },
  1612. {
  1613. "count": 1,
  1614. "body": "",
  1615. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1616. "user-agent": "Microsoft-CryptoAPI/6.1",
  1617. "method": "GET",
  1618. "host": "ocsp.msocsp.com",
  1619. "version": "1.1",
  1620. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1621. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1622. "port": 80
  1623. },
  1624. {
  1625. "count": 8,
  1626. "body": "",
  1627. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1628. "user-agent": "Microsoft-CryptoAPI/6.1",
  1629. "method": "GET",
  1630. "host": "crl.microsoft.com",
  1631. "version": "1.1",
  1632. "path": "/pki/crl/products/microsoftrootcert.crl",
  1633. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1634. "port": 80
  1635. },
  1636. {
  1637. "count": 3,
  1638. "body": "",
  1639. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1640. "user-agent": "Microsoft-CryptoAPI/6.1",
  1641. "method": "GET",
  1642. "host": "crl.microsoft.com",
  1643. "version": "1.1",
  1644. "path": "/pki/crl/products/microsoftrootcert.crl",
  1645. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1646. "port": 80
  1647. },
  1648. {
  1649. "count": 4,
  1650. "body": "",
  1651. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1652. "user-agent": "Microsoft-CryptoAPI/6.1",
  1653. "method": "GET",
  1654. "host": "crl.microsoft.com",
  1655. "version": "1.1",
  1656. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1657. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1658. "port": 80
  1659. },
  1660. {
  1661. "count": 3,
  1662. "body": "",
  1663. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1664. "user-agent": "Microsoft-CryptoAPI/6.1",
  1665. "method": "GET",
  1666. "host": "crl.microsoft.com",
  1667. "version": "1.1",
  1668. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1669. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 01 May 2019 05:01:31 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1670. "port": 80
  1671. }
  1672. ]
  1673.  
  1674. [*] Network Communication - SMTP: []
  1675.  
  1676. [*] Network Communication - Hosts: []
  1677.  
  1678. [*] Network Communication - IRC: []
  1679.  
  1680. [*] Static Analysis: {}
  1681.  
  1682. [*] Resolved APIs: [
  1683. "mso.dll.#1443",
  1684. "mso.dll.#9214",
  1685. "mso.dll.#199",
  1686. "mso.dll.#1073",
  1687. "mso.dll.#4255",
  1688. "mso.dll.#3459",
  1689. "mso.dll.#1262",
  1690. "mso.dll.#5709",
  1691. "mso.dll.#7353",
  1692. "mso.dll.#5228",
  1693. "mso.dll.#2155",
  1694. "mso.dll.#1283",
  1695. "mso.dll.#2024",
  1696. "mso.dll.#5274",
  1697. "mso.dll.#3195",
  1698. "mso.dll.#6221",
  1699. "mso.dll.#2314",
  1700. "mso.dll.#408",
  1701. "mso.dll.#2714",
  1702. "mso.dll.#8622",
  1703. "mso.dll.#3380",
  1704. "mso.dll.#2052",
  1705. "mso.dll.#677",
  1706. "mso.dll.#469",
  1707. "mso.dll.#7974",
  1708. "mso.dll.#2609",
  1709. "mso.dll.#8499",
  1710. "oleaut32.dll.#7",
  1711. "secur32.dll.FreeContextBuffer",
  1712. "ncrypt.dll.SslOpenProvider",
  1713. "ncrypt.dll.GetSChannelInterface",
  1714. "bcryptprimitives.dll.GetHashInterface",
  1715. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1716. "ncrypt.dll.SslImportKey",
  1717. "bcryptprimitives.dll.GetCipherInterface",
  1718. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1719. "user32.dll.LoadStringW",
  1720. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1721. "ncrypt.dll.BCryptGetProperty",
  1722. "ncrypt.dll.BCryptCreateHash",
  1723. "ncrypt.dll.BCryptHashData",
  1724. "ncrypt.dll.BCryptFinishHash",
  1725. "ncrypt.dll.BCryptDestroyHash",
  1726. "crypt32.dll.CertGetCertificateChain",
  1727. "userenv.dll.GetUserProfileDirectoryW",
  1728. "sechost.dll.ConvertSidToStringSidW",
  1729. "sechost.dll.ConvertStringSidToSidW",
  1730. "userenv.dll.RegisterGPNotification",
  1731. "gpapi.dll.RegisterGPNotificationInternal",
  1732. "sechost.dll.OpenSCManagerW",
  1733. "sechost.dll.OpenServiceW",
  1734. "sechost.dll.CloseServiceHandle",
  1735. "sechost.dll.QueryServiceConfigW",
