API tools faq
paste
paladin316

Docs_3aa14486d8eeb3a04a9d57d7e25dac75_doc_2019-07-22_20_30.txt

paladin316
Jul 22nd, 2019
2,080
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 130.83 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Msoffice"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_3aa14486d8eeb3a04a9d57d7e25dac75.doc"
  7. * File Size: 8446
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "1c4ec78bd99951fdd23597f30b749dc815d2a58015554aa15e917263cd3d941d"
  10. * MD5: "3aa14486d8eeb3a04a9d57d7e25dac75"
  11. * SHA1: "23ceced3ab8950a7c6117655e66e923ff29aa269"
  12. * SHA512: "d3a5c5de66b9927a2ae43c2bbfdbaa5f85d18b693e04a60e4d9924ebe9d294019e88d0bca9ee6d347e211a3b4e1bbee75b8203ef67bc9b2ea81486f3a6b78594"
  13. * CRC32: "FB0C131A"
  14. * SSDEEP: "96:g/oBPcvyGTq5tz5qPiBnWhhbdMjNfIyHQWIa1p7Y/:gIPsyGTq5tz5bwhddMjBDzE"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (6 unique times)",
  25. "Details":
  26.  
  27. "IP": "52.109.20.4:443"
  28.  
  29.  
  30. "IP": "96.17.4.23:443"
  31.  
  32.  
  33. "IP": "104.18.24.243:80"
  34.  
  35.  
  36. "IP": "72.21.91.29:80"
  37.  
  38.  
  39. "IP": "52.109.2.14:443"
  40.  
  41.  
  42. "IP": "104.115.150.73:443"
  43.  
  44.  
  45.  
  46.  
  47. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  48. "Details":
  49.  
  50. "ioc": "rame.glox"
  51.  
  52.  
  53. "ioc": "ontent.inf"
  54.  
  55.  
  56. "ioc": "ist.glox"
  57.  
  58.  
  59. "ioc": "chevronaccent.glox"
  60.  
  61.  
  62. "ioc": "rc.glox"
  63.  
  64.  
  65. "ioc": "gosttitle.xsl"
  66.  
  67.  
  68. "ioc": "turabian.xsl"
  69.  
  70.  
  71. "ioc": "mlaseventheditionofficeonline.xsl"
  72.  
  73.  
  74. "ioc": "ccent.glox"
  75.  
  76.  
  77. "ioc": "gb.xsl"
  78.  
  79.  
  80. "ioc": "harvardanglia2008officeonline.xsl"
  81.  
  82.  
  83. "ioc": "pictureorgchart.glox"
  84.  
  85.  
  86. "ioc": "iso690.xsl"
  87.  
  88.  
  89. "ioc": "nline.xsl"
  90.  
  91.  
  92. "ioc": "adial.glox"
  93.  
  94.  
  95. "ioc": "ieee2006officeonline.xsl"
  96.  
  97.  
  98. "ioc": "e.gu"
  99.  
  100.  
  101. "ioc": "chicago.xsl"
  102.  
  103.  
  104. "ioc": "quations.dotx"
  105.  
  106.  
  107. "ioc": "ext.glox"
  108.  
  109.  
  110. "ioc": "iso690nmerical.xsl"
  111.  
  112.  
  113. "ioc": "rocess.glox"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Performs some HTTP requests",
  119. "Details":
  120.  
  121. "url": "http://coldcerealfordinner.com/wp-admin/js/12jan/Ojan/Jan.exe"
  122.  
  123.  
  124. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  125.  
  126.  
  127. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  128.  
  129.  
  130.  
  131.  
  132. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  133. "Details":
  134.  
  135. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x016\\x14\\x1eux (\\xaf\\xd1\\x9d\\x93\\xa8\\xea\\x7f\\xb3\\xea\\xfe\\x8b\\xc8\\xbc\\x8b\\x89\\x8f\\xa6\\x85h\\xf0\\x14\\xa8b\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  136.  
  137.  
  138. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04bp\\xbbo\\xfe\\x9f4\\xb0e\\x90\\x86\\xf7\\xc5\\x93\\x06\\xf1l\\xef\\x1b\\x9d\\x94\\xf4l\\x80\\xaa\\x9e\\xce\\x06\\x93\\xa6os\\xb1,\\xfap\\xf6\\x9f\\x8f\\x80\\x88\\x84\\x80kj\\x0b\\x13\\xfb\\xecdk_\\x87\\xfa;p\\xa3d\\xe2c,\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\x8c\\xd7m\\xe2\\xe2\\:\\xf8sw\\x03\\xec\\x07g\\xb2\\xe2\\x81x'\\xd2\\xa9\\xb6\\xfco\\xdck\\x16\\xa0\\xfe\\x8a\\x1b+& \\x919\\xa6\\xf2\\xeb\\x1awj7\ty\\xc1"
  139.  
  140.  
  141. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p%\\xd1\\x8b\\xfd\\xc6o-p\\xa7l\\xbf\\x17c\\x025\\xfdy\\xa9\\xe9\\xbc_\\xc5a\\x0e\\x15\\xc3@\\x85\\xc44*\\xb6\r\\x83\\x16\\xf42\\xf9\\x17\\x1c\\xfc\\xbb\\xd5+\\xdb:&7\\x13\\xf5-kcj\\xfb\\x8a\\x1e\\xd4=\\x8e7\\x0f\\xf1\\x1cg\\xb8y<\\x0f4q\\x02\\xac9\\xe2\\x06q1t5\\x87\\xe8\\xa0l\\xf1\n\\x0bv<\\x89\\xaei\\x139\\xf7\\xbf\\xa81\\x9c\\xa1\"t4u\\xc7s\\xd5\\xbb\\x0b\\x81o\\x89\\x14\\xeb\\xa4x\\x1e\\x8a\\x04\\x95\\x0co\\xa7\\x18\\x91\\x88;p\\x07\\xba\\xdf\\xad.s\\xfd\\x8f\\xc3@\\xac\\xfbo\\xcf\tt\\xbe\\x1a\\xbbi\\x03\\xea\\xe0\\xca\\xc5l\\xe4\\x01\\xf3\\x15\\x98m\\xdb\\x14g\\x8c\\x0b\\x91\\xa3\\xd5\\x81p\\xb7+\\xc1^\\x89\\xa8\\xf4\\xcc\\xa2w \\xfcr\\x1a\\?#n!\\x85\\xff\\x04p,\\x1f\\x00\\xdb\\xab\\xca<\\xf7\\xdbv\\xa1\\xa9\\xe2a\\x17\\x81\\xf3\\xf4\\x1bm\\xcc|7\\xd3\\x92\\x9f\\xe5\\xc4\\x93.v\\xf6\\x19\\x92n\\xd4\\x8bu\"2vg:\\x07\\xb1\\xa1\\xb6\\xf0\\xb6j(\\xb5\\x8c\\x9bb"
  142.  
  143.  
  144. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x016\\x14\\x1f~\\x0b\\xf6d\\x82\\x91uicv~q\\xffj\\xb9\\xdbu\\xadbf\\xef\\xb8\\x07~\\x89\\xdb\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  145.  
  146.  
  147. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xa6\\x06\\x98\\x0b\\xe5a\\xce\\x0b<.y\\x1c\\xa9\td\\x1d!5\\xb5\\x88\\x0ck\\xfd\\x9d%\\xfa\\x0f\\xf2\\x14\\xbc\\xcd$g\\x08s\\x10w\\xe8%^7\\x9b\\x04\\xc8e\\x170\\xea\\xb6\\x8dg\n\\x95z\\xf8\\xff\\xd2~%ke-\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8\\xc0\\x9f\\xec\\x01\\xc9\\xbb\\x90\\xfe=\\xf4\\x0f\\xed-w\\xadgi?@f\\xc1\\xd5\\xe965\\x83a\\x8do|!bd0f\\xda\\x9e\\x06\\x0c\\xcfh\\xf5\\xedc\\x06r"
  148.  
  149.  
  150. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  151.  
  152.  
  153. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x016\\x14 b\\xf0\\x9e\\x99\\x05\\xf9w\\xa7\\x07\\x9e\\x88\\x88\\xc8\\xe1\\xbb\\xf6\\xc4\\xa5^kl%\\xde>2\\xab\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  154.  
  155.  
  156. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r\\xee\\xd3,<\\xb41\\x88\\x00\\x10\\x8b\\xc7@\\xbf\\x7f\\xc96\\x90_\\xa0\\xe0\\xc8\\xc9b\\xba\\xd0\\x14\\xec\\x1f\\x94\\x9bnnl\\xb6i~\\x12\\x93\\xca:\\x04\\xdfu\\xc1u/\\xa6\\xd3e\\x96\\x1b\\xe9 \\x01\\x14\\xa0:\\x7f\\xd9\\x1ax\\xb1\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=m\\x013\\x9e\\x004xg+\\xf7\\x99\\x9f\\xbde\\xf5akaq\\xf3\\xf5\\xbb\\xcc\\xc9\\xcc\\xe2\r\\x8c\\xcf\\xff\\x8b\\x82\\xe9u\\xce\\x8f\\x89\\xa5\\xca\\xce4|\\xf6\\xd6sy"
  157.  
  158.  
  159. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1aa\\xfe\t\\x8e\\xb7zu`\\xf2;\\x7f\\x0e\\x03\\xdd\\xba\\x80\\x19!l\\x91\\x92xn1\\x9a\\xc60g%\\x96\\xf3\\xad\\x99n\\x1dn\\xff\\xfa\\x04\\xd6xn\\x80c\\xd0=gxq\\xde\\xef\\xbf:c0.n\\x1dqp@\\x02r\\x8d\\xec\\xd1eee \\xe4\\x00\\xa9k5nr\\xf0$\\x9d\\x84\\x9bw<\\x1a\\xecz\\x12\\xa6\\xd4\\xab96q\\xa3n\\xf02z\\xa5\\x16\\x117\\x13\\xfbc5'\\x03~\\xf0f@\\xe7\\xf5\\xea\\xef\\x1a\\xfd\\xc4\\x1e\\xe5\\xab\\x93\\xbe\\x1a\\x00\\xaa\\x87\\xad\\x17\\x03*\\xe7\\xbc\\xfe\\xa0\\xf7\\x12\\xa9\\x92\\x9c\\xfe4\\x1ctq\\xa6\\x07uq\\xe6\\xdb\\xf9\\x81\\xc0\\xa3ami\\xa1\\xb5\\xaf\\x90\\x15\\xaf\\xa8\n\\xe4\\xe1\\xb6rf\\xa8\\x99>\\xfe?.\\x98\\x93a^\\xca\\xa8\\xabc\\xa8\\x9f\\x8a~\\xc9b\\xb1|\\xc7v9\\x96\\xa6\\xf2\\xa1\\x1df$\\xfb\\xdd\\x81?\\x9d\\xda\\xbf2\\xfe>\\xddx\\xfa\\xe9wv\\xdc\\xfc\\xbe\\x99\\xe3+a\\xb2&0\\xb4\\xae\\x0cye`\\xa1\\xa1\\xc51\\x95r\\x19d\\x9cy"
  160.  
  161.  
  162. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  163.  
  164.  
  165. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x016\\x14!l\\xdc\n\\xce-\\xb7w\\xcc\\x19\\x01\\x82\\x01b\\x81\\xde\\xa6\\x9a\\x02mz\\x0332\\xd4f\\x87y\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  166.  
  167.  
  168. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xbe9or\\xfc\\xa3\\x89\\x80\\x8a\\x02(\\xd9+\\x06k\\x1bu\\xb3\\xe33\\xd6\\xa4\\x1d\\x18\\x8cb\\xcd\\xff\\xf1\\xdb\\x92\\x17\\xe5\\x81&\\xd5\\xa1\\xf1k#^\\xbd\\xce\\xca\\xca\\x9f\\xc9b\\xaf\\x81\\xde\\xfc*\\xd6\\xd8ta\\x11\\x19\\x7fc\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\xc0.`^o\\xab\\xc3<\\x04\\xf0n\\xe6\n\\xd9\\xb2\\x14\\xd4\\xf1yn\\xf0\\xbaq\\xc0z\\x00b\\xeei\\xbd:\\xd0)\\xa9\\xed\\x0e'\\xd0\\x83f\\x12\\xaa:wi\\xe2"
  169.  
  170.  
  171. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xee\\x93z\\x04q\\x85\\x88k\\xd6\\x86)\\x94\\x1c%k\\x1d\\xfdu\\x0c\\x83#aj\\xb6x\\x8e\\x86\\x9b#\\xd5\\xc0\\xd5\\xc5\\xea\\x9a\\xe9\\xf1(\\x8b\\xd5\\xff\\xcd\\x9cvy\\xbb\\xbc\\x12\\xbe\\xf2\\xf1di\\xeb\\xa3\\x10+\\xc9\\xc7yd\\x1c\\x95\\xac\\xfa/|\\xcd\\xc8\\x0e\\x167\\x03\\xaf\\x8c\tvm\\xfb\\x19(ml\\x00\\xf8\\x13\\xa7f\\xa8>\\xdf\\x1b\\xeb\\xe0\\xa6\\xf6\\x93\\xf0\\xca\\xbb\\xc9l\\xb9n\\xf0@\\x8ae\\x94\\xb1\\xdek\\xa3\\x88\\xf7&\\x1d-\\x88\\xf8p\\xb0\\xea\\xc4\\xbb)\\x9f\\x96nn%\\xda\\x12\\x9d\\x84\\x973\\xabs\\xd6\\xf1l\\xb1d\\x87\\xf5\\xe1j\\x81k\\xf0cms>\\xa9v\\xd3\\xe5\\xf9x\\xed6g~\\xcd(.\\xac\\x86\\x9f\\xca\\xa6\\xdau\\x035\\x05\\xa66m\\x80\\x9co0\\xa0\\x05\\x8d\\x14\\xc9\\xe1\\xeb;\\xf3\\xed\\xcb\\xe0\\x90\"\\x02\\xbc_\\xfa\\xd0q\\x18\\xf5\\xf9\\x04rlm\\xeb\\xcf\\x18\\xac@\\xae\\x92h\\x9a\\xab\\x0c\\x05t\\x9c\\x18\n\\x9f\\xa5v\\xfc\\xb4\\x91\\xa3\\xd4\\x15!\\x02j\\xd5\\xca,#\\x11\\xa2\\xb2="
  172.  
  173.  
