API tools faq
paste
paladin316

Docs_03ea1072931ef1d9fa24e9605413b4b6_doc_2019-07-26_03_30.txt

paladin316
Jul 26th, 2019
2,141
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 234.17 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_03ea1072931ef1d9fa24e9605413b4b6.doc"
  7. * File Size: 267409
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "e579215a73e2e33a07f007bb162ef69c534c7227b78d1e905957a471199cb6d6"
  10. * MD5: "03ea1072931ef1d9fa24e9605413b4b6"
  11. * SHA1: "5d87361917e65f526f8c5bd1bc557a3f9859e905"
  12. * SHA512: "0dfb06c5e8483cd7e3473c547559c63bb8823ae76f8b7ca5c37415e8f112e44e71dd7045a989105de1dc0a7f5d955ec03d0c3fcb9b63dc786196b73349dc79de"
  13. * CRC32: "67BECD10"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLeosANQUK82qx6jB0Tz2DfteC3rbdF/lriedsEf:sxxQW3ynjrFiep7h7fF7d"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2232"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 250 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  41. "Details":
  42.  
  43. "IP": "52.109.20.1:443"
  44.  
  45.  
  46. "IP": "23.60.72.96:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "72.21.91.29:80"
  53.  
  54.  
  55. "IP": "184.28.188.192:80"
  56.  
  57.  
  58. "IP": "104.18.25.243:80"
  59.  
  60.  
  61. "IP": "23.64.189.123:443"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  67. "Details":
  68.  
  69. "ioc": "nline.xsl"
  70.  
  71.  
  72. "ioc": "ontent.inf"
  73.  
  74.  
  75. "ioc": "mlaseventheditionofficeonline.xsl"
  76.  
  77.  
  78. "ioc": "ext.glox"
  79.  
  80.  
  81. "ioc": "turabian.xsl"
  82.  
  83.  
  84. "ioc": "gb.xsl"
  85.  
  86.  
  87. "ioc": "rid.glox"
  88.  
  89.  
  90. "ioc": "..3b"
  91.  
  92.  
  93. "ioc": "sist02.xsl"
  94.  
  95.  
  96. "ioc": "ist.glox"
  97.  
  98.  
  99. "ioc": "ccent.glox"
  100.  
  101.  
  102. "ioc": "architecture.glox"
  103.  
  104.  
  105. "ioc": "chevronaccent.glox"
  106.  
  107.  
  108. "ioc": "rocess.glox"
  109.  
  110.  
  111. "ioc": "set.dotx"
  112.  
  113.  
  114. "ioc": "pictureorgchart.glox"
  115.  
  116.  
  117. "ioc": "eadlines.thmx"
  118.  
  119.  
  120. "ioc": "harvardanglia2008officeonline.xsl"
  121.  
  122.  
  123. "ioc": "adial.glox"
  124.  
  125.  
  126. "ioc": "asis.thmx"
  127.  
  128.  
  129. "ioc": "content.inf"
  130.  
  131.  
  132. "ioc": "quations.dotx"
  133.  
  134.  
  135. "ioc": "gostname.xsl"
  136.  
  137.  
  138. "ioc": "iso690.xsl"
  139.  
  140.  
  141. "ioc": "iso690nmerical.xsl"
  142.  
  143.  
  144. "ioc": "rame.glox"
  145.  
  146.  
  147. "ioc": "chicago.xsl"
  148.  
  149.  
  150. "ioc": "rame.thmx"
  151.  
  152.  
  153. "ioc": "rop.thmx"
  154.  
  155.  
  156. "ioc": "rc.glox"
  157.  
  158.  
  159. "ioc": "rings.glox"
  160.  
  161.  
  162. "ioc": "iew.thmx"
  163.  
  164.  
  165. "ioc": "adge.thmx"
  166.  
  167.  
  168. "ioc": "ieee2006officeonline.xsl"
  169.  
  170.  
  171. "ioc": "e.gu"
  172.  
  173.  
  174. "ioc": "anded.thmx"
  175.  
  176.  
  177. "ioc": "erlin.thmx"
  178.  
  179.  
  180. "ioc": "ividend.thmx"
  181.  
  182.  
  183. "ioc": "gosttitle.xsl"
  184.  
  185.  
  186. "ioc": "uotable.thmx"
  187.  
  188.  
  189. "ioc": "ype.thmx"
  190.  
  191.  
  192. "ioc": "etropolitan.thmx"
  193.  
  194.  
  195. "ioc": "arallax.thmx"
  196.  
  197.  
  198. "ioc": "ircuit.thmx"
  199.  
  200.  
  201. "ioc": "g.n9"
  202.  
  203.  
  204. "ioc": "roplet.thmx"
  205.  
  206.  
  207. "ioc": "avon.thmx"
  208.  
  209.  
  210. "ioc": "eathered.thmx"
  211.  
  212.  
  213. "ioc": "amask.thmx"
  214.  
  215.  
  216. "ioc": "vent.thmx"
  217.  
  218.  
  219. "ioc": "esh.thmx"
  220.  
  221.  
  222. "ioc": "late.thmx"
  223.  
  224.  
  225. "ioc": "rail.thmx"
  226.  
  227.  
  228.  
  229.  
  230. "Description": "Performs some HTTP requests",
  231. "Details":
  232.  
  233. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  234.  
  235.  
  236. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  237.  
  238.  
  239. "url": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/bey.msi"
  240.  
  241.  
  242.  
  243.  
  244. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  245. "Details":
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3,h\\xd0\\xfb\\x94\\xc6\\x9d \\xd9\\xf0\\xdf?\\x9bn \\xc2\\x96\\xd4\\xcd\\xb9\\x8d7\\xb8\\x9dp\\xc4u\\x7f\\x18\\xf0\\x91\\xff_\\xd6\\xbf\\x18\\x03s\\xde\\x19lk\\x198bzx\\xf7mo9 \\xf3\\xe9\\x15x\\x036\\x013\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^\\x04^\\xd2>e\\x03\n\ngt\\x8b\\xb9\\x068\\x1b\\xd7tpg\\x15f\\xf8\\x08 ld\\xd1\\x06\\xbd\\xa5\\x990\\xf7\\x1d\\xce\\xe3(\\xa4\\xc8\\xb4.t_=\\"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf8osja\\xd0\\x81u\\xda\"\\xeev\\xeb\\xf66\\xf1\\xa9m\\xe0\\xb3!>\\xb2\\xa5f\\xefu=\\xa3\\x82v\\x998\\xd3\\x92*\\x8e\\x04q\\x12\\xb7\\xe5\\x00\\xfb\\xd0/\\x95\\xc8%% \\x94\\x98\\x02\\xd7fg\\xbb)\\xf9l\\x01\"d\\xb1\\x87j\\x92\nl\\x0729/\\xdcvf\\x1a\\xb1.\\xb7qk\\xd0\\xee\\x91\\xbf!#\\x053\\xfdd^\\x97c\\x05\\xb6\\xe7'=\t\"\\x8d\\xbe.a\\xd4dp\\x1e\\x97xhi\\xec\\xf1\\x80\\xe4\\xadf\\xf7\\xf1\\xb9\\xfcb\\xb8\\xffm3\\x8d\\x0b\t ?k\\x18\\xdf\\x18\\x87\\xa5p\\x9f6\\xca\\x9c\\x06\\xde\\xb0\\xaa\\xe36\\x7f6\\xd90\\xecr\\x84\\xe6\\xe2x\\x0fs\\xbf\\xe9\\x8bs\\xe1-n\\x96#\\p\\x8e&\\xa1\\x88q\\xd9g\\xcd \\x06\\xe5oj1f\\x96\\xbaz\\x80yt\\xaa\\xd7\\xb1\\xf5\\xae\\xfe\\xaek\\xd9\\x94w(\\xfe'\\x83\\xb5\\x81\\xd0ece\"\\x96\\x9c\\xael\\x18e\\xe3\\xee0i;\\xa9\\xc5\\xbd\\xf0\\xf8\\x9c\\x8c;\\x073|\\xa2\\xce\\xa4|\\x93,b"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xee\\xd76y\\x97\\xa0\\x18\\xffm|\\xf6z\\x88o|\\xdc\\x8e\\xac\\x03xr\\x90\\xc2\\x9a<\\xba)\\x0c\\xeb7.\\x9f\\x98\\xcd\\xc5\\xfa\\x7f^\\x90\\xef\r\\xb6\\xa5\\xda\\xf3\\x11:#d\\x86\\xef\\xd9\\x16\\x15\\x1a\\xb0*1\\xae\\xad4=#\\x9f\\xa5*\\x94*\\xa7\\xb2\\x13\\xc6\\xcd\\xb7\\xdcw\\xfa\\xeba\\x84\\x19ua\\x01\\xf0y7d*\\xcc\\x93o\\xd7.h\\xe6\\xe6\\xf3?kt\\xd2i\\xe3\\xed\\xc9\\xfa\\x9fjtw\\xec\\xc5;h\\xd81x\\x8a1\\xdf\\x02v \\xb1tv\\x9dn`\\x80\\xc2\\x16\\x81\\xc1x\\x1c\\xe1\\xdf=\\x07\\x8f\\x9f\\xb1,%\r_\\x15\\xe5\\x96a\\xc3\\xecp\\x9fr\\xb8\\xd1\\x98\\xfa\\xea\\xa1k\\xd8\\x01\\xffl0;\\xc3\\xbcsp\\xaa\\xce\\xd0\\xf5f\\x14\\xd8\\xabl\\x86q#\\xb7\\x15\\x9eh\\xe4(0\t\\x93v\\x99\\xff,(\\xd4&\\xc6\\xc4\\xa2>\\xdc\\x806c\\xf6\\xc3mzf\\x13^\\x8e\\xa7\\x8b\\x89 ,~\\xfa\\x1e\\x92zv\\xed\\x154\\x98\\xdf\\x85lm\\xc2b7\\x8fd\\x1f\\xa7 7\\xef'"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01:k\\x13\\xfdrf\n\\xa2\\x9b\\x1d\\xab\\xa9\\xf2i-zc>y\\xe2\\xa9 \\xc0\\xea\\x12\\xe2\\xd0j\\xd7\\xaa\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xde\\xad\\xe6oh$\\x9c\\x07p\\x0e\\x9dy(\\x85\\xb3\\x86/7\\x08\\xd9,&&\\xa5.<\\x1f\\xfa.\\xb0\\xb3wu\\x97\\xaf\\xf7\\xed\\xee\\xc0\\xa6\\x8du7\\x1d\\xb1\\x17\\xd9\\x836~!\\xe2az\\xdb\\x93e\\xb2c\\xde\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xf4\\xfa\\x96\\x0ctk\\x9df,\\x14t\\xcb\\x9flv\\xde\\x83/f5z\\xddn\\x0f\\l\\x1c\\xf9\\x1f\\xb8\\xf9\\x8bh\\xf1\\x1c\\xff\\x857\\x8d\\xf0\\x949\\xae\\x15,"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa3\\xd8\\xd2\\xb9p0\\xb4\\xe0\\xe5\\x07\\xb6\\xf6*#a\\xed'\\x04'\\x9e\\x7f \\xec\\xe1\\x7f\\x1a\\x9av\\x86t6m9d\\xa9\\xbc\\xc4\\xe7v\\xd2t\\xd1&\\xf6\\xf2d\\xe7\\xc9g\\xe8\\xdf\\xc4\\xeda\\xb3\\xed\\x03\\xca$e\r\\x0b\\xad\\x17\\xa7\\xcd\\xfdch\\xf4g\\x11r\ni\\x1d_\\x19\\xe29\\xbcw\\xd0\\x9f\\x9f\\xe9/\\x06s\\xd9\\x00|9\\xc1\\x1e~\\x16\\xf3\\x0e\\xbdn1&qv\\xbfh(\\xd9\\xc0\\xa4\\xdf\\x8f\\xe6\\xc9bx\\xe3\\x8f\\xab\\x0f \\x15\\xaee\\xe5|t\\x83%\\xfc\\xe7\\x8f\\x92$$2\\x11\\xbd\\xbf\\xdc\\xd1<\\xa9\\xd2\\xaa\\xa4(d\\x0be`\\xdc\n\\xd3\\xc0a\\x9a\\x10b\\x85\\xa8\\xc0\\x8ed\\xefr2\\xb4.d\\x11\\x8b\\x11\\x1ad\\x86\\xd0j\\xaa\\xf8>\\x1d\\xc8\\xc6;h(ch:\\x80|\\x04\\x7f3\\xbe|\\xe2fow\\xad\\x853a\\x15&\\x18\\x8f\\xf6\\\\x80b\\xc0\\xfc@\\x86~\\xfa*\\xc3\\x1ax\\x08_7qy^\\x0e\\xe0\\x1e\\x85\\x9e\\xc9\\xfe\\x02\\xd3\\xf2\\xb0m\\x7f\\xc8l\t\\xce"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01:k\\x18\\xb0\\x0e\\xc1\\xa9\\x96\\xbb\\x9d\\xd4\\xbc\\x85y\\x8e3\\xce\\x85\\xca?\\x8a5\\x81ao\\xf7\\xf7\\xe3!n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xb5\\x9f\\xe8\\xf1\\xb2\\x9f\\x11h\\xf5\\xc99\\xe7\\x1f\\x89_?\\x80@)c^m\\x8dvz\\x18\\xdf\\xcd\\xc8\\x178\\xfb,\\x0b\\xcb\\x16s\\x0b\\x86\\x10\\x1f$\\x1d\\x90\\xeck9\\x0b6\\xddha\\x01\\xcd\\x83\\x91\\x02\\xda\\xc9\\x1f3$a\\xa1\\xa9\\x11\\xc4t\\x04+`\\xa1\\x1b\\xebvl\\xbb-\\xa5l\\x98\\xf3p\\xebz\\xb0\\xde5g\\x95\\xcb\\xdd\\x95\\x8d\\xc7\\xfa\\x8a\\x9a.-\\xb29\\xfa \\x061\\xef\\xd7\\xd0q\\xca\\xf7.\\x8f;\\xdbo\\xd2\\xa1y\\xd0lx\\xef\\x1f(\\xd9(\\xb3i\\xbe\\xe7\\xf0\\xa4d6\\xe0c\\xedn\\xfc\\xb6\\xf4a\\xd4q\\xf0dh\\xbd\\x05\\xe7v\\x94n\\xb5\\x8bh\\x91\\xfa\\x92\\x88\\xa9\\xea\\xd6t\\x1b\\xf5u5c\\xb0\\x18v\\xc8\\x17\\xbap-\\x9b\\xc0e\\x062\\xcc\\x86\\x03\\xbes\\xa3\\xd7?\\xdc\\xd9f!\\x0f5\\x16\\xda\\xd4\\xa9\\xf0#%\\xc5\\xe1?\\x87\\xbb\\xef\\xc7n\\x1d\\xd0v\\x83\\x9f\\xa2\\xd3a\\x91!\\xc7\\xc1\\xb0\\xc5\\x15\\xf8m\\x14s\\xabs\\x1d\\xafqj"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`f\\x07d\\xee\\xaf@\\x9c\\xca\"\\xeb\\x93j\\xe7e\\x05\\xbc\\x92\\x953\\xbewvx\\xff \\x7f\\xa6m\\x7fcez\\x1d_g\\xee\\xb5\\x1f\\x17lgoq\\x98\\x08'\\xee\\x08`e\\xad\\xb7\\xc3\\x96\\xd8\\x0c\\x8d\\xca\\x86u\\x1cuh\\x00\\xaa\\x80;\\x03\\xa2\\x91\\xcb\\x9e\\x10\\x06i\\xbd&\\xba-\\xed\\xf7qo\\xb0\\x11c\\xc6\\x1a\\xf4\\xc0\\xa6\\x12`\\xdd\\xb1x\\x9aa>\\x8a\\x01\\xc6vc\\x0c\\x08\\x03v9\\xcav\\x1e4\\xa9l\\xac`\\xb2q\\xff\\xec\\x1f\\xf5\\x13^\\xac\\xb4\\x80\\x05\\xa6z\\xb5\\x92\\xf8k\\xd4r\\x00\\xe8b&v#g\\x87\\xb9\\xa2\\xf4\\x05\\xa2\\xcan:8\\x92&\\xf9\\x05\\xfb\\xea\\xc5\\x1e\\xbf@6\\xd8a7\\xd2$h\\xf8\\xfe\\x08\\x85\\xe4b\\xe1b\\xb2\\xb3\\xb1\\x0eu\\x9b\\xca\\xf4c6\\x8ep\\xa6\\xe2\\x1c\\xcc\\x97\\x1a-\\xf6!\\x85#\\x7f\\x94\\xa4t\\x87\\xf2\\x1f\\xbb\\x7f\\xd3%\\xbb\\x17|\\x1a\\xd0\\x19r\\xc5\\xf9<m\\x99\\xf3\\x90\\xa9\\xc3wt\\xb0%\\x94\\xdcpj\\xb8\\x1c\\xa4\\xe4\\x08\\x17\\xb4<\\xe4w\\xce"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019pk\\x81c\\x8c\\xc2\\xcf@_\\xa0\\xcd18\t\\xbd\\xd7p\\xba4\\x95\\x89\\x8fj\\x9c8yd\\x88\\xb7*\\xbb\\xd2x\\x8c\\x16\\xee=\\xe7\\xa2\\xf9\\x93,\\x08`\\xf6\\xfa\\x88\\x02\\x9c\\xe8\\xc92\\x94zl2pq0\\x84\\\\x80\\\\xbe\\xf6l.