  1736. "cryptsp.dll.CryptAcquireContextA",
  1737. "cryptsp.dll.CryptCreateHash",
  1738. "cryptsp.dll.CryptHashData",
  1739. "cryptsp.dll.CryptVerifySignatureA",
  1740. "cryptsp.dll.CryptDestroyKey",
  1741. "cryptsp.dll.CryptDestroyHash",
  1742. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1743. "ncrypt.dll.BCryptImportKeyPair",
  1744. "ncrypt.dll.BCryptVerifySignature",
  1745. "ncrypt.dll.BCryptDestroyKey",
  1746. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1747. "crypt32.dll.CertFreeCertificateChain",
  1748. "crypt32.dll.CertDuplicateCertificateContext",
  1749. "ncrypt.dll.SslEncryptPacket",
  1750. "ncrypt.dll.SslDecryptPacket",
  1751. "winhttp.dll.WinHttpReceiveResponse",
  1752. "winhttp.dll.WinHttpQueryHeaders",
  1753. "winhttp.dll.WinHttpQueryDataAvailable",
  1754. "winhttp.dll.WinHttpReadData",
  1755. "webservices.dll.WsCreateError",
  1756. "ntdll.dll.EtwEventWrite",
  1757. "ntdll.dll.EtwEventRegister",
  1758. "ntdll.dll.EtwEventUnregister",
  1759. "webservices.dll.WsCreateHeap",
  1760. "webservices.dll.WsCreateReader",
  1761. "webservices.dll.WsSetInput",
  1762. "webservices.dll.WsFillReader",
  1763. "webservices.dll.WsReadToStartElement",
  1764. "webservices.dll.WsReadStartElement",
  1765. "webservices.dll.WsReadType",
  1766. "winhttp.dll.WinHttpCloseHandle",
  1767. "crypt32.dll.CertFreeCertificateContext",
  1768. "rpcrt4.dll.RpcBindingFree",
  1769. "webservices.dll.WsFreeReader",
  1770. "webservices.dll.WsFreeError",
  1771. "webservices.dll.WsFreeHeap",
  1772. "webservices.dll.WsCreateServiceProxyFromTemplate",
  1773. "winhttp.dll.WinHttpOpenRequest",
  1774. "winhttp.dll.WinHttpAddRequestHeaders",
  1775. "winhttp.dll.WinHttpSendRequest",
  1776. "winhttp.dll.WinHttpConnect",
  1777. "winhttp.dll.WinHttpCrackUrl",
  1778. "winhttp.dll.WinHttpSetStatusCallback",
  1779. "winhttp.dll.WinHttpOpen",
  1780. "winhttp.dll.WinHttpSetOption",
  1781. "winhttp.dll.WinHttpWriteData",
  1782. "winhttp.dll.WinHttpSetCredentials",
  1783. "winhttp.dll.WinHttpQueryAuthSchemes",
  1784. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1785. "winhttp.dll.WinHttpGetProxyForUrl",
  1786. "winhttp.dll.WinHttpQueryOption",
  1787. "webservices.dll.WsOpenServiceProxy",
  1788. "webservices.dll.WsCall",
  1789. "webservices.dll.WsAddCustomHeader",
  1790. "shlwapi.dll.StrStrA",
  1791. "shlwapi.dll.UrlUnescapeA",
  1792. "mso.dll.#1725",
  1793. "user32.dll.RegisterWindowMessageW",
  1794. "mso.dll.#4314",
  1795. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1796. "mso.dll.#6484",
  1797. "mso.dll.#9871",
  1798. "mso.dll.#4743",
  1799. "mso.dll.#5452",
  1800. "mso.dll.#2088",
  1801. "user32.dll.GetForegroundWindow",
  1802. "mso.dll.#7531",
  1803. "mso.dll.#5315",
  1804. "mso.dll.#8140",
  1805. "user32.dll.IsWindowEnabled",
  1806. "ole32.dll.CoGetCallState",
  1807. "ole32.dll.CoGetActivationState",
  1808. "advapi32.dll.RegisterWaitChainCOMCallback",
  1809. "cryptnet.dll.CertDllVerifyRevocation",
  1810. "profapi.dll.#104",
  1811. "sensapi.dll.IsNetworkAlive",
  1812. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1813. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1814. "rpcrt4.dll.NdrClientCall2",
  1815. "winhttp.dll.WinHttpSetTimeouts",
  1816. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1817. "shlwapi.dll.StrStrIW",
  1818. "winhttp.dll.WinHttpTimeFromSystemTime",
  1819. "user32.dll.IsHungAppWindow",
  1820. "cryptnet.dll.I_CryptNetGetConnectivity",
  1821. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1822. "setupapi.dll.SetupIterateCabinetW",
  1823. "kernel32.dll.RegOpenKeyExW",
  1824. "kernel32.dll.RegCloseKey",
  1825. "cabinet.dll.#20",
  1826. "cabinet.dll.#22",
  1827. "devrtl.dll.DevRtlGetThreadLogToken",
  1828. "cryptsp.dll.CryptSetHashParam",
  1829. "sechost.dll.QueryServiceConfigA",
  1830. "sechost.dll.QueryServiceStatus",
  1831. "rpcrt4.dll.RpcStringBindingComposeA",
  1832. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1833. "rpcrt4.dll.RpcEpResolveBinding",
  1834. "sechost.dll.LookupAccountSidLocalW",