  174. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xbb\\x8d\\xe75u\\x16\\xb5n\\xf6|\\xd3?\\xd2\\xc8\\xe6nh\\xb7\\xcee%\\x16\\xf4w\\x06\\xad\\x17\\x85\\x99\\xb1\\x1d.|\\xb1\\xa4\\xa2\\xf7\\x0b\\x82\\x8c\\xf7\\xdfntgm:\\xda\\x9c\\x91\\x19\\xdb\\xc7\\xef\\xc7\\xda\\xda\\x96\\x9b\\x1f\\x98\\x06\\xb9\\xb7t\\xddq\\xe0\\xfc\\xfe\\x94z\\\\x9f\\xe8\\xda\\xba\\x9e#d\\xd9\\\\xce\\x90e\\xdc\\xc1r\\xf1\\x95\\x88\\x8d\\x9b\\x08\\x1a\\xbdec\\x7f)j\\xe1\\x07\\x1epd\\xa6\\x9ff0\\xcb \\x7fja\\x84\\xa9\\x87\\xee\\xcf6(+\\x8b\\xee\\xc8\\xde\\xdf\\x1f\\x97\\xf8h'\\x99\\x14s\\xfbc\\xa5\\xc5\\x98\\x15d\\xd4\\x03^\\xedg\\x94\\x9ao\\x88\\xcc\\xfc\\xedo\\x9a\\xfd\\xf4\\xd4\\x12/\\xdai\\xb3\\xc0\\x8dd\\xa9m\\xc8\\xfao\\x81\\xa9\\xa3x\\x96\\xc4\\xa8\\x01z\\xe4,\\x17\\xe4e-\\x91,\\x90j\\xc2\\xe9\\xf0\\xd7_:\\xf8\\xdf\\xa1\\xac@\\x92@\\xeb\\xdf\\x1f\\x93j\\x80c\\xb4\\xfab\\xb2\\xa4\\x12j\\xb0\\x9b\\x04\\xb38\\xc97r\\xb0j\\x88\\xf3\"\\xd1\\x8e\\xec\\xe7\\x01\\\n\\xd9\\xe7\\xa0\\xb8\\xe2\\x9c\\xc1\\xc0"
  175.  
  176.  
  177. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p&\\xfe\\x9a\\xeex,x\\x10\\xe51p/e\\xd1\\xf6a\\xe8\\xf6\\xe9\\xf2\\x066\\xf3\\xe2g\\x84\\xe2p\n\\x8b1y\\x8c8\\xa1\\x02\\xee\\x8d\\xb9@\\x82\\xd5\\xc00\\x0c\\xf1\\xc6\\x97x\\xb2\\xd6\\xd6\\x8f\\x1at\\xfe\\x87\\x04\\xb2v\\xbdf\\x85\\xaa7j\\xdf\\x99\\x894q\\x8a/l\\xfee-i\n_\\x04d\\x1f\\x1b\\x93\\xa1\"\\x06\\x99\\x8b\\xa8,\\xa7\\xa9;'\\xc3!!\\x11\\xb4'ff\\xa85\\x02\\x80\\xc7\\xda% \\x00\\xad\\xaa\\x7f\\xaa\\xe0\\xca\\xf0\\x0f\\xb1j\\xd4e\\x89h\\xcd\\xca@\\xe0\\xb8\\x0c7\\xdb\\x84+\\xd3\\xd3\\xad\\xc0\\xd3\\x98\\xd8\\x1b\n\\x0f=p\\x9d\\x9ab\\x1by\\xf4(\\xa8\\xd60\\x94\\x05\\x03\\x8a\\xd9\\x9b\n\\x1e\\x99l\\x97<sq\\xc1?pdt5\\xcd\\x9fe$\\x0ey/\\xbb\\x1e\\x9dv\\x15\\xb9\\xe4\\xb8.\\xda\\xec\\x83y_\\x17\\x85|\\x88\\x96k\\xa4\\x00h\\x03\\xfd\\x03\\x92?\\x1a\\xd6\\xe2i\\xd7\\xeb\\x02\\x8f\\xd8\\x88\\x14\\x87\\xc7\\x88\\xe7\\xd7\\xf0\\x85\n\\xc9\\x91s\\xea\\x8f!zh\\xf0u&\\x01\\x1af"
  178.  
  179.  
  180. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xb0\\x97\\x02\\xa8\\xafe\\x1d\\x8d~!5ze\\x94o\\x08h0=\\xe8\\xc6\\xab\\x13\\xc8\\xa6@\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  181.  
  182.  
  183. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xdf\\xef-\\xe2_\\xb9\\xfb\\x1f7\\xdc\\xc0\\x8f\\xe6cc&\\xaa\\x0fp\\x19\\x12=\\xec\\x1b\\xdc\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  184.  
  185.  
  186. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x91v\\xe2\\x1fh<\\xab\\xc3\\xb5\\xd2\\xd5\\xd0\\x9d:\\xbfed`yv\\x82\\xc7\\xb5\\x91\\xa0\\xa1\\xab\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  187.  
  188.  
  189. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"<\\xd0\\x82\"-e\\xa1p\\xdey=\\x875b\"\\xb9e\\x83\\x82wc\\x8d\\x8522c\\xa3z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  190.  
  191.  
  192. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xc7\\x9dbz\\xc8\\x92l\\x92\\xa5\\xf0s\\x14\\x11v\\xd3\\xfe:\\xb1\\x1b\\xa7-\\x94yi\\xbb\\xa3\\xba\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  193.  
  194.  
  195. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xf9\\xd4\\xc0\\x98\\xdblzf`\\xc5\\xd5\\x9f\\xf8d\\xdf\\xdda\\xe4\\xf5\\xbb\\xaf^\\xa1\\xb0\\xf7e\\xc5\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  196.  
  197.  
  198. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"v\\xc5\\xcf\\xc8\\x19\\xa2\\x01\\xe7\\xe8\\xc3\\xbb\\xc4%\\xf3k\\x19l%#\\xe6\\x1d\\x10\\x02>#g\\xb8\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  199.  
  200.  
  201. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"a\\x12\\xc1\\x00\\xe8>\\x90,\\xbe\\xc5\\xb3\\xcbe7\\x8e\r\\xf4\\x0bb\\x8ex6\\xf3\\x04\\x08\\x10 i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  202.  
  203.  
  204. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x92\\xb4tx\\x8f\\xa4\r$\\x93\\xc8\\x8d\\xc7\\xccx\\x96$y36\\xfc\\xc9\\x1c\\xa1w\\xa9\\x1b\\xc1\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  205.  
  206.  
  207. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xd22x|r;\\x0e\\xa2\\x1b?qd**b%3a\\x1d\\xc6\\x99\\x94\\xfd\\x87|r\\xb8/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  208.  
  209.  
  210. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x05\\xfb\\xb2\\x85o\\xff\\xee\\xea<\\x9e\\xed\\xb6\\xa5\\xb729(\\xc1\\x19\\x01f\\xd3pgfg\\xab$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  211.  
  212.  
  213. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xb0\\xf8\\xe4\\xca\\x1cc/\\xc7\\x80\\x8c\\xb4\\xb2'\\xa6\\xcdb\\x8cc\\x0e\\x05i\\x14\\xd7\\x90\\xeb\\x90;r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  214.  
  215.  
  216. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xf0\n\\xb0\\xc0',\\xa3\\xb3a\\xee~\\xdbq\\x1a\\x84\\xeb\\x8c\\x972\\x1f\\xf4\\xfebg\\xba\\x08\\xd4\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  217.  
  218.  
  219. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x02\\xb1\\xdc687\\xc8e\\xda\\x85\\x8co\\x9a\\xcb\\xb8\\xef\\xa8\\xe1\\xeb\\x90\\xd8g\\xb5\\x07g\\xb4\\xd6\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  220.  
  221.  
  222. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xf3\\xda\\xe5l\\xe6\\xc1\\xdc\\xa7go4\\xfd\\x91\\xaf\\xe6=|\\xd9\\x86\\x8d\\xc8\\xe6\\x9b\\x82\\xda\n\\xd6\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  223.  
  224.  
  225. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"'r\\xb6|\\xd3\\xbb\\xdb\\xcd_\\xc8g:=\\x8ak\\xb4vvd\\xb3\\x8b\\xebw\\x8c\\x7f\\xc3\\xd2\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  226.  
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xc9\\xb5<\\xc3t$pq\\xd5|\\xf6\\xe9\\x9a\\xf4\\x05\\x10\\xd5\\xc6\\xe4\\x94\\xbad(e\\xcf\\xd7#g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"z\\x99\\xa6m\\xda\\x1c\\xa8\\xdb\\xf7es<\\x0ec\\xe1\\x00\\xfbc\\xcd\\xaa\\x0f\\x85b\\xc1\\xadcd\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xe6\\xf7d\\x04f\\xf08n\\x00\\xe1\\x1b\\x80\\x03\\xa3\\xe7|ajc\\xd8,\\x96x\\xbb\\xba\\x80\\xf2\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xbb\\xbd\\xa8\\xae\\xd0m\\xf6!,(f\\x87*\\xbd\\x1c\\xf1n\\xa7l\\x05\\xcf\\xff\\xd9\\x85mh\\xf8r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xa2\\xb7m\\xb0\\x9f\\xdc\\x8e\\x94\\xb4\\xba\\xfa\\x0fu\\xf6\\xa7b\\x01\\xfag\\x05\\xe0~\\xd8\\xba\\x05l\\x0fr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xb6\\x87?@\\x9an\\xd7\\x14y\\xa1\\xba2\\xcfk\\xf7\\xc3i\\xbb\\xb4\\x17\\x19\\xeb$\\x93\\x90j\\xf6\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x96\\x98\\xfd\\x8c76^\\x9f\\xc24'\\x1f\\xb4\\x83\\x93\\x13\\x0c\\xcd\\x92d\\xd8\\x1d\\x166 \\x1e!\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xcfnu\\x1f\\x81\\xe4!/\\xdc\\x0c\\xd5\\xde\\x8fh\\xf3\\xb6\\xbc%\\x8a\\xdc\\xcf\\xecu\\x9ae\\xc2d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\x98$\\xa5\\xf2\\x82\\xa0%\\x9a\\xba\\xea\\xdd\\x94\t\\xcf\\xac\\xd6f\\xa1\\xc0\\x08\\xb8\"'\\x93\\xce\\x99\\x198\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xd6\\x92> \\xa3\\xaev\\xad\\x07hl\\xdf8\\xa8\\xb8u\\xc6\\xe3\\xf2\\xf1\\xf3o,\\xc8\\x0c\\x85sw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xb6\\xfd\\xa1ez\\xe2v|\\x1b\\xa0\\xc0\\x9d\\xd3\\x8e,\\x8b=\\xabd/\\xed\\xaf\\x8ab\\x17w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xec\\xe0k\\xab\\x85\\xa5\\x1b\\xe3,\\x1fz\\x9e\\xe3c\\xaet\\xfeeh\\x0e\\xa4\\xfd=\\x12i\\xe7\\xc8s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\\x83\\x07\n\\xc7\\x84\\xa2\\xf1vf\\x9aj\\xa5_\tl\\x12s:\\xb5k\\x8c\\x03d\\xdf\\x00\\xa3s\\x00\\x89\\x9ffq\\xd1\\xdd,\\xc2\\xdc0,e\"\\xddymkn\\xa3\\xe3y\\x8d\\xea\\x98'\\xf9\\xfe\\x92\\xef\\x07\\x93\\x8e\\x87^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\xbc%\\xd3\\xbfmn=odh\\xd1\\xbb\\x7f\\xbe\\xd7\\xf1\\xd7\\x19\\xe4\\xa5\\x9a%e\\x7fi\\x9c\\xa7\\xa0\\xed\\xc5\\xe4\\x9aal\\xf9\\xe5\\xdf\\xb7\\xdb\\xc8\\xed\\xf9\\x99*\\xaeo"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\x7fa\\xe6\\xd4\\x8ebk\\xe8\\xc7\\xdb?\\xa0\\x98jf\\x8f'i;\\xc6fw\\xe4\\xdf\\x92\\xc9\\x0ff\\xb9\\x95\\x15\\x9e\\xe0m\\x8ar\\x06s\\xb9\\x1b\\xb5s\\xd1>\\x89s\\x02\\xe16\\x06i\\xb5\\x86\\xb2\\\\x8c\\xbeb,\\x0f\\xb3\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\xab\\xbc2\\xb3n4?\\xb3\\xec\\xb3\\x07s\\xca\\x15@\\xa60/\\x00\\xe4\\x84\\x9aq\\xa8e\\x90\\x89\\xe1\\xa2\\x89-\\x15lt\\xbf\\x05fi\\x8e\\x10\\x1c\\x12\\xc5t\\xad\\x80"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\x1d\\xf5\\xa1x\\xb5\\xaf\\x1b\\\\xebk\"!r\t\\x18s\\x1e0\\x95\\x95\"\\x80j\\xa1\\xb5\\xb6\\x01\\xa9\\xfe\\xf4sf\\x00c\\x06\\xe8\\x8fz\\xcfp\\x04\\xdd\\x7f\\xf9\\xe4\\xef\\x97q\\x0f\\x92=z\\xd3\\xa3\\x01\\xc3d\\xfe\\xd6l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\x1d\\xb1lpv\"$`\\xef\\xde\\xc5\\x145\\x87\\x074o\\xd9i\\x9ag(\\xf3z\\xb2\\xda;\\xe9\\x8eb_\\x9d\\x1e\\xc6\\xc7\\xb5\\x9d\\xf3\\xd1\\xf4n\\xea\\x15\r\\xb2\\x8d\\xe2"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w:\\xbb\\x90\\xe9s\\xbe\\x00\\xfd/\\x90\\x1f\\xc2ak\rru\\x0ee\\xc9.z\\x8f\\x06\\xdf\\xb0:\\x12:\\xa8\\x98y\\x03lv\\x18/\\xbe\\x97/q\t\\x16p\\xb0)\\x9e\t\\xbd\\xb5\\xdb\\x82!5g\\x1c\\xc3\\x01\\xc8\\xd9n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9fw\\x1c>\\xa5\\xedlen\\xf0\\xe9\\xf8`yq\\xd2\\xb2.