\\xee\\xd1\\xfb\\xef\\xb9\\xa0\\x16\\xc4\\x8c\\xa1\\x9e\\xa5i\\xc2\\x95x\\xd9kr\\x85\\x8d\\x051\\x17\\xa2\\x92\\xb6i\\xaf\\x0bf\\xf1igj\\xe1\\xca\\xf2j\\x9f\\x14\\x96\\x81\\x03\\xb2e4\\xc9\\xf1\\x9cn\\x1a\\xb2\\x0e\\xda5\\xd4s\\xd28\\xf1=\\xb1\\xeb\\x1eg\\x19&\\x0b=9\\xb4\\xa6i\\xe0a\\x18s\\xe0\\xb0q\\x97\\xa7\\xd5\\xeck\\x0b\\x01=\\xfc6\\xc8og\\x03\\xf5\\xbce$\\x1f\\xef\\x0f\\xdf\\x8e,5\\x0c\\x81\\xaf\\x05=>e\\xef\\xcf2\\xd9\\x8b\\x91\\x06\\xfb\\x18\\xa8rm\\x94\\x9ch\\xa5\\x86\\xa3w-\\xe6\\xba\\xe9~nmr\\x95\\x19j\\xb4t\\xd1+zm\\xa5f\\xdde\\x0c\\x9fqi?\\xac\\xe6e\\x03\\x00\\xe6#^\\xac?o\\x06sm\\x89\\xa3h3\\xfd\\xb1\\xe8\n\\xe3f"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01:k\\x1b8u\\xfa\\x15\\xeb\\x19\\x052)\\xc5\\xa0\\xd7\\x93l\\x9e+e\\x14\\xf5\\x1d\\xc7@\\xa7\\x81#\\xc49\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe5\\xba\\xd9x\\x85\\x94\\\\xb7\\x98u\\xff\\xf4\\xfb14\"\\x0e\\xb0\\x1e\\x95c\\xbc\\xcb\\x12\\x8ah%\\xcd\"\\x8f|r'\\xbd(\\x0e\\xac\\xb8~\\xacz,\\xb7\\xb4\\xc1:ps\\x97\\xf8z\\x97\\\\xfdcl\\x89\\xd7+\\xa30\\x89\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x98\\xc8\\x9fx\\x83\\x83\\x12\\xea#\\x9e<\\x89\\xa2\\xad\\xa2\\x8fb\\x07\\x90\\xaf\\x9e\\x8d\\xf6\\x0b\\xa57\\x84\\xe19!\\x9cc;/q\n\\xac\\xd8\\xb7\\xa4\\xe3\\x83\\xa8\\x13\\x0f\\xc3"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw\\xe2_\\xd6cd\\xee\\xb6\\xe5\\7\\x883\\xcd\\xab\\xdd\\x1c\\x0e\\x96\\xdf\\xf8o\\xfak\\xccx\\xd3\\xf8\\xc4\\xa1\\x85\\x0fp\\x17\\xa1\\x19\\xf1\\x04\\xb8\\xd5\\xbe\\xad\\x04\\x9c\\sa\\x15\\xa4\\xd1\\x82h\\xae\\x9b\\x08\\x1e\\xf6\\x87\\xc7\\xf3\\x10\\xfdds\\xe1tb\\x18\\xda\\x0e?\\xa2o\\xda\\x8c\\xb4\\x1bz\\xb4\\xe3\\xec\\xda\\xa0\\xa7b\\xdf\\x18\\xe5\\xcc\\x9e\\x01*<\\xe6\\x81\\xea\\x9c=9j\\x19w\\xa77r\\xe1\\x9a\\xf8\\x98\\xa4-\\x8d\\x1f\\x1eap&\r\\xc3\\x10q\\xf4)\\x8an\\x12\\x17\n\\xcb0p\\xa4\\xa81\\xe3k\\xb2\\xea\\xb3\\x9dtn\\x99i\\\\x9c5\\xa5qn\\x8a\\xd2n\\x13\\x92=\\xe5\\xb5aa\\xf3c\\x9en\\xfe\\x07\\x14$\\x1f=&v\\x11\\x93\\xb7\\x189_\\xc8\\x8b\\\\xed\\xac\\x94k\\xcc\\xd0i\\xea\\xdc\\xac\\xfa*\\x06\\x0c!\\xd7w\\x8c\\x13\\xb5\\xb9z\\xb0\\x9dm\\xb9%f\\\\x1c\\x92\\x04v\\x1br\\xf8\\x81\\x9d\\xad|\\x93\\x87y\\xf7\\xd6ih\\x17\\xc7\\x02\\xe3\\xb7j\\x9d\\xe9=\\xe9\\xe6\\x80\\x97v\\xa3\\xee\\x8c\\x1f\\x98\\x17*"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x81\\xa6=\\xc5\\xddt\\xbf\\xd4\\xe2\\x12\\x91\\x07\\xe3d\\xf9!\\x04\\xcez6\\xab\\xa1x\\xf19\\xcb\\xa0\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1be\\x88>\\xa4w\\x9bz?\\xfc\\xa5?0\\xaej\\xf4\\xd3r\\xe2\\x18_i+'b\\xd1a\\xcb\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x9b\\xa1\\xf1\\x9c\\xc4|\\xa0\\x0bx\\xbd\\x0b\\xa12\\x83\\xaf\\x86>\\xfe\\xcf\\xf2\\x85d\\x7f\\xe5\\xd1r\\x9e\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xc1\\x05\\x1a\\xb2\\xad\\xb4\\xe2h\\xa8l:\\xce m\\xe3\\x9c\\x08\\xa8\\xcdjc\\xad\\xa0\\x81\\x8c\\x8a\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b0\\xd0\\x11\\x08w \\x0ei\\x94\\x98g|=\\x8c\\x0b7\\x90\\xf7;\t\\x13a\\x01r\\xa8\\xfb\\xc62\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xab\\xdcj\\x94;\\xb2:\\xdf\\xc7\\xcb\\xa1\\xbdg\\xe2\\xbb\r\\x05\\xf7o\\x89k\\x18\\xe6\\xb8)\\xcc\\x9d\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x84x^\\x0eu\\xd5\\xd4\\x01\\xf5\\xd7\\xe7\\xd0s&\\xa5\\x98\\xf1\\xe5\\xc5\\x82\\xf4\\xbe8gh\\xe4w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x11\\xa0\\xb8\\x9f7\\xa7\\xb2\\x0f\\xce\\xf2\\xe0\\xdd\\xa0\\xbd\\xe2\\x0cxin\\x96\\x98\\x92(z\\xf3\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bn\\xbc\\x1a\\xf9x\\xcb\\xf8aa$*\\xdbn\\x11e\\xcbj\\xf5\\xc7\\x96\\x86\\xf4\\xd2|\\x82m\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b%\\xecu\\x16\\xc3=s\\xb2v\\xf2k6\\xa4\\x06\\x8ers\\x8d\\x8e3\\x19\r\\x01\\xf3x\\x83\\xf2\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bz\\xb01kyr\r\\xbe\\x0f\\x9d%\nzu\\xcf.\\xe7#\rk\\xa6q\\x90\\x13\\x900h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bx,\\xad\\xcex\\x8d\\xd8\\xba\\xdfr:\\xce\\xf3\\xc5g\\x01\\xe4v3(\\xb6m\\x89\\xdb\\xc3*3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xb9\\xf7\\xd0\\x86g\\xc0_\\w\\x93\\x8f\\x94\\x87\\x10\\x87az\\xcc\\xb2/\\x94\\x98z\\xc6\\xfeu2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bd\\xd9a\\x0e\\xac\\xc7\\xd1\\x8f1d\\x99a\\xa1\\x01\\xc7ox\\x84.\\xc8j\\xccw\\xee\\xb5\\x87\\xec\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x0f\\x07n\\x14(f\\xa5d\\xe5\\x0c\\x01-\\xd9u\\xd1\\xc4v\\xb1\\x98\\xed\\x91@\\xc2u\\xa4\\xcfiw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bo%\\xc0\\xbd\\x97n\\xfar\\x97\\xefv\\x94r\\x0c\\x9d\\xfd#\\xdb\\x9b\\xffu\\xfc\\xe6=\\xc1l\\xb61\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x7f\\x84db\\xc7\t`i;\\x86\\x86\n\\xdf\\xa5?\\xea\\xde\\xcd\\xa8\\xff# \\xb3\\x8b\\xa9/\\xa7\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b92\\xa9\\x81zq\\x0b\rro\\x7f\\xef\\xb5\\x17xa=\\xdb\"\\xd7\\x01\\x7fa\\xcc\\xab\\x1b\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xa7\\xa2l\\xb3\\x06\\xda\\x7fcd\\xa9\\xbb\tl1\\xea\\xbe\\xc3g\\xf6p\\x8a\\xdf(5\\x04t\"\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bz\\x16\\xeeo_ku,\\x166a\\xfb\\x86@i\\x9d\\x83l\\xb3\\xb2\\xe2@\\x9bhr4\\xab\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bb\\x0b\\x1a\\x14+\\xc9\\xe0\\xd1ez\\xf6\\x95?.\\xc1v\\x90\\xb0\\x91\\x06_\\xf4\\xd0\\x1a\\x7f\\xda:\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x93xoh\\xfe\\xce\\\\x07\\xe87s\\x83\\xeb\\x81le\\xb3\\x00j!\\xce\\xdf<\n\\xb1k\\xba\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xe4\\xb3r\\xd1\\xdd6\\x0b\\xf0\\xb2\\x8c/hd\\x88\\xcb\\x89\\x18j\\xb50\\x8ce\\x83\\x9a\\xb9z\\x1f\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b;\\x1bj \\xd7\\xf7\\x91h\\xe7\\xbe3\\x97\\xdc\\xee\\xc6wo\\xdf.\\xfe\\xf4\\xaf\\xf6.n\\xba`l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xfd\\xe34\\x7f\\xcdi\\x16q\\xcap\\x08\\xa5z<vs\\xfd\\xf6\\xe9\\xbb\\x00\\xaf9\\x0fe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xafb\\xba\\xfb\\x92\\xff\\xb9\\xe7y\\xbc\\x11\"\\x08\\x84\\x07\\xab~\\xb7&.\\xbd\\x06m\\xe3\\xeb\\x8e\\x12i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1br\\xe1g\\xd9\\xff\\xcf\\x86y!k\\x04\\xc0\\x84\\xe7$\\xa2a?\t\\x9e\\x17\\xbe\\xa6\\xbc\\x19\\xdd-^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bpq?\\x18\\xb3\\xc6l\\x9d\\xdd\\xd8\\x97\\x99\\xb5\\xb4\\x8d\\xd2\\x98n\\x9f(y\\x12\\x14\\x851\\xd4k\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xa3a\\x82\\xee\\xb6\\xf0\\xb2\\x8e\\xc2\\xa8p\\xd3\\x88\\x14\\xc9\\xab\\xd6\\x9c\\xb2\\xc2\\xc1\\x02\\x89\\x1e\\x81\\xdb\\xa9\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xbainh\\x81j\\xed\\x08\\x82\\x9b5`\\xf4g\\xc1&\\xc4\\xd4~\\xf7\\xf7\\xf4w\\x1ck`8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x976\\xbd:/y\\x1d\\xc8nq|9\r9\\x19\\xfde\\x08\\x9a\\x96\\x0f\\xd3\\xf9\\x83\\xbf\\xa2\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x1d\\x05\\xedi3o\\xbb\\xaf\\x99\\xa5l\\x0fp\\x17q\\xa1\\xf5\\x0f\\xef\\xe9\\x06\\xa7\\xeav\\xc8:\\xc9\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b6\\x99\\xf3\\xcd<\\xbaf\\xf4zs\\x85\\xb1t\\xachp\\x17\\xdb1\\x85%\\xd7\\xba1\\x83e`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbbu\\x1e\\x84l\\x1ci\\x88\\xbb)\\x9al\\xba:\\xe9\\x92\\xde.u\\xdb6\n\\x9b\\xb0;\\xa8o\\x93\\x07\\xd1\\xab\\x96\\xb0\\x08 b\\xf0w\\xb7'\\xfb\\x99\\xee!\"\\x04\\xba&\\xf5\\xc6\\xb6a_\\xc8i\\x94\\xde\\xaad\\xa4\\x95(\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2\\xbd\\xfe\\xac?\\xaa\\xc2\\x9d\\xbc\\xe5&\\x0c\\xc4t/\\xbe%\\x8d\\xc7\\x9bm \\xd4\\xcf!\\xc4a\\x9eo\\xd1\\xd2 z\\x9c\\xb3\\xa2\\xc3\\xc1\\xcc\\xe2\\xd8zm\\xd6\\xf8\r\\xbd"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xc5\\xd3\\xe5\\xac_>,k\\xd3\\xaf\\xec\\xc9\\xf6%\\xc2\\xdc\\xffc\\x83z4\n!\\xd4\\x19\\xe7\\xb3m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xea\\xd7\\xb8\\xdb\\xa9$\\xdb&\\x10j\\xab\\xaf\\xd4l\\xe4\\xc8/\\x9er y\\xe8q\\xa7\\xf0\\xcb\\xad\\xf1\\xbej\\xadi\\x9ca\\x88b\\x8c\\xe6\\xdeup\\x9b:\\xda\\xa0\\xc4\\xdc\\xe0\\xe1%c\\xa2x\\xfb\\x8b\\x17i\\x95\\xaa\\xab6\\x90\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xb22\\x88\\x84\\x82\\xa3\\xe5\n\\xe1o\\x88\\x10=\\xc2tz\\xe1\\x9btm\\x99\\x9d\\x9a\n\\x92\\x85\\xbdeu\\xd6rj\\xe3\\xc3\\xdc\\xcfv4\\x1cj\\xec\\xa1u\\x07\\xc4>k"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\xb4 2\\xc7l\\xa2\\xc1~\\xaf\\xf1\\xed\\x8e\\xcew-\\x0b0\\xa5y\\xec\\xd0.b\\xa2\\x1do\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1b\\x07,e\\xe2)\\x82\\xf6\\xb1\\xf0zv\\xb0\\x8a\\xc00|%\\x9a\\x0e\\x01\\xdai\\x19'\\xc3!0k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\xf8v\\xb1;\\x8f\\x98\\x82ls\\x81x\\xa8\\xec\\xa8\\xf4\\x07\\xb2h\n\\x1d\\x1fw\\xe3\\xe0\\x89\\xdbc\\xa2~\\x9d\\xa6\\x920\\xbd\\xbdc\\x12b,\\xba\\xf1.\\x08br\\xa2\\xc5z^\\xc36\\x07\\xbcy\\xf0\\xfd\\\\xc6s|\\xd8\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006;\\x04\\x7fg\\xfe\\x7fb\\x8b\\xea\\x94\\xcd@\\xa1\\x10\\xd8\\xe1)\\x9d(;\\x14n\\x92\\xdcw\\x03\\xfa\\x07.\\xe4\\x9c\\xd8\\xd7'\\\\xbd\\xa4\\xeci\"t\\xed\\x19\\xf87"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6&\\x8f\\x92\r\\x84;wr\\x8fi\\xf9\\x186\\xbe1v\\x19\\xd1b\\xffk\\xb3=\\xf7\\x0c\\x89\\xbel7\\x92\\xee\\x97 \\xe4\\xc0\\xdcx\\xc5\rx\\xbc\\xa1\\xde\\xc2\\xac\\xe9\\x83;\\xb8,*\\xd7\\xee\\xdf\\x18q\\xe3x>$\\xdd1\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\xd2y\n\\xab\\xf7\\x9b\\x9c#\\x95\\xf7\\xce\\xaa\\xaa-\\xb3\\x1a\\x83\\x92k\\x16:\n\\xf8$c+\\x13\\xccr\\x8c\\x18\\x90\\xd2o\\xbd\\x15\\x1bob\\xba*\\x05h\\x89\\x0e\\x17\\xd8"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\xaf\\xd9'\\xfb\\xf7w\\x0e\\x16;:d\\x83\\x85msb\\xe24\\xedo\\x17\\xeck\\xdf\\xed\\xb5\\xa0\\xf0\\xbd\\x9eq\"`\\xf4\\x13x!\\xd8\\xab c#\\x85\\xebzf\\xec\\xedh\\xf5u\\x01\\xc5\\x85\\xf6xd\\xe2jn\\xed\\x1e\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000uv=y\\xe9\\x18\\xd3\\x8b\\xb3\\xbe\\xcee%\\x05!