  1835. "rpcrt4.dll.RpcStringFreeA",
  1836. "webservices.dll.WsResetHeap",
  1837. "webservices.dll.WsCloseServiceProxy",
  1838. "ws2_32.dll.#3",
  1839. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1840. "webservices.dll.WsFreeServiceProxy",
  1841. "ncrypt.dll.SslFreeObject",
  1842. "mso.dll.#9175",
  1843. "user32.dll.SetRect",
  1844. "mso.dll.#25",
  1845. "mso.dll.#1056",
  1846. "mso.dll.#8136",
  1847. "mso.dll.#8931",
  1848. "shell32.dll.SHGetFileInfoW",
  1849. "mso.dll.#5362",
  1850. "mso.dll.#6044",
  1851. "mso.dll.#6516",
  1852. "mso.dll.#5780",
  1853. "mso.dll.#4870",
  1854. "mso.dll.#6046",
  1855. "mso.dll.#1241",
  1856. "mso.dll.#2821",
  1857. "mso.dll.#2340",
  1858. "mso.dll.#7287",
  1859. "mso.dll.#5290",
  1860. "mso.dll.#1508",
  1861. "user32.dll.IsZoomed",
  1862. "user32.dll.GetWindowPlacement",
  1863. "user32.dll.GetWindowRect",
  1864. "mso.dll.#821",
  1865. "user32.dll.GetSystemMetrics",
  1866. "user32.dll.MonitorFromWindow",
  1867. "user32.dll.MonitorFromRect",
  1868. "user32.dll.MonitorFromPoint",
  1869. "user32.dll.EnumDisplayMonitors",
  1870. "user32.dll.GetMonitorInfoA",
  1871. "user32.dll.EnumDisplayDevicesA",
  1872. "mso.dll.#2378",
  1873. "user32.dll.SetWindowPos",
  1874. "user32.dll.AdjustWindowRect",
  1875. "mso.dll.#5912",
  1876. "mso.dll.#9719",
  1877. "mso.dll.#8824",
  1878. "mso.dll.#6117",
  1879. "mso.dll.#3307",
  1880. "user32.dll.SendMessageW",
  1881. "user32.dll.DestroyIcon",
  1882. "mso.dll.#3813",
  1883. "mso.dll.#1815",
  1884. "user32.dll.PtInRect",
  1885. "mso.dll.#1613",
  1886. "user32.dll.SetWindowTextW",
  1887. "user32.dll.GetClassLongW",
  1888. "mso.dll.#8572",
  1889. "gdi32.dll.CreateDIBSection",
  1890. "gdi32.dll.CreateCompatibleDC",
  1891. "gdi32.dll.GetViewportOrgEx",
  1892. "gdi32.dll.SetViewportOrgEx",
  1893. "gdi32.dll.SetBkColor",
  1894. "gdi32.dll.ExtTextOutA",
  1895. "mso.dll.#1573",
  1896. "mso.dll.#8612",
  1897. "user32.dll.SetScrollRange",
  1898. "mso.dll.#2509",
  1899. "user32.dll.BeginDeferWindowPos",
  1900. "user32.dll.DeferWindowPos",
  1901. "user32.dll.EndDeferWindowPos",
  1902. "user32.dll.OffsetRect",
  1903. "user32.dll.EnumChildWindows",
  1904. "user32.dll.GetScrollInfo",
  1905. "user32.dll.MapWindowPoints",
  1906. "gdi32.dll.DeleteDC",
  1907. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  1908. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  1909. "mso.dll.#6126",
  1910. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  1911. "gdi32.dll.GetFontRealizationInfo",
  1912. "gdi32.dll.GetFontFileInfo",
  1913. "gdi32.dll.GetFontFileData",
  1914. "mso.dll.#7261",
  1915. "mso.dll.#9540",
  1916. "usp10.dll.ScriptGetFontScriptTags",
  1917. "usp10.dll.ScriptGetFontLanguageTags",
  1918. "usp10.dll.ScriptGetFontFeatureTags",
  1919. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  1920. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  1921. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  1922. "gdiplus.dll.GdipCreatePath",
  1923. "gdiplus.dll.GdipStartPathFigure",
  1924. "gdiplus.dll.GdipAddPathLine2",
  1925. "gdiplus.dll.GdipClosePathFigure",
  1926. "gdiplus.dll.GdipCreateMatrix2",
  1927. "gdiplus.dll.GdipTransformPath",
  1928. "gdiplus.dll.GdipDeleteMatrix",
  1929. "gdiplus.dll.GdipGetPathWorldBounds",
  1930. "gdiplus.dll.GdipCreatePathIter",
  1931. "gdiplus.dll.GdipPathIterRewind",
  1932. "gdiplus.dll.GdipPathIterNextSubpath",
  1933. "gdiplus.dll.GdipPathIterCopyData",
  1934. "gdiplus.dll.GdipDeletePathIter",
  1935. "gdiplus.dll.GdipAddPathLine",
  1936. "gdiplus.dll.GdipDeletePath",
  1937. "gdiplus.dll.GdipClonePath",