\\xbe?\\x89\\xa5\\xa7|\\xb7\\xd6\\xfb\\\\xaf\r\\xdc\\x93q\\x16\\x87\\xf4ze\\x8a)\\xa3\\xfb\\xbfks:a"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13js#\\x858r\\x03_\\xc2\\x90\\x10a\\xb6\\xe7\\x1f\\xf9u\\x94\\xc7\\xe1\\xc7#\\xc6\\xbdo\\x16\\xab\\x9a\\xec\\x93\\xb3\\x10\\x1a\\x08\\xd6\\x87\\xacl\\x1es8\\xb4\\xf4\\xc8\\xc9j\\x8bzho5\\xa1\\x0f\\x8b97\\xe5\\xa2s?\\x01\\xb0\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000xd8voe\\xd2\\xff\\xaa\\xaa\\xf4\\x81\\xf0d\\xa0#\\xb4l\\xbc\\xfe\\x1e\\xfe\\xec\\xa8#+\\xba\\xdef\\xc0/v@\\xa2\\xc4g\\xcf\\xf2_u\\xfe\\xaa\\xc6\\x86\\xfd\\xa3f"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\ny\\xb3\\xd6\\xd9\\x85j\\xbc\\xad\\xc9\\x11\\x18+\\xe4\\xc3\\xfek\\xf0\\x879\\xc8u\\xc7\\xad\\x14\\xed\\xf6_.<x\\x85\\x15\\xdc\\x8c\\xbc\\xc3\\xb0b\\x81\\x0f\\xfa:4\\x94\\xde0\\xff\\xdc'\\xd1\\xf2\\xda\\xf9\\xe5\\x1f\\xc5&\\x19\\xb7\\x02&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\xd339\\x88\\x99\\x84\\x95@\\x05t\\xf7d\\xa3zc`bg\\xbd\\x91\\xea\\xda\\x911s\\x1e\\xd0\\x12\\xe4\\xfd\\xf4\\xe7\\xb7x\\x8a)ms\\xa47m\\xc0x\\xf3\\xbc\\x15\\xf1"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&i\\x1b\\x8b\\xe9\\xf8\\xff\\xf7k\\xcfdw@\\xe4\\x85p5p\r\\\\x90\\xe2\\x8f\\xeeu\\xdb\\x8emx\\xea\\xd0\t\\x8b\\x7f\\x0b\\x02\\xc6\\x9e\\xe1\\x11j\\x97\\xcd/:4d\\xb1z\\x0e\\xf7fl`\\xda\\xbcv\\xaf\\x82\\x8d\\xb2f\\x03y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\x9c\\x8f\\xaa,\\xa5uq\\xfe\\xc6n\\xb3\\a\\xbe\\xdb\t\\x99\\xf3\\x901w\\xb4\\xca\\x9e\\xdc\\x84x\\xfaqt\\x018=rz\\x1bq\\xae3\\xc4\\x98.\\xe2\\xe7\\x17\\x95"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^\\xad\\xcd\\xa3mr\\x7f\\x97\\xda\\xd1\\x18r\\xd4\\x91\\xd8p_\\xd5\\xa70\\xd4\\xd5n\\xc6chw\\xa6\\xf8~>\\xf8\\x03\\xd3\\xa1\\x0bn\\x9ci\\xbb\\xe5\\xc3\\xe5\\x96\\xa0\n\\xe6\\x1a\\xc6p\\xc6\\xf4\\xaa8\\xc2=k\\x8a\\x93\\xf5\\xe8\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7\\x9a\\xce\\x13\\xe3qd#:\\xb9;\\x1d\\x8b\\xd5\\xe5\\xee6\\xb4\\x88\\xa0lhc\\x04\\xa0\\xb6\\xd2s\\xe0brx_+#\\xe9\\xd3\\xfe\\xdb\\x17\\xd6y\\xae\\xf7\\x97\\xc0e"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xf4.ll\\xc9\\xfa\\x1ft\\xbae>\\x95\\x0e=;\\xa1>\\x86\\x99\\xadv\\xf36\\x0b\\xec+)d9(\\x95\\x02\\xb6\\xe9\\xae\\xf9\\x86\\x96\\xe2\\x19\\x0e~\\xbey4\\xf1a\\xad\\x1f\\xa3e\\x8d:\\x86\\x06\\xad k\\xae$\\x00\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xbc\\xbcp\\xa8\\xce\\x8dq\\xdc\\xf8n\\xaex\\xb7\\xbe\\x92\\xa2\\x80\\xc2\\x85q\\xb0\\x19^\\x82\\x02i\\x90\\x9b\\x9dq\\xad\\x1a\\xd3\\x81\r\\xc1t\\xc7zv\\xf6\\x82vz\\x97\\xc5g"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x08,dq\\xf8\\xb8f\\x95(\\x8e\\xb7w\\\\x0c_\\xa1\\xe0`\\xcbx\\x89\\xc8-8\\xa6\\xe9\\x1a!\\xfe\\xa6o\\xa25\\x08v\\xff\\xc9\\\\xbb\\xf1i'a~\\xd4\\xdb\\xaa\\x08-\\xbf\\x83c\\x07q\\xc2da\\xdd\\xef\\xca\\xb1\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xc0\"\\xb4y\\xcc\\xa7<\\x0b\\xd9s!\\x97r\\x02\\xf1/~\\xfej\\xf4h\\x9c\\xe1q\\xbf5\\x90\\xd4l\\xda\\xe1jq\\xbe\\xfcf\\x91?\\x18\\xf9\\x18_,?\\xd1l\\x8c"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$ht\\x042r\\xc27\\xbe`njwhe\\xf3&\\xf0k\\xe3\\x8d\\x806\\xbe\\xbaf\r\\x05\\xcbm\\xb5\\xc6\\xcd\"\\xb8\\x89\\x8e\\xe3\\xcf\\xc3\\x90\\xb3\\x98\\xf0\\x9b\\xce\\xd0\\x91\\xcd\\x83\\xe9\\xa6\\xbe\\x94p\\x00v;\\xa1\\xe9\\xb9\\xb7\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\xad \\xbc\t\\x9b\\xf6\\x90\\xf9coah\\x98<\\x03\\xfe\\x16\\xe9c\\x93\\xa8\\xba\\xe5x\\x0cd\\xff<\\x12c\\xect\\xe9\\xa2\\x06\\xbd~\\xec\\x1a\\x17`\\x08>\\xdc\\x02w"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xb8,m\\xbf\\x8ekm\\xbd\\x89\\xb5\\xaf\\xb8bl\\xd6x-\\xf1|\\xd20\\x03\\xdej\\x17\\x83ps\\x0b2l4\"\\xeav\\x93\\xb5c\\x18=\\xd5,,\\x89\\xdd\\x81g\\x8d\\xb60\\xb0^\\xb4\\x11\\xd7m\\x05\\xb6\\xe3\\xf1'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j3\\xf9\\xa6\\xe2\\xb7\\xd0&*a\\xc4/j\\xfc2\\x87(\\xab\\xad=\\xd5'y\\xd5\\xbb .\\x04\\xb7\\xb7zv\\x0c\\xf5\\x89\\xcb\\xfa\\xc6\\xf8\\xa0\\x98\\xc6\\xc6d1\\xd1\\x14\\xb7"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\x87k\\xd0\\xb3v\\xc8\\xb1\\xf6\\xe0\\xfe\\xa2\\xe7\\x8f\\xf7|\\xc6\\xb8j\\xe7)\\xe4\\x9b\\x18\\x042\\x18k\\xd5\\xa0\\xfb\\xb3\\xddiszx\\xa8z\\xa0\\xe0\\x88\\xe6gl\\xa1\\x8e\\xba\\xd3; y>\\xca\\xe2\\x80\\xc6a/(\\xc1f\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85a\\xdf\\xa2\\x1a\\xf8\\x99e\\xd8\\xd3\\x1d\\x01v\\xf8t)\\xdc\\xb5\\xd8\\x84\\x04\\xbe:^\\x89\\x86\\xd5\\x86\\xe0\\xb9\\x8f\\x8a\\xcd9\\x1fy\\xc13f\\x8f\\xaa'\\xb6m\\x1f\\xe5\\xd9\\x9a"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\xde\\x11$\\x8a\\xabp\\xe5u\\xcb\\x16\\xa3\\xdd\\xa2l\\xbak\\x0c\\x9ce\\x84\\xda\\xbcz\\x19aj\\x11\\xb6\\x9cgy\\xc1\\x88\\xee\\x01\\xd3\\x0c\\x03\\xbet`\\xe5\\x92\\xb2=0\\xbc\\x10\\x82\\x9a\\x94\\xf5t\\x11p\\xdf\\xd7_\\xe5\\xacr-\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1juf\\x1bsc\\xbf\\xb3\\xaam\\xcf\\x01\\xb8e\\x8d\\xc1\\xbb\\xfe\\xcd\\x8a>\\x1a\\x0e^\\xb3\\x8d\"8|x_!\\x82%\\xc5\\xba\\xa2\\xd5\\x16\\x87\\xb8uu\\xb5\\xd9"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb98j\\xb4d\\xf8\\x17\\xe3\\x02\\xc5\\xdb\\xa0\\xe4\\x8c\\xedxo\\x07\\x96%\\x0b\\xdc\\xa0u\\xf1\\x99pos\\xb1\\xd0m\\xd1\\x8d\\xff\\x91\\x80\\x9c\\x18_\\xb3\\x83\\xd2\\xe9\\xa2:\\xc3*\\x8d:8\\xcb\\xb0\\xe0\\xf4\\xed\\x15\\xa4\\xbdk\\xb9\\xd17\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\xe8\\xe7\\xeeq\\xd3g\\xd0\\x87\\x169o\\x91p\\x851#\\xd8\\xf9\\x0f\\xc5\\x1c\n\\x9e\\x08)p\n\\xbb\\xc67\\x95w\\x08\\xf9\\xcce\\xbb,wb\\xb7\\x07\\xefd-^8"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xc1\"\\xc9\\x82\\x1f\\xbep\\x96\\x1e\\xcc\\xf9\\x18n\\x01\\xa8\\xd4~/\\xac\\xfb\\xff%z\\x19h\\x98h\\xe7>4\\x8f?k\\xa2xi\\xd2\\xd6v\\x9b\\xb0\\xa0\\xa3\\x93in\\xcek\\xa7\\x99\\xc5\\x0bj\\xf1\\x8f\\xe3\\xf2\\xf1d\\x91u\\xb8\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xea\\x87\\x82\\x112?\\x0e\\xa1\\xfcl,~\\x99\\xf5\\xbd\"\\xd5\\x98n+\\xfa\\xdd\\x80\\xf7\\x9c>\\xcdyi\\x07\\x00\\xcdcl\\xcc\\xd4\\xf6#\\xb2_\\xc0yu\\x8e\\x08\\x97\\xcb"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xbdq\\xe3\\x9ee.c\\xb8\\x07\\xe9\\x9c\\xc4\\xe8\\xfb\\x8f\\xf1\\xf2\\x19\\xcfh\\xffzv\\x01\\x16\\xf1\\x04n*\\x19\\xfall\\x8a\\x0e\\x1f\\x15.\\xefk_\\xe6\\xcc4k\\xa8\\xac\"\\xc9\\xc3\\x8a\\xd4\\x97\\x04\\xb9\\xeb\\x80\\xcdq\\xf9y\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xab`a:\\xd3\\xa6\\x7f\\x9c\\xfdu\\xbc\\xa9\\x17\\x02\\xaaa\\x18\\xfe\\x94a_\\xbe_\\xe8$l\\xb6\\xaah\\xa2\\xf3\\x8e\\xe4\\xb4\\xbbj'\\xd9\\x84\\xf9d\\x0b1n\\xaf9\\xd2"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xbc\\xb3cc h\\xf1\\x94\\xc2j\\x16\\xaf`\\xfcx\\xbce\\x90ruu\\xf5m\\x8fy\\xfe\\xf0%oc\\xcb\\xbd\\xc6\\xa4wce\rh\\x99g\\x98\\xea\\x9dj\\x0b\\x15\n^\\xd0ak\\xbe\\xc1\\x9f\\xe8\\xbd\\x9f\\xc4rqo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3\\xe4\\x1f\\xcfk\\xaat\"\n\\xa1\\x82\\xb3\\xf6\\xca\\x88\\xcb\\xf5\\xdaw\\xa4e\\xfcs\\xb0z\\xd3\\x97\\x85j\\x00\\xc3~\\xe3i\\xec1\\xde\\x02w&\\x98\\xa0\\xe2\\xbc\\xb6\\xca"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\",\\xddy\\xd9\\xe749\\xb5\n'\\xba|\\xc9\\xc3vvw\\x1c\\xef\\xbegyd\\xbd\\xb8\\x83r^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xb3/\\xc60\\x87\\xe3u\\x15\\xf4r\\xdc\\xd8\\x10\\xd3b\\xf6\\xff;1\\x14g\\x96\\x1d\\xdbng,\\xf9\\xdfn\\xd4\\xac\\xb1\\xad\\xdd\\x88ta\\xc7b\\xfea\\xbb\\x1fr\\xcfx\\xb0u\\xd7xs\\xb2~\\x07s\\x9e\\xfa\\x8c3.y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\xa6\\xeds3x\\xd0\\x05\\x16\\xc9\\xc6\\x08\\xa5250\\xbf\\x04)\\x95\\x81g#\\x10;1\\xd3uw\\x05k\\ \\xdfb\\xa8y\\x9a\\x93\\x8b\\xba\\x9f\\xad\\xcb\\xd7\\xe1\\xbc"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"t\\x8cf\\xd4\\xc1s\\xc8\\xf4w\\x98\\xbc\\xd2\\xcf9\tsx3\\x94\\x90\\xe2\\xff9\\x87\\x94l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<\\xd6\\xf1\\xba\\x1d\\xb4$\\xcc^\\xc2\\xf3\\x15\\x82\\x1e\\xfa\\x8b\\xcbic\\xd9!vg\\x94\\x83cf8\\xc5q\n\\xcb>4\\xfb\\xc6\\x194\\xe6& \\xe1\\xfb.