\\xf4\\xb6j\\x1c\rkrv \\x00\\xfe=m\\xab\\xdc\\xc3\\x060(\\x1d:g\\xd1#z\\x90\\xd5\\xb6\\x8aa\\x9f\\xe9"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1bl\\xe0\\xf6\\xb9\\xea\\x8fw\\xd3\\xbd\\x9e\\x86v\\x1c\\xf8\\x1a\\xd6d\\xb1\\xfe,\\xddv\\xd4\\x12\\x92\\x8bx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xc3\\xb7\\xee8\\x07\\xe9\\xfdun|\\xf1\\x04a\\x85\\xf9\\x9e\\x8f\\xfc\\xd6\\xf4\\x86\\xceu\\xaadr*o\\x0f\\xa3\\xf2\\x17\\xc7\\x92\\xd05m\\xfb\\x93\\xa9\\x9a&\\xc6\\xc3\\x86\\xe2\\x1dv\\xe8\\xd0\\x9b\n\\x10\\xb2\\x86bjs\\x84\\x1b0\\xfcw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xdam3m\\x11\\x8b\\xbb8\\xaa\\x17\\xd4\\xea\\x1f`\\x12\\xee\\xd0\\xf1\\xc6\\x10l\\xae\\x88\\xe1y\\x86\\xfa\\xb6\\xc2\\x10\\x8c\\x13dl7\\x140\\x18,\r\\x15h\\xb8\\xe2\\x96e"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x03\\x80\"\\x93k\\xcfd\\x866?|e\\x00|\\xee\\xd5s\\xc7\\xc9y_\\x96f\\x92m\\xd2\\xb1\\x82\\xc2`m~\\xf8/t\\x9e\\xbe\\x93x\\xecm\\xc7-\\xc4=\\xe5\\xb8\\x98bd\t\\xad\\xdc\\x931\\x14\\xa5\\xa6coy\\xf6\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f\\x7f5\"\\x13\\xdc\\x85\\x8fy\\xb6l.\\x9e^'g\\xe5\\xe9\\x9d\\xc1w\\x1bi\\xe9\\xa4\\xef\\x8bu\\xeaq\\\\x07>n\\x172m\\xf4iku(\\xf6\\x12\\xe4\\xb4\\xaae"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\x8aa*\\x9d\"(p\\xa9\\xb4f=\\xed\\xae\\xd1\\x8f\\xd3j\\x9a\\xac)\\xd0\\x93q\\xfb2\\xc9.';\\xb8\\xe82\\xd4\\x1b\\xb4\"\\xf6k\\x05\\xac\\x07\\xc9\\x04h~\\x1d;\\xad\\xf0\\x11\\xd1\\x98\\x06\\xc1\\x019^\\xe0\\xb3\\xd63h\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\x810\\xaf=\\x81kb\\xf6\\xde\\t6u\\xb3@\\xb0@\\xc60\\xaf*f\\xae\\xac\\xd5\\x90\\xe0\\xa8\\x8e(\\x16\\xe3\\xc4\\xfd\\x9e\\x90\\xaa\\xe3\\xfc\\xaa\\xc0\\xf18f\\xb9\"k"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95q\\xfa2\\xa4\\x86\\xea \\xc8 \\x0bp\\x05\\xe56.x\\x1a\\xd7_\\x9f\\xc0\\x1b\\/\\xee\\xde\\x1cqt\\x84-r\\x1d\\x8d\\x19\\xea\\xe5#\\x10\\xeaf\\xc5>\\xc0\\xcb\\x19\\xb1*\\x9f\\xf1\\xc8\\xb0\\x92\\x86\\x99\nd5\\xc7jzu~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2/zv\\xaa\\xddb\\xd0n\\x97pu\\xab\\x9d*t\\xa5\\x92\\x12m\\x8b\\xb9k\\xb5\\xe2ryp\\x0bq\\xcd\\x0f>9\\xda\\xb4\\xc1\\x9az9\\x80\\xbf\\xa0\\xab\\x11.\\n"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12@+\\xc0_'\\xa4\\x1d\\x12\\xead\\xf8\\xf3\\xe8\\x88\\xe5h\\x9c\\xc7\\x8e94\\xcc\\xcf\\x8e\\xa7a\\xfbz\\xebe\\xe5\\x10%#\\xcf\\xc7\\xa3\\xbb\\xfc\\xbc\\x15xjxe\r\\xca\\xfc\\xe5\\x95\\xce\\xda\\xe9\\xf6\\x8e\\x05-\\xf3'\\xda\\xc2\\x10\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xf6eq\\xb5\\xfc\\xd2(\\x9d\\x9c'\"m\\x99\\xa3\\xfc\\x17\\x03\\xd5\\x90l\\x82y\\xd9\\x00\\x9a\\x1d\\x92\\xfe\\xd1\\xc5-\\x8d\\x0fze\\xbe;~-\\x00*\"\\xf9>\\xfe_\\xb3"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\xbe%\\xce\\xc8.\\xbdc\\xf6\\xd7d\\x17s\\xad\\xa6\\xd4\\x03\\x9e\\x08%r\\xe72\\x87\\x0e\\x82\\x909\\xe7\\x93\\x7f\\x97\\x7f\\x0bl\\xdf\\xbe\\x16\\xcaj\\xcf\\xe2\\xf6\\x14\\xd6a\\xe87b\\xb6\\xe0\\xc73v\\xca\\x88@p8\\xad0:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9g\\x12<\\x9b\\x92\\x9d\\x04m\\xb4\\x99\\x9e\\x10\\xb8\\xfb;\\xe05^\\xc3\\x95\\xe0\\x17\\x02k\\x14vf\\xc8y\\x15\\xf7t\\xf8\\xff$\\xb0\\x8f-,\\xc6w\\xf6\\xa9\\xbb\\xe5\\x9b<"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\x9e\\xa3\\xf5\\x1d\\xb1\\x8cwxx\\xc2\\xf3\\x1b\\x19pb\\x83\\x1f\\x99b\\xa6\\xfd\\xbdc\\x8c\\xde\\xb56\\xdcxb\\xb1x\\x0f\\x12\\xfa\\x11\\xd8\\xc8m\\x1ay\\xf0l(;\\xcf\\x11\\xb8>\\x19\\xe5\\xb1\\xc8\\xf2i\\xa7\\x0e55\\x0c\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\x04\\xd6\\xb9\\x1f\\xbe\\xc4\\x07of\\x935\\x07\\x7f\\xac\\xec\\xe3\\xd8\\xbd\\xc8\\x8a\\x95l\\x90\\xc8\\xf1s\\x92\\xd5\\xf5\\xec\\xee\\xff%+\\xa4_\\x14\\xc73\\xbe\\x94s\\x03t\\xc2%"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\xcf\\xc4\\xb7\\xbf\\xa37\\xaa\\xf3\\x93?\\x8f\\xd9\\x06\\xc1\\x83z\\xd0\\x8c\\xd8xw\\x8bz\\x87\\x01\\xf6\\xcd\\x18\\xc7\\x8a!\\x18\\xb8\\xce\\xa7\\x9d9\\x8d\\xbb6\\xeb\\x9d\\xfb\\xc2j\\x8b\\xab71\\xa8\\xfe0\\xc5\\x96\\x91\\xa5\\x17\\xc9\\xbc\\x9f\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x04x\\x18\\x92\\x0er\\x8c\\x9b\\x02\\xef\\xfa\\xac\\xc7'\\xfd\\x0b\\x037scpde\\xe0\\x97j\\xd4\\xd1\\xd9\\x14|f9\\xbe\\xde\\x07\\xc0\\xef\\x81\\x9f\\xd6\\xb9\r\\xed4\\xab\\x1a"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xefnn\\xe5\t\\xda#\\x85\\xa6+\\x827\\xc4\\x1b\\x9f\\x94\\x81\\xc5e\\xbb\\x87\\xc9?\\x93\\xae\\xd3ap\\xact\\xcc;\\x90\\xc3\\xd2\\xa5_\\x1d\\x12\\xac\\x93\\xb5g\\x94\\xaddgo\\xfbl\\xe6p7;s\\x96s\\xcfj\\xcelf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82wl\\xe4-\\xd7j\\xe3$\\xdc\\xa983\\xee\\xb3\\x19\nq\\x1f\\xf1\\x9c\\xfd\\xbe/\\xc4\\xdey\\xcc\\xbdc\\xd8\\xbd6(\\xed\\x99>\\xd6\\x94\\x81\\xa6\\xd1\\x82\\xb4"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\xc71\\x90\\x04ca\\xd5\\x9f(\\xc5\\xf0\\x85e0\\xb4\\xac\\xcd\\x84\\xf0_\\xf1\\xee|3n+@1\\x97!q\\x94\\x85e_\\xc2j\\xb4\\xcb\\xba\\xa0q\\xdb\\x88\\x06\\x1f\\x98k\\x1b\"o\\x08\\xce\\xa4<.\\xda\\xd4yrq_\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2zz\\xb3\\xde\t\\xc8\\xd9\\xa3pl6uc\\xaf\\xcc\\x1c0\\xf2.0y\\xa3\\x01\\xb7\\xc1\\x87#\\\\xfc\\xae\\x8c\\xd4\\x1fz\\x11.\\x9c)y\\x86\\xb8\\x880v\\xccv"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc08;:-\\xf7\\x87\\xd4\\xa6\\xa3\\xca$\\xca\\xf2\\xf4\\xe8\\xb6\\xaf\\xf4\\xb9g\\x96\\xdf\\x92\\xcb\\x0e\\xc6o\\x1ft\\xf4\\x84\\xd8\\xc3\\xaa\\xae\\x0c\\x02\\xa5\\x04\\x97\\xa8\\xb86z\t\\xd6~\\x80;\\xc6s\\xa7\\xdb\\xbf=dg\r\\xd9(\\xfbt\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\x02\\xf4\\x97\\xb4\\x80\\xd0\\xea\\x1f\\xef\\xa5n%\\xda\\x8a\\xd2\\xe5@\\xc8$\\xe9\\x87\\xcds1eh6m\\xd0y\\xc8\\x97\\x12\\x89\\xd355\\x80\\xf6\\x0fd\\xf6uo\\xccj\\x90"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\wc\\xd4\\xa0\\xd1\\xcc\\x8d\\x9cm\\xba\\xbfohk\\xb37\\xae\\x93\\xf94\\xf6\\xe66\\xfb\\xa7\\xc0aqt\\x9d\\xe3\\xb7\\xf7\\xcc\\x00\\x8e\\xc6\\x84q1_2\\x1d\\xcc\\xc7\\xb9\\xd6m\\xddb\\x96\\x9a\\xa1\\xc4\\x8d\\xb2\\xed\\x9a?\\x9d\\xe2\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\x00m\\x00a'w\\x17vdx\\x97\\x06=\\x1c\\xf8\\x9a\\x85\\x89\\x11\\jpgs\\x9a#/\\xb6\\x81\\x1bm\r0y\\xcc\\xc2t.\\xf9\\xc7g\\x9c\\xcd3\\x17k"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\xd8\\xb4\\xfd\\x99\\xea\\x0b\\xde\\xcc\\xf8).\\xef\\xd4\\xb3\\xa6i\\xdaj\\xf16\n\\xbc\\xba/\\xce\\x8fm:\\xe6~\\xd4\\x95\\x8b\\xc3g\\xe5)\\xdbv\\xee-\\x87\\x91\\xdb\\x1b\\xac>).\\xd0\\x01o\\xfe\\xaa\\xe7*\\xdca\\xadr\\x91\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xdb\\xaay7\\xdc\\xa4b\\x86\\x17\\xab\\x02\\xb3^!n\\xd0h\\xaa\\xd5\\xf6\\xce;|`\\xb6\\xb18\\xf9\\x1eo\\xf1\\xfa\\xaa\\xca\\x18\\xf5\\x86z\\x1dt6\\x9b\\x81\\x11w\\xc1\\xbf"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xb37\\xba+\\x15\\xdc\\x14'\\xb7\\xab\\xf1l\\xe1\\xe1\\xf8\\xcb%\\xc21\\xeb\\xf1-\\xe1\\xb3\\xc7\\x00\\xc8g\\x10\\xc5w\\x8ba\\xb41\\x13?\\xf8\\x0e:`\\xfd/\\xb0&0\\x8b\\xa8\\xd8\\x14\\xde\\xaa\\x8f\\x96\\x12z\\xa0\\xe8\\xce,\\xd7\\x84\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\xef\\xd9\\xa9.hs\\xdc\\xe1\\xb4\\x07\\xb8\\x83\\x1dcz\\x01eo(\\xe9\\x08\\xef\\xac\\xb2\\x86\\x11j+\\x03\\xb0\\xdb\\x0c\\xc2\\x8ah!o\\x92o\\xf7-:*\\xd0nj"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xdcg\\xa72\\xc6\\xcd\\xf2\\x0c\\xcc\\x0e\\x80?\"d\\xd8\rsp\\xa21km\\xcd\\xa7\\xfd w\\xd4z\\xb7fl\\xf9\\xa7n\\xdb\\xcb\\xa9\\xe5y\\xff\\xa7\\xa6\\x93\\xbe\\x16\\x8ej\\x13\\x93\\xf5\\xe1\\x05\\x8c?d=\\xf0\\xc1\\x89\\xeb,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2d\\xe3\\xc7\\xe2\\x82\\xbey\\xfc\\xa8v\\x9c~\\x81|\\xf4f\\x92q\\xf3~\\x043\\x88\\xc7\\x855\\xde\\x92y)\\x8e\\xae\\xd1\\xf1b\\x13\\xb8q\\x86\\xd7\\x89\\xa4\\xa3\\x8c"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\x92\\xa0\\xd8\\x81\\xce\\xee\\xb1\\xac\\x8bvm\\xf4<\\xad\\xdd\\xa2\\x99\\x04\\x9b\\xc0\\xd1o\\xef\\xde\\xed;(\\xa4\\xa6\\xa5\\x00\\x11'*9\\x9b\\xfd:\\x95v@\\xb0\\x86\\xd1\\xc3\\x07\\x02\\x1c\\xa2\\xac\\xb9i\\xc8v\\xe7\\x17r\\xaa2\\x8cc\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xd8c\\x84p4\\x11\\x86\\xbd\\x15|#:p\t\\x95\\x04\\x98ju\\x0e:\\xcf\\x14\\x0f\\xc0'\\x92\\xebd\\x19j?2\\xb7\\xec\\x9a\\xdc\\x99\"\\x8f\\xca\\9\\x8en\\xad\\x17"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d\\x85\\xdb\\xc0 \\xce;.4a\\xf1\\x0b\\x8a_abu\\xba\\xf3\\xf5\\xa2r\\xd5.\\xbcj\\xa7\\x92\\xe7\\xea\\x8e'\\x1chpei\\xd0rs\\x00p\\xd1\\xb4@ip%\\xea\\x17\\xa87\\xec\\xcdy\\xc8<\\xab\\xef)\\xc6f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1=\\x1d\\xf1\\xaai3\\x0byc\\x1c\\x0e\\x9c\\xee\\x1fk\t/l\\x80\\x9a9\\x1b~\\x03\t\\xae\\x7f&\\x94\\xd1\\xfck@\\x8b\\x1d\\xcbj*\\x92\\xa5\\x0b\\xad\\xec5\ta\\xf4"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xbehv\\x18%\\x7f\\x8c\\xc0\\x820pe.\\x97\"<\\xf0\\x82\\x0ef\\xbbm\\xedu\\x84\\xd6\\xfe\\xa3\\xcf\\xbfu\\xf3\\x98\\x11\\x0f\\xa6i\\x97o~3\\xd7\\xba\\x19\\xa7\\x15\\xc8\\xb1q\\xb5>\\xb6\\xec\\x12\\xd1hv\\xd8\\x1c\\x88\\xe9\\xc6,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0cw\\x19\\x84\\xda@\\x96\t\\xcc\\xc1\\xf0q\\xa2\\xe9\\xe3\\xea\\xea%gr\\x97\\xc9\\xc8\\x04\\x91\\xaa\\xc7\\xef\\x9em\\x1a\\xb1zxe\\x95\\xe5\\x9e9@\\x93c%\\xae\\x10l\\x9f\\xb9"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6=\\x88\\xb7\\xa8e\\x1a\\x9d\\xf3\\xf8t\\xd4+g\\x7fv\\xd4\\x9d\\xa0\\xcc\\x14 \\xb7\\xc3r8>$\\xb2+hcjgf4\\xf9\\xbd\\xb9\\xe8u\\xd1\\xba\\x0ff/\\x8b\\x10d\\xd0\\xef\\xeah\\xf8\\x01\\xd9\\x99-3\\xf5\\x94\\xc6\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\x89\\xa4m\\x99\\xa2\\xe8y\\x94hfr_\\xf6t<v^\\xaed\\xbct\\xe4i\\xdf\\x0e\\xb9\\xcd\\xd5_o\\xc3\\xd1`\\xb8\\x02nag\\xaa\\xb6!\\x12\\x1b\\x86g\\xa7"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2n\\x02n:'\\xd51\\x07\\x88\\x92\\xa3t_\\xab\\x014\\xe66k\\xde\\x99?\\xed\\x85\\x97\\xf3\\xd3\\xbew\\xf5\\xd4\\x16\\xeb\\x96\\xa2\\x07\\x978\n\\xb9_q\t\\x9a&\\xd1\\x01\\xab\\x1b.4i; x\\x03e\\xf3\\x91\\x92\\xce\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xaf\\x8e\\xf3\\xd8$y\\x95\\x19\\xae\\xf4n\\xd4\\xe7i\\x85\\xbe|\\xce\\x9b\\xafl.n\\xb1\\xac\\x14\\xbb\\xe7\\xa3u\\xae\\xeb\\x9f/\\xc1\\x10x\\x97\n\\xd8\\xee\\x98z\\xafy"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_a\\xed;\\xf2\\xae\\xb5s\\xd29\\xfd\\x96\\xa6\n\\x03\\xd7|\\x9a\\xa7\\xcd$\\xb3\\xd1(\\x17b\\xc9\\x96l\\x90-\\x13\\xa9\\x1d7v\\x16%\\xd4\\x1b\\x0c\\xcf\\xcehy\\x0cm\\xcdi\\xb4\\xff\\xaf\\xf3b\\x7f\\xfej\\xfb\\xfd-\\xc8\\x0e\\xd4\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\x0b\\xc1\\x84l\\xca^n\\x8e\\xed\\xda\\xdc\\x0f\\xb3h\\xf83_\\x8b%\\x7f@\\xfb\\x8d5\\x1c8\\xe7\\x18\\xa4\\xf4\\xdc\\x1f\\xb6n\\xd1<\\x97b\\xcd<z\\xda!