  1938. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  1939. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  1940. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  1941. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  1942. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  1943. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  1944. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  1945. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  1946. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  1947. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  1948. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  1949. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  1950. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  1951. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  1952. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  1953. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  1954. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  1955. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  1956. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  1957. "mso.dll.#2566",
  1958. "mso.dll.#1429",
  1959. "mso.dll.#6502",
  1960. "uiautomationcore.dll.UiaClientsAreListening",
  1961. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  1962. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  1963. "user32.dll.SetRectEmpty",
  1964. "user32.dll.IntersectRect",
  1965. "user32.dll.InflateRect",
  1966. "mso.dll.#1100",
  1967. "mso.dll.#7047",
  1968. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  1969. "user32.dll.GetCursor",
  1970. "user32.dll.GetClientRect",
  1971. "user32.dll.SetScrollInfo",
  1972. "user32.dll.SetScrollPos",
  1973. "mso.dll.#3747",
  1974. "mso.dll.#8218",
  1975. "mso.dll.#5394",
  1976. "mso.dll.#331",
  1977. "mso.dll.#6829",
  1978. "mso.dll.#539",
  1979. "mso.dll.#4959",
  1980. "mso.dll.#6463",
  1981. "mso.dll.#4987",
  1982. "user32.dll.GetWindow",
  1983. "mso.dll.#7195",
  1984. "mso.dll.#7573",
  1985. "mso.dll.#5932",
  1986. "mso.dll.#2071",
  1987. "mso.dll.#1024",
  1988. "mso.dll.#6245",
  1989. "mso.dll.#9041",
  1990. "mso.dll.#1767",
  1991. "mso.dll.#9369",
  1992. "mso.dll.#4617",
  1993. "user32.dll.FillRect",
  1994. "mso.dll.#343",
  1995. "mso.dll.#9636",
  1996. "mso.dll.#2022",
  1997. "mso.dll.#4750",
  1998. "mso.dll.#4577",
  1999. "mso.dll.#850",
  2000. "mso.dll.#1776",
  2001. "mso.dll.#9026",
  2002. "shell32.dll.SHAddToRecentDocs",
  2003. "mso.dll.#4497",
  2004. "mso.dll.#4647",
  2005. "mso.dll.#8926",
  2006. "mso.dll.#7212",
  2007. "mso.dll.#5407",
  2008. "mso.dll.#5152",
  2009. "mso.dll.#3327",
  2010. "mso.dll.#6333",
  2011. "mso.dll.#420",
  2012. "mso.dll.#1335",
  2013. "mso.dll.#2041",
  2014. "ole32.dll.PropVariantClear",
  2015. "oleaut32.dll.#9",
  2016. "mso.dll.#7834",
  2017. "mso.dll.#239",
  2018. "mso.dll.#6357",
  2019. "mso.dll.#7026",
  2020. "mso.dll.#1671",
  2021. "mso.dll.#8263",
  2022. "mso.dll.#9307",
  2023. "mso.dll.#1441",
  2024. "mso.dll.#9223",
  2025. "mso.dll.#6453",
  2026. "mso.dll.#8044",
  2027. "mso.dll.#3698",
  2028. "mso.dll.#8565",
  2029. "mso.dll.#8373",
  2030. "mso.dll.#9741",
  2031. "mso.dll.#478",
  2032. "mso.dll.#479",
  2033. "mso.dll.#340",
  2034. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2035. "bcrypt.dll.BCryptGetProperty",
  2036. "bcrypt.dll.BCryptCreateHash",
  2037. "bcrypt.dll.BCryptHashData",
  2038. "bcrypt.dll.BCryptFinishHash",
  2039. "bcrypt.dll.BCryptDestroyHash",
  2040. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2041. "mso.dll.#8633",
  2042. "mso.dll.#5213",
  2043. "mso.dll.#6163",
  2044. "mso.dll.#552",
  2045. "mso.dll.#5630",
  2046. "mso.dll.#2513",
  2047. "mso.dll.#1607",
  2048. "mso.dll.#791",
  2049. "mso.dll.#1848",
  2050. "mso.dll.#8735",
  2051. "mso.dll.#9374",
  2052. "mso.dll.#5286",
  2053. "mso.dll.#6368",
  2054. "mso.dll.#4262",
  2055. "mso.dll.#1010",
  2056. "mso.dll.#7979",
  2057. "mso.dll.#8549",
  2058. "mso.dll.#8970",
  2059. "mso.dll.#9198",
  2060. "mso.dll.#4795",
  2061. "mso.dll.#1865",
  2062. "mso.dll.#9688",
  2063. "mso.dll.#320",
  2064. "advapi32.dll.RegDeleteKeyA",
  2065. "user32.dll.DestroyCursor",
  2066. "mso.dll.#7173",
  2067. "mso.dll.#8511",
  2068. "mso.dll.#3299",
  2069. "mso.dll.#7001",
  2070. "mso.dll.#3913",
  2071. "user32.dll.PeekMessageA",
  2072. "mso.dll.#1380",
  2073. "mso.dll.#9500",