\\xe5\\x89\\x0e\\xdcd\\x86c\\xf8\\x88\\x15;\\xcd\\xa0\\xb2\\xe3g\\x1a\\x01m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c\\x94f\\xd7no\\xf6f\\xfd\\xee\\x14\\xc9c'\\x8as\\xcfz\\xd2e\\x05a\\x99\\xd7\\xfc\\xf3f\\xcen\\xf7\\xc0\\xce\\x1f8(#\\x91n\\x8a&o\\x1b\\xde\\x7f\\xbd8\\x97o"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\x1c\\x9e6\\x9d\\xb96pl\\x9c\\x92\\xc9\\xe9g)\\xd2\\xdc\\xb9\\x83yt\\xbf\\xb2og\\xb9\\x8e\\xe8/$d\\x82\\x02^\\x07/\\xec\\xee\\x8a \\xab\\x87\\xac\\xfa0\t\\x16\\x01;\\x95\\x85u\\xaatb\\x81\\xc8\\x92\\xc1\\xd0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xd2\\x9f\\xbb\\x99_z\\x0b\\xab\\x02x\\xad\\x8e+\\x80\\x10\\xd0\\xdd\\x88\\xa6rv\\xdd\\x19/\\x15\\x90`\\xb5|lu&\\xb6\\x91\\xfdt\\xc60k\\x8aksguc\\xa7\\x86"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe25\\x17^j\\xc0h\\x17\\x08c\\xfe\\x7f\\x0f \\xc6p\\x7f0\\x9d1r\\xd3\\xc5\\x9c\\xf0\\xebo\\x04\\xda\\xd7/\\xcd9\\xc8\\x85\\x05\\xf4\\x1c\\xa5\\xfd\\x02\\xed\\xe9@j\\xd2\\xc5\\xfd7.\\xa5\\xa8d\\xe6\\xa5\\x8f\\xa9\\xe91\\xf5f\\xf6x\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p \\xf5\\xa0\\xd9\t\\xba\\x9f@\\xf8 \\xb3\\x08\\xfd\\>?p\\xc3\\xcbg\\xe6l\\x8d\\xdcs\\xa8\\xe2\\xa8\\xc8\\xa3t\\x95\\x84\\x84:\\xc0u`\\x134p\\x11r\\x14\\xe4\\xe9k"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\x88v\\xb8\\xe5\\xebj=\\xb0\\xae\\xe2\\xf2\\xc6\\x1f\\x00\\x07\\xb9(\\xe5\"t\\xef\\xe8_\\x17\\xe0\\x19\\x08\\x1a uet\\xb7\\xde\\x06\\x1b\\x04\\xe1m a\\x1c\\xa9p\\x89\\x10a\\xf5\\x12\\xb6f\\x87\\xe1h3\\x18\\xc3`\\x90\\xa5\\x9c\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6g^y7\\xb0\\xc4\\xe8*\\xfc\\x07h\\xfag\\xce\\x1e\\x87\\xf6`wv\\x11ka\\xbdto)\\x8b\"9r\\xe9.\\xfd\\xc4\\xdc0c^\\xe6\\xe5\\xd9\\x03\\xde\\x95\\xff"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\x1c#\\x87\\xdb\\xd9\\xd5\\x17\\xcb\\xc4\\x0b;\\xc6\\x0f\\xa6\\xa8.&,\\x88\\xd3t\\xe5\\xc2i\t\\x088\\xd8r 7\\xb0\t\\xba\\xf7\\x8a\\x04dc\\xe2\\xae\\xc7\\x812\\x8d\\x93\\x00\\x08qz\\xd8\\xec\\x7f\\x84\\xca\\xa3p\\xc3\\x9c\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xd6%\\xae\\x93\\x8df\\x11\\xf7\\xcd2\t\\xfd5\\x93\\xb5\\x95\\xa0y\\xcds\\xecd,\\x98`\\xf9\\xd1\\x9b\\x9e\\xb8\r\\xfc\\x92\\xe5\\x7fa\\xa61\\x13w\\xa6\\x7f\\xb9\\x8ez\\xce\\x9d"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19a\\xce\\xe7g\\x82\\x94\\x8b\\xd76\\xf9\\xaa\\xf6x\\xdc7\\x15\\xa4 \\x7ff\\x9a\\xc4\\xa3\\xa6v9\\xe2i\\xde@\n+\\x9f\\x9a\\x1b\\x1f\\x85fq\\xf6\\xdb7\\xec\\xa5\\x18\\x1d\\x93\\x052\\xe0'\\xcf\\xbf\\xa5p5\"\\xbbw\\xc1a\\xae~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3<w\\xd1\\x95\\x19>~\\xe66\\x078\\xc2j\\xe4\\xef\\xb4\\x06\\xd6\\xa8f\\xf1\\xe041b:\\xabx\\xc1\\xf4\\xc8k\\xeeq\\x8d\\x93l\\x15\\xb9q&0\\x08\\xb9\\xd8"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\x8d\\x11\\xdc\\x18m\\xe1x-\n\\xfd\\x02w<u\\x02\\xa3\\xc8\\x92\\x11a\\x13\\xaca\\x8c\\xf5h\\xa9\\xa8\\x9ewa\\xe7a\\xed\\xfe\\x93\\xa2e\\x91\\x93\\xb93\\x8b?d\\xbd?\\xf6\\xc675\\x84\\xdc\\xd9\\xec\\x9a\\xaf\\x16\\xa8\\xeap\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x8b\\xdc\\xc5>\\xc4c\\x91';\\xf7/\\xf1w\r\\xebq\\xe8\\xf7v\\x80\\xe2\\x01\\xd7:\\x85d,<d\r\\x18\\xd5ji\\xe4t\\xef;\\xce\\xf8n\\x10\\xe8\\xe6\\x1a\\x07"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xa5b\\xe0c\\xc4\\xd8\\xbe\\xaeq\\xf3f\\x99\\x906b\\x9ff\\xe9tt\\x0c\\x00\\x11\\x1a8\\x97\\x9f\\\\x0cg\\xc0y\\x92\\xae\\xce\\x85\\xa2e\\xe7>\\x8ao?\\xf4\\x96!\\x9f<lo\\x06\\x1a\\x14\\xa9\\x9a\\xe8t\\xfb\\xfe\\xb2\\x89\\xff\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\x9d\\x83\\x10\\xa5s\\xd3g\\x08\\x95\\x8f\\xc0\\x9b\\xec\\x94\\x1c\\xa1\\x0f\\xe1\\x0f\\xe9\\xbch\\xc5\\xd2\\x9a\\xc5\\xc7e+c\\xef\\xc6\\xf9\\x94\\xeft\\x8a\\\\xf2(lr\\xea\\x8bv\\xff?"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\x1e\\x03\\x89\\xf1/\\xf9\\xd1a\\x93v\\x8cs\\xde\\x18\\x08:\\xbe\\xa3\\xe3\\xa1\\xfe9\\x97w\\x9e\\xb6\\xd3% \\xc0f\\x1b\\x9b\\xcai!j\\x8b\\xe0`\\xccq\\x01\\x87q\\xb6n\\xe8h/~\\xbf\\xd3u\\x9e\\x8bgs\\x05\t\\xad-\\xf1\\x0fy\\xba~\\xaa;\\xc1\\xe1\\xab\\x9al\\x93\\x88\\x9b\\xe9\\x84(s\\xf6+\\xc9\\x82\\xe1\\xfc\\x15\\xef\\xcdn\r9\\xfd/s)\\xfe\\x88\\xa9!\\xd8;\\x8f\\xdf\\xbc\\xcdd\\x1d\\xbc\\xcbi\\xf7\\x1f\\x92:\\xe3\\xaf\\x8e\\xb7\\xfc\\xc2\\xe2\\xd3\\xa2\\x15\\xa8\\x06\r\nu\\xe6\\xd4jld\\xe8(g\\xe5\\xbfx\\xfb\\xfc\\xb7j`\\x9c\\xd6\\xeev\\xc16\\xe8\\xe8\\x17\t\\x02vwcs\\xc6o\\xc7p\\xd5\\xe7\\xc59\\xf7\\xf5\\x05k\r\\x1c\t\\x80\\xb8c\\xd40hf\\x88\\xc6i\\xc7\\xa4\\xc9\\xfe\\xa3\\x8e\\xfc\\xee\\x1b\\xfc\\xe6q\\xdb\\xb8\r\\x1f\\x1e*\\xe6\\xa6u=\\x07*\\xc1\\x0c\\xf0\r\\xbbzl\\xf4\\x96%\\x984\\xe4hmn\\x1dk\\xf9\\x1dcah\\x97\\x8e\\x13a\\x928g\\xdc\\x0b0\\x89k\\xf9"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\xef\\x91\\xccrg\\xd2z\\xe2d\\xf9.\\xe3.\\xc2\\x84\\xa7\\xc6\\x05\\xa3\\xb2\\xb1\\x87\\xbbpc\\xf2\\xd6\\xdfo\\xdf\\xf1\\xac\\xc0tw\\x94\\xeb\\x13\\xc4\\xe0\\xfe08\\x15\\x99\\xe16\\x88c\\xb3\\xdd\\xb4\\xa9\\x94ii\\xb3\\x1f\\x99ld)rsv\\xfc\\x02|\\xf3\r\\xf3\\xcf<\\xd8\\xdd\\x81\\x9e\\x9d\\x13\\\\xfb9\\xf3sv\\x0c\\xa03\\x8d\\xa7\\xb7emd\\xd4\\xa2\\xaf\\xa26t\\xf0\\x8a\\xc0\\xff\\x1e\\xfc\\x11\\x95\\xb5|5\\xb91x\\xe5\\xdbh\\xa3e\\xd5\\x1e\\x88\\x8d\\xe5\\x02\\xd1\\xab,\\x80\\x104v\\xc6dq\\xfc\\xb3vu\\x003\\x9a\\xe6f\\xb6\\x15'\\x137\\xf5\\xab\\xbbv\n\\x1do\\xf9\\xdb!\\\\xa5\\x01e\\x11\\xae\\xf4\\x110c;\\xd0\\xc0\\x87\\xc2a\\xdej\\xf7k\\x9e|7z\\x17\\xc5\\xeb\\xaf^\\x87d\\xcf\\xef\tnb\\x91\\x9e\\xaekq\\x1f\\x1d\"a\\xa4\n@\\xe4\\xc2\\x86m\\x83g\\x12r,\\xcf\\xd7\\xb7\\xe9\\x8e\\xdam\\\\x82\\x82\\x90\\xf6lf\\xf0\\xfds\\xb9\\xc9h\\xc3\\'\\xc7\\x90\\xae\\x1a\\xad"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<\\xdd\\x03\\x0c\\xd1\\xa6\\x9c\\x9a\\x99\\xd6\\x93\\xc0\\x04\\xea\\x99\\xa9\r\\x1a\\xb8r5t\\xe7\\xb2\\xb7e\\x81z\\x19l7\"\\xdc\\xd4<\\x10\\x8b\\xa2\\x13v\\xadj\\xe7\\xc5\\x11yy\\xb7\\xd5s\\xa41\\x10\\x99.\\xa5@\\xe5\\xb0\\xbe\\xdd\\x1bi@\\xeb\\xd0\\x80qw\\x0f~|\\xe6\\x07\\xe5?\\x07\\x1c\\xedph\\xae\\xc4\\xc6\\xe06\\x98m\\xe0\\xe7\\xe6\\xeew\\x1e\\xc1g=\\xfd\\xd8\\xb6?\\xfen\\x0el^\\x16\\xb3qo\\x8c\\xa5p\\x9d\\xc6\\x91h\\x08\\xf95\\xff\\xbb17\\xc0\tu\\xf9\\x9f\\xf6\\xb0h5\\xb7a\\xfa\\x8f\\x00g7\\xb0i\\x9c\\x90\\xab\\xcb\\xfd\\xa7\\xe2y\\x1a\\x10\"\\xfd\\xcc)\\xe5as\\xe9\\x86\\x85\\xceo,\\x8f.\\xb25-\\x01\\xc7\\x0e\\xa27\\xf8\\x9a\\x08\\xf8\"\\x98\\xf0\\x8a\\xba\\xee\\xc4t>@\\xf5\\xc2\\xb5\\xae\\xdc\\x17\\x10\\x9ff\\xf8\\xa4\\x8dbn\\xe7\\x8ey\\xccb\\xb2\"d,\\xbak\\x0fj\\+\\x10rl!\\xabc=\\xaf\\xda\\xf3v\\x10\\x9c\\xa4/q\\x83\\x80~\\xc5\\xa8\\xdd\\xe4\\x8a\\x97\\x1a\\xb8="
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04yo\\xad\\xfdvg)\\xc9\\xea\\x03\\x89_az\\xea\\xd4\\x0c\\xd6c\\xb3\\xb1\\xea'\\x01\\x0f\\xd2\\xb7\\xbf\\xbe\\xcf\\xa6\\xc8^\\xad\\xa3\\xe6\\x1b\\xa7\\x81\\x11\\x89\\x12\\x84\\x8f\\x87g\\x02\\xe4h\\x06a?\\x89\"\\x063v\\xef\\xf8\\xbf\"\\xe5\\xaec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xf4\\x9a\\xcdp\\x86\\xc3\\xbak\\x14\\xfdm\\xf2\\x0e\\xf7\\xea\\x98\\x82c$\\xf3\\x0c\\xfd\\xf7=/\\x83\\x1e4z\\x17\\x9d7\r\\x12\\xb3t\\x8c+\\x1b\\xc0\\x87\\xe2~\\xa1-\\x9a"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7+ v\\xe7\\xa7q\\x8e\\xe3\r\\xfa\\x84\\xf6\\x00&\\x04l4\\xfe\\x05p\\x1d\\xff\\x0b\r\\x97\\xfc>*\\xd1a6r%\\xc1z\\x18\\xf1\\x90\\xbb\\x9e\"\\x8e\\xeb\\x14%\\x86\\x89\\xa4\\xa7c\\x8c\\xd2\\xdc\\xc5\\xec=1\\xaf\\xbc+\\xf2\\x19g\\xe5\\xf6 z\\xaatw\\xe1\\x1e\\xb4n\\x8c\\x8a%\\xfd\\xd0\\xb8\\xb4^\\x1e~9h\\x13.n;zn\\xd3\\x80`\\xd7\\x88t\\xa1@\\x1d\\xbc9\\xce6\\xb2\\xbct\\x01=\\xd8\\x92(\\xd4\\x03y\\xa2|$\\xbfk\\x15\\xbc\\xb6\\x8b\\xb3\\xd2h\\xad5\\xc0\\xf4\\x97\\x17\\xcd\\xc27\\xb2\\x1c\\x02\\xb4\\x1a@\\xf0\\x03\\xf8<fyq\\x19i\\xb3\t%\\xf9\\x86\\xe7&\\x96^\\xc6\\xcf2g#ua\\x88\\x8d\\x0f\\x12\\xbb\\xf7?b;^\\x94>\\xcf\\xc1\\xe9\\xe6\\xd6\\x89\\x8cfk%\\xe7\\xed\\xebo\\x19$)\\xb4\\xd9\\x95\\xe9o\\xad\\xd9y\\xee\\xfaou\\xd55\\xc5e\\x88\\xdc.\\x9fy\\x083\\xea\\xd7\\x1e\\xff\\x8b9n\\xcd\\xee\\x06\\xcbc\\xe2hu=|\\x13\\xb7\\xb7\\x8a\\xdf\\x84g\\x9e\\xa4"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xa4x \\xfe\\x07i\\x89`\\x8b6\\xdf\\xd4tx\\xbf\\xabav\\x85\\xda\\x1e(wt)\\xbfm0\\xd5\\xa6\\xd1\\xa9\\xf1\\xdd\\x8c3%\\xe2\\xa1\\xf5\\xd0\\xfb(\\xb6j\\xe7\\x95d1(\\xc2r\\xb7\\x89h\\x9d\\x1d\\xd1\\xfe\\x98(\\xb4\\xaa\\x0f\\xcdy\\xce\\xe6\\xf5w\\xe1\\x8b\\x81\\xc9\\xc6\\x8b\\xce\\x90,dh\\x0c\\xcbekpu\\x93\\x02r\\xd5\\xe0%\\x7f\\x913\\x13n\\x88\\xcc\\xd5\"\\xe6\\x90\\xdc\\xf4\\xfa\\xdbk7\\x8e\\xbe\\x9bm#\\x01\\x90 \\xb2\\xe0\\xc6$\\x0c4@j\\xc5\\xcfn\\xffn:\\xcffe\\x1c\\xe3\\xde\\xa8\\xb1\\xbb\\xfe\\xff\\xfe\\x82\\xfb$\\x05\\x16f\\xd7\\x96\\xf0\\xd5,e\\xcd\\xfa\\xc9@\\xcd\\xa2w\\xa0@\\x85\\xb8\\x1f\\x93\\x017<l\\xda\\x02\\x87\\xf3u\\xae8\\x1f\\xd7\\xbb\\x83\\xa90\\x12|\\xdd\\x99\\xcc5/\\xc9r9\\xfado\\xc1u\\xe2\\x1f\\xaa\\x91a=v\\x06x\\xdb\\xad\\x05\\x86\\x18\\6\\xd5o.\t/\\xddo\\x97mk\\xf7\\xe9\\x00:z\\xbb\\x9a\\x02\\xf54\\x16+,\\xa6\\x8c\\x9a\\\\xea\\x13u"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\x08\\xc2\\x11=\\xd8\\xdd\\x1f\\xa2)\\xeb0\\x94\\x90\\xdd\\x0evn\\xa7\\x11\\xe2\\xe8gnz\\x82\\x85'\\xddg\\x18\\xc5\n\\x8c\\xe1p\\x02\\x94\\xd0)(94\\x8bb6>&\\x95\\xbc\\xadi\\x13\\x9c\\xb9x\\x0ea\\xa3\\x9c/\\xc9\\xa3\\xf6\\xb4)\\x89\\x8fm\\xd5\\xe4\\x91\\x02\\xfc\\xe6(d\\xd0\\xd6g\\xcd\\xfb\\xd9\\xb8\\x8e\\xda\\xdeq\\xc5\\xdci\\xae\\x03\\xd8s\\xd3k\\x8av\\xf4\\x06\\xb7\\xcc\\xf9!