\\x8al\\x8a\\xe9"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t^\\xe5\\x03\\xde\\x1b\\x08\\xc0\\xb6\\\\xb3\\xf8\\xcd\\xcb\\xa3\\xa5\\xd1\\x1d\\xf7ge\\xa0\\xb5\\xb49\\xcah\\xf3\\xa5\\x1c\\xd2b/\\x1c\\xbbe\\x00k\\xa1 \\xeb\\xd2\\xaed\\x19\\xa9\\x81\\x9d\\x1c:\\xdfn\\xd7\\x08\\xf4<#\\xdc\\xc4\\x00\\xbfr,d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\xce\\x80kbz\\xe9\\xbd>7\\x01\\xdf\\x93*\\xf9\\xad\\xac\\x00\\xa4\\x1d\\xbd\\x06\t\\xef\\xae\\xfey\\xe6\\x96\r\\xe3o\\xdfx\\xbc\\x9e\\xd0=\\x0e\\x85e_\\xa2\\xb7\\xf9e\\xbdu"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\xe4\\x11\\xd5uh\\xb6\\xca\\xcb\\xcep,:&\\x13\\^\\xc9z\\xdf\\x80t\\x8d,\\x16\\xc4<\\x9c\\xf8r\\xec\\xcdf\\xd21\\x00\\x02\\xa5\\x1d\\x9b\\xba\\xd5\\x8eab@i\\xc8\\xb2y$9\\xa5a\\xa8:\\xd0v\\xaa\\xf6\\xba\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa0\\xba*\\xcbq\\x13\\xc3\\xbf\r(\\x93\\x9c\\x04\\xc8\\x08647\\x15g!$\\xa9x\\x87\\x86x\\x99\\xb0\\xb5\\xee6b<\\x87\\x15\\xe4\\xd2\\x1d\"\\x97\\xb3w\\xd1\\x92\\xd0)j"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0fk8\\xe5\\xf2\\xee\\xc70\\x90\\xc0\\xa0a^in\\xce\\xdb\\x14\\xe0a!\\xf2)\\x05tw94`x\\x16\\xba\\xb1v\\x16\\x8e\\xf4\\xc4\\xb6\\x9f\\xed\\xf4(\\x10\\xc8\\xd6\\xc6\\xf4\\x11\\xd6kd\\xdaj\\xcf\\x9e\\xd7\\xe7\\xeb#@s\\xe8\\xa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\xcba\\xb3\\xc1\",7tu\\x14iq\t04\\xaf\\xdd\\xe2\\x1dk79\\xc8\\x1cz\\x98\"\\xc2\\x07\\x19\\xcf\\xd8%m\\xae\\x93\\x1ff\\xe3\\x95\\xcd\\xd3dh\\xd6f"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xd5\\xe7,\\xd8\\xc7\\x9e\\xe2\\x89\\xce\\xdeh\\xfb\\xa5\\x0bs\\x83w\\xc2f\\x11\\xd0\\xc5\\xa9y\\xf6\\xad\\x9e\\xddl\\x98f?\n\\x95\\xc5c\\x11\\xe5*\\xa9\\xb2\\xda\\xd8$\\xacl\\xbc\\xce^\\xd4\\xf9l\\x158\\xf7\\xe3\\x18!\\x80bzi\\xd2\\x7f\\xb2=\\xdeu.n$fv\\xa8\\xd633\\xbbtk\thk\\xa9\\xc1o\\xd1\\xe62a\\x0c\\x9fi\\x02\\xb1\\x07\\xa5\\x00\\xd2x\\xa3\\xb9\\x04\\x06\\xf5\\x7f\\xa2\\xb0\\xa70\\xb9\\x8c)\\x0b\\xfc\\xb0p\\x10,x\\xba\\x98\\xc6\\x16\\xa3\\xca\\xc2o^\\xc8\\xb5\\xa5\\xcd\\x8aw@\\xc1\\xbfj\\xfcx\\xd3\\x04\\x81\ruy\\xc2\\x0e\\x96\\x12\\x8egp\\x87'\\xba\\x128\\xee\\xd1\\xde\\x97\\xf8\\x8e\\xe0\\xa4\\xe3\\xbcl\\xbc\\x81\\xd6\\x1ais\\x93\\xee-\\xb8.\\xd0paw,0^\\x88*\\xdd\\x97\\xfb\\x8a\\xe37y\\xe3\\xd4\\xac\\w\\xd4\\x1a\\xe0\\x1c8%\\x0fe%\\xa9\\xb2\\x1c\\xdfo\\xae\\x03\\xb8\\x8923g\\xc3-\\xd2`\\xd5\\xc2\\x8ak_\\x17\\x98\\xc093a\\xeaw\\xf3|\\xf0\\x82rd\\x82"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u3+\\xd3y`\\xc3\\xc8\\x80\\x8f\\xea\\xe0\\xc7\\xd1kb\\xd3\\xc0\\x14\\x9a\\xdca\\x1c'\\x1fq\\x82**\\xe0(\\x95\r\\xddf\\x9e_h\\xf1rq\\x9c\\xe6|n\\xb6\\xe3\\x92\\x05(\\xf8\\xc4\\xa1\\x96\\xd9\\xfdxr\\xe7ms\\x93\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\xa8\\xa0i\\x8ej2@\\x04\\x10\\x90\\xad\\x1dr\\x87\\xd0e\\x82\\xe4:\\x8cum\\xc5z\\x1e\\x16\\xb9\\x10\\x96\\xc6\\xdf\\xef*\\x9d\\xcc^\\xb5u!1\\xdem\\x0f\\x1a\\xc0\\xa7\\xde"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\xa7\\x8e\t\\x86y\\xb6\\xc3p\\xa3\\x91\\xb5g\\xfdj\\xf6\\x11\\xabh2\\x94\\xc5\\x07\\xf9\\xaa\\xf0\\x83\\xe9\"\\xd6\\x98gw@@_\\xcf\\xd6\\x16\\xbf<\\xb6(z\\xd5p\\xd8\\xf1!\\xael\\xad\\xc0\\xe3ytg)\\xd0\r\\x0f\\xf0\\xe0w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\xde\\x89\\x1ct\\xa1\\xb0\\xb3\\x9f\\x9br-\\x07\\xf4\\xdb\\xd0\\xd8k3\\xeapp\"4aw\\x94\\x17\\x0e\\x83\\x07\\x90\\xd4\\x9a,\\xfb\\x84%\\xc6'o\\xfa5\\x91\\xd2\\xef"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7>\\xf08+\\xa1\\xb6\\x8b\\xb81\\x93\\x10\\x11a^\\xea\\x9e\\xa5ir\\xdeh\\xd5\\x15_\\x12;\\x82\\x90\\xa4\\x80xt\\xfe\\x18~\\x14w\\xa9\\xb3\\xc2y0\\x88\\xfbd\\x1boy\\x1b$r3n\\x0c\\x8d\\x10y\\xb5tt\\x1a\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c9\\xdb\\xbe\\x92ql\\xb9\\xcc\\x0e\\x07\\x97\\x02 \\xaa\\xc2\\xf4\\xe6\\xa5\\x1a\\xc4d\\xfa-\\x04\\x95k\\xcf\\xa5\\\\xce5z\\xbd\\xd5j\\xc6a\\x8c\\xae\\x80\\xda\\xb9sp\\xaf\\xde"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97q_\\xa8u0\\xd5+\\xa5l\\x81\\x86\\xd0\\xec7\\xdb\\xb9+\\x06\\x8f\\xf1\\xc6\\x97y\\xb7\\x98\\\\xdf\\xd8\"\\xb0\\xaf\\xfb\\xd7\\xd0t\\x95u`\\xd2\\x8e\":n\\x9asyo\\x8eb\\xa1'p\\xe0\\x0b\\x1b\\xe6r\\x0f\\xc8v->\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xb3\\xb0\\xe4\\xd4\\xa4w\\x08|\\xd0\\x87\\xea\"\\x03y\\x0b\\xe7\\x1a\\x12\\xa9\\x8ff`\\x84\\xf1\\xe7\\xe99\\xab1\\x01\\xf4\\xb6\\x01m\\xe4\\x04\\xdd\\x8d\\x9b\\x8am\\xf6\\xb4\\x8a5\\xc8"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\x9f\\x9a\\xcew\\x8epwl\\xd1\\xe4\\xe8\\xfa\\xd9r\\xf0q\\xd9\\x96\\xfc\\xe4\\xbdm\\x03\\x98\\x18\\xf9\\xa5`\\xd4\\x80\\x8d\\xca\\xb1\\x9d\\xaf\\x12\\x97\\x90\\x85j\\x91\\xa3\\xecs\\xf8\\xf9\\x18b9\\x93\\x1a\\x1au\\x9b\\x96\\xa4\\x93\\xcat.\\xde\\xd8\\x9b\\xf0\\xab/\\x84\\xb4\\x9d\\x0b\\xefh9\\x03\\xcb\\x05\n\\xcc\\x8f\\xa2d(o\\xed\\x16\\xfe\\x10\\xfb@r\\xe9y\\x9c\\xf3\\xc5r\\xb3\\xc3\\x042\\x1e\"\\xb4)?\\x1cr!.a.\\xe8s\\x91\\xbe\\x9c\\xeb\\xf7\\x93\\xf7/\\xbb\\x9aic\\xe3\\xc6\\xec\\xdd\\xf9re\\x9fn\\xc4\\x95\\xcf\\x94x\\xc6i\\xa2u\\xf2\\x05mj\\xf5q\\x1b\\x1e$\\xeb\\x928g\\xa7fm(\\xbb\"\\x9f\\xb6\\x86\\xc5\\xbf\\xf9\\xf9\\xaf\\xbfe\\xb1\\x85k\\xbc\\x13\\xd3 \\xc8\\x0c\\x18n\\xdd\\xb5\\x1a\\xa1\\x06j\\xc5\\xf07\\xb7mj\\xc6\\x1e\\xd2\\x1c\\xa2\\xc5\\x1e\\x1e\\x04\\xa2&s0w60\\x85\\xec\\xcc\\x8d\\xf40\\x88\\xa5\\xc4\\xf04\\x7f\\x90\\xd3\\x8a\\x8b`\\xaem\\x8f\\xa2\\xa6;\\xd0\\xc4\\xd6\\xc4\\x0b\\xfe\\xe4\\xae\\xff\\xa2n\\xbcv"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\rm\\xde\\xd0j\\x1d\\xec'\\xa6\\xcdp\\xd3#p\\x1a-\\xc7jl\\x83c\\xb0\\x01\\xeafe\\xece\\x91\\xe2&\\x9b\\x90\\x9e\\x86?\\xb1e\\x7f\\xa9l_\\xc0\\xcd\\xdc)\\xb5\\x93\\x1b\\x81\\xc0p\\x82\\xef:\\x9a*\\xd9\\x9f\\xe1f\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc\\xa6\\xb6\\x8a\\xc5\\x024\\x9b\\x8b\\xcc\\xcb\\xa0\\xbeh\\x1cqm+eq\\xd7cdgw*\\x93r\\xf5^\\xcacf\\x93\\xa2m\\xd9\\x82\\xe3\\x9d\\xbd\\xccf\\xeb\\x05\\x0cx\\x99"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8\\xf5\\xe0s\\xc2\\xf3;q\\x11\\xa4\\x8e\\xccksc\td\\xad_/\\xd0\\xf2\\xb1\\xb5?\\x92\\xce\\xda#r\\xbbfr\\x94\\xdf+g\\x97mc\\xc5\\xd5\\xaf\\x02\\xa6/\\x93\\xa664@\t+\\xc6%\\xb6\\xb0:vv\\x9a\\x88q\\xc3\\xed?\\xd7\\xac\\x0b\n\\x8f\\xa8z\\x11\\xe36e\\xc9\\x8b\\xb8\\x99\\xea\\xc9v\\xf1\\x7f\\xda\\xee\\x90\\x90djt\\x87\\x930\\xd1\\xfb\\x0e\\x9e\\xbay\\xa4\\xbe\\\\xcf\\x8di\\xe5\\x10\\x96\\xfd-3\\xd2\\x90\\x91r\\x03a\\x10\\x0f\\x11\\xb1\\x88r+x\\x100z\\x17\\x00\\x14\\x1bc\\xe6,\\xb7w\\xa4+w=p\\xa5\\xfb\\x88\\x80.\\xbd\\xc02\\x9cs\\x8ew\\x14 s\\x7f \\xaeem8rn\\xd75w\\xd9\\xdd\\x91!\\xc6u\\xed\\xd8\\x08\\xf6a\\x0b\\xda\\xaf\ny\\x1b\\xba\\xfdq\\xab$\\x1a\\xfe0\\xcbp\\x83\\x05\\xcc!\\x92\\x9ew\\x080\\xdew\\xf7\\xcb\\xacz\\x99\\xce\\xcdc\\xf4\\xfd\\x7f\\xd3\\xa9\\xc3\\x97\\xd8\\x14\\x1ch#\\xcd\\xe9k(\\xfc\\x19a\\x1c\\xe5\\xee\\xb4kuq\\x98r@\\xd2"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf@q\\xdf\\x88\\xff\\xe1v/r\\xb3th\\x13&3g_~&\\xc0\\xa1\\x85\\x9a&x\\xad\\xc4o(\\xe20g\\xe4\\x9d\\xd1\\x06\\xef^\\x85\\xf9\\xc3\\x9885\\x9f\\x13`s\\xd7\\xbd\\x1f\\xd1\\xbd~\\xa34\\x8c6\\xb1\\x1b!q\\xd4\\x9e\\xf0\\xa8n\\xd8\\xd4\\xc2\\xf1\\xbf\\xb1\\xf0.?\\xf3i\\xa1`\\x14\\xf7sw\\xf6\\x02ntm\\xf2\\x9by\\x9c\\x08s\\xb1\\x8fb1;\\x84\\xc3\\x0f\\xab\\x8c\\x19\\xe9\\xbe<\\xbfje\\x88n\\x08\\xac\\xf4\\x8c\\x91\\x94\\xeb\\xee\\xcd\\xf2!\\x1ct\\x98\\x8dy\\xaa2f\\x18\\xcb\\xca\\xb1v\\x05\\x03tl\\x04\\xe2\\x01ne0(6o\\x1e\\xa0\\xde\\x11\\xdb\\xb6\\x13\\x93~\\i9\\xa6\\x039\\x07i\\xc5\\x02\\x8akh\\xad\\x12\\xb0\\xe1vb\\xca_\\xbc\\xc0hs\\x9c\\x03\\x8b\\xfc&\\xf0\\xd5~\\x0b\\x87\\xe7\\xc9\\x03\\xdf\\xf6\\xe7\\xa0\\\\xe7\\xc58^\\x0b\\xc8\\xa6\\xe4\\xdc`\\x184\\xd7\\xa3\\x9c\\xa8 \\xb9\\xf1\\xb4c\\xd9\\x8f\\x82~u\\xcd\\xfa\\xb0\\xab\\xe9j\\x86\\xb2k8%\n\\x1fm\\xf9m/\\xd3\\x14"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3\\x1a6x\\xd4\\x91&\\x9ar\\x9b\\xaba\\x80\\xd3\\xc9\\x87j\\x91/\\x81\\xbd\\xb2\\xcf\\xac\\x06\\x91\\xde\\xd1\\xebhug\\xb4\\x1f\\xc9\\x97\\x7f\\xf0?p\\x93\\xf5\\xd6y\\xfa\\xb3\\xfe\\xb0\"s\\x9cw\\xa2\\xeb\\x02\\xf8\\xe8\\xc4\\xad\\xac\\x06\\xd5\\xed\\xe2jm\\x16\\xddv\\xc0\\xf6\\xc4\\xc2e z#\\x82\\xd8\\x86\\x86|\\x918\\xa7\\xee\\xfc\\xf7of\n~#\\xb2\\x99b2\\xc9\"\\xd5\\x88\\x04l\\xbf)d\\xd6\\x0b\\xa7)(\\xce\\xda\\xe6\\xb8\\x8e\\x04m@\\x9ey\\x83\\x90\\x9a\\xd4\\x15\\x87\\x8f\\x7fbi\\xc1^q\\x1dn\\x9e\\x9c\\x03lkk\\xa2hk\\xdd\\x12\\x08\\xad\\x8a\\xe8\\xba\\xd1\\xa3\\xd1\\xa7\\x0f\\xa1\\xffz\\xeb\n\\xac\\x12\\xef\\xea\\x1d\\xf9h,h\\x1c7\\xe4\\xb6\\xf9oz\\x16\\x1b\\x96\\xe61n\\x1b\\x13\\x90\\$l\\x96a\\x97\\xbf\\xa8n\\xa8,\\xbd\\xd3\\x99\\x87\\xb3v\\xe8\\xa2>\\xfem\\xdc\\xcc\\xa1\\x0ebv\\xb0\\xed\\x03&\\x15+:\\xa9\\xa1v\\x81\\xc1s\\xf8\\xa1e\\x05\\x00\\x97b\\x1a4s\\xe8\\x9f\\x8c\\x89\\xec\\xcb\\xe0\\x1c\\x95\\xd3"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfb\\xf3~kj\\x01\\x1a4\\xbc \\xc7\\xdc\\x8dw\\xd4\\xcd\\xc3\\x864\\x0e \\\\x87\\x1b\"\\x8eq\\x80\\x8d\\xad\\x92q\\xdfa\\x97\\x9c_oxm\\xb0\\xde\\xce\\x84p\\xe3\\xc1\\x03nx'\\xcd\\xcdpqzs\\\\xceb\\x7f\\xcf\\xf1p\\xcfe\\x8d\\x96\\xe3q\\xd4\\xf1\ngr\\xce\\xe8*\\x873\\x125$y\\xf32#\\x14\\x15\\x91\\x1d\\xef\\xa7\\x08\\x07\\xed\\xd9\\xc0\\xd1\\xaae\\xad\\x81\\x9c\\xca\\xcavrj\\xc8\\x16\\xd4g\\x94xc\\xdc\\xae\\xe2x\\x81\\xc0m\\xce\\xb6a a\\xc7\\xc9dm\\xc8\\xf7\\xfb\\xb2\\xe1\\x81\\x05t\\xd5%\\x04;\\xb6\\x89\\x11\\x89\\x05\\x9d\\xe1\\x94\\xb3~\\x9ci\\xff\\xb0h\\x06\t\\x9bz\\xd6p\nr\\x13;\\x1b\\xd8\\xa77$\\xc5\\xa6mul\\xb5\\xec\\x85\\x12\\x06\\x11\\x02\\xbd\\xbf#\\xbeo\\xee\\xd1\\xa7\\x1fk/+\\xc4\\x9dq\\xaa\\x1f\\x06lb\\x14\\xe3z\\xb1\\xec\\xff\\xe8\\xcf>h\\xc2\\xfes8\\xcfa\\xbd\\xa9ry?\\xcc\\xd3c\\xe2\\x07\\xaci)\\xd1\\xdf\\xe2\\x18\\xd2m\\x84\\xb5\\xcf\\xac\\xc9v\\xda\\x81\\xa7,"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2\n\\x80y\\x8dv\\xde;\\xcb^k\\xabl\\xf5\\xa3\\xb96ria\\xb1\\xbf$\\xb3\\x7f\\xe9zl\\x08\\xf5\t\\xc6\\x81\\x86\\xa6\\xaa'\\x19\\x97f\\xb3\\x0e\\x81\\xcc\\x15\\x855-\\xdf\\x01c\\xb2\\xe4t\\xbf\\xcc\\xa6e\n\\xa4\\xd9x\\xe8\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\nd\\xe0\\xd9\\xc8i\\xd5\\x94e\\xa8\\xdc\\x07\\x1e\\xe5\\xfdc\\xae\\xa9\\xd2\\x964t`n\\xaf\\xe4\\x80\\xa4\\x96\\xf1e\\xcee\\xec\\x06\\x925\\xf7\\xe9\\x1ef\\xb4\\xc4\\x8c\\x97"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbef\\x8fbh+\tlr\\xbe\\x13\\xa3\\xdd\\xbc-\\xd9a\\xefl\\x19\\xba\\xa8 \\x83,g\\xdd \\xf02\\x11s\\x90c\\x96\\xe7h\\xc0\\x01\\x0b\\xf4\\xa7\r\r\\xd9\\x15\\xad\\x1e0\\xce\\x9d \\xe8/\\xa3_%\\xe1\\xb19\\x90j\\xaa;\\xcemdy\\x10<\\x10\\x81vtla\\xc6\\x02\\xbb\\xb4\\xd5\\xc9\\\\xb9m\\xf4\\x86\\xd8*g\\xedib\\xc4@a\\xd0q\\x02`\\xeeo\\xcff\\xc7\\xba<e\\xd9p+\\xc4\\x9c\\x02\\xb6\\x08@\\x03\\xf4\\xe9\\xf7?