  2074. "user32.dll.TranslateMessage",
  2075. "user32.dll.IsWindowUnicode",
  2076. "user32.dll.DispatchMessageA",
  2077. "user32.dll.DispatchMessageW",
  2078. "user32.dll.UpdateWindow",
  2079. "mso.dll.#999",
  2080. "mso.dll.#287",
  2081. "dwmapi.dll.DwmIsCompositionEnabled",
  2082. "mso.dll.#1575",
  2083. "mso.dll.#5034",
  2084. "mso.dll.#1517",
  2085. "mso.dll.#718",
  2086. "mso.dll.#4708",
  2087. "mso.dll.#8046",
  2088. "mso.dll.#4175",
  2089. "mso.dll.#8672",
  2090. "mso.dll.#1990",
  2091. "mso.dll.#3051",
  2092. "mso.dll.#1819",
  2093. "mso.dll.#1419",
  2094. "oleaut32.dll.#147",
  2095. "kernel32.dll.WerRegisterMemoryBlock",
  2096. "dwrite.dll.DWriteCreateFactory",
  2097. "advapi32.dll.RegQueryValueW",
  2098. "apphelp.dll.ApphelpCheckShellObject",
  2099. "gdi32.dll.GetCurrentObject",
  2100. "gdi32.dll.BitBlt",
  2101. "gdi32.dll.GetClipBox",
  2102. "gdi32.dll.StretchDIBits",
  2103. "riched20.dll.REExtendedRegisterClass",
  2104. "user32.dll.GetWindowLongW",
  2105. "user32.dll.GetSysColor",
  2106. "user32.dll.SetWindowLongW",
  2107. "user32.dll.RegisterWindowMessageA",
  2108. "user32.dll.RegisterClipboardFormatW",
  2109. "user32.dll.GetDoubleClickTime",
  2110. "user32.dll.SetCaretBlinkTime",
  2111. "user32.dll.SystemParametersInfoW",
  2112. "user32.dll.GetKeyboardLayoutList",
  2113. "mso.dll._MsoGetFidUspDll@0",
  2114. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2115. "usp10.dll.ScriptGetProperties",
  2116. "usp10.dll.ScriptItemize",
  2117. "user32.dll.LoadCursorW",
  2118. "user32.dll.IsWindowVisible",
  2119. "user32.dll.GetKeyboardLayout",
  2120. "user32.dll.PostMessageW",
  2121. "user32.dll.DefWindowProcW",
  2122. "uxtheme.dll.IsThemeActive",
  2123. "uxtheme.dll.IsAppThemed",
  2124. "uxtheme.dll.OpenThemeData",
  2125. "user32.dll.GetDC",
  2126. "user32.dll.ReleaseDC",
  2127. "user32.dll.IsIconic",
  2128. "user32.dll.GetParent",
  2129. "usp10.dll.ScriptGetCMap",
  2130. "user32.dll.InvalidateRect",
  2131. "user32.dll.HideCaret",
  2132. "user32.dll.ShowCaret",
  2133. "user32.dll.NotifyWinEvent",
  2134. "user32.dll.GetWindowTextLengthW",
  2135. "user32.dll.EnableWindow",
  2136. "msctf.dll.SetInputScope",
  2137. "ole32.dll.CoRevokeInitializeSpy",
  2138. "comctl32.dll.#388",
  2139. "user32.dll.GetWindowRgn",
  2140. "gdi32.dll.CreateCompatibleBitmap",
  2141. "gdi32.dll.SaveDC",
  2142. "gdi32.dll.SetPixel",
  2143. "gdi32.dll.GetPixel",
  2144. "gdi32.dll.RestoreDC",
  2145. "imm32.dll.ImmAssociateContext",
  2146. "mso.dll.#806",
  2147. "mso.dll.#4908",
  2148. "mso.dll.#8439",
  2149. "mso.dll.#2736",
  2150. "gdi32.dll.GetTextAlign",
  2151. "gdi32.dll.ExtTextOutW",
  2152. "mso.dll.#8122",
  2153. "mso.dll.#2114",
  2154. "mso.dll.#6558",
  2155. "gdi32.dll.GetFontData",
  2156. "usp10.dll.ScriptItemizeOpenType",
  2157. "usp10.dll.ScriptLayout",
  2158. "usp10.dll.ScriptShapeOpenType",
  2159. "usp10.dll.ScriptPlaceOpenType",
  2160. "mso.dll.#1318",
  2161. "gdi32.dll.GetTextExtentExPointWPri",
  2162. "mso.dll.#8395",
  2163. "mso.dll.#379",
  2164. "mso.dll.#6338",
  2165. "mso.dll.#7964",
  2166. "mso.dll.#1437",
  2167. "mso.dll.#1427",
  2168. "mso.dll.#6137",
  2169. "winmm.dll.timeGetTime",
  2170. "mso.dll.#7578",
  2171. "mso.dll.#8483",
  2172. "mso.dll.#3055",
  2173. "advapi32.dll.RegDeleteTreeW",
  2174. "xmllite.dll.CreateXmlReader",
  2175. "user32.dll.GetWindowDC",
  2176. "gdi32.dll.SetLayout",
  2177. "gdi32.dll.RectVisible",
  2178. "gdi32.dll.GetClipRgn",
  2179. "gdi32.dll.ExcludeClipRect",
  2180. "gdi32.dll.SelectClipRgn",
  2181. "gdi32.dll.GdiIsMetaPrintDC",
  2182. "mso.dll.#445",
  2183. "user32.dll.BeginPaint",
  2184. "gdi32.dll.SetWindowOrgEx",
  2185. "user32.dll.EndPaint",
  2186. "user32.dll.IsWindowRedirectedForPrint",
  2187. "gdi32.dll.CreateRectRgnIndirect",
  2188. "user32.dll.GetUpdateRgn",
  2189. "gdi32.dll.GetRgnBox",
  2190. "user32.dll.ValidateRect",
  2191. "user32.dll.GetUpdateRect",
  2192. "user32.dll.GetCaretBlinkTime",
  2193. "user32.dll.CreateCaret",
  2194. "mso.dll.#3624",