\\xec9r\\xbc\\xc2w\\x02\\xe0 \\xee\\x90\\xdc\\x8f\\\\x95\\xae\"\\x8dj\\x85\\x85\\xe3pbo\\x07\\xd6\\xabb$\\xf2w\\x1f\\x95\\x91\\x03jd\\xf6\\xf7\\x89\\xb1x\\x81\\xcc\\x87\\xb27\\x8b\\xcbp\\x0f\\xb1\\xa9\\x92\\x04\\x00\\xff\\xf7\\x9ay\\xb0n\\xde\\xfd\\x9b\\x92\\xd9f\\xadyh\\xd5\\x1d\\x07\\x8d\\xb8r\\xb0\\x97k\\x93\\xf4\\xb1\nb\\xb5ud\\xa3aw\\\\xca:\\x85\\xed%\\x13\\x90k\\x12\\x04!\\xedtld\\x92\\xe9\\xfb^\\xbb\\x8e@\\xe9\\xed\\xb16\\x03\\x90\\xfe>\\xe5\\x01\\xc5) \\x11\\xb5\\x18^ke\\xe9\\xf5\\xab\\x0e\\x94\\xf3\\x87yvn"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\xbeb\\x99,p\\xbd\\x11\\x04\\x14\\xd3\\xe6?\\x18\\x87\\xec>\\xfe\\xbf\\x05\\x08/p\\xb9\\xe1\\xa7_\\xba\\xc7e\\xc9\\x92\\xd3\\x17a\\xa7\\x15y\\x9a\\x1a\\x83\\x8f\r\\x97!x\\xfdg\\xb3\\xa6\\xb5\\x17\\x98\\x89\\x85\\x89\\xfd\\xcb\\x1b\\xbc5\\x8c\\xc4\\x15lgb\\xb5\\xe4\\xc0,!\\x08\\x9eo\\x8a3\\xb1\\xaci23\\xda\\x9d_\\xa0\\xf5\\xb6\\x01\\x00\\xb1\\xa9\\xb6\\x86\\x8f\\xef\\x7f\\xb7\\x0e 8\\xdd\\xb1\\x10\\x8ceu-\\xdc\\x10u\\x9b\\x1f\\xc5\\xdc~mt\\x11;\\x0b#t\\x86\\x7f2!'\\\\x19\\x1b\\x97c\\x99\\x86\\xd0cp\\x9b\\xbc\r\\xec-\\x10\\xe2\\xe3\\xac\\xec\\x04\\x7f\\x005gp\\x83\\xab\n\\x861\\xbe\\xf2\\x10\\xaab\\xf6c\\x8c\\x8f8\\x1ay\\xa8\\xe9\\xe4\\x80n>6\\xf2k\\xe8\\x9e\\xea\\xc7\\xab\\xcb\\xd6\\xdd#\\x85\\x18\\xa2\\xa0\\xc8\\xbc\\x8d\\xcc\\xef\\xfe\\x0c\\x15\\xbbm/\\xcd\\xc33a\\x95c\\xdayzare\\xc2-\\xd4\\xac$\\xb1\\x9as\\xb6\\x9ao\\xdd\\x87\\xe6>\\x9d\\xda\\x9d\\x07\\x8dwy\\xeec/\\x02$"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xc3\\x98'd\\xe0\\xab\\xcd\\xf1\\xbbv\\x1a\\x8cn\\xd0\\xf9\\x05\\xe3\\xdc\\xed\\xfew\\x92\\x0e\\xf8_\\xb5h\\xd1\\xd0\\x17\\xa3\\xfc^_\\xb1\\xd4#\\xdft\\xea\\xbc\\x1enz\\x8b\\x883w\\x8b\\x81\\xa3vxg\\x9e\"\\x9d\\x17\\xadu\":=\\xf1\\xc0\\x14v\\x92\\x83d\\x96\\xe7@\\xeb\\xac\\x11\\xbb\\xd2\\xfdg\\xbb\\xfd6\\x8cn\\x9a\\x97\\xa2\\xb4\\xe33\\xc1?w\\xfc\\x93m\\x91\\xdbk\\xa5>\\xf5\\x92n\\x1fy\\x98z\\xfani\\xcb\\x97\\xc36\\xb70\\xbc\\xd2\\xa1\\xef\\xe0<\\xdc\\xa7\\xd7\\x8ej~8\\xcd\\x84\\x9a\\x17\\xcc`\"y\\xeb@\\xcc\\xb8\\xf3\\x8bi f\\xf10g\\x92\\xcb\\x82\\x9e\\xb57\\xc6\\xf6)\\xa0\\xde\\x9c\\xfa\\xe5\\xe47\\xfc`\\x80\\xd5\\xb0\\x05l\\xba\\xeb\\xe5\\xf2z\\xe31\"\\xe5~\\xd8\\xe4q\\x9bi\\xd0+\\xc2\\xce\\x1der\\xbf\\xac\\x8a/yx\\xa0<\\xc2\\x83\\x10\\xa0\\xb5\\xfa\\xbaf\\x93r\\xd3q\\xa2\\x857p\\x87\\x99\\xce'\\xf3\\xc1w;\\x93\\xf9x\\xc4\\x99\\xd3\\x01\\xb4\\xf0^j&j\\xc38\\x12\\x07\\xa1\\xc9\\x0c"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\x13\\xa1\\xae\\xad\\xfex\\xb9\\xe2\\xac\\x03\\xb5\\xf0g\\xcdl\\x13n\\x9f\\x0b\\xbd\\x97\\x7f\\xf8r\\xcf\\xf1w\\xdc\\x02,i\\xfaz\\xd9\\x9cz\\x80_t\\xbd\\x03q\\xcb\\xcce\\x17q\\x91\\xb3\\x97\\x8e\\xe2\\xbe\\xec\\x80\\xf3e~\r`\\xc3\\x19\t\\x1b\\x05\\xbc\\xe8\\xc7`\\x17\\xbf\\x102\\x99\\x17u\\x1ea\\x91\\xbd\\xe4\\xe5\\xfa3|b\\x83\\xfc\\x9e+|\\x90\\x07\\x89$\\xd6\\x1e\\xbbe\\xecgc\\xa1\\xa4\\xd7\\x89<mdn\\xde\\x06p\\xa6cx\\xd7\\xa4\\x8f\\xa6\\xed\\x05\\xdd\\x952\\xfe\\x04\\x9b\\x1edr\\xde1&\\xe8<p-\\xd4\\xf7b\\xcfv\\xdd\\xf5o\\xdc\\xad\\xe3\\xd9\\x11wcc\\x99\\x1a\\xba+n@\\xdbh\\xb6\\x00\\xe4\\xb7\\xa8\\xc8\\xae\\x10m\\x12\\x8f$\\x9d\\xc2\\xa9\\xd0\\x0bg\\x16\\x93\\xb5\\xb4\\x88\\xf3c\\xe4hmf\\x1d\\xa6\\xbay\\xdb\\xd04zf\\xeb,\\x0ce\\x9a\\xff\\xdef5l\\x81o\\xd4\\xe1\\xcb2\t\\xb2\\x86\\xba\\x81\\x16~\\x1b9\\x0e\\xe0\\xec8i3k?\\x0e\\x92f\\xef\\x82_w\\xa1\\xc7k\\xad\\x13"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\x14\"\\xad\\xf8k\\xfc\\xa7\\xc6\\x8e\\x1c\"\\xab\\x9el\\x1d\\xd4n~\\x1c\\xd9w\\xe7lv\\xd0\\x0f\\x06'\\xfb\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103s3\\xa2\"*9d\\xcb\\xe4\\xf1q\\xbb\\x0c>;\\x11\\x93\\xb7\\xf02\\xdd\\x90x@=b\\xfb\t\\xcagk\\xc6\r$y\\x95\\x87w\\x0c\\xe6v\\xcak\\xa7m\\x98\\xb9(@\\xc4j\\x0e^b\\xd2\\x13\\xfc\\xa5\\x91\\x80\\x0f\\x0c*\\xc9\\x05\\xa3m\\xb5u\\xa6\\xae\\xcb\\x9a\\xdb\\x0c\"\\x8c\\x9f\\xfbd\\x08y\\xab6\\x99\\x9b\\xeb\\xdb\\xbfw\\xb9,g\\xd8^\\xf2\\xbe&c\\x80(aj\\xf8\\xd8\\xbe\\xd2i\\x00u\\xeb'n\\x02\\xe5t\\x02<\\xd0\\x8e\\x18t\\x83\\xc7\\x97|wfg`*\\xe4%\\x15\\xaf\\x94\\xd7ks\\x07\\x82|\\xbbz\\x1e\\xa8\\x89\\xfd\\x91w8\\x15\\x97nl/\\x01\\x1dp7\\\\xcdu\\xe4s\\x8a\\\\xfb.\\xcc\\xd50\\xabr\\x85)\\x94\\xad`\\xee\\x11\\x00\\xf1\\x8f\\xcfc\\xd9u\\x96\\xa3\\xde\\xfc\\xdd\\xdc\\x7f\\x18b\\x179\\x8c\\xee\\xb2+\\xfb\\xd4\\x0e\\xad&\\x99g\\xdc\\xe9i@\\xc4\\xfc\\xaca\\xa1kn\\x91p\\xdb\\xac\\x92\\x89,\\xfdl\\xee\\xb2\\xf7\\xab\\x83u\\xc7\r\\xa8\t"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8g\\x1e\\x93\\x9a1w\\x12\\x903n\\x15\\xb7;\\xff\\x84f__p\\x0e\\xa0a\\x9d$^\\x1b\\xc1\\xdd\\xb5\\x07\\xbbg0,\\x9f\\x9f\\xed\\xe0\\xdev6\\xe7\\xc5\\x06\\x97m\\xf9qd\\xf0\\x98\\xb0;\\x93\\x85q\\xc85\\xcdj\\xc9f\\xcc\\x94r\ne\\xc1\\xb2\\xff\\x8b\\xc5\\x93\\xd2l\\xb2\\x9e\\x05\\x94\\x0e\\xab\\x8d\\xb9\\x9ei\\xe7\\xdej\\x93\\xca\\xd0\\xcf\\x85\\xa8\\xc0w\\x00\\xd1l\\xee\\xf1\\xc2\\xd7\\x07\\x95n>h\\xd9\\xb8(\\xc4xg\\x06\\xda\\xf16\\xa9l\\xa1l!(\n\\xf3\\xc9\\xc5\\xb4#\\x00\\xbb~\\xbf\\x88\\xec\\xc1\\xccx\\xbd\\xd5\\xf3\\x99\\xf8\\x83\\xdc\\xc1z\\xa5\\x8bxmz\\x96\\x0f\\xcdw\\x1a\\xa8\\xa4\\x83\\x17`\\xba\\xea\\xb2\\x84~\\xd5@\\x0fu\\xd0p0\\x031\\x8e\\xa2\\x08%`0\\xc1\\xdf\\xed\\xac3\\x98x\\x97m\\xfe\\xd8\\xfbh\\xd9z0\\xf2\\xd0\\xfceh&g2l\\x01f\\xcd\\xa3\\xd4$\\x1e\\xc6\\x823\\xef\\xf5#\\xbck2\\x80d\\x1eq(\\xac\\xd7c\\x04\\x01\\xb6:b\\xcc\\xc9\\xe2\\x1e\\xe2p\\xcf\\xca+5\\x86"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xf6\\xfa\\x93\\xf5\\x82xg\\x19ia\\xed\\x07l\\xe8\\xa6~v*\"\\x99\\x88z8e\\xc8\\x11\\x04\\xafga\\\\xcb\\x8a\\xd0j\\xf5\\xbel\\x9d\\xed\\xcf\\xd2\\x9a\\xb9\\xdb\\xa7\\x9d\\x13\\x83%b>e\\xc5\\xb9\\xd7\\x05\\xbec\"s\\xf8\\x8f\\xb9z,\\x8f\\xd4\\x18\\xfekb\\xf4\\xa4v\\x07$.#\\x97\\xe5`\\xe0\\xa1\\x12\\xc1\\xea\\2\\x06;\\xbd\\xa0\\x98\\x04\\xa0 <j\\xd8\\x02\\xba\\x1fi\\xda\\xa4\\xf0\\xad\\x8c\\xfa\\xdb\\xa6a\\x04w\\xcc\\xa5.\\x80\\x13\\xa0\\x94\\xa5\\xd8g\\x01\\xc1\\xcfy\\xfe\\x1b\\x04n\r\\x04\\x1d\\x98;\";\\xce\\xdds\\xdd\\xca\\x06wz`-\\xd3\\xf1\\xe9\\x89\\xadc!\\xf8\\xc7\\x9d\\x99\\\\xee\\xcbv)\\x86\\xce \\xe1\\x84ea\\x06\\x81\\xf3\\xba\\xd1+\\xa2\\xae\\xe7\\xa6\\xc7\\xa6\\x16\\xcc\\x15\\xa0\\x87x-\\xba\\xc3\\xdb\\x963\\xf8\\xd8z\\x16\\x95>*\\x874j\\x95\\x9b\\xd1\\xac\\xe8\\x86\\xb8\\xf42k\\xeb\\x8eg_\\xecf\\xd7dju&\\xc5\\x02d$\\xdf\\x0f\\xd7n\\x9a\\xe5o\\xa7\\xce\\xe2\\x14u"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xe886j\\x97\\xe6\\x84\\xc7\\xablq\\x0b\\xa65\\xb6\\xd0\\xd0z\\xc3sk\\x01\\xecz\\xe1\\xf3?3\\xce\\xde\\xb8\\xa3\\xcd\\xa6\\xb0\\xf3\\x04'e\\x07\\x86\"5\\x13i\\xe5ro\\xae\r6\\xbe\\xb0`\\xe1\\x9ah\\xad\\x15h\\x99\\xf4x\\x05y\\xdb\\xb4\\xf5\\x1a\\xa47\\x80\\xfd\\x91<\\xc7\\x1e\\x1d\\xab\\x89\\x1d\\xfa\\x10\\x9dbdr\\x12\\xc9\\x06\\x89\\x13\\xe5f\\xe7by\\x13*c\\xa5\\xd4\\xf9l\\xa7\\xfc\\xbdg\\xc7\\xee\\xab\\xca\\xf9!\\x8a\\x12\\xccj\\xd1o\\xd9\\x9a\\xdda;kd~\\xba\\xc0v\\x99\\x91\\xddi\\x96r\\x0ei\\x17/\\x9fb\\x94\"\\xdf\\xed\\xd3\\xab/\\x03\\xd4o\\xb2i\\x18\\xa8\\xe5\\xed\\xb7\\xb3\\xfes\\xe8s\\xcd\\xce3wpe\\xa3\\xbd\\xe82=\\xe2\\x87\\xcb\\xdb\\x87^c\\xd6t\\xfe\\x95\\xa8/\"\\xdf\\xa8h\\xcah\\x83v\\xac\\xd6\\x83@\\x04\\xae\\xcd\\xbe\\x05\"\\x90j\\xb2p\\x08\\xb9\\xe0\\x94\\x88\\xc5\\x98\\xa5m\\x048\\xce\\x88i\\xbb\\x15\\xec8\\x8f\\xc1\\x89\\xca\\xb1o,t\\xbe+\\xa3/\\xc8\\xb4s"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xa6r0lr\\x1chrs\\xa6\\x1f(vv\\xb4\\xfa/o/\\x01p\\xf6<\\x06|\\x80\\xe0\\xfa1\\x7f5\\x00\\xdc\\x9b\\xa8e&\\xa5\\xfb\\xfc\\xd8\\xd2t\\x05\\xfc\\xc8\\xa8& \\xcc\\x11\\x85\\xecg\\xae\\xecv\\xdf\\xe6d\\xf3\\xce\\xa2\\xd2kv\\x1a=\\xa4t\\x90b\\xb5m\\xa9\\x96\\xd2)rh&#\\x01\\xee7\\xb7c>n\\xbf\\xb7i\\xa6\\x94\\x99\\xe0\\i\\xab:\\x10\\x84\\x99g!@#\\x95\\xce\\x82\\xa4\\xa8*\\xb6\\xbb\\xfb\\xca\\xfb\\xcd4\\x12\\x01\\xe1\\x1c\\xb3f\\xa9\\x8f\\xe0\\xabhv\\xf0\\xdd\\xf9\\x85.\\xa0\\xeer\\xea-\\xe0\\xcc\\xe89\\xf7=\\xb5\\x1d,\\xe74\\xd8\\xfd2'\\x9e\\xde\\xcfe\n\\xdef\\x18\\x8a\\x97\\x1a\\xd0;\\x89\\xd5\\xe3r#\\xdaw\\xe3\\x81u\\x08?m\\xbcp\\xfc\\xccj\\xabp?\\xdf\\xff\\x0e0xp\\xf9\\x88\\xf5\\xc4*.\\xfbz\\x9d\\xce\\x1cr\\xaf\\x9b\\xc4\\xbc\\x95\\xde\\xda\\xe4\\x9b\\x80ste&\\xecre8\\xf4*\\xfa~\\xb8\\x9d;\\xff\\xfb\\x01d\\xdd\\x97tx\\xbar"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd7\\xbc!\\xcf@\\x98`\\x90\\x7f\\x0cu_xy\\xac\\x15\\x0e\\x00d\\xe5\\xc6\\xc9\\x1a\\x8cg\\x1d\\xefoa\\xf0j\\xc2\\xc3\\xe1;\\xf4\\x98\\xc5\\x9e\\x1e\\x07\\xfe\\xa3\\x93\\xc6.\\x196\\xf8\\xfeuy\\x11~\\x979\\xb8\\xe0\\x8c\\xe0\\x85\\x06\\xf2/\\x0f\\xb2\\xc5\\x7fa\t\\x07\\xa3.^\\xda\\xd1\\x87\\x08m\\xa0\\xbb\\x8az8\\xd2\\xf7s\\x0c\\x86\\xcb\\xe3%\\xae\\x96\\x14\\x11\\xad\\xb4v\\xca\\x8f\\xf8\\xfa_\\xd7\\x07?