|\\x1e\\x8f\\x86d\\xb6\\x16\\x99nf\\xd7\\xfc\\x18\\xa30zqu\\xd7b\\xf4\\x1c\\xa9\\x94\\xb1g\\xc7\\x14\\xa0\\x1f\\xfes\\xd8|\\x0e\\xde\\xafq\\xe1\\x03z\\x1ex'y\\x84\\xcb\\x88\\xbbk\\xdc\\xfd\\xa2\r\t\\xcd\\x9d\\x08\\xde\\x83$d\\x94\\xccr\\x06\\xac\\xe0\\xd5q\\x083\\xb0\\xe9\\xb5\\xd3o!\\xe1\\xe96\\xc6\\x16\\x8db\t\\xa3\\xee\\xc4\\xb9\\xc4%\\x90\\x08t\\x89\\x83\\x99e\\xc7\\xafz\\x07\\xf3\\xd4\\x06\\x08\\xad\\xa0\\x19\\x1a+\\xed\\xf5?\\x15\\xc3\\xfe\\xda\\x8c\\x90\\x98\\xb7\\xa7\\x07_"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e.o v\\xa1.@\\x84\\x94~\\xc8\\xeb\\x0e\\xa4\\x03c6\\xa4\\xb8\\x1d\\xc77&\\x84y\\xb7\\xa2\\xa3p;\rw\\xb2\\x85\\xc6m)\\xe8ua\\xeb\\xc2=v\\x912w~\\x08\\xfe\\x8fj\\x1fht\\xc3o\\x8cmwp\\x1b\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\x9a\\x00\\xe2h\\xc81\\x1f\\xe8\\xbc\\xcb\\x1eqi\\x04\\x86;\\x8a\\xdd\\xdb\\xb1\\xd4\\xba\\x89\\xc8\\xce\\x89\nxv\\xb6w\\x02\\xad\\xd1\\xa5h!\\xf8\\xc6?\\xec\\x8bc\\x97\\xca\\x8a"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c\\xa1\\xec\\x8bw\\xaf\\x1a\\x8b\\x7f\\xae\\x7f\\xe9\\x8b^\\xc9d\\xa4y\\xd6\\xd2\\x97\\x8d\\xcb:\\xdb\\xd9\\xa3\\x82g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\xa4\\xd3\\xf1\\x0c\\xcai\\xe0\\x975\\x86\\xe0\\xeb\\xe4\\x846\\xbc*\\x93\\xafb\\xffb\\x11i\\xfa\\x9au\\x0e\\x18aa;\\x01\\x89\\xce\\x8a\\xfb*\\xc8\\xfcx84\\xa9>\\xad\\x80\\xc5c\\xde\\xd5\\xd98\\xadb\\x0c\"`\\xb7\\xa0z>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xdc\\x1f\\xfd\\x83\\xc3\\xd4\\x0f\\xaad\\x0c\\x1a\\xcd\\xcf\\x84\\x9f\\xe5\\xa2\\xd6<\\x1e\\xd3c\\x13v&-\\xba\\x1c\\x91#\\xfa\\xe2;\\xff\\x82\\xcf\\xbe\\x1d\\xcc=\\x1a\\x82\\xcdlf\\xce\r"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1\\x84\\xfe\\xfb\\xed'\\x18\\x0c\\x10\\x0c\\xb0\\xd1w\\xc2\\x1d\\xa6\\xc4w\\x18\\xb9\\x0e\\x97\\x81\\xd0g\\xbf\\xa2\\xc7\\x10\\xb1\\xe1\\x93\\xa6l\\xf9\\x0c\\x17\\xa4ktyl\\xf1~s\\xbc\\xaf!x(\\x11\\xc4\\xf7\\xc1\\xc5a\\xf5m\\x82?\r\\xaf\\x92\\xa3\\x8dtc\\x85x\\x11\\xb1\\xfb\\x06~l\\xd5\\x9b\\x80\\xe0\\xf6y\\xc09j\\xbc\\xa99\\x18\\x93\\\\xb4\\xecm\\xcah\\x82\\xf0\\xb7f\\x90w\\x9e\\x7f\\x19\\xb5\\xb9\\x155\\x14\\x84\\xc1\\xa2\\xf6zb;\\x18~i\\x8f:\\xe9\\x1e\\xee\\x8d\\xe2\\xc8hj\\x11\\x05\\xfe\\xe1\\x08c\\x8as\\xa4#\\x1c\\xa6\\xac\\x1a\\xac\\x9b\\xd9\\x88y\\xe7\\xea\\x14z:\\xd7\\xea\\xe6\\x03\\xbct&\\x7f^e%\\x95\\xd7\\x93z\\xc7\\xb6\\x02x*\\xd4\\xcf\n3\\xda\\x1f%e\\xa4\\x92w\\xa3\\x808fu#\\xd2h\\xfb\\xfcua\t\\xcd\\x9bv\\x0e\\x8ces\\xe3/\\xd4\\x1b\\xd6\\xfc\\x18\\xa1\\x89\\xb4\\x99i\\x02\\xe4\n\\x08%\\xa4\\xab%\\xac\\xf72 \\x91\\x0ey\\x962$\\x9bn\\xb1\\e\\xb9\\x02d\\xe8g\r\\xcd\\xd1j"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c\\x1cb-x/#\\xe6b\\xd6\\x97\\x07n\\\\x98r(\\x14\\x91*=4m\\x9a\\xac/\r\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010pf\\x1c\\xdfu\\xe8\\xd7\r\\xae\\x87-\\xf8k'l\\xa4\\x96l\\xd5g~\\xca\\xa8\\x03\\x08\\xb1qq\\x08\\xed\\xb6\\x13\\xe81v\\xb4\\xbed\\xda/\\x88\\xc3\\xf4g\\x0b\\x90\\xb4\\x18\\x10<\\xe0\\x99\\x81b\\xa59\\xf3\\xa3\\x11\\x82\\xaal\\xea\\xde\\x85w\\xa0\\x1erp\\x89\\x86\\x13\\\\xaa\\xf8\\x88ha\\xa1\\xe0\\xcf\\x8e\\x07\\xa7\\x99\\x91a\\xdac\\x02h(y\\xe8\\xa1/\\x12\\xd2\\x81~9\\xe2\\xf2\\xcc\\x1b\\xe0(\\x18\\x91(\\x88qy0\\x98\\x93v\\x0fk\\x08\\xf9\\xb4ezq!\\x9c\\xa2s3\\x83 0\\x14\\x9c\\xfbyr\\x85\\xd8\\xb6\\x1b/\\x89b\\xede'u`~j\\x0e\\xc6kf\\x87x:\\xf7\\x18r9\\xa4\\x85\\xf2\\\\x8d\\xf4\\x15jxg\\x0f\\xa0\\xa1$5\\xc1\\x1e\\xcc\\xe8\\x92\\x8a\\xf5\\x88\\xac\\x7f#\"\\xe2y\\xd2\\xfd\\xe2\\xc2gz\\xfbn3c\\x98\\x07\\x9e6\\x86\\xe8q\\xf1\\xcat\\xad\\xdfg\\xbc\\x1bq\\x04\\x15\\xfb\\x92\\xcb\\xc2\\x08\\xb2\\xfc\\xa8\\x96 \\x95g\\xb9\\x9d\\x95\\x9f\\x1b\\x9d\\xcc\\x98\\xf7\\x07\\xff~"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c%=\\xfe\\xbc\\xe2\\xbc\n\\xae=^\\xccr\"\\xb5\\x92;\\x1b\\xfb\\x0b\\xc9\\xbf\\xf2\\x89\\xc8\\xb8,\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xd39qa\\xect\\x9ba\\xd2\\x13\\xca\\xa0\\x14hit\\x1an\\x02\\xdb\\x1b?f<\\xd7@\\x8e*\\xdf\\xec\\xe0\\xc8\\x9fb.\\xc7h7h\\xa2\\xa9\\xd4\\x0e\\xa6d(u\\x8e!\\xf4d\\xce\\x18\\x13)a#\\x8d\\x83\\xb8'#\\xa4\\xff\\xa6\\xa5\\xaa\\xdc\\x1a\\xe7\\xe8\\xbe\\x0fo\\x92\\x8f\\x91g\\xd6\\x9e\\x9e+`\\xb6\\xbd2\\xdf\\xd3\\xd6\\xe9vv\\xc7\\xafg\\xed\\x15\\x9d5t\\xbav#\\x0e.\\xec@\r\\x1c\\xd7\\x05\\xe1\\x93\\x1d\\x99-\\x7f\\x94\\xbf\\x1d\\xe9\\xbf* \\xab\\x0c\\xa9n\\x8a\\xb5\\xaa\\\\xcd\n$-x\\xd1k\\x92\\xea\\xd4\\xf8\\xbb\\x17\\x96\\x9b\\x83\\x1e\\xcepg\\x04%-\\x963\\xd0z\\x00sm\\xdd\\x0f\\xa0\\x8cx<\\xa3\\xe6z\\xbd\\x05n\\x1d\\xc5\"q1\\xf2\\xe6r\\xf8\\xed\\\\x82\\x11\\x8f\\xcf\\x97\\xaee\\x8b\\x1e\r\\x8e\\x046\\x81\\xa1\\xeb\\x16\\x9bk\\x84\\xc6:q\\x97\\xc8\\xf3ce)x\\x12\\xf3\\x1d*\\xce*\\x08\\xbbb\\xf3;\\x0f\\xf6\\xe2\\xeakb\\x0f\\xdb\\xd7\\x01\\xe8\\xe8/\\xf7\\xf0wu9\\x02\\xaf;\\xc4"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1cp\\xd3~\\xef\\x18\\xc7\\xe9\\xe8\\xe7\\x7f\\xd7\\xa3\\x1f\\xc5\\xc5=pm\\xdb\\x9d\\xe0?\\xff\\xc7\\xb7\\xab\\xf31\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,z\\x9a\\x05\\x90\\x95'$\\x9b)?\\x82b\\x17\\xa3\\xc1s\\xbfb\\xbd@b\\xb9k\\x84\\xd8@b\\xa7\\x1c\\xe8x\\x05y*,\t\\xd5\\xdd\\xb8m\\x82\\x08l\\xdec\\x0c\\xd8\\xf1\\xf3\\x19h\\xc8\\xc5%\\x9c\\x83\\xf5\\xe0a\\xf6\\xdb\\xa0/x\\x81\\xdd\\x81\\x9a\\xb2?\\xde\\xa8-p\\x8e\\xd0\\xc9e<4\\xda\\x969\\xf4o\\xfd\\xf9\\xf4\\xa36\\xc9\\xb9tj\\x1a\\x9eg\\xb7>.d\\xf7\\xa5i\\x98t\\xddp2.\\x9d,o\\x81a\\xa8gj d\\xd7\\xd5\\xc1&\\x7f\\xf2rd\\xc7\\xec,\\xfd\\xdd!\\xe9\\x86v\\xe0\\x8e\\xb95m|\\xca\\x924\\xea\\xfe\\x93\\xe8\\xdc\\xeb\\xf9\\xa1\"\\x13\\xb8\\xd5\\xbb.\\xe1\\xf7\\xf7\\xeb\\xc4\\x1eo\\x102\\xa6\\xc09,\\xb4\\x7f\\xdb\\x9f\\x15\\xd1m c\t\\xd7\\xbf@\\xaa\\x80?\t\\xab\\x03\\xae\tb8\\x9f\\x0e\\x92\\xc9nx\\xfe\\xdc\\xff\\x7fg\\xf4r\\xe8\t>r\\xd6\\xcf\\xb5\t\\x9c\\xb9d\\xda\\x0b?\\xd4\\x1a\\xc3\\xbe8c\\xfe;;\\xf7hq\\x06\\xd1\\xf2\\x9a\\xe5\\\\xc1\\xb5\\x1d\\x98\\xb1"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\xcay6\\x02\\xa7\\xfb\\xc7\\xc9\\xde\\x0bp|\\xe9\\x14\\xe4\\xe5\\x9d\\xd4y\\xe4\\x05\\xfe\\x15n\\x15\\xbd\\x8e\\xa7\\x06\\x07\\xc3\\x0f\\xdch\\xbb\\xc2\\xa4j`\\xbd\\x1d\\x0b\\xa5\\xf8\\x82\\x13#\\xc3p\\xdb=\\x0b\\xfes_r\\xdc%\\xb06&\\xfc\\x1f\\xc5\\x1c?l\\xbd*a\\x86\\xa9\\r\\x1f%i\\xf7al\\xa3y\\x02p\\xce\\xfb+\\x90\\xeeu/!\\xd2ye4\\xc6u#\\x9f\\xde\\xd5e\\xd8\\x91a'\\x16~w\\x89(\\x9f\\xc4(a\\x13w9\\xdd\\xc0:xh-gu\\xd8\\xa8\\xc0\\xb4\\x10\\xaf\\xd5\\xdc\\x86\\xdfe\\x07\\x80@\\xe8.\\xbc\\x0e\\xb1y\t\\x95\\x1d*)\\xc1u\\x81\\xae)\\x05^\\x8e\\xa6\\xd0\\x19t\\x92q?\\xb6\\xc1\\xd2\\xf1\\xca#<c5n\\xefi\ng6\\xe7\\x14a\\x0c\\xc5\\x02\\x89\\xbe^\\xa8\\xd7hn\\xad\\xb7\\x16\\xec\\x16\\xfaa\\xde\\xb6\\x12\\xc2\\x88y\\xdc\\x996l\\xad\\x86\\x80*0\\xc2\\x802\\x0fn\\xa4\\x98\\xd6\\x06\\x1f\\x81\\x1f\\x82\\xac\\x80\\x93k.\\xb4\\xa5\\xc7\no\\xc5\\xd5\\xc7\\xd5\\xf4\\x8c$\\x13"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x1e4\\x8e_\\x80\\x18\\x17\\x1c\\xa3b<s\\x1ed\\xac&\t\\xe6<o\\xa8\\xee\\xb8u\\xcd\\xccj\\xe0\\x8b\\xca,\\x11a\\x96;\\xb2\\xbagjmsz\\xd3\\xa8\\xcc\\xa8\\x1ee\\xb0\\xc4 \\xae\\x00\\x85lnv\\xe3\\xfene,\\xe3\\xb5\\xcd1d7\\xb5\\xde<c\\xb4\\xa8\\x88\\xfao\"\\#\\x06\\x84\\x85d\\xbe\\x130\\x92\\xf7\\x8bn\\xc6dg\\xbe\\x08\\xca!l\\x9d\\xe3r\\x0b\\x85tz\\x91\\xb5\\xc3\\x0b\\x80\\xc0\\xf8\\xff\\x8a\\x07\\xd0\\xde&\\x89\"'v@\\x98\\xe6\\\\xf7r\\x86\\x1a \\xd8;\\x85\\x8cb\\x88\\xa2\\x8d\\xc9\\x07\\x1f\\xb3>\\x832\\x8a\\x84\\xe7\n\\xe3\\xc6\\xd7\\xb3\\x8d\\xf1\\xea\\xa7e\ns\\x1c\\xba\\x99\r^s\\xeb\\x91m\\xcep\\xc8\\xca\\x9e\\xe9\\x8b\\x1a\\xdd\\x1en\\xc1\\x15q\\xdb'\\x02p\\xf9d\\xb1;\\xeb\r\\xc2u#\\xf0c!\\xfe\\x90i\\xc3ud\\xa7\\x05u'o\\x1e\\xec\\xdc\\x1f\\xa1\\xeb\\\\x07\\x96\\xc1\\xcc\\xbd\\xc5\\xe6\\x9a\\x94\\xc8\\x077i\\xc9\\xdf\\xe9\n\\xc4\\xb3\\xcb\\xbc4,\\xff*8"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\x8f`w%\\xfb\\x17e\\xcd\\xc9\\xf5l\\x12|\\xd0\\xe73:k\\xd31\\x01\\xc9zf\\x1e)\\x84;.\\xa8\\xa8x\\x85\\xbf\\xe1\\xc1\\x16m\\xf4\\x10\\x11\\xce\\xcdaya\\x0fk^f\\xdb\\x83\\xd9\\x80y\\xe5\\x98\\xb9\\x1e\\xa9'\\x821\\xe6\\x0b\\xa0\\xcc$\\x9b\\x8dq\\xbb\\xc5f\\xd1.s\\\\xb0j\\x07u\\x98\\xcf&\\xd5\\x0fy\r\\xebgm\\xe8\\xeff\\xec\\x86\\xd0\\x98\\x9c&)\\x16\\x96\\x05\\x861\\xfa\\x92\\xe31\\x00ei)^k\\xb8q\\xef\\x9c\\xbbr\\xf3\\xcfi\\xa8ms<|k\\x90\\x1e\\x89\\x83/@\\x0f\\xda17\\x01\\xb9\\xfeu\\xea/m\\x97\\x96\\xac\\x8c\\xf8\\xb8^\\xe0'\\x80\\x10\tm\\xf0\\xd9\\x1b\\xa7\\xf4\\x11\\xc9\\xc7x\\xec\\xf6\\x07\\x17\\x84\\xdf\\xcd\\x03\nt\\xfa\\xe5$h\\xdb\\xb5\\x92w\\xb0\\xd8\\xd1\\x08k\\x98rdj\\x1f\\x86(yht\\xd8(\\xe3f\\x1c.71(\\x97\\xa4\\xc1\\xa2w\\x95&\\x12\\x8c\\xe7t\\xd2\\xbcd\\xbe\\x08=\\x15\\x1cf\\xd0\\xe4\\x0b,\\x18\\xd8\\xb5\\x86\\x1aj"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`bg\\x07\\\\xd0g\\x89d\\x06\\xf7\\xa43\\xc1jp\\x93\\xbeg\n;\\xe48%\\x19zmg2\\xe4\\x9b\\x90\\xeb=\\x14\\x9a!\\xab\\xb4\\xb8\\xe8\\xd1\\xfd&\\xdf,|0z\\xf1\\xba\\xd6\\x11ev\\x81\\x03\\xca0\\xdbq\\x16\\xc0;\\xa8d\\xc0p\\xa6`q\\xe9\\x0c\\xd7\\x1a\\xd5c\\x93\\x1e\\xcf:m2 \\x14\\xe0d(\\xd7c\\xd5\\xff+\\xb6n\\x05\\xd1\\xb4\\x8dw\\xce\\x80\\xd2\\xf5i\\x14h\\x021\\xa6\\xdb/\\xf6\\xe0\\xc0\\x90|\\x98\\xf2\\xb6\"<\\x9c\\xe9\\x92\\x99_\\xfea<*\\x9c\\xe6\\x82\\xc1is\\xc7\\xc7>g\\x0c\\x92<'g\\x04\\x88\\xbe@b\\x87\\xc7(\\xaf\\x1c\\xe1\\xca\\x0fj\\x8a'\\xe1\\xf4b\\xfc\\xe7i'\\x02u\\x99b\\x8d<\\x01w\\xb3\\xe7\\x13\\xad\\xc7\\xd7\\x02\\x8e6\\x813\\x11ba\\x17\"\\xd9\\xa2\\x96\\xc4/\\x7fc\\xd7\\x02\\xce\\xe2r\\xee2y\\\\xcf\\xc8\\xa3\\xac\\xc73x\\x08\\x1b5\\xa9\\xfcu\\xc1\\x0f\\x9a\\x91\\xc9!?x\\x8a\\xde1\\x08\\xe8\\xdb\\xda\\x90\\xd7-n\\xa8:\\x02\\xe8\\xda\\xa1\\x04c\\xc9"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a%\\xa8\\xeb\\x98\\x8fi\\xcd\\x192\\x9cr\\x07t\\x15\\xaf\\xa2\\xf2\\x022+\\xabb\\xde\\xe4k\\xa3\r\\xc6'm\\x83\\x87\\xa8\\xf5\\x10\\x82\\xbc\\xbey\\xdcs5\\x7f7\\x80\\x96\\x12\\x8d\\xf3\\xad\\x1d\\xcdy\\xed\\xf5\\xc3\\xe2t\\x18\\xa1f\\xe4\\xcf\\xee%%2\\xb8\\x80v)\\x99i\\x81\n\\x88\\xb8g\\xae\\x17\\xf6\\xd5\\xbc\\x1dm\\xdd\\x96q\\x8e\\xfb\\x88;\\xca\\x01o\\xe3\\x90j\\xe5\\xc3\\x95\\xfe\\xf0\\xd2\\x99m\\x10\\xcb\\x91\\xce\\x8c\\x030f\\xf9\\x9f2oa\\xbe\\xb0\\x00\\x8f\\xea\\x16\\xc9\\xf4\\xdc\\xd2\\xa5\\x91\\x01\\xb3\\xca\\xa0ot\\xbc\\x990\\xe0k\\xbfb^h\\xbc\\xa6\\xaf\\xaf\\x08\\xf9\\xab\\x88\\xc0 e\\x87\\xa40\\xe4\\x08\r\\xa2\\x02\\xfa\\x13\\x8c\\xb7\\x83u\\xb0\\x94\\x05/\\xc9\\x19f\\xfa\\x81\\xab\\xc66\\xc2\\\\x1c5\\x1bwe1\\xb9\\xdd\\xed\\x93\\xef5\\x94)\\xcf4h\\xde\\x15\\xb7\\x1b\\x1cp\\xa7b n\t\\x14\\xaf\\xe4\\xe4s\\xa0\\x81\\xe9j9\\xe8\\xa3\\xe1\\x16^j\\xbd\\xd6\\xb8\\xdf\\xc6w?a/w\\xcbrjpr"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08\\xbd\\xd9\\x846r\\xee\\xfc!