  2195. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2196. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2197. "gdi32.dll.TranslateCharsetInfo",
  2198. "mso.dll.#3300",
  2199. "mso.dll.#7465",
  2200. "mso.dll.#6247",
  2201. "mso.dll.#5070",
  2202. "gdiplus.dll.GdipCreateSolidFill",
  2203. "gdiplus.dll.GdipCreatePen1",
  2204. "gdiplus.dll.GdipSetPenLineCap197819",
  2205. "gdiplus.dll.GdipSetPenLineJoin",
  2206. "gdiplus.dll.GdipSetPenMiterLimit",
  2207. "gdiplus.dll.GdipCreateFromHDC",
  2208. "gdiplus.dll.GdipSetPixelOffsetMode",
  2209. "gdiplus.dll.GdipSetSmoothingMode",
  2210. "gdiplus.dll.GdipSetCompositingQuality",
  2211. "gdiplus.dll.GdipSetPageUnit",
  2212. "gdiplus.dll.GdipSetInterpolationMode",
  2213. "gdiplus.dll.GdipGetSmoothingMode",
  2214. "gdiplus.dll.GdipFillPath",
  2215. "gdiplus.dll.GdipDeleteGraphics",
  2216. "gdiplus.dll.GdipDrawPath",
  2217. "mso.dll.#6899",
  2218. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2219. "user32.dll.DestroyCaret",
  2220. "user32.dll.GetCaretPos",
  2221. "user32.dll.SetCaretPos",
  2222. "user32.dll.GetFocus",
  2223. "user32.dll.GetClassNameA",
  2224. "mso.dll.#8662",
  2225. "user32.dll.RegisterPowerSettingNotification",
  2226. "powrprof.dll.PowerSettingRegisterNotification",
  2227. "user32.dll.GetWindowThreadProcessId",
  2228. "user32.dll.GetWindowTextW",
  2229. "mso.dll.#732",
  2230. "mso.dll.#5804",
  2231. "ole32.dll.CoCreateInstance",
  2232. "mso.dll.#434",
  2233. "user32.dll.GetMessageExtraInfo",
  2234. "user32.dll.TrackMouseEvent",
  2235. "mso.dll.#424",
  2236. "user32.dll.GetInputState",
  2237. "mso.dll.#8461",
  2238. "user32.dll.GetClipboardOwner",
  2239. "user32.dll.GetActiveWindow",
  2240. "user32.dll.GetAncestor",
  2241. "advapi32.dll.NotifyServiceStatusChangeW",
  2242. "mso.dll.#3544",
  2243. "mso.dll.#900",
  2244. "mso.dll.#1422",
  2245. "user32.dll.MsgWaitForMultipleObjectsEx",
  2246. "mso.dll.#1885",
  2247. "mso.dll.#832",
  2248. "user32.dll.GetClassNameW",
  2249. "mso.dll.#9465",
  2250. "user32.dll.GetScrollPos",
  2251. "mso.dll.#629",
  2252. "advapi32.dll.CryptAcquireContextA",
  2253. "advapi32.dll.CryptGenKey",
  2254. "cryptsp.dll.CryptGenKey",
  2255. "advapi32.dll.CryptImportKey",
  2256. "cryptsp.dll.CryptImportKey",
  2257. "advapi32.dll.CryptExportKey",
  2258. "cryptsp.dll.CryptExportKey",
  2259. "advapi32.dll.CryptDestroyKey",
  2260. "msi.dll.#111",
  2261. "kernel32.dll.FlsAlloc",
  2262. "kernel32.dll.FlsGetValue",
  2263. "kernel32.dll.FlsSetValue",
  2264. "kernel32.dll.FlsFree",
  2265. "ieawsdc.dll.HrExtractTemplateToPath",
  2266. "advapi32.dll.CryptCreateHash",
  2267. "advapi32.dll.CryptSetHashParam",
  2268. "advapi32.dll.CryptHashData",
  2269. "advapi32.dll.CryptGetHashParam",
  2270. "cryptsp.dll.CryptGetHashParam",
  2271. "advapi32.dll.CryptDestroyHash",
  2272. "msi.dll.#90",
  2273. "crypt32.dll.CryptQueryObject",
  2274. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2275. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2276. "cryptsp.dll.CryptGetDefaultProviderW",
  2277. "cryptsp.dll.CryptAcquireContextW",
  2278. "crypt32.dll.CertEnumCertificatesInStore",
  2279. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2280. "cryptsp.dll.CryptReleaseContext",
  2281. "wintrust.dll.WinVerifyTrust",
  2282. "wintrust.dll.WintrustCertificateTrust",
  2283. "wintrust.dll.SoftpubAuthenticode",
  2284. "wintrust.dll.SoftpubInitialize",
  2285. "wintrust.dll.SoftpubLoadMessage",
  2286. "wintrust.dll.SoftpubLoadSignature",
  2287. "wintrust.dll.SoftpubCheckCert",
  2288. "wintrust.dll.SoftpubCleanup",
  2289. "wintrust.dll.CryptSIPVerifyIndirectData",
  2290. "advapi32.dll.RegDeleteValueW",
  2291. "advapi32.dll.SaferiSearchMatchingHashRules",
  2292. "wintrust.dll.WTHelperProvDataFromStateData",
  2293. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2294. "crypt32.dll.CertCloseStore",
  2295. "user32.dll.WindowFromPoint",
  2296. "user32.dll.SendNotifyMessageW",
  2297. "user32.dll.IsClipboardFormatAvailable",
  2298. "user32.dll.GetCursorInfo",
  2299. "user32.dll.GetCapture",