\\xce6l\\x1c\\xfb\\xdd\\xd2<\\xd6\\xd6\\xde`\\xb3f9\\xbdf\\xa9\\xd6\\xfa7w4\\x93h\\xff\\xfcl\\xe8\\xb1\\x96\\\\x90\\xb4\\xceb_\\xbd\r\\xb3z\\+n\\x1d\\xfdl\\xacs`\\x05\\x98|e\\xc4\\x17\\xb1\\xd8\\xe4\\xf8)\\x84\\xdca\\xa8-\\x14\\x00\\x9a\\x00\\xea\\xeb=\\xac\\xaa\\xdca\\x1f\\xf1\\xd6_\\x92\\x16\t\"\\xf2b\\xbaz\\xc8\\xe8ri#\\x96b\\x98zv\\xcf\\xb6\\xa7\\xc9\\x9b\\xe5\\xab\\xf6j\\xef5\\xe8fg8\\xde\\x87\\xbf7\\xf2fjx\\xfd\\x16\\xb2,ov\\xc2\\xd9\\x99\\xbfp\\xf0\\x08\\x80\\x88b"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\x90c\\x0f\\xe5\\x0f\\xa3\\x1b<r\\x00\\x1d\\x9en\\x1btp\\xb3\\x0e:-\\x93\\xe2\\x1f\\x1d8\\xfcu\\xb2\\xe8\\x03`!\\x94$\\xcd8\\x14q\\xa7\\x1c\\xeb\\xa3\\xfb\\x1d\\x14\\xc1cm\\x16\\xdf\\x8a\\x15q\\xf7'\\x18\\x0c\\x05\\x1e\\x86\\xaf\\xa5\\xe6t\\xed!\\xcco\\xcc4\\xb7k0\\x1a\\xac\\xe4\\xa4\\x85\\\\x15\\xb6\\xfb\\xe0 7\\xbfac\\x9a$\\x17\\x01?\\x13\\xa0\\xdf\\xc5\\xb5g\\xd2\\x08$1q\\x94\\x04c\\x96ax\\xad\\xc3\\x03\\x12\\xe1\\xfc\\xdfj@\\xfe\\xd1ssob\\x8e\\xc2tp<\\xd5\\xbdl\\x11\\xe6y\\x84\\xf8^\\x8a\\x08\\x06\\xa8n\\xd0d\\xab,\\xed'\\xfc\\xf52w\\xcap\\xca\\xd5\\x96>*\\xdf zbxh\\xe2\\x930\\x0c\\x0cp\\xa9\\x0b\\xd6k\\x90aak\\x81w\\xf5\\xa9\\xa6\\xcd\\xb1\\xfbl\\x16.\\xe2nu\\xfdvx-\\x0c\\xa5\\x95\\xeb\\xb5d)\\xcb\\xd8\\x03`\\xcd\\xe9q\\x19+\\xef\\xec\\xbb\\xfa\\x8f\\xf9\\xdfs\\x90v\\xec\\x04\\xf2\\xef\\xa0?'\\\\x90o\\xfa\\xe7\\x98+\\xf0x\\xf0n\\xd1\\xa3\\xc1\\x02\\x94"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%\\xa0\\x84w\\x881\\x97\\x14\\xff\\xa3d\\xb6\\xb2\\xd3db?\\xd1\\x14\\xa2\\xb6\\x8f\\xb2@\\xd1ms\\xfawi\\x1ef\\xc6\\x12\\xd4\\x83 .b7c!\\xeba\\x83i\\xe2\\xb1h\\xd5\\s^\\xf4\\xaf\\xac\\xe7\\x04\\x86\\xbe@z\\xe7\\x06e\\xf0\\xc2\\xe9\\xda>\\x10g\\x98h\\xb4+d\\xd3r\\x8d\\xa6\\xa4.\\xdd\\xf6o\\xa2\\x99q3\\xee!8\\x02\\xc4\\xed\\x99\\x10\\x98\\xa2\\xc0\\xef\\xf5\\x7f\\xebo\\xa0\\xf5/.\\xc0\\xf9i\\xa8\\x1ev\\x00\\xcc\\x87\\xd1\\xdd\\xd7\\x06\nn\\xd9\\xea\\xa1\\xc6t\\xf9\\xfb\\xe9l\\xd7jmq\\x0b'/f\\xbb\\xc8\\x8f\\xf1\\xc9_ey\\xc8h\\x9a\\xf8\\x86\\xdb&\\xc0\\x15\\xf4\\x8f\\xc8t\\x8f\\x9ew\\xe1\\xbe\\x97\\x84g\\xdbm\\x0eh\\x12\\xaa<\\xdf\\xb0\\xd8\\xe3+\\x9d\\x9d#l\\xc2\\x19\\x84\\x19#\\xf0n\\xc5\\x00`8\\x84\\x98s\\xde9\\xbb\\xbc#l\\xc8\\x0b,\\xa0\\xec\\xe7\\xa99\\xabxj\\x9b\\xf5i\\x0b\\xda\\xa2\\x93\\x86ad\\xda\\x08\\xf34\\x9fh\\x8c\\xbf\\xc0yn\\xf1\\x9f\\xe4\\xcd/x$v\\xc9"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8czk\\x18\\x93b\\xf0\\xab\"\\xe1\\xa4\\x80\\xe5e\\xb6\\x84d\rp1\\xef/y\\x03\\x89\\xcd\\xb3\\x04\\xe2\\xa7\\xbf\\x9f\\xcfsu#\\xcea\\xb8\\xd2\\x9e\\x00w\\x853\\xc2\\xae\\xa1lu\\xfb\\x865+\\x8d\\x96\\xdbe,\t\\xf84\\x1f\\xc8h(wu\\xaf\\xb0\\x9boe\\x86\\xf9\\xcf\\xf0\\xef\\xe3a\\x9fo>\\xa9c\\xe0\\x05\\xeei=\\x0b\\xc1\\xb1t,d\\xcce\\x07\\xda\\xa2\\x9d\\xa1\\xe7\\xdf\\xca\\x02\\xc87\\x06w\\xa7\\x17\\xf4\\x9e\\xdbom\\x84\\x91\\xae\\x1b\\x98\\xc5meu\\xaa; e\\xb2\\x99xj\\xad/!\\xef\\x89\\xf1\\xf2*w\\xd2\\x7f\\xfd\\xf1z\\xfe>\\xe9i\\xcfk\\xea\\xc0\\x12\\xe2\\xaf.\\xd5^\\xd0\\xb7\n\\x84\\xd1\\x9b\\xedm\\xe3z/\\xef65o\\xcfig\\xb0f&tu\\xeft\r\\xd8<\\xec\\x12\\xbf\\x92\\x7f\\xce\\x98\\xba\\xeby/\\xc8\\xb0\\xe8u\\xc1\\x82,\\x9d\\x95iv\\xba\\x0f,\\xfd\\x8e\\xfd+\\xa3m\\x1d5\\x82\\xca\\x83q\\x1d\\xbd9\\xfa\\xfbmfy\\xdegfn\\xd9\\xb1\\xe8xt\\xdd\\xb4"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9aom\\x0f\\x82\\xf8=\\x18\\xb1\\xdf\\x93s\\xd6br/\\x93;\\x8ao\\xf3\\xdc\\x9e\\xfa\\x9b\\x04w\\x1a\\x03\\xbe\\xe3\\xa3i\\x1e\\xed!\\x91\\xfa\\x8e\\xf6\\x1dp\\xfe\\xfd\\xe3k\\xe5!\\x0cd\\xcf5.\\x0b\\xc3\\xfba\\x88\\x1c\\xd7x?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ybx\\xb5w\\x85\\xfa\\x0c\\xfe\\x1b\\xa9\\xac>\\xe9\\x1c\\x80\\xac0\\xf5\\x94\\xa9\n\\x10<\\x00\\xe7\\xdf\\xb9\\xad\\x87j\\xb5\\xa7\\x96#\\xc4\\xda\\x11\\xff,\\xb2\\xbd\\xf8\\x83h\\xe4\\xd3"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\x183\\x7f\\xfb\\x1b\\x03\\xdb\\xaa\\x857\\xc4\\x869\\x13\\xf4\\x7f\\xe5x<\\x85\\x95\\xe9\\xa2\\x87\\x02,\\xcc\\xe4\\x8b\\x10(\t\\xbf\\x8c\\x04r\\x15\\x92t\\xab\\xe7\\x97\\x82n\\xa96*\\x94\\xb3\\xc4hz\\xcab\\x1d\\x9c2edhl\\xed\\xd8i\\xe5aqt\\x10\\xa8\\xab\\xaa\\xd1p\\x1a\\xb8r\\x87b9\\x92\\xee\ru\\x9ch\\xb7\\x88k\\xbf\\xc0\\x0b\\x89\\x15\\xd9\\xdfnn\\x98i4\\xeb:*zr\\x10\\x98v\\xe7\\x8f\\xb8\\x86+p\\xe1\\xc4m\\x1e\\xea|\\x17x\\xb7.\\x1eo\\xc0\\xe9\\xf7\\x1a\\xa5\\x93\\xc9\\x82_|\\x19\\x12\"w\\x0c\\xaeq\\xbb\\xc6\\x0c\\xc63dyq=8\\x08\\xbfhd\\x13\r\\xb7\\xe9\\x83o\\xce\\xef\\xa6c \\xff\\xca\\xa0\\x05k\\xe2_22\\xf8\\xe7\\xa0\\x90f\\xb4\\x07i\\xea\\xb1\\xca)\"\\xd3l\\xe4>\\xdc\\x0c\\xbf\\x85\\xb8\\xb2\\x16\\xda\"\\xd5n\\xde\\xb1\\xc8\\xec\\x0eg\\x92vh\\x02\\x0c\\xc1\\xfd'\\xe2\\xb6\\xe9\\x0bq@\\x9d\\x0e\\x9c\\xcf\\xa5=\\xe1\\xb3\\xb0a\\xe5\\xbb\\x9e\\xe1\\x99\\x92\\x8e\\x02i"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bf\\x87\\x8cr\"\"#%d\\x7f_$.\\x17\\x11\\xb6\\x8f\\x00`c\\xadv\\xc8\\x8f&\\xb6\n'*o\\xdd\\x10\\xfab\"\\xfd\\xbcd\\x14'eg\\x15\\xbe:f\\xaf\\xe9\\xd8\\x82\\xec5\\xf3`\\xeal\\x047\\xd4\\x8d\\x0c\\xee\\x18n\\xe6\\x84gc\\xb1\\x01\\xcc\\xb7w\\xdb\\x04sl\\xce\\xe8\\xa2u%\\xe1\\x83)i\\xe4\\xc7\\xc5\\\\xc0\\xe6\\x11gb\\xb8\\xa3\"\\xc2\\xb7q^zy\\xbb\\x08\\xc6\\x16\\xa7e\\x15|\\xa7\\xc1\\xc9\\x1b\\xd37\\x9e\\xae\\xfcm\\xefz\\xeb|\\xec\\xa8\\xa5\\xe9q\\xd7\\x02\\x1ab\\x9c\t\\xae\\x82n\\x9c\\x90\\x11u\\x8e\\x81\\xc2o|yr\r\\xbc\\xe9%w\"\\xaa\\xcb\\xad5|'.\\xb6\\x06h\\xeak\\x82\\x99y6\\xa5\\x9dng q\\xa43$\\x1e&\\xe5^\\xb0aj\\x06ph\\x16\\xc9\\xb6?*/\\xd8/\\x86\\xb0i\\xcck^y=e\\x8f\\x80\\x02\\xdf;\\x7f\\xcc#\\xa3\\x08uq\\xd6\\xc9\\xcd.\\xd3\\x92\\x91\\xe4\\xe5\\xdf\\xf9\\xe4\\x13\\xd4~\\xdd\\xafss\\x85\\xe18c\\xe9\\xba\\x96"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xb7\\x8c\\xb5u\\xdc\\xd98\\xfd\\xf2\\xe6_\\x8ag\\x0b\\xd6\\xcc\\xac1\\xbe\\xa6u\\xac\\xd0_\\xea3|:jd~it\\x9d!\\x8d&t\\xe4\\\\xc9(\\xe7\\xd6\\x8fow-\\x1ap\\xa2\\xb4\\xf3\\xca\\xd3,5\\x84\\x08\\x01\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb&\\x0ek\\x03'\\xfc\\xe3\\x85\\xbae\\xe8\\xaf \\x88j\\x98\\xbf\\xb3\\x97i\\xbc\\x04\\xd4\\xdc\\xf6`;\\xa1\\x06\\x98\\\\x96\\xeds\\x9be\\xceh\\x16\\xc74\\xd3\\x9dr>\\x8e"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\\xa8\\x94\\x84o\\xb8k\\x90f\\xbb\\x17\\xec\\x07\\x02\\xbf\\x06\\x9f\\xb2\\x19\\xa9g\\x08\\xc1\\xa8\\xc0\\x8f>jqrxl\\x1c?\\xd8$\\xfa\\xcfm\\x070\\x8f\\x13*1\\xc6\\x92\\x03\\x8b\\x8cc-\\xcf<\\x11m\\xc6\\xc1\\xe9=\\xa0\\xb2\\x86f\\x11o`\\x1b%\\xc4\\xf0\\x00\\x8a\\x93\\xeb\\x8e\\x1b\\x9b\\xde\\x93\\xeb\\xba\\xfas\\x92qsoaw\\xdc`\\x92x\\xe5\\x87\n\\xe7\\xcatnk\\x89t\\x8b\\xb8|\\xaa\\xe8\\xd9\\x17\\xc5\\xf0\\xab\\x16\\x9f\\xe6\\x7f\\x0f\n.\\x9c\\xbeq\\xc3o4\\xdft\\xceg?\\xe6\\x1bs\\xcdr\\xc5%\\xca\\x95\\xdc\\xb5_u\\xc6#\\xf1\\x0b\\x00\\x02ghm\\x9cf\\xe6pd\\xb1i\\xe2q\\xe2y\\xe6\\x18\\xe3s\\x9f\\xfb\\xb0f\\x06\\xf1\\xb8\\x04\\xe2:\\xf6\\xd77\\xe1\\xd8\\xbb\\xb5\\xf6t\\xf0e\\x17\\xb0q\\xcc\\x99\\xda0m\\xc5\nw\\xab\\xaf\\xa4`\\x1f\\x03\\x1e\\xd8j\\x97\\x1b\\xfc\\xbe\\xde\\xf9\\xfa\\xcb\\xb5\\xe5\\xbf>q\\x82\\x13\\x10\\x93\\xa3\\xc9\\x81\\xda=\\xcfv\\xc7\\x89\n\\xb6cv\\xb3\\xd1\\xcc'j\\xbf\\xd8\\xef"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\xfc\\x00\\xd6#\\xd0\\x8e\\x1d\\xdb4ew\\x83\\x163\\xd3\\x9a\\xa7\\x15\\xf1b,\\x8b\\x83\\x19\\xc6\\x01\\xb8\\x96b\\x19c\\x98\\xb4\\x0f\\x8c\\xaf\\x83#\\xfa\\xo8\\xe98\\xec\\x89k\\xc8%\\xb2\\x11\\xefs\\x9d\\xa0\\x1a\\x98\\xc9\\xb1\\x13jy\\x02k\\x07\\xee\\xd7h\\xb9\\xa1\\x9d\\x19$a<\\xb4\\x05b\\xe9\\x0e\\xcao5\\xf5\\xfc\\xd75\\xb6\\xba\\x99\\xec\\x98\\xb7\\x9b\\x9e\\x1b\\xdbdl\\x99t\\x95>\\xc9\\xfc\\xbe\\xf3\n4t\\xfc\\xc6b\\x1c\\xbd\\xff#\\x842\\xd4bj x\\x97\\xf3\\x14\\xab\\xc86\\xd4s\\xad\\x99\\x8c\\xe4\\x86-u\\x8b3\\x035dh8\\x81\\xc5k\"\\xc8\\x8b\\xba\\x10 \\x85\\xf2\\xdc\\x94\\xae\\xc6\\xba\\xe4\\xee/\\xf7\\x04\\x85\\x03\\xcct\\xa6(\\x948\\x8f\\xff\\xff?ena\\x93\\x88\\xd8e\\x1b\\x17r\\x8e\\xb2|\\x16`8\\xa5g\\xf2\\xb7\\xb0\\x1a\\x95\\x94\\x9c\\xb7ul\\xc6\\xd1\\x98\\x05t\\xc0'9)uz\\xfa\\x08\ng\\x07\\x9f\\x1f\\x97\\x0e\\x86\\xa4\\xc5@_\\xc73\\xd3\\xd1\\x7f\\x94$\\xae\\xf9u"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xe0!nb\\xa4b\\xda0\\xe6bro\\x96z\\x0eo\\xaa\\xdb@\\xd6\\x1e\\xf4\\x1d.\\x13\\xfc2\\xcd\\x86\n\\xf6ng\\x93\\xa5r\\xa3\\x05>9\\x84\\xa9\\xd5\\xc8f>\\xa2\\x83\\xf1\\x9a\\xb7\\xea\\xf9\\xd4wz\\xfe\\xeba8\\xad\\xe5\\xb2\\xc0\\x05f\\x8e\\x9fcj\\xae\\xf7\\x03\\xcb\\x00\\xb5_9\\xcb\\xaa1@|\\x8d.\\xf6\\xf8\\x0b\\x02\\x8cwh\\xbe\\xdc\\xf8ac\\x17\\x92\\x17\\xd9\\x98\\xea;t*\\xfey\\xd3a?\\xa4\\xe7\\x1e\\xffewny\\x86o\\xf8\\x8e\\xf6\\x01/\\xa3\\xc8z\\x93h&\\xf2\\x8f\\xbf \\x1d\n\\x86^\\xae\\xee\\xcf\\xce-j\\x16\\xf8rwkfc\\x97\\x88\\x12\\x00kgo\\x08h\\x7f\\xe3\\xb4\\xc9\\xc7\\xeau\\xa4\\xb8\\x00d\\xc3rfo;\\xf8y\\x10\\xc1\nf\\xb3\\xd6hi\\xad+\\xec\\x10\\xc8~,\\xb7\\xe2\\x08\\xff\\xc6o\\x92\\x98\\xdb\\x9c\\xf8@\\xce\\x86\\xa9@\\xe7a\\xc1\\x1a\\x05\\xcbe\\x89\\xde\\xdd\\xfc,fx\\x1b\\xab\\xbbui\\x10\\xe7.3\\xe7q\\xfa0_n\\x9f)\\xae\\x88\\xf0\\xdb"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010gn\\xa2\\x1b#\\x17\\xa8\\x9a\\xc4d\\xaa\\x7fz\\x89u\\x89v\\xf7\\x9d\\xaei\\xd6\\x88\\xf3\\x1d\\xc8\\xb1\\xe5)w\\xb0\\xfa\\xfcn\\xc4#\\x84d\\xc0a7\\xaf\\xd8\\xe4w_\\x9c\\xc9\\xf3yn\\xccp<;w\\xac\\x17\\xda6d\\xb43.