\\x9d\\x01a\\xc5\\xc4_\\xb7s\\x86u\\xcd\"\\x05\\x13\\x04\\xe6\\xce\\x8d\\xac\\xb2v\\x8d=\\xdd\\xcc\\xa1=<\\x98\\x93\\x0e\\xb5\\xf4\r\\xdf\\xca\\x1dy\\xfc\\xb4\\xb1\\xd2\\xfe<\\xc3\\x0b4\\x89\\x90w\\xd9bs.|;\\x9e\\xa6\\xd5\\x97\\xc6l\\xb9\\xe8o%\\xe5\\xd0)a+dd*\\x93\\xe3x\\xdat\\x05\\xab\\x00r\\xdc\\x9c\\xc1\\xd3\\xd0\\xc6\\xbd\\x15\\x89f\\xbba\\x06\\xec\\xfce\\xa6\\x0bf\\xb9\\xbf\\x0br\\x9c\\xc1\\x90\\x08\\xad\\xd0_otgw\\x8d9\\xee\\xd4q\\xd7\\x8e\\xdc\\x9a\\x17*2\\xac\\xf3\\xe6\t'\\x84\\xdf&\\xee\\x8e\\x99\\x9b\\x1f2\\xe7\\xf2*\\xc3\\xbbc\\xd3\\x98\\x14f\\x9b\\x18j\\xe2'\\xef\\xc2\\xd3\\x88w<u\\x92\ns\\x06s\\xb6\\x92\\xec\\x194$\\xf8\\xae\\xff\\x9a\\x8d\\x96\\xf1\\xdb2\\xcd\\x045+\\xb8\\xa4b\\xf9zxd\\x84_\\x95(x\n\\x0e\\xb4oa\\xf7\\x04(\\x84\\xd2\\x1b\\x87\\xb6\\x16\\xe4\\xf3\\xe3\\x13\\xe7\\x10m\r\\x04\\xf7\\x13\\xea\\xe3\\x0b\\x91e\\x96"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\xf7\\x85\\xc7\\xe9\\xdc\n2\\xe4\\x8f\\xc3\\xb8\\xe2\\x1f\\xe8\\x05\\xc8\\x83\\xf5\\x96\\x93\\xc5\\x0b\\xf9`\\xda\\xca\\x1a\\x8bvbl\\x1d\\xd26\\xae\\x93\\xe2\\xd68\\x1e\\x8b\\xfbe\\x92\\x17\\xdc\\x85\\xee\\\\x96\\x80\\xca\\x07c\\xaf \\xfd\\x82\\x0c0\\xe9\\xff\\x87e\\xfe.\\x9b\\xe6\\xc0\\x93\\x89\\xce\\xae\\xc5\\xafy\\x0c\\xc2x\\x0f\\x05\\x19\\xd7h\\xd9o\\xf2\\x12\\xack\\x87.\\x0b\\x9c3\\xab\\x0c\\xcf\\xd2!\\xe9\\xee~\\xe5\\x80\\x90k\\xd7\\x08\\x17\\x80k2lyj\\xf2\\x83\\x87\\xa5\\xe2-wa\\x1f\\xde\\x9a_\\x11m\\x88\\x15\\xcc|dg\\xb1\\x9e3k\\xee$\\xe8*\\x12\\xef,\\xe5\\xdb\\x0cc\\xa3\\x8e\\xbd3\\xd7\\x84\\xb2\\xb3\\xb7i\\xec\\x117\\x8a\\xe3\\xf9\\x89\\x0bs\\x9d_n\\x92x\\xa8i\\xdd$$\\xfb\\x06\\x9f\\x1b\\x80\\x12\\xab\\xfb\\xc75\\xa9\\xaf\\x985\\xaf\\xfc\\xfd\\xc4\\x9b\\xf9\\xea\\xc4\\xc7h\\x1d\\x84\\xd9|\\xa5\\xc2^\\xeaap\\xb7gm\\xb8\\xb6z\\xf9\\xb6\\xe3\\xd6q\\x9ch\\x00s\\xbc\\xf6@:\\xa1\\x1a^;\\x10q\\x8d5i\\x14\\xe9\\xb5"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#r\\xbc\\x17\\xf6\\\\x8a\t\\x1c\\xfa\\xea\\xe7\\xe0s`\\xa8?\\xd64_\\xeb\\x9c\\x89\\x91(\\x97\\x8e\\xbd\\xa6e\\x89\\x9c$\\xd1.\\xf16\\x9a\\xb2\\xaf\\xe1t\\xdc\\xf8\\xb4\\x06\"\\xfd/\\xba\\xd2\\xd9\\xb0&k\\xf0c\\xae\\x11\\xd2/\\x0c\\xbb3\\xa8\\xfd\\x9e\\x9d\\x8c-v\\x96\\x1d0\\xf4\"\\xe0\\x82\\x8d~\\xb1\\xdf\\xa3\\xf4\\xd8\\x870\"\"u\\x07\\xe3qx+\\xa1^\\xd6bs\\x07\\xc4\\xd1\\x8fg\\xbb\\xde\\x1f\\xc6\\x07\\xc6i\\xe2\\xa3<\\x8a.\\xf6\\xf840\\xad\\xbck\\xee\\x80\\x87#\\x00\\xber8\\xaf\\x88\\xb0z`\\x99\\x07\\xbc\\xedb\\xb2\te\\xe9a\\x1b'ns;\\xb5\\x7f\\x11^q\\x02x?@\\x82y\\xc9\\xa8\\x0ef\\xc6\\x04\\xbd\\xf8r\\xd8\\\\x14\\x13'\\xce\\x0f\\x12\\xc6\\xa6\\xe8\\x17\\x17w\\x01\\xbb\\x98'oc^\\x0b\\x10\"a+nq\\xf0~\\xcf\\xeai\\xc3j\\xc4\\xd0\\xf1~\\xd0\\x82\\xdb\\x02h\\x8ebbu:6ij\\xff\\x11\\xd7\\x17\\xc8\\x06\\x9c~f\\x9e#2\\x1b;ik\\xe6t)\\x8c\\xb4$\\x1f"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\x80\\x1e\\xdc\\xa5\\xa29\\xc5\\xa6\\xf1\\x1d=#\\x022f\\xd2?\\xa6w\\x08\\x86\\xc2\\xf4\\xff-\\xc1\\xbdz\\xd8e\\xb5\\x11\\x18\\xd5\\xc8\\x83ie\\x8ezu\\xc5\\xbek\\x0e\\x1a\\x07\\xa0!\\x98\\xc1pu\\xd6~\\x8d\\xbd\\xcb\\xf3\\xd4a\\xed\\xda+\\xaf\\xd1o\\xea\\xbd\\xcc\\xbf\\xaf\\xc8\\xadd~\\xe1\\x90\\xe8\\x9c\\x9e\\xe9\\x98\\x98\\xc7!\\xfctr\\xf7\\xf4\\xb5\\xfb\\xa6k7\\xd5(\\x83e\\xce\\xe4\\x0co\\x89\\xdb4\\x04\\x12\\xc0\\xde\\x03b8\\x077es\"\\xee\\xc5\\xe5\\xa8\\xf7\\xc7\\xf1\\\\xad\\x8e\\x9d\\xd1\\x0f\\xea\\x90\\x926\\x14\\x18w/\\x88\\xeb\\xe0ns\\xa9\\x89;\\x97-\\xda\\x9c\\x01\\xaa\\xf1\\x9e\\xa5\\x1c\\xaa\\xce&\\x03\t\\xe6\\xa8-\\x85\\xc1\\xf9\\xc1nv\\xc7\\xd5q|\\x99n\\x1d5\\xf3\\x1a\\xfdm\\xd5g\\xd2\\xa9\\xa5:q\\x8d\tj\\x0e\\x8a\\x8c7f\\xb0\\x91\\xec\\x17\\xa1\\x1e\\x1cx\\xea\\x96\\x9c\\xf3lb\\xdd*&gf@,=\\x964$nt\\xf3\\xfa\\xa347\\xf7\\xa4\\xa1+k\\xaep\\xea\\xcbeg\\x96\\x92\\xe4\\x80\\x13"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc;\\xad!m1\\x9e\\x87\\xda\\xee\"_\\xd9=1\\x19e>\\x1b\\xa8\\xf9\\x83d\\xf6:`^c\\x037\\x98\\x90=\\x14m\\xba\\x1b\\xe5:q\\x94z\\x1d\\x85\\x8d\\xcc\\x1b$3\\x8a\\xd2\\xbf\\x9e\\xae\\xe3\\xab\\x95?j\\xb7\tb\\xd6\\xdd\\xcc\\xdeu\\xe5\\xcf\\x86\\x05\to\\xde\\x9e0\\x12p\\xca\\xb5\\xdc\\xf9\\xb9\\xd7\\x02\\x04u/\\x838\\x8d#\\x06\\x15;\\xbe\\xc6\\x15\\x1d\\xe8+\\x00\\x9c\\x81\\xa0f\\xfb\\x90\\xb9\\xb3\\x8d\\xb0\\xdf\\xea\\x0e\\xc5\\xf7\\xbc$d\\xdda\\xe9w_vbp\\x9b\\xe9\\xf6\\x8e\\xc7\\x8b\\x06\\x19\\xd4\\xe1\\x99\\xda\\x00\\xd0\"e\\xec\\xef-\\x14\\xb2p\\x03y\\x95\\x02\\xde\\xe5\\xf1\\x00\\xcdn\\x0f\\x80y\n\\xe5\\xdb\\x7f\\xed\t<\\xab\\xe8\\x9d\\xaf\\xbb\\x91\\xdcdr\\x96q\\x15\\xfa7g\\xaa\\xf3\\xaa\\xfe\\xbd\\x08\\xfft\\x17\\xdc\\xd7\\xbc\\x93\\xf5\\xa88\\x87\\x8f\\x80\\xa4\\xfa\\xfc\r\\xb2c\\x95\\xac\\xb60z\\x16\\x04\\xf8|\\x96z\\xf5%\\x9f\\x8d\\xed\\xa9\\xad\\x83\\xc77\\xf2zd0m\\xb0\\x07\\x91j\\xd8\t\\xb2\\\\xe6\\xc4"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9a`\\hzo\\x9asbjt2,\\xf9\\x10\\xdc$\\xce\\xc2\\x8d\\x0f\\xeaf\\xc8\\xf0c\\x98\\xeamii\\x8d\\xe4h.\\xe8|\\xff\\x89\\xacu@\\xe0t\\xfe\\xa2\\xdb\\x96j\\xd5f\\xca\\xda\\xd5\\xc92x\\xc3\\xa4\n\\x9d\\xd0\\xc4\\xda@\\xaf\\xa1\\xb0#\\x0f\\xa1\\xdb\\x13\\x855v\\x99\\x86\\xe6>\\xd9\\xbf\\x82\\xe5!*\\xdd\\xbf\\x04 \\x17cb^\\x07t\\xc56\\xa5\\xea)y\\xda\\xe4\\xff\\x8c\\xbf\\xae\\x9a\\xf5\\xd6<\\x14i\\xd8\\x12|\\x94\\xb5ek\\xad'\\xc8'\\x0e\t \\xf4\\xe9\\x90\\x1d\\s#\\x8br<\\x07#ku\\xe1\\xfbm\\xd7\\x9f\\x96k|\\xb7\\x1d\\x00l\\xc3\\xaf\\xf4n\\xce\\x8a\\xc6\\x94\\x18\\x7f\t\\xc3\\xe37\\xe7,\\x96\\x7f+\\xd6\\xf0\\xe2x\\xc2\\x8e\\x00\\xe7\\xc7o\\xee+|\\xd4\\xfb\\x02\\x11f\\xe5o8$v\\x9d\\x1dq\\xaf\\x9b\\xe6\\xe7g\\xb9|d\\x1d\\xef\\xd0?p\\xd1\\xa1\\x8b\\x17xzg\\xd0<\\xb7\\x17\\xa9\\x91d\\xd0\\xe6\\x8bx\\xe87\\x8ft\\xb9\\x9d\\xdd^\\xd1>z\\\\xec"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\x1a\\x06\\xb3h\\xe4\\xe1\\x80\"\\xab-\\xd5\\x9e\\x93\\xc5\\xeb\\xed\\xfa\\x9b\\xbes\\x01|\\x8b\\xdbn\\xa1\\x10\\x14l\\xaf\\x08b?\\x18\\x97\\xd1\\xee\\x96\\x0c0\\xde\\xa0\\xa4e\\xc83\\xee2b\\xa6\\xa4\\x89\\xd9\\xcc\\x12\\xed\\x80\\xff\\xf4w6\\xfc\\xec\\xc2\\xc6;\\x1f\\xe6\\x1f\\x17\\xa5\\xb5\\xc8r\\xc68\\x08t \\xdblzf9#j@\\xf8$\\x80><\\x1b\\xcf\\xfctq\\x9c\\xe8!8h\\xa4\\x93\\xb5\\x83\\xebr\\xa0'\\x885;\\x9e\\xb5\"\\xb0r\\x9br?6\\x0b\\xea\\x85\\x85g\\xf13\\xe87j\\x0f\\x89\\xbf\\xe6\\xa8f!\\x8fl\\x92\\x9b#k\\xdb\\xb5\\x0f\\x06a\\x9c\\xc9\\x02\\x83\\xb0\\xb7\\x00\\x07\\xee\\xcd\\xd1n\\xe8\\x82\\xab<\\x86\\xb2\\xaf8\\x13g\"\\xb1p\\xd1g\\xb46>\\x1a\\xe5\t\\x981<\\x12\\x0f\\xa1\\\\xa1\\xe5\\xc0\\x04h\\xa9n\\x81\\x11\\x02\r2\\xcax,\\xc6\\x93\\xf58p;f p\\x8e\\xec\\x9ah\\xe0\\xcd\\xb7\\xaff\\x17\\xfa\\xbc\\xc4\\xdezz\\xff7`\\x9d\\xbf\\x8ck\\xf9t.\\xc5\\x1f\\xeb\\xd0\\x86"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\x9d5\\x058\\x96\\xf2?\\xe1\\xe7\\xc3\\xf0u\\x19\\xc1c`c\\x13\\xf7&\\x16\\xbb?\\xe6\\x0c\\xd0\\xc2\\xf8\\xffs\\x9c\\xde\\x9e\\x84\\xa8\\xafk\\xd9n%\\xd4n\\xb2\\xb8\\xb5\\x96\\xf5\\xe3\\x00\\x1d&:\\xdd\\x9b\\xd9k\\x10\\x02\\xfb\\xcc\\xc2c\tp&\\xfe\\xab\\xb4zou\\x9di\\x11\\xbd\\x81\\xdc\\x94\\xc5\\x11z\\xca\\x1d\\xfe\\x8f\\xda\\xbf\\xb3p\\xb5ew\\xec\\x96\\xa5>\\xc2\\x1c\\xb8\\xa6\\x9f-ng)\\xee\\x9e\\x9b\\xbc\\xedd\\xe6'\\x18\\x97\\i~\\xf3\\x15\\x1d\n\\xa4\\xed\\x92\\xd1u\\x93|\\xb8s\nl\\xce@\\xbb\\xab\\xf4\\xa7\\xd4<\\x9fuo\\x03b:\\xb0+\\x9a\\xdb\\x9d\\xadmo\\xfb\\x9e\\xbco`_\\x0eev@\\xff-\\x93\\x1c\\xad\\xdel\\xd1k\\xa4\\xd2t\\xf3\\x93l\\xda\\xb6\\xe6\\xa8ymc\\x86\\x0b\\x17\\x87v\\xda\\\\x15\\xc0yq3\\x94b\\xd0\\x91\\xefd\\x07\\xae\\x840\\x84g\\xa8\\x0b?\\xd0\\xfbm\\xfay\\x8b\\xe10\\xc1\\xa6\\x0f\\xd9\\xcf\\x08+\\x8b*\\xe5\\x9e\\x88\\xd0\\xd5i\\x8a$\\x95s\\xa4^\\x8ei\\x98\\x13"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+$\\\\xca\\x8e.|\\x85\\xcc\\xe1.\\xe2'n\\xb8\\x9d\\xd7s\\xa9\\x9e\\x81\\xe9\\xd1\\xe4\\xcc\\xd1eh \\xd9\\xd3\\xc4@)\\xc3\\xda5z\\xe7\\x0edem\\xac\\xcb\\xba\\x14\\x00\\\\xd9\\xc2\\x82\\xd87ge\\xda\\xccu\\x99g\\xf28\\xb7\\xf5\\xcaea\\xbf\\x1c\\xdd\\xc7\\x04\\x85\\x0f\\xf9g\\x8c\\xa1\\x1fb\\xc8\\xe1\\x104o\\xfb\\x06\\x19\\x8d\\x8f._\\xab\\xdf\\xb5\\x82-\\xcad\\x19u\\xb2\\x1a`xr1\\x06#\\x0e\\xca\\xfd\\xa1\\xed\n\\xa99\\xe5n\\xa6bk\\x15\\x95\\xc9\\x88\\xad\\x12!\\xecn\\x89u\\x84\\xde\\xb6\\xd6\\\\xc0\\xb8\\xc0\\x11\\xa2\\xb4\\xe3a\\x9e+\\xbc\\x10\\xc2yx\r\\x12i\\xedr&\\xd3\\x89.z\\xb7u\rt!\\x81\\xe8\\xfe\\x16\\x04a\\x00\\xb2\\xf4\\x9a\\xb6mp\\xa9\\xa7z\\xecfg\\xb3\\x89ak\\x91\\xc83\\xf1\\xc3\\xe2l\\xce\\xee\\xed\\x07j\\x0epui\\xf2\\x1fw\\xba\\x86\\xc9sg\\xb3\\xb7\\xab\\xf89gq\\xb2\\xfb\\x15?:\\xc46\\xf2\\x0c\\xaca\\xbcz579\\xd7|\\x96\\xc1\\xe16uh"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xd2\\xec\\x03\\xdb\\xeay6\\x8c\\xd9\\x82\n\\xa9\\x1fi\\x86\\xa2\\xe7\\xd6x\\xb2do\\x08\\x90\\xf6\\xc6\\xf5\\xbb\\xf8\\x8e\\xab\\xcddw\t\\xe6\\xe9\\xd1\\x86\\xf05\\x8a\\x91\\xb56r\\x7f \\xf6r\\x19)z\\xb2 \\xb2^t\\xcfd\\x9f<\\xfd3\\x8bsv\\x0e:b\\x99\t>r\\x83\\xa4.\\x04\\xb3\\x80f9\"\\x91\\x8f\\x8b\\x07\\x14\\x13\\xef9\\xe6\\xf6\\x8ea\\xd6\\xaf\\x98\\xaf\\x17\\x99u##\\x9cd*\\xa5\\xcb_\\xc9hu\\x8c\\xa9?t@v<5\\x0e\\xd7\\x88p\\xe1,\\x149\\x1e\n\\xf0\\xb8n\\xd7c?n\\xf0\\\\x18l\\x14q\\x1dm8\\x19mt?\\xf8\\xe7z\\xca\\xb5\\xccnj\\x95y\\x84\\x1b\\x02\\x93\\x1d3\\xab\\xab\\xf6\\xd5\\xe6\\xb0\\xc4\\x8b\\xa2h\\xa0/g\\x1d\\x81\\xd6\\xde\\xa0\\xe3\\x9a*\\x18\\xa5\\x05\\x0ch\\xe5\\xe1\\x1e\\xad8\\xcb\\xbc\\xa3\\x06+g\\x12bag\\xe8\\x87\\x81\\xd6\\xc6\\xe8\\xff\\x00k/\n\\xf9k^\\xe3\\x82\\xf2\\x8c\\xe7\\x12\\xea5r\\xe5\\xcfu\\xe8\\xb4v\\xf8+q\\xeb\\xed"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\xed\\xb4\\xa3fp\\x1d\\x12\\xd6\\xed\\xb3\\x11\\xb3c\\x19\\xf5\\xca\\xff\\xd6\\xd9=i\\xdd\\xffm\\x8c\\x8a\\xff\\x13\\xc7gi\\xd2\\xa3\\xf9\\xbe\\x00\\xc4\\xef q\\x1bso\n\\x94\\x13\\x0c:\\xf2?4qp>\\xfc\\xcf\\x97\\xfd8`\\x8d\\x9f\\x997\\xe0\\x06\\xbas\\x05'u\\xc9\\xa8\\x16\\xcd\\xbb\\xbdq\\xd0\\xb7\\xbe\\x01l\\x7fg\\xcb3\\x1f.