  2300. "user32.dll.GetMessagePos",
  2301. "user32.dll.ScreenToClient",
  2302. "user32.dll.SetFocus",
  2303. "user32.dll.GetDesktopWindow",
  2304. "user32.dll.FindWindowExW",
  2305. "mso.dll.#4746",
  2306. "mso.dll.#8837",
  2307. "advapi32.dll.ConvertSidToStringSidW",
  2308. "msi.dll.DllGetVersion",
  2309. "mso.dll.#5787",
  2310. "user32.dll.ShowCursor",
  2311. "user32.dll.IsChild",
  2312. "cabinet.dll.#23",
  2313. "user32.dll.IsWindow",
  2314. "mso.dll.#1455",
  2315. "user32.dll.LoadImageW",
  2316. "user32.dll.CreateWindowExW",
  2317. "comctl32.dll.HIMAGELIST_QueryInterface",
  2318. "comctl32.dll.DrawShadowText",
  2319. "comctl32.dll.DrawSizeBox",
  2320. "comctl32.dll.DrawScrollBar",
  2321. "comctl32.dll.SizeBoxHwnd",
  2322. "comctl32.dll.ScrollBar_MouseMove",
  2323. "comctl32.dll.ScrollBar_Menu",
  2324. "comctl32.dll.HandleScrollCmd",
  2325. "comctl32.dll.DetachScrollBars",
  2326. "comctl32.dll.AttachScrollBars",
  2327. "comctl32.dll.CCSetScrollInfo",
  2328. "comctl32.dll.CCGetScrollInfo",
  2329. "comctl32.dll.CCEnableScrollBar",
  2330. "comctl32.dll.QuerySystemGestureStatus",
  2331. "uxtheme.dll.#49",
  2332. "uxtheme.dll.CloseThemeData",
  2333. "user32.dll.EnableScrollBar",
  2334. "user32.dll.ShowScrollBar",
  2335. "user32.dll.ShowWindow",
  2336. "user32.dll.SetParent",
  2337. "user32.dll.KillTimer",
  2338. "user32.dll.ClientToScreen",
  2339. "user32.dll.MoveWindow",
  2340. "user32.dll.DestroyWindow",
  2341. "gdi32.dll.GetViewportExtEx",
  2342. "gdi32.dll.GetWindowExtEx",
  2343. "gdi32.dll.GetTextCharset",
  2344. "gdi32.dll.GetMapMode",
  2345. "gdi32.dll.GetLayout",
  2346. "oleaut32.dll.SysAllocString",
  2347. "oleaut32.dll.SysStringLen",
  2348. "oleaut32.dll.SysAllocStringLen",
  2349. "oleaut32.dll.SysFreeString",
  2350. "uxtheme.dll.GetThemePartSize",
  2351. "user32.dll.GetMessageW",
  2352. "gdi32.dll.IntersectClipRect",
  2353. "gdi32.dll.SetTextColor",
  2354. "gdi32.dll.SetBkMode",
  2355. "gdi32.dll.SetTextAlign",
  2356. "gdi32.dll.ExtSelectClipRgn",
  2357. "gdi32.dll.GetTextColor",
  2358. "uxtheme.dll.DrawThemeBackground",
  2359. "user32.dll.WaitMessage",
  2360. "gdi32.dll.GdiFlush",
  2361. "wininet.dll.InternetGetConnectedState",
  2362. "rasapi32.dll.RasConnectionNotificationW",
  2363. "sechost.dll.NotifyServiceStatusChangeA",
  2364. "osppcext.dll.SLActivateProduct",
  2365. "osppcext.dll.SLGetTokenActivationGrants",
  2366. "osppcext.dll.SLGetTokenActivationCertificates",
  2367. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2368. "osppcext.dll.SLSignTokenActivationChallenge",
  2369. "osppcext.dll.SLDepositTokenActivationResponse",
  2370. "osppcext.dll.SLFreeTokenActivationGrants",
  2371. "osppcext.dll.SLFreeTokenActivationCertificates",
  2372. "advapi32.dll.CryptReleaseContext",
  2373. "mso.dll.#7673",
  2374. "mso.dll.#709",
  2375. "mso.dll.#5913",
  2376. "mso.dll.#8051",
  2377. "mso.dll.#3712",
  2378. "comctl32.dll.SetWindowSubclass",
  2379. "comctl32.dll.DefSubclassProc",
  2380. "mso.dll.#8693",
  2381. "mso.dll.#6330",
  2382. "mso.dll.#1966",
  2383. "user32.dll.UnhookWindowsHookEx",
  2384. "gdiplus.dll.GdipDeleteBrush",
  2385. "gdiplus.dll.GdipDeletePen",
  2386. "mso.dll.#3702",
  2387. "mso.dll.#3484",
  2388. "mso.dll.#6960",
  2389. "mso.dll.#8705",
  2390. "mso.dll.#7892",
  2391. "msi.dll.#39",
  2392. "mso.dll.#7931",
  2393. "mso.dll.#3837",
  2394. "mso.dll.#8574",
  2395. "mso.dll.#8398",
  2396. "mso.dll.#2477",
  2397. "msproof7.dll.DllGetClassObject",
  2398. "msproof7.dll.DllCanUnloadNow",
  2399. "mso.dll.#4172",
  2400. "mso.dll.#1439",
  2401. "mso.dll.#9566",
  2402. "mso.dll.#111",
  2403. "mso.dll.#4191",
  2404. "mso.dll.#3802",
  2405. "mso.dll.#6982",
  2406. "mso.dll.#8800",
  2407. "mso.dll.#3572",
  2408. "mso.dll.#167",
  2409. "mso.dll.#5737",
  2410. "mso.dll.#590",
  2411. "mso.dll.#3758",
  2412. "msgr3en.dll.CheckVersion",
  2413. "msgr3en.dll.#29",
  2414. "msgr3en.dll.#30",
  2415. "msgr3en.dll.#31",
  2416. "msgr3en.dll.#32",
  2417. "msgr3en.dll.#33",