\\x017\\xfa\\xa3s\\xb8\\x0c\r\\xb4\\x8d\\x1e\\x92\\x04\\xa8\\x92\\xcc\\x1d\\xd1\\xbee\\x84\\x94(\\xee\\xfd\\xc4\\xb4j\\xad\\xd3$9v36\\xbe:\\xc9\\xfb`\\x91\\x91\"\\x84\\x11\\xedm-\\xd7-\\x10`\\x17\\xe9\\xfa\\xb7\t\\xac\\x07a\\x18\\xf3\\x85\t\\xb1\\xa1\\xa74\\x9a\\xb3\\xect\\x9e-\\xfar\\xb7\\xe2-\\xdei\\xdf\\xfe\\x9b\\x1b=\\x10j\\xf1\r\\x87\\x15\\xe4u\\xe2\\x96\\x88x\\x18,u\\xa7xvq\\x12u\\x84\\x176\\x98\\xf9\\xad\\xf1\\x96ct ~k\\xbchm\\x0e\"\\x17q\\xd7b\\xf9\\x0e\\x90d\\xddn\\xbc\\xbb\\xf65\\xc8\\xcf\\x87q\\xdc\\x12ik\\xa7\\x13f\\x815\rc\\xb9\\xd7\\xcb\\xa1\\xc2\\x13v\\xc2\\xa1p\\xc0\\x19_>c\\x94+z\\xa6\\x99\\xb44dxm"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=\\x0b\\x85\\xbe\\xb1\\xfeb\\x155\\x06\\xaf\\x04\\xcc\\x91 \\x1d\\x97\\xac\\xe0_\\x1fx^\\x1a\\xb1m\\x9c\\x98\\xa2\\xbc\\xf9e@\\x0e\\xc0t\\x93\\x07\\xc3\\xfe\\xc2\\x10\\xa1'y\\xabk\\x90\\xeb\\x9d\\x1e,l\r\\xdb\r\\xaf!\\xa1j\\x0b&\\x1b\\xacpa\r\\xc5\\xfeh\\xe8\\xec\\x90\\xdd\\xeb\\xed\\xd9h\\x91;\\x80\\xe1i\\xfcq\\xc4\\xe5\\xf1`\\x14\\xda\\x92\\xf9j\\x8a\\xae\\xa8\t\\x92\\xc6\\xc55vm7y(\\x0f\\xe9\\xe9<)\\xc8\\xe5z\\x13\\x00_\\xc6\\x16%\\xd3d\\xdb\\xa4\\xcd\\xa3\\xac;\\xb9\\xf8\\xb7\\xf9\\xa2\\xf3\\xa2\\xef\\x0c\\xa9\\xfd\\xa5`x\\xc4\\x18hfg\\xcb\\x99y\\xf5\\x93\\xeck=\\xfcj\\x15\\xd5\\xb4\\x1b\\x8c\\xf73\\xcb\\x1e\\xe0\\xc1n\\xfax\\xd5sx|x9i\\x10n\\x87gs\\xd2\\x0e\\xc1\\x07t\\xcb\\xd6\\xb3\\xa0\\xa9jej\\\\xf6\\xd0pxc\\x7f\\xc2\\x1b\\xdfc(4\\xa3\\x92\\xea\\x94\\xdex\\xb5\\x7f\\x02\tq6\\xd9l7of\\x9e^\\xe4\\x8d\\xb8d;ffq\\xd9\\x84\\xcfthh\\x15\\x0e\rg\\xcc\\x85z"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x8d\\x02c\\xac\\x81tf\\x9f\\xd1\\x92\\x0c\\xe9\\x0f\\xa3\\xf9\\xc6\\x196\\x99\\xda\\xe6\r\\xaa\\xe6w\\xdagf\\xeaz\\xbf9\\x0e\\xbdm\riu\\x13-\\x16\\x14\\xb6\\xb9\\x1d\\xaf\\x03g& r\\x7f\\x95v\\x13\\xe0\\x9c)\\xcbz\\x11\\x88\\x18%r\\xd6\\xcf\\xe9/l<\\x0c\\x8f\\x87o\\xf6\\xbf\\x9c\\xbc\\xfa\\xf8\\xf9\\x18\\xd5\\x83z\\xc3r\"d\\xde\\x89\\x9d\\xfcx;\\xccl\\xd5\\xb8\\xc4\\xf0\\x16\\x1f\\x99\\x98\\xd4\\xb0\\x88\\xec\\xa5!\\xf6\\xec\\xa6kt\\xa2\\x1a8\\xfd\\x93b\\xfc\\xeb\\x9f\\x02\\xa2l\\x9b=p\\xafz\\x00q\\xe7\\x1f\\xf9\\xfcz\\xe4k\\x19u\\xf2r>\\x9a\"\r\\x9c\\xc3,\\xe6\\x98p~\\xa0\\xf9y\\xden\\xdf\\xa5\\x1e\\xc4\\x18e5\\xa3\\xc7\\x93\\x18\\x17\\xf35\\xc86\\x1dr\\x1d\\xd2\\xddy>\\xa2\n)\\xe7\\xc6p\\xca\\x12g \\xae7m\\xd5=dz\\x82\\x8f\\x13\\x92@.\\xee\\x8b\\x93\\xb9\\xa1\\cq\\xb4\\xdd\\xbc\\xb5\\xb0!zir\\x7f\\x80\\xfe!\\xad7uld\\xeet\\xa7\\xe2\\x8c2no\\x0e\\xac\\x939\\"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j-\\xf4\\xaa\\x1f\\x12\\x7f\\xfe+\\xce\\xc9\\x0c=\\x0eq\\xbe\\x8d%\\xfezq6\\xafk\\xbb\\xb7\\xe0\\xc9?\\x8d\\x7fh\\xe9\\xd4\\xb5&(_\\x91~\\xefc-@\\xfags\\x1f\\xce\\xe10\\x9b\\xf3\\xab\\xcfi\\x82z\\x94o\\x03\\xf3@\\xc9\\xdd\\xac\\x0f\\x1b\\xbb\\x13\\xbd\\x96h\\xa0\\xe9\\x8b\\xe6\\xfe\\x8f\\xaf>0\\x9f4ie\\xbd\\xd5k\\x03d\\xf9\\xa4#\\xace\\x0bq_d\\xe0\\x11ji4q\\x83\\x02n\\x15gc/o\\xc2\\x8fi\\x1a\\xca\\x02\\xe5)\\[email protected]\\xfc5\\x98\\xd5\\xe7g\\xcc\\x14\\x08\\x02\\x08\\xae\\x0f\\xcf\\xaa\\x0es\\xe9\\x19\\xbf\\xd1\\x88\\xa0\\x08\\x16\\xc5\\xf90e\\x02\\xcc\\x96j\\xf5\\xa0\\xffyl\\x9e\\x13`\\xa2$\\xf3s\\xbdd\\x1a\\xf1\\x816h\\xac\\xb5\\xbcst_<*\n\\x8b\\xe5wy@\\x05\\xfc;2\\x159\\xbfu\\xc2e\\x0b\\xd2\\x10\\x83?fr\\xbf\\xc9\\x8c\\x14\\x87\\xe4\\xcc\t\\x13\\x84p5\\xaf\\xac\\x8e\\x89\\xd8s\\xa5\\x18*\\xb6\\x93\\x80u\\xee\t-\\xf2\\x92fg\\xbc\\xea\\xf9\\x10;\\xdd\\xb5"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bx\\xb7z\\xc9m\\x02\\xf4\\x14\\xdaj\\xa5\\x18\\x82\\x08\\xd1\\xaa~t\\x94\\xec\\xc56\\x9d-\\x842\\xb2\\x15\\x15\\x82\\x8c2\\x8f_\\xf4\\x9f\\x9e\\xaa\\xfd\\xbb\\x1d\\x9bbz\\xe4\\\\xea\\xfe\\x85\\x1c\\x83\\x04\\x12\\x0bd\\x88_\\x95\\xb4~ea\\x8dsj8\\xba\\x1a\\x1c\\x89-\\xfah2;\\x0e\\xa3\\xa0\\x08lnm\\xf0\\xd6og94z=\\x9a\\x9e\\xef\\xaf\\xa6v\\xc7\\\\x92\\xb0\\x9ckj?s\\xcdn\\xa3\\x19\\xe8\\xc7ba_\\xb088\\x86%\\x0f\\xe2\\xe2\tn\\x00h\\x87w\\xffx80\\xfb\\xbc\\xc6w\\xad\\xd1n\\x94\\xd7\\x9al*zqo~\\x88s\\xc3\\x04l\\xeaa\\xa0\\xb8\\x8a\\xf5\"\\x94\\xb1\\xad\\x8c^y\\xfc\\x8e\\xf7\\xce\\x16\\xb2\\x92\\xe1\\x96\\xd3\\xfd\\x85\\x9f\\xfaz\\x1c\\xa4ijq\\xd60\t/\\xe2\\x13v(\\x8dl7\\x0e<u\\x7f\\xa6p5$\\x9c\\xfe\\xa65\\xa7\\xb4>.fxu\\xefo\\xab\\x96\\xb2vz\\x93\\xbf\\x86\\xb8a\\xd6e\\xa7l\\x1bk\\x1a\\xc4$\\xd9f`5\\x81\\x015\\xf4\\x07n\\x14\\x19"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbcl\\xbe\\x10\\x13\\x91\\xe6h\\x01\r\\xa1a\\xb2\\x0b\\xa2\\xe2\\x82\\x11n\\xd2\\x8d\\xbb\\xbf\\xaa\\x85nn\\xfc\\xe9o\\xd7\\xff\\x18\\x1cr\\xf9\\xcf\\xcc\\xa4\\xd9\\xdb\\xdb%\\xa6i\\xc5\\xf69\\xab\\xda\\xf2j))\\xdb\\xe8\\xd7\"h\\xf3\\x81\\x83\\x927\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\xb7:\\xfe'\\xf5\\xda\\x0f\\xad\\x8b\\xb5)h_\\xec\\xa5c\\xbf\\xc1\\xe9l\\xcb\\x9bbf\\x0e\\x7ff\\xac\\xa9f)\\xec\\xd6l\\x0c\\xd1\\xf5\\xc4\\xfdr\\xe4\\xbe\\xd4\\xdf\\xfdt"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14\\x85\" \\x9bsl*o\\xb4\\xb7\\x1b\\x1b$\\x85\\xea\\xb65\\xe0\\xbc\\xbf@\\xdd\\x19\\x8a\\x9d\\xfax\\x7f>\\x8f\\xea\\xca\\x0e\\xb5\\xd0e\\xe3\\x1be\\xbabm\\x0c6\\xe0\\x98\r\\x8e\\xed\\xe8\\xcf\\x89\\x06\\x16\\xf7\\xb4\\x14\\x13\\xf7\\x1dd\\xaekg\\x03e\\x84\\x05;\\xec \\x03\\xbep\\x88\\xe6\\xeb\\xdctf\\x91*\\x02\\xab\\xe5\\xaec9\\xcd\\xe6\\xfa\\x1bh\\x12f\\xe1\\xedrg5\\x10\\x7f\r\\xa9\\x9e\\xa1\\x1a\\xa7\\x81\\x89a~f\\x936\\xf5v\\x16\\xce\\xc8\\x91\\x03\\xbc\\xadb\\xab=\r\\xfe\\xadh\\xaad\\x89\\xcfz\\xde\\x14t\\x8f\\xd4\\x0b+\\xed\\xab\\x9b \\xbc\\xb2\\xe3\\x8d\\xed+\\xbe\\xab\\xd6\\xe1\\xb0\\xd3\\x1fwv\\xa3\\x9f\\x81\\xe9x\\xd9\\xaa\\x8a\\x84*\\x88\\xcfami\\xb1\\xd6\\x109\\x08\\x95\\xba\\xa7\\xfc\\xca\\x86\n\\xef\\xb6msz\\x1c\\xda>6\\xf3\\xd7|\\xbf5\\x89\\x82\\xbf.\\x16w&a\\xbb:\\xa0'1\\xfb*n\\x7fa\\x92\\xbaa\\xa31\\xe5\\xb4-\\xf5\\xcf\\xe4\\xaas\\x1d\\xbe\\\\x9e\\xfe/\\xe5"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91\\xd7\\xb6\\xe1\\xc2\\xdaxry1\\xcf\\xf8\\x08\\xf4\\xf8\\xb8\\x0b\\x11\\xf6\\xfdj&\\xb7%6\\xa5\\xd1\\xeau\\xb6)-\\xe5\\x1f\\xb6!gj\\xb6\\xe2:\\xa0\\x80\\xce\\x17\\xfa\\x13\\xeb\\x07\\x93\\xa4<s\\xce\\xd6\\xfe,aw^v\\x81\\x95e\\xf9\\xc5\\x8dy\\xbf\\xa9|'a\\xd5\\xd0*\\xea\\x89\\x97|uk\\xf24m\\xffmc\\xdb\\xbel\\x8a_\\xd3\\xf19l\\x15\\xe5\\x96\\x0f\\xde\\xd0w\\xcf\\x01\\x86\\x9c\\xec\\x19\\xad\\xbbc8\\x0698\\xfd\\x83t\\x9f4\\x0b'\\x0e\\xfd\\x90\\xa1/2\\x8a\\x8e\\x03\\xbb4\\xa6\\x87\\xf9m\\x81\\xa7\\xcf\\x92\\xf6\\x11\\x98\\xca\\xebz\\x8cot\\xd8b\\x18\\xee\\xd9l\\xa5\\xb8\\xa57\\xeczsj\\xb6\\xa8\\x81j\\xc7:\\x18vm\\xfa\\x1f\\xfe\\xc2\\x17\\xdb\\xbd*\\x99\\xaa\\xab\\x01\\xc3:\\x84\\xd0w\\xb7\\xc8\tz;(\\xb7\\xca\\x0c\\x15\\xbb\\xc36\\xd5\\xdd\\x95\\x94\\x15\\xae\\xbc\\x1b\\xf1@\\xfbzk\\xd5\\x01\\xfbt\\x80\\x1b\\xfdxd\\xd6j\\xe9\\x13\\xc9\\xf2%!!l\\xe5=\\xd2=\tk6\\x85\\x83:\\xb1"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$q\\xe64x\\xc8mfq=0,\\x9ff\\x86\\x8ey\\x84\\x83\\x176\\x04\\x05\\x15\\x84\\xbd\\x14\\xd7\\xa4st\\xcb\\xcc\\xfb\\xc3z\\xe0q\\xa9\\x90\\x90b\\xcd\\xf4f\\xf9\\x84\\xe7\\xf1p\\xac\\x03\\x10\\xc1\\xa5e\\x98*\\x93i\\x8f\\x19\\xcenir\\x86f\\xa1k\\xae\"\\xef\\x8a\\xa8\\xe0b\\xa9\n\\x88\\xf7\\x11\\x7fd\\xfa\\xc8\\xech\\x80&\\xff&\\xadsk\\xdb\\x02j_o\\xe0\\xa3\\x83\\xeb\\\\xd2\\x9e\\x9a\\x1dx%\\x83b\\xfb\\xa3\\xb3\\x16\\x03!\\x1a\\xb3\\xb9\\xbc\\x9f\\xff\\xaf\\x0c\\x1c\\xcb-\\xe5\\xfe\\x01\\x1a\\xa0z\\xb5\\x19\\xa7\\x1e\\xc4\\xcf\\xa2\\xb8\\?`\\xfd\\xdf\\xad\n\\xbd&k\\xe9<\\x89\\xb07x\\x85\\x0c\\x81v'z\\xeb\\xden~#v\\xf4\\x07\\xbe\\xfe\\x0f\\xf5\\x04\\x0b\\x14\\x97\\xfa_\\x86\n\\xfa\\xc4\\x01~\\x02\\x88~\\xe6v\\xb3\\xa5\\xeb\\x0f\\x97rkf\\x83\\x03\\xf0\\xbdf;\\xa4\\x80\\x1bm\\xd0\\x1c\\xb6\\xe76\\xb0s\\xc2:o\\xd6\\xdd\\x80qo\\xb4\\xfc\\xc0\\xed\\xc5\\xa0\\x05\\xa13\\xe9u\t\\xd5\\x0f\\x82\\xe9v*\\x10\\xbe0"
  457.  
  458.  
  459.  
  460.  
  461. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  462. "Details":
  463.  
  464. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  465.  
  466.  
  467. "FireEye": "Exploit.CVE-2017-11882.Gen"
  468.  
  469.  
  470. "McAfee": "Exploit-CVE2017-11882.bu"
  471.  
  472.  
  473. "Symantec": "Exp.CVE-2017-11882!g3"
  474.  
  475.  
  476. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  477.  
  478.  
  479. "Avast": "Win32:ShellCode Expl"
  480.  
  481.  
  482. "ClamAV": "Doc.Exploit.CVE_2017_11882-6934206-0"
  483.  
  484.  
  485. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  486.  
  487.  
  488. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  489.  
  490.  
  491. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  492.  
  493.  
  494. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  495.  
  496.  
  497. "Sophos": "Troj/RtfExp-EQ"
  498.  
  499.  