\\x90b\\xdc\\xf0\\xc6u\\xe9\\x0e\\xac\\xb0\\x84b\\xf1\\xfc\\xe7-\\x07\\xfa>\\xc1\\x95\\xfbd\\x10\\xa9=\\xf0\\x1d1\\xb6\\xee\\xdcw\\x96\\x90\\xd5\\xa8\t\\xf15\\xd7\\xb2\\x97\\x91|\\x8fy\\xcd'\\xba\\xba\\x18\\xbb|\\x93t^\\xb78\\xa7^gi\\xe4\\xb7u\\xc7\\xa2\\x95\\xa8\\x1f\\xeb\\xc3e\\xf4\\xfd\\x05@\\xbb\\xb0\\xc3\\xcb\\x05\\x05\\x0c\\x94e\\xb7c\\xd8ws\\xccz\\xde'\\x83e\\xdcz\\xc9\\xa2n(\\xdfd\\xd6\\x7f\\xc2w\\x9b\\x9f\\x0ea\\x0e\\xfb\\xa2\\xca\\xa3\\xb1!l\\xe3c\\xdc|>\\xe6j\\x83<&'z\\xf2^\\x93\\xef\\xdc\\xa6\\x95n\\xf2\\xa0j\\xd8\\xb3t\\xac \\xa5\\xb4\\xfe\\xaf\\xd1p2\n"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,r\\xc8\\xd3\\x00c\\xfe\\x8e\\x9dw\\xef\\xb6h\\xf1\\x9f\\xe6\\x03\\xcfh\\xf4d\\xcf\\xc6)\\x9d\\xf7\\xbf&\\xe2\\x9a%\\xdf\\xa1\\xdd\\xbfr\\xddxqbj\\x0f'(\\xc1\\xe5\\xde\\xee\\x96\\xd2\\xbe\\x14o\\xa2\\xac\\x04\\xc8\\x0c\\xb1\\xa1s\\x12\\xaac<\\xc3\\xe2\\xdb\\xb4w\\x81*vi$psw\\xcb\\xa627\\xda\\x03\\xb9\\x1a\\x1ff\\x8e\\x03\\xdec8\\x1f+*s\\xb1e\\xc8\\xfd+\\xe4\\xdb\\x1c\\xc4*\n4`\\xe6\\x02\\xf9\n\\x05l\n\\x0b\\x0e\\xfe\\xa1+\\xbdjq\r\\x9f\\xb7u\\xed\"n\\xab\\xd1\\xf4\\xf21\\xbd\\xc2\\x8c\\xfd\\x0ch\\x91\\xcf@>#u,\\xfbg\\x90%\\x81\\xef\\xbf\\xfcv\\xc5@\\xf1|~\\xc8r\\xa0\\x08y\\xb2 \\xb3\\xf7*eg\\xf2\\x9c@x\\x88\\xf6d\\xbd*\\x0fc\\x1e\\xd0\\xee\\x00\\x7f\\\\x8f\\x81v\\x94q\\xb7\\x05\\x91\\xba\\xf2\\xbf\\x03m\\x93x\\xb0y~\\x9bs\\xa25\\xbe\\xaaa1\\x81r\\x0b\\x9c\\xfa\\x8b\\xf5\\xe0.\\xa0\\xceg\\xd3|\\xd3\\xc8\\xb1\\x0f\\x0e/@\\x19\\x8a\\x11kjw"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\x81\\x9e&\\xee\\x05\\xc1\\xb0\\xbb\\x1dw\\xaa\\x8f\\x19\\xaa\\xe3r+\\xd5\tt\\xd3\\xd8f 8\\xc6\\xad\\xd4\\xcfef\\xc7os\\xd0v\\xd9\"|\\xe8wv\\xd2r\\x086\\xa1\\x02s\\xa31@\\x06y%\\xe0l\\xc4\\xb6oki^\\xe7\\xf4~wq\\x8a\\x01\\\\xd4\\xfc\\x80(%\\xb0\\x19>\\xfdt<\\x90\\xecf\\x12x\to^\\xee\\xd8\\x0c\\xd2\\xef\\xd3b\\xc2\\xd4\\xfdj\\x16\\xbf|\\x8a\\x08\\xcf\\xb3f\\xfb\\xf0\\x94\\xbc\"\\xe4\\xaa\\xc6t*'tn\\xddb\\x0c\\x1c\\xea\\xc9\\xf0\\x01k\\x89f6r\\x968\\xe2\\x8a\\xc21\\xc0\\xd0\\x0cxjn\\x93\\xaaa>s\\x9f\\xfae\\xd1\\xe1\\xd7w\\xe9\\xec\\x90m^_\\x0f\\xe7_\\x93n\\xa1\\xb2\\xfc\\xfcx\\xa0\\xf4\\xd4)`\\xfb5\\xb2t\\x1a\\xa7ieo\\x04\\xc8y\\x1c\\x9a\\xd9n\\xa8\\x0c\\xcd\\x8d\\x0b\\xc2+\\xcb\\x00\\x8e\\xd1w\\xd9\\xe2\\x1f\\xf8\\xce\\\\xf3\\x87g\\x12\\x8e.\\x1b\\xe3h\\xb1\\x98\\xe6\\x849\\x1d&\\xc4b\\xd2\\xc3\\xf2\\xe2\\x04\\x05\\xe3\\xcd\\x86\\x94\\xdd\\xc5po\\x0e"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x92\\xcb\\x0c\\xca,\\xb2\\xcb\\x8e\\x9em\\x91\\xd3lh\\xdf\\x86k\\xbc'\\xc4/\\x0bf\\x1bf\\xde\\xf7\\x9f4t\\x11\\xd8-\\xf19r~g\\xa0~\\xec.\\xd0\\xd7\\x11s\\xd2yjn\\xe8\\x98e\\xa7f\\x12`\\xc0z\\xea\\xd5\\x1b'\\xf4vy\\xf7@\\xa8\\x81\\xea\\xcf,\\xc1\\x04&\t\\x05\\xe6\\xcb\\x92\\xbc\t\\xa3\\x10\\xc8\\x9f\\xc78\\xcd\\xaf\\x9df\\xda\\x13\\xb3\\xa7\\xe0\\xbdi\\xaf\\xaa\\x1f\\xdc\\x11r\\xad\\x94e\\xff\\xac\\xc6\\x85&.=\\x1bg\\x8e\\x8e\\x07+!@@pns\\x83\\xbe\\x0b\\xc5kf\\x0f\\xa1\\x80\\xddy\\xd5\\xb0p\\x11$kk\\xd7\\xa0\\x88&d\\x81~4?\\xc6~\\x95\\x07+\\x8b,d=4\\xd6w\\xae\\x97cm\\x10\\xc3\\xaaw$qc\\x98cm\\xa5\\xa6\\xf8\\x98\\x14\\x9c\\xcd\\xc7\\xf9t|\\xa1\\xcb|\\xcdmg\\x15\\xf1k\\x10*\\x8b#/\\xf3\\x9b\\xee\\xe9\\x05\\x182m\\xf5z\\x7f|\\xf2un\\xc7\\xcf\\xe7\\x01\\xc1\\x9b\\x1b\\xd5\\xf4\\x88w\\xa9\\xb0\\xa5\\x06+\\xd2uwt5\\x0b\\xfd\n\\x98zv\\xd2"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6\\x00\\x96\\xaex\\xc6\\xc0\\x8c\\x8c\\x7f\\x08l\\xc6\\xd7\\xda\\xc5\n<z\\xf0q\\x92ys(6x\\xba\\xf8\\xed\\xbf%\\xdb^n\\x92\\xaf\\x9c\r\\xa8x\\xda\\xa1\"\\x92\\x17\\x9e\r\\xd6\\xfcj\\xfa\\xa6\\xe3\\x15\\xa4\\xe7\\x1e='g5i\\x95\\x11\\xff\\x81k\\xfb\\xd3\\x87g \\xb4\\xc4d\\xb0h\\x19\\xd4\\xd0k\\xf9\\xff\\xc2\\x8aphwu\\xae\\x95\\x04m\\xf5\\xca\\x131s\\xe1!d\\xb1\\xec\\xec\\x0f\\x89\\xc6\\x105\\x9e\\x85\\xd7\\xef\\x03)\\xf4\\xad\\x06\\xf4\\x1e2\\xd7z~\\xe2 e\\x17\\x96\\xe7!f\\xdd\\x87\\xe4\\x06\\x1fhn\\xf5_\\xddum\\x8e\\xb7t\\xc8e \\x89\\xd5it\\x0c\\xf8-\\x02\\xca\\xf4\\xee\\x822\\xa4\\xeahe\\xbce\\xb6?7+\\x19x\\xba\\x13py\\xa4\\xe7ze\\xa5@u u\\xeeg\\xcb\\xdf\\\\xd7\\xa7\\xa9xq\\x80\\xc0h3f<\\x1a\\xadf8\\xbe\\x81\\xf6\\xdb\\xe1\\x06@\\xe7\\xe7\\x01\\xe18\\xc9ny\\x04<\\x9f\\ep\\xc7\\xb7e\\x08\\xac\\xbf\\xc6k\\xc9\\xe8\\xbd\\xf8\\xd0\"_\\x05\\xe5"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6&\\^\\x15j\\x80\\xd0\\xeb\\xcfrbv\\xab\\xcd\\xde`\\xf3\\xa3\\xae\\xec\\x0e\\xc0\\x02\\xf3s,^\\xe8kw\\xd3;\\xaf\\x9a=\\xea!\\xbb\\xf3njg1\\x04\\xac\\xfd\\x99\\xdd\\xda\\xf1\\xa9\\xffw\\xb6\\x0b\\x95*\n8wy\\xc1\\xce\\xac\\xf5\\x8dk\\x1ap\\xba\\xd7tg\\xa5\\xf2\\xb81\\xd3\\x9d@\\xafz\\x8b\\x19\\xf94\\x82\\xe3p\\x8e\\xb5\\x80\\xe7\\xba\\xfdf\\xa8v+>\\x86d\\xc7\\xb2\\xdfh\\xaa\\xf2\\xa0g\\x9f\\xa6\\x87o8\\x97\\x88^\\xa4\\x0c\n\\x16\\xf5u\\xfc+\\xc9\\xa5a\\x86r\\xb1\\x0b\\xed\\xb2\\xa6\\x12\\x01\\xdd\\xfa\\xdap\\xb1\\xc4@\\xff_\\xfc\\xd6r\\x8c\\xeb\\xc1\\xc4\\x1e^s\\xac\\x01\\x05\\xeb\\xc7\\xa1e\\x1b\\x0f\\x94\\x08u\\xeb\\xbe\\xe7sv!=\\x81=\\xa7\\xfc&l\\x03v\\xf4`\\xbbjl7\\xb2\\xf8\\xcc\\xca\\xcb@mxa9\\x1f\\xf0\\xc1ep'`\\xc3.\\x99\t\\x19\\x85\\xa2yf\\xab\\xe9\\xfe\\xfd\\xfep\\xd6k\\xc8\\x16\\x82o\\xc0\\x90\\x0c\\xc7v\\xa7\\x04\\xe0\\xa7=\\xd6j\\xe3e\\x0c\\xa5\\xe2iz\\xc5\\x91"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010pq\\x97\\xf9\\xb68n~e\\x00h'\\xb9\\x8ba@\\xa7/\\xa7p\\xb3\\x84\\xae~\\x0b+.\\xa2y2\"\\xf9s\\xe9<\\xfaf\\xc9\\xc2\\xbb\\xc0rvb\\x05\\x83\\x02\\x86\\x8e\\xe9|u\\xe5\\x9d\\xbf)o<(w\\xb3jo:u6i\\xd4\\xd491\\xee\\xe7\\xcc\\x8c\\xe8\\x8b\\xf9\\x93)\\x1e)\\x8f\\x92\\x008\\xb1\\x96o\\xe5h\\x84*\\x16\\xbfdo\\x8fr\\xfbt\\xe8.;\\xa9\\xbfk\\x83\\xba\\xfd\r\\xe7s\trz-\\x1a\\xf6'\\x8c\\xc2\\xe1q\\x18\\x81\\xe6\\x95?ig\\x14\\x82+\\xf2<\\xd6\\x7f3\\x80v\\xc5\\x96\\xee\\xa1s*_,\\xa2\\x95ao?xo\\x16\\x02&\\xd1\\x7f\\x0f*\\xd0mt\\xe0j\\x15xa\\x94\\x0bo\\x8c \\xdb\\x00%\\xb4\\xf9,p\\xe7\\xc4\\xc3\\xa00\\xc8c\\x94\\xc0\\xca3\\xb1<\\x1d\\xe7\\xd9\\x19s\\x85\\x0e\\x96%7\\xac'\\x0cg \\xe0\\xcf\\x8b\\x04j\\x95\\xa2$g\\xe8y\\x972\\xa8\\xe4b\\xcf\\xe0\\xf8g\\x99-\\x93\\xf5u+~$\\x93\\xa3_\\xa1\\xae\\xc0c"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\x86\\x80z\\x9a83\\xe5\\x96\\xcb\\\\xa7(\\xa7\\x82y\\xb4v7i\\xf0\\xb8%\\x10\\xa4e\\xd7pq\\x19!\\xf7\\xd2s\\xd0\\xca|\\x8c\\xe7|\\xa4\\x85\\xf1\\x8c\\xbf\\xeei\"\\xdd\\xe6\\x1d\\xd3\\x1dt\\xcd\\xc3i'\\x11e\\x07i\\xda\\xf6hq\\x9e\\xfc\\xb6\\x9f\\xaf\\xb0\\x06plh\\x89q\\xce\\xa4ffi4\\x19\\xb2\\xf5\\xba\\x99o1\\x1f=n\\xa7_w\\xaa3\\xa4\\xa8\\xb9t\\xbe\\xbe\\xc3\\x8e\\xe3\\x914x\\xb60b\\x8a\\x9f\\xb1\\xd4\\xb6\\xbfx!\"j\\x02(\\x17/\\x85@\\xf4ga\\x9f\\x90\\x06\\x1a\\x1f\t\\xfa\\xb2f\\x13\\x95\\xedcic7\\xa4?\\x93\\x87\\xc5\\xa7\\x19\\x06\\x02p\\xe5\\xb9p\\x1d\\xc0`\\x18\\x95\\xfe7\\xc5\\x90l\\x85\\xf6fv\\xec\\x86\\x99\\x92\\x99\\xb5\\x1a\\x8d\\x07\\xfc\\xd0\\x15eh^\\x8ed\\x0c\\x9a\\xe0\\x0b\\xda0.a\\x0c\\xe9\\xed\\xf2\\xcf\\xa1\\x8b#\\;\\x01d\\x7f\\x02\\x8c\\x95\\x16|\\xe1\\xdf<m\\xc7|\\x0e\\xc1d\\xcb\\x9c\\xc6\\xed\\x97\\x06;\\xef\\xa6-\t\\xc1\\xf4\\xbc\\xf6\\x08\\xd7\\x99\\xb1\\x922"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08\\xb4\"\\x84\\xc5\\xfao\\xb1\\xc2\\x0f\\xeb\\x9ck0\\xcf\\xe4\\x81\\x8f\\x14\\xdc\\x88aq\\x7fv\\x91\\xe29\\xc76\\x8b?\\xf3\\x9d8\\xafm\\xc9\\xa6\\x8a\\xd0a\n_\\x03\\xf6\\x94\\xca\\xa5\\x8abq!\\xac\\x1f`?y\\xf8o\\xe8\\xe2\\xea\\x8c\\x0fa2\\x97\\x0f\\xaf\\xdc\\x9c\\x98p\\x15\\xf8\\xbb\\xb7.\\x15\\xc9\\xcd_\\x0e`5p\\x84n\\xeb\\xf3\\xeb\\xe9\\xdb\\xbfml\\xc4\\x8b\\xc2\\x80\\x82\\xac\\xc8?hk\\xd8\\x08\\x1ay\\x1f\\xbdyf\\xf0\\x8bxg\\x86\\xf3'\\x9e\\x9e\\xb4\\xaee\\x03\\x0b\\x0b\\xcd\\xf3v\\xca\\x8c\\xf3\\x16\\xa6\\x07!\\xe9.yvj=+/\\xa0\\xbb\\xad\\x97v\\x0f\\xd2fd*\\xd2z\\xe0\\x12z\\x1e:<\\x0c\\xeb\\x1f\\xd5\t\\xce\\xd7;\\x8f\\xe5\\xcb+,mn\\xce\\xca\\xce\\xcc\n\\x0c7\\xf3\\xc7\\x1e\\xae\\xe2\\xbc\\xf0\\xa0\\xe3hz=xg\\xc0\\x81)\\xdeb\\x0f\\x82|\\xc9\\xce\\x00\\xc3p\\x03\\x02\\x9c\\xcfs\\xfa\\x8c\\x9e\\xc2\\xd0\\xbf\\xac\n\\xef\\xfe\\xc3a\\xe7\\xfc\\xca\\x8c\\xac\\x9ab\\xf1@\\x8cc`\\xac\\xa6r"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=%\\x1e\\xec\\xd8\\xbbx\\x7f\\xac\\xc0p\\xfe\\xf3\\xd1\\x9c\\x03h\\xae\\xbb\\xacmou\\xadw\\xdad\\xa9o\\xf8\\xfa'\\x96eu\\xbc\\x13\\x08h5\\xf1\\xe6\\xb5\\xfb,\\xff\\xe4\\x7fl\\x9d\\xea\\x02fy\\x1d\\x8by3\n\\xed\\x1e\\xb0\\x1d\\x8e\\xe1\\xe2xk##\\xf9\\xcbg\\xce|\\xba\\x0f\"\\x83#\\x05\\x0e8hsu\\x92\\xf8\\x92$\\x93\\x13\\x04\\xf5\\xba\\x99a/bx@\\xc1=.\\xee(,\\xba\\xa2\\x15\\xdc\\xc3\\x16\\x9d8\\x05\\xc4\\xd4\\x10k\n\\xa7\\xb3v\\xb0)\\xd9\\x8e@\\xb1e\\x8b\\x8a\\xaf\\xe7\\x1c\\x11\\x17\\x8aw\\xdb\\xe8v\\xbb\\x11k\\xe0\\xf9q,\\x7f\\xf9\\x1a;\\xbe\\x9c\\xc7\\x8f\\xba\\xa8\\x19\\x00\\x12;\\xb9z\\x19\\x8a%xub*\\x8byy9ms\\xa0\\x84n7c\\xed%\\x8a\\xc8\\x8f\\x13\\x1d\\xfa\\xb7\"\\xc8\\x1e\\xda\\xd6\\x9di\\xda\\xb3p\\x91\\x08\\x04.\\xd6ah\\x96=n\\xaf\\xc8\\xfff\\xda%~\\xd1`/d\\xfer>=\\xb6$\\x81s^\\xec!\\xa8\\x95\\x9d\\x07y\\x1f\\xc0&\\x17j\\x80t\\xf1\\xa2"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8r\\xaf\\xb4\\x9fr\\x074\\x9f\\xac\\xb8\\xc6o\\x85\\xbd\\xcf\\xd6/u(\\x14\\x84\\xc6x\\x7f\\x92\\xc7\\xb4\\x9b\\xa6o\\xb9x@\\xa8*\\x05\\x1e$~\\x88\\xd1\\x07(\\x7fw\\x17\\xb1yr2\\x8dq\\xbd\\x1a\\x0ff\\x10\\xc6\\x81\\xf4i\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1b_\\x85\\xff\\xe3\\xab\\x168\\x0f\\x16#bjz\\xbb\\xc5\\xef\\xc4-b>\\x8bez9l\\x07\\xd3;p\\xb6o+\\xf1\\x8d-\\xcd\\xe2\\xbb\\x9c(\\xb4\\x88\\xd0p*w'"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcbn\\xafx\\x84\\x18\\x11\n\\xe6\\x9f\\xc1\\xb6\\x97+\\x1a\\xc5kw\\x87\\x7f\\xae1\\xe7\\x1b\\xb9\\x0fi\\x87\\xe4\\xe7\\xc4\\x8f\\xa3\\x8az\\xb2\\xe8\\xf0\\x05k\\x01n\\xc8\\xb2i\\xecb\\xbb\\xf1i\\x9a\\xbc\\x95f\\x7f\\xea:$\\x1fp_7\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000qk\\x13\\x9e\\x8d\\x0b\\x13\\xf9j\nt\r\\xfb.\\xb7\\x9e\\xdb\\x14\\x1c\\xe1\\xa6\\xa7\\x0eh\\xa5\n\\xe6\n(\\xdd\\xc4xu\\x1c\\xe8\\x96o\\x16\\xb1\\x19\\xc7\\xe9\\xe3?\\xea\\xb7"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc1i\\xaae\\x85-\\xcd\\xa6\\xb5\\x925\\x9a\\x89$\t\\x0e\\xeb\\xa4\\xad\\x1f\\x86\\xbaq.<\\xfaj\\xddi\\x16e\\xd2\\x8c\\xb2\\xae\\x1f\\xff\\x9f#\\xc3h1>e\\x8d\\xcd*,\\x84c\\xf3*\\xf1\\xf32\\x82\\x9c=\\xb0\\xce\\xa6\\xc5\\x9f&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd56\\x94\\xc8w\\xb4\\x03l?\\x05\\x96_\\xfe\\xca))\\xcf\\xf2\\xab\\xec\\xc1\\x85w\\xb6a\"h\\xe7\\x0e\\x85\\x87\\xb7\\x04?