  2418. "msgr3en.dll.#34",
  2419. "msgr3en.dll.#35",
  2420. "msgr3en.dll.#45",
  2421. "msgr3en.dll.#46",
  2422. "msgr3en.dll.#47",
  2423. "msgr3en.dll.#48",
  2424. "msgr3en.dll.#51",
  2425. "msgr3en.dll.#50",
  2426. "msgr3en.dll.#49",
  2427. "msgr3en.dll.#43",
  2428. "msgr3en.dll.#41",
  2429. "msgr3en.dll.#42",
  2430. "msgr3en.dll.#44",
  2431. "msgr3en.dll.#39",
  2432. "msgr3en.dll.#40",
  2433. "msgr3en.dll.#36",
  2434. "msgr3en.dll.#38",
  2435. "msgr3en.dll.#37",
  2436. "msgr3en.dll.#56",
  2437. "msgr3en.dll.#52",
  2438. "msgr3en.dll.#53",
  2439. "msgr3en.dll.#57",
  2440. "msgr3en.dll.#58",
  2441. "msgr3en.dll.#59",
  2442. "user32.dll.LoadStringA",
  2443. "mso.dll.#2561",
  2444. "user32.dll.SetTimer",
  2445. "mso.dll.#6857",
  2446. "gdi32.dll.GetBitmapBits",
  2447. "mso.dll.#230",
  2448. "gdi32.dll.CombineRgn",
  2449. "user32.dll.CopyRect",
  2450. "gdi32.dll.SetStretchBltMode",
  2451. "user32.dll.UpdateLayeredWindow",
  2452. "mso.dll.#6205",
  2453. "mso.dll.#2417",
  2454. "mso.dll.#6057",
  2455. "user32.dll.RemovePropW",
  2456. "user32.dll.EnumThreadWindows",
  2457. "user32.dll.EnumWindows",
  2458. "mso.dll.#6420",
  2459. "mso.dll.#4702",
  2460. "user32.dll.SetCursor",
  2461. "oleaut32.dll.#10",
  2462. "mso.dll.#8165",
  2463. "mso.dll.#8071",
  2464. "mso.dll.#4355",
  2465. "mso.dll.#1414",
  2466. "mso.dll.#8202",
  2467. "mso.dll.#7189",
  2468. "mso.dll.#2738",
  2469. "mso.dll.#8691",
  2470. "mso.dll.#6079",
  2471. "mso.dll.#7167",
  2472. "mso.dll.#7163",
  2473. "mso.dll.#333",
  2474. "mso.dll.#1785",
  2475. "mso.dll.#5919",
  2476. "mso.dll.#5973",
  2477. "comctl32.dll.RemoveWindowSubclass",
  2478. "mso.dll.#2014",
  2479. "mso.dll.#1442",
  2480. "mso.dll.#4388",
  2481. "mso.dll.#8472",
  2482. "mso.dll.#2281",
  2483. "mso.dll.#2628",
  2484. "mso.dll.#3425",
  2485. "mso.dll.#5291",
  2486. "mso.dll.#1718",
  2487. "mso.dll.#4777",
  2488. "mso.dll.#9668",
  2489. "mso.dll.#2294",
  2490. "mso.dll.#2968",
  2491. "mso.dll.#1401",
  2492. "mso.dll.#1914",
  2493. "advapi32.dll.RegDeleteKeyW",
  2494. "mso.dll.#235",
  2495. "mso.dll.#4416",
  2496. "mso.dll.#9398",
  2497. "mso.dll.#8022",
  2498. "mso.dll.#8757",
  2499. "mso.dll.#237",
  2500. "mso.dll.#4214",
  2501. "mso.dll.#884",
  2502. "mso.dll.#121",
  2503. "mso.dll.#1712",
  2504. "mso.dll.#9344",
  2505. "mso.dll.#4203",
  2506. "mso.dll.#3974",
  2507. "mso.dll.#4882",
  2508. "mso.dll.#2449",
  2509. "mso.dll.#2767",
  2510. "mso.dll.#9199",
  2511. "mso.dll.#7948",
  2512. "mso.dll.#3209",
  2513. "mso.dll.#4083",
  2514. "mso.dll.#292",
  2515. "mso.dll.#795",
  2516. "mso.dll.#8349",
  2517. "mso.dll.#8796",
  2518. "mso.dll.#3930",
  2519. "mso.dll.#9105",
  2520. "mso.dll.#2427",
  2521. "mso.dll.#8116",
  2522. "mso.dll.#6156",
  2523. "user32.dll.UnregisterClassW",
  2524. "usp10.dll.ScriptFreeCache",
  2525. "mso.dll.#7002",
  2526. "mso.dll.#186",
  2527. "user32.dll.PostQuitMessage",
  2528. "mso.dll.#591",
  2529. "mso.dll.#2272",
  2530. "mso.dll.#4284",
  2531. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  2532. "mso.dll.#4426",
  2533. "mso.dll.#8473",
  2534. "mso.dll.#8106",
  2535. "mso.dll.#8876",
  2536. "mso.dll.#4210",
  2537. "mso.dll.#8586",
  2538. "mso.dll.#8004",
  2539. "mso.dll.#6078",
  2540. "mso.dll.#815",
  2541. "mso.dll.#187",
  2542. "mso.dll.#5625",
  2543. "mso.dll.#8316",
  2544. "mso.dll.#7598",
  2545. "ws2_32.dll.#116",
  2546. "user32.dll.RemoveClipboardFormatListener",
  2547. "user32.dll.UnregisterPowerSettingNotification",
  2548. "powrprof.dll.PowerSettingUnregisterNotification",
  2549. "shell32.dll.#155",
  2550. "advapi32.dll.EventUnregister",
  2551. "user32.dll.UnregisterClassA",
  2552. "gdiplus.dll.GdiplusShutdown",
  2553. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  2554. "winsta.dll.WinStationUnRegisterConsoleNotification",
  2555. "mso.dll.#2482",
  2556. "mso.dll.#5458",
  2557. "advapi32.dll.UnregisterTraceGuids",
  2558. "comctl32.dll.#321"
  2559. ]
  2560.  
  2561. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!