  500. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  501.  
  502.  
  503. "DrWeb": "Exploit.ShellCode.69"
  504.  
  505.  
  506. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bu"
  507.  
  508.  
  509. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  510.  
  511.  
  512. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  513.  
  514.  
  515. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  516.  
  517.  
  518. "Avira": "EXP/CVE-2017-11882.Gen"
  519.  
  520.  
  521. "MAX": "malware (ai score=81)"
  522.  
  523.  
  524. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  525.  
  526.  
  527. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  528.  
  529.  
  530. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  531.  
  532.  
  533. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  534.  
  535.  
  536. "Microsoft": "Exploit:O97M/CVE-2017-11882.L"
  537.  
  538.  
  539. "ALYac": "Exploit.CVE-2017-11882.Gen"
  540.  
  541.  
  542. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  543.  
  544.  
  545. "Zoner": "Probably W97NativeOnly"
  546.  
  547.  
  548. "Ikarus": "Exploit.CVE-2017-11882"
  549.  
  550.  
  551. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  552.  
  553.  
  554. "AVG": "Win32:ShellCode Expl"
  555.  
  556.  
  557. "Qihoo-360": "virus.exp.21711882.d"
  558.  
  559.  
  560.  
  561.  
  562. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  563. "Details":
  564.  
  565. "target": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:1c4ec78bd99951fdd23597f30b749dc815d2a58015554aa15e917263cd3d941d, type:Rich Text Format data, version 1, unknown character set"
  566.  
  567.  
  568. "dropped": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:1c4ec78bd99951fdd23597f30b749dc815d2a58015554aa15e917263cd3d941d , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_3aa14486d8eeb3a04a9d57d7e25dac75.doc, type:Rich Text Format data, version 1, unknown character set"
  569.  
  570.  
  571.  
  572.  
  573. "Description": "Created network traffic indicative of malicious activity",
  574. "Details":
  575.  
  576. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  577.  
  578.  
  579. "signature": "ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious"
  580.  
  581.  
  582.  
  583.  
  584.  
  585. * Started Service:
  586. "osppsvc"
  587.  
  588.  
  589. * Mutexes:
  590. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  591. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  592. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  593. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  594. "CicLoadWinStaWinSta0",
  595. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  596. "Global\\552FFA80-3393-423d-8671-7BA046BB5906"
  597.  
  598.  
  599. * Modified Files:
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_3aa14486d8eeb3a04a9d57d7e25dac75.doc",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_3aa14486d8eeb3a04a9d57d7e25dac75.doc",
  602. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF1F948B7F-6794-4FDD-AF0F-EAA3FA64E279.tmp",
  603. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  604. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0EB6851-F87C-4E28-A417-B590C17498A5.tmp",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_3aa14486d8eeb3a04a9d57d7e25dac75.asd",
  606. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  607. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  608. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  609. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab282C.tmp",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar282D.tmp",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D3F.tmp",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D7E.tmp",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D8F.tmp",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D90.tmp",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DCF.tmp",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DE0.tmp",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DE1.tmp",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E22.tmp",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E23.tmp",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E24.tmp",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E21.tmp",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E34.tmp",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E35.tmp",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E46.tmp",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E47.tmp",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E48.tmp",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E58.tmp",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E69.tmp",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6A.tmp",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6B.tmp",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6C.tmp",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E8C.tmp",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EAD.tmp",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EAE.tmp",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2ECE.tmp",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2ECF.tmp",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F2E.tmp",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F2F.tmp",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3039.tmp",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3182.tmp",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C2.tmp"
  643.  
  644.  
  645. * Deleted Files:
  646. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  647. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab282C.tmp",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar282D.tmp"
  650.  
  651.  
  652. * Modified Registry Keys:
  653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"w:",
  654. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\112692C",
  673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\112692C\\112692C",
  674. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  675. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime"
  976.  
  977.  
  978. * Deleted Registry Keys:
  979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"w:",
  980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\l=8",
  981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate"
  985.  
  986.  
  987. * DNS Communications:
  988.  
  989. "type": "A",
  990. "request": "coldcerealfordinner.com",
  991. "answers":
  992.  
  993. "data": "104.24.123.173",
  994. "type": "A"
  995.  
  996.  
  997. "data": "104.24.122.173",
  998. "type": "A"
  999.  
  1000.  
  1001.  
  1002.  
  1003. "type": "A",
  1004. "request": "brannlly.com",
  1005. "answers":
  1006.  
  1007. "data": "",
  1008. "type": "NXDOMAIN"
  1009.  
  1010.  
  1011.  
  1012.  
  1013.  
  1014. * Domains:
  1015.  
  1016. "ip": "",
  1017. "domain": "brannlly.com"
  1018.  
  1019.  
  1020. "ip": "104.24.122.173",
  1021. "domain": "coldcerealfordinner.com"
  1022.  
  1023.  
  1024.  
  1025. * Network Communication - ICMP:
  1026.  
  1027. * Network Communication - HTTP:
  1028.  
  1029. "count": 1,
  1030. "body": "",
  1031. "uri": "http://coldcerealfordinner.com/wp-admin/js/12jan/Ojan/Jan.exe",
  1032. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1033. "method": "GET",
  1034. "host": "coldcerealfordinner.com",
  1035. "version": "1.1",
  1036. "path": "/wp-admin/js/12jan/Ojan/Jan.exe",
  1037. "data": "GET /wp-admin/js/12jan/Ojan/Jan.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: coldcerealfordinner.com\r\nConnection: Keep-Alive\r\n\r\n",
  1038. "port": 80
  1039.  
  1040.  
  1041. "count": 1,
  1042. "body": "",
  1043. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1044. "user-agent": "Microsoft-CryptoAPI/6.1",
  1045. "method": "GET",
  1046. "host": "ocsp.digicert.com",
  1047. "version": "1.1",
  1048. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1049. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1050. "port": 80
  1051.  
  1052.  
  1053. "count": 1,
  1054. "body": "",
  1055. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1056. "user-agent": "Microsoft-CryptoAPI/6.1",
  1057. "method": "GET",
  1058. "host": "ocsp.msocsp.com",
  1059. "version": "1.1",
  1060. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1061. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1062. "port": 80
  1063.  
  1064.  
  1065.  
  1066. * Network Communication - SMTP:
  1067.  
  1068. * Network Communication - Hosts:
  1069.  
  1070. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!