\\x16bgl\\x80\\x11\\xb2u\\xb1\\xa9\\xbb\\x02"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c\\x97\\xd0\\x8f~\\xc6\\xb5+\\x9f\r\\x1d\\xf3\\x8c\\xfe\\x9bv\\xd2\\x13bi\\x8f\\x8c\\xa5r\\xb6\\xe8v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xc9\\xe0\\xf6\\xbc\\\\x84d+~, \\x03\\x8a\\xef\\x0b\\x80\\x9db*!t\\xad\\xc9\\xd5\\x8a\\xe5x\\xefm<\\x04\\xbc^\\xf5\\xbe\\xa6_#t\\x05u\\xcez\\xf7\\xe8\\xebp\\x14e0\\xeak\\x83\\xcd\\xcea\\x8f-\\xcek\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0\\x05\\xaa\\xe1\\x98\\x01d6y\\x1an\\xbc!2x(n\\xc3g\\x05\\xf9/c\\x07\\x03\\xa4y\\x14\\xff\\xda\\x81\\xf6\\xb1+\\x01\\x0f\\xfc\\xc9jw\\xc9\\x94+hz\\xc3v"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c2\\x7f\\xbd\\x13\\xc3\\xad\\xd1\\x0c\\xdb\\x17\\xe5\\xce\\xdc\\x96-l~\\x0b\\xff\\x9f2\\x9f\\xa9\\xe3\\x8b\\xa4\\x93y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1czz\\x13r\\x16k!\t\\x9b\\x1f\\xef\\x8an\\xf5e\\xc2a\\xd7t\\xabk\\xa5\\x8d\\xcc\\xa7o;\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c\\xf0?\\x17\\xd6\\xd89\\xa1\\xbf\\xe6'\\xed\\xf7\\x96\\xcf\\xa9\\x19\\x93|\\x9a\\xce\\xc5\\x08y\\x01\\x82(\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c\\x81r\\x9f+932\\x84\\xf82\\x0fz\\xa3+a$\\xe2\\x7f\\x16\\xf5\\x04t\\xef\\xb7\\xfc\\xcc\\xbf\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1c- \\xc2\\xd7\\x01\\xe1e\\x91\\xac\\x05\\xb6\\xa8k\\xa6u\\x92\\xf5\\xefp\\x04o\\xbf;\\x99\\x8d\\x9ec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1cz\\x8bhpc\\xe1\\x1a\\xf5\\x818\\x1b\\xd7\\xdf\\xb9\\x89\\x8a\\xa1u\\xb0\\xf3\\x16\\xfe\\xe0\\x9ao\\x19\\x95w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\xee\\xf0\\xa1~n3z\\xbe/\\x88'\\xa9\\xd9\\xc3~\\\\xad\\xc5\\xf6\\xd3\\xa2d\\xd9=\\xbbkw\\xe8\\x93\\x111\\xf1\\xb7\\xfdg\\xd3ixyo\\xf3\\x16\\xe5>)\\xdaq\\x0b\\xc7\\x9c\\xdaz\\x05\\x95\\xb0\\x88\\x13\\xe5\\x15b!\\xd1\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x1d\\xea\\xbamj\\xb5\\xd1\\xd9h\\xde\\xcfug\\xe4nh=\\xe8\\x92\\xd3\\xf4\\xebm\\x07\n\\xf6\\xdf\\x87\\xackg\\xfe\\x03\\xb8\\x02d\\x0f\\x9c*?g\\xf5\\xd8ukt"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\x87?\\xea\\xebn\\x0bnhn\\x97\\x9b&s\\xc2\\xe4k\\x9b\\xd1\\xe5bf\\xd3\\xd0k\\xf5\\x88\\x17\\x00)\\xb5\\xb7v2hsr\\xb0\\x9ad\\x06j\\xe7\\x90+\\xa5t;\\xb43\\xc9\\x05^\\xd1\\xff\\xb4\\xa3\\xf0v\\x9d \\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\xc6s%fq\\xdb\\x8c\\xb2\\x1e\\xdd\\x85!\\xb40e$z\\x01\\xde\\x18\\xbd\\xb8o\\xef\\xdd2\\x08\\xcd\\xban\\x1f\\x8e\\xd3\\xf3\\x99`e\\x1dtj\\xba\\xba\\x1a\\x9f"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\x86\\x0f\\x94\\xcd\\x80\\xc3&\\x1b\\x1dn\\xbd:\\x1c\\xcb\\x89\\xe7\\xec1a\\x8a\\xb3\\x1a\\x05t\\xcb|\\x7f\\xc5d\\xfa\\xcc7:\\x04g\\x12\\x85\"\\x02\\xfa%d\\xef\\xf2\\x15>5,\\xce\\x03\\xc1\\x97\\xaa2\\xaay \\xbc\\x9e\\x1b\\xd2\\xdb\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x18v\\xe6\\xd6q\\xd0\\x89\\x07?\\xd9c5\\xd80\\xd6\\xd6\\xf2\\x16\\xf3g\\xd9qe\\xc1\\x1f\\xa6u\\x846\\x8cvx@\\x1bz\\xc5e\\x89bw\\x9c\\x95\\x94\\x14\\xf6,d"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\xa9g\\xe5;\\xc9\\xb2\rx1\\xd9\\xfat'8\\xfe!\\xaa\\x94\\xc5\r\\x8b5\\xaa\\xb9c\\xe6\\x06\\xe3\\xf4i\\xdd\\xe9\\x1b\\x0c<\\xabp\\xc0\\x9f\\xfa\\xbdm/\\xf2\n=%\\xb1\\xcb\\x95\\xc1\\x88\\xe3w,t\\xa3\n9\\xe5\\x08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xb6\\x80\\xee\\x91<\\x99\\xa2\\xe8\\x8f\\xa0\\xc9\\xfd\\x0c\\x02\\x87\\x1fk\nx\\xcb\\x83>\\xcc\\xdc\\x1bh.\\x1f\\x99\\x1c\\xe1+@\\xf9z\\xbc3\\xb6\\x9amt \\x91+\\xa3%"
  677.  
  678.  
  679. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\xa7\\xfdlm\\x83\\xcb\\xfef\\x8fh\t\n\\x81\\xc4\rr\\xf7\\xb4\\xc6i\\x1c\\xb6\\xb3\\x9c\\x08gz\\xcc\\xb96\\x18m?\\xfa\\x83\\x06\\x87\\xdb\\xc3\\x8af\\xbb`\\xec\\x08\\xc8\\x1d\\xa5m~\\xf2\\xac\\xb8v\\xc8(\\x0e\\xf40\\x90\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd79\\x18qk\\x915\\h\\x88\\xba\\x9f\\xd1\\x8d\\xa2c\\x9e\\xb6\\xbe\\xef\\xadi:\\x80g\\x12q\\x04\\xe9\\xf3\\x8et\\x05\\x03ms\\xd9\\x81\\x9ep\\x98'\\xebcwk\\x13\\xd3"
  680.  
  681.  
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1chz\\x16\\xfb\\xc4\\xa3m;y\\xd52\\xad\\xa9\\xe5\\x17y9z\\xd1b\\x04\\x94b\\x07\\xd1\\x95\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  683.  
  684.  
  685. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\xdc\\xe2oj\\xf9ajn\\xaa\\xc38\\xa0\\x1f\\x03\\xc8\\x04\\xc0ep\\x8fi6xh*\\xa6\\xa0l\\xb4\\xb7\\xec\\xed\\x80\\x00\\xd4\\xe4\\xa6\\xf7\\x83p*\\xf2\\xff\\xc5\\xea\\x19(\\xf1n\\xe3\\x1c\\xcdz\\x8c\\x0e@'k\\xbb~\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e+\\xf6\\xb5\\xf6\\x05c\\xa6\\xd9?n\\xbc\\x86\\x95!\\xcfug\\xfe\\x95\\xd7;k\\xa6\\xe9\\xbb\\x84v\\x89\\xdd\\x1a\\xb7\\x14\\x10aog\\x94\\x84!\\xdf\\x9a\\xd7\\xb3bt\\xf0"
  686.  
  687.  
  688. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x1cj\\xc7\\x8d\\xfc\\x05ij\\xc5>\\x8c\\xb4\\x00td\\xd7\\xcdfc\\xb0\\xc0\\xe6\\x8c#,x\\x04\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  689.  
  690.  
  691. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8ev\\x84\\xe3w\\xefy+\\x94\\xa6\\x08c\\x00\\xc9\\xf18\\x16\\xfbs\\x9e\\xd80s\\xa4\\x9b\\x85q\\x94\\xa17\\x16\\xcd\\xfb\\xa2\\xdd\\x9dki\\xb8\\x8e\\x1e\\xfe\\x17>\\x1b\\xdfkh\\xbe\\x8bgt\\x8d\\xdbzf\\x08\\xdd\\x12'\\xf4n\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x15l\\xb5\\xf6\\xacsp\\xd6c\\x15\\x84a\\xa3\\x16\\xbb#\\xc7t(c\\xad\\xfbq'\\x931\\xfa\\xc4\\xeb\\xb7\\x17\\x0e!\\x90\\x0f5f\\xc0.\\xd62\\xb2\\xac\\x0c10\\x1a"
  692.  
  693.  
  694. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xf3\\xb5\\xc6\\x05\\xbaa\\xde\\x1b\\xf3i\\x0e\\x18\\xeb\\x02\\x1auk\\xe5\\x07i\\xa4\\x0c\\x8fd\\xec\\x19\\xd5dq\\xc5d\\xad\\xf5\\x8d\\xf2k\\xdbk\\x8b\\xd05\\x94\\x11\\xe4\\xc6\\x00x\\x82\\x98d\\x9b\\xd4\\xf2\\xb68\\x0c.\\xc9\\xfa\\x7f-:\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8a-p(\\x15t(nj\\xa7\\x13\\xefb5\\xbco\\xd6\\xaeg\\xa3d?\\xd8\\xa9\\xba\\xb7$\\xf6p\\x84'\\xd1&*\\xf1\\xc7ax\\x8a\\xe0\\x00\\xef\\xff\\x9d\\x95\\x1a"
  695.  
  696.  
  697. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\xc5y\\x99b!\\xa7\\xa2\\xd2p\\x8a\\xbd\\x845\\xa8\\x0cl\\xdb!ng|h\\x7f\\xfd^a\\xc8\\xd8\\xeet\\xffd\\xf5\\x1e\\xff\\x8ey\\xb2\\xb7vr\\xd8u\np\\xe4 \\x98\\x15%\\x00\\xb3z\\xb8\\xb0\\xd7\\xe7nb\\xe1\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\x04p\\\\x0c\\xb7e\\x11\\xfe\\xe21\\xba\\xa2g\\xc2\\x80\\xab*j\\xe6\\xb6\\xf9\\xd3~\\xce\\xd8c\\xce\\x14\\x0fc9b\\x86\\x96\\xa7te\\xb0s\\xb1\\x14\\xb7u\\x7fg\\xb5e"
  698.  
  699.  
  700. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xca\\xc7\\xf9\\x04\\x85\\xb8z\\xca:\\xc2f\\x80\\xfc\\xf5b\\x8c\\xd6y\\xe2\\x90d\\xae\\xfby\\xd6@\\x9d\\x08t\\x13\\x9fz\\xe4\\xfa\\x15/\\x92\\x82\\x15\\xce\\xa4\\xf5\\x85\\x88\\xf6\\xe3\\xeek\\xf6\\x02\\x1c5\\xd9\\x91oz\\x81p\\x84\\xb0\\xe7d\\x04\\x01\\xe3\\x01u\\xd1)6\\x8a\\xe7\\x99r/4\\xc2\\x0c\\x8d\\xa3\\x9b\\x03\\xbc\\xa0z;\n\\xf3\\x12r\\xbfmj\\xd4\\xc2\\x94\\xb0\\xe7\\xa3\\xbcb\\xdd\\xdf\\x88\\xda\\x90g@\\xa48|\\x1dco\\xe3\\xf4_o\\xd8\\x84l\\x10\\xb2&x\\xa1\\x8e2\\xb3\\x84\\x05m:\\xeb\\x19\\xfew\\x16\\xd8\\x03\\xbe6yr\\xca:\\xb3\\xfdd\\xae\\x90\n\\xc5\\x94\\x16\\x8d\\x86\\xde<k&\\xb1\\xaa\r\\x81\\xc4\\x05:e.\\xdej\\xf2\\x85\\xdbb\\x96\\xcc\\xd4\\x8a\\x05\\x94l\\x80\\xd6\\x93\\xdd\\xad<a\t\\xdc\\x9a\\xa7\\xca\\xa5\\xad\\xfc\\xf0g\\xbd\\xcc\\x11&=\\xfby/t\\xfec\tgi\\xc1/==g\\x06s\\x91\\x16\\xbc/\\xc2s\\xdf\\xee\\xcd\\x9dx\\xc7\\x88)2\\x142\\xdb\\xda\\xe0c\\x08\\x15\\xf8\\x96"
  701.  
  702.  
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\xc5\\xec\\xe0\\xb9mk\\xcc\\xc9\\x85\\x19\\xb56\\x06\\xf7\\xeb\\xc8\\xefy\\x98s<(az\\xaf\\x81\\x9e\\x19\\xf1\\x8b\\xc3,\\xf3\\x91m\\xd5n`\\xad\\x18\\x8a2\\x04a\\xe0k\\xf7\\xcb\\x1a)\"%\\xf5\\x13(\\x89\\xce\\x86\\x84\\xc0xfs6\\x9b\\xca\\xb4\\x99<<_y\\xd5<%p\\xeev\\x857_6\\xe8\\x81\\x06\\xff%7\\xb7\\xaa\\x0f\\x8b_\\xcdq@\\x10\\x02/jyh\\x07\\xdb\\x82\\x8dm\\x17\r\\x9c*\\x80\\xf6\\xf2$\\xa9h\\x8cvowv\\x8b\\xc3\\x02`\\x9f \\xc3\\x85\\xc0\\xd6\\x82\\x82\\xce!$\\x8c\\xca\\x99-\\xa7\\x14\\xe6#\r\\x1e\\xa3\\xf8\\xd9\\x1c\\xc8\\xfb\\xb6\\xe5\\xd4\\x03\\xac\\xfe\\x8a\\x93\\xc37\\x9d%giqa\\x91\\x88\\xe3\\x15\\x0cp\\xe1\\xebc\\x02\\xed\\xd7\\xcc\\xaf\\x0e\\x92\\x83c\\xd2t\\x7fi\\x9c\\x80\\xe7'\\xe8\\x034\\x84\\xe4\\xf1\\xf0\\x97!\\xbb\\x9b\\x17\\xea\\x92\\x93\\x86\\x86\\xe19y\\xb1\\xff\\xc3\\x7f\\xa5\\x1a\\xf5\\xde\\x08vho\\xddi\\xd4\\xf0g\\xcb\\x7f\\xa3\\xb4\\x88\\x80\"4\n\\x1d\\xb2\\xc6\\x03\\xa9\\xd3"
  704.  
  705.  
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfay\r\\xe6\\x86)\\x87\\xf8\\x887j\\xe1\\x0b\\xfa\\xff.\\xb0\\x00\\x81\\x99u\\x95\\x90\\xe2y\\x8a\\x01\\xc2^\\xe7\\xc3\\xec\\x98\\xae\\xa6\\x91\\xfb\\x9dx\\xb2\\xf2=\\x9f\\x13\\x01y\\x9d\\x19\\xf0\\xae^\\x8a\\xa5\\x8e\t\\x9b>*\\xffkpfb\\xf4\\xb6\\xbf\\x11r1_\\x11\\xdaa\\x1b\\xdd\\xfbc\\x8bcz\\xc5\\xf6\\xc6\\xf5x\\xe86\\x91d\\xaax\\xf2\"\\xdb\\xce\\xaaw\\xc2nx\\xcd\\x18s&\\xac\\xe0\\xec\\xd4c\\xf4\\x1bc\\xff .\\x95\\x86\\xdb\\xbc\\xf4\\xd55\nwf\\xfb\\x1c\\xd4\\xa2\\xd8\\x95\\xa5\\x8d\\xdc o\\xc9w3\\x03\\xc7\\x96\\xd5ivr\\xed\\xb9qj\\x9bu\\xcf7e6\\xb6\\xed\\x95\\\\xf1=\\xf7\\xf5\\x8e\\xf7\\xb6\\xb33ac\\xc8\\x17\\xff\\xc8\\x1fy\\xe1\\xfa\\xd4\\xce\\x89\\x92\\x00j\\x08\\x98\\x11\\xdce\\xea\\xff\\xf0\\x8f\\x94\\x97\\x16\\x1d\ny\\x07\\x88n\\x91\\xe6\\xf2*\\xe9\\xfb\\x03\\xf1\\x18gis\\xf0\\xbc*xu\\xe9t.\\xd6\\x96\\xff\\xb2wg\\\\xf7\\x7f\\xb5g\\xe1,\\xe6\\x9dijp\\x84s\\xf3q\\xc7)"
  707.  
  708.  
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9o\\xed\\xcdn\\x92\\x9fg\\x13b-\"\\xa0_fj\\x86\\xe7a\\xa9o\\x84\\xce\\x99\\xe2\\xa53\\xaav\\xf5d\\x18m\\xfd3\\xbf\\xdf\\xf5)\\xb1x\\x05\\x8an\\xba\\x10\\xa3\\x18 \\x13s\\x7f\\x80i\\xcan\\x93\\x04qf\\xfa\\xdf\t\\xff3osr\\x81\\xc7>\\xd4\\xf7\\x8em \\xabrv\\xca\\x87\\xfd\\x8c\\x04\\xb5c\\xb6\\xc7\\xf6\\xb1\\x11\\xaad4\\x80?\\x1bu\\xdb\\xa0\\xd0\\x90\\x96)\\x9ep\\xf9\\xee0xy\\xafi^zl\\x9f\\x9ev\\x1e\\xe3\\x86\\x0e\\xcf\\xc7\\x15\\xaf\\xf4d\\xde\\x17\\xfa\\x90kl\\xc9\\xd7c\\xa1\\xe5zk\\xf0s#\\xd4*~ 4\\xc9\\xbal\\xef\\x8ft\\xbd\\xdd\\x8f\\x9eb\\x0e+\\xe7\\xd64n\\x9f\\xf0z\\x812\\x8f\\xafd\\xdc\\xe2\\xf5\\xc7f\\x80kv\\xba\\x18\\xe5\\xe6p\\xd2\\xa1\\xc6\\xd5\\x05\\xc68\\x12 w\"\\x00\\xa9,\\\\x05*:\\x9d\\xa8\"\\xcc)\\x8b3\\xdd\\xba\\xb8c\\x10v\\x14\\xefp\\xcdo\\x9b#\\x96p<|1*\\xcb9\\x9d\\x96:m\\xbc\\xa2x\\xaf>h\\xac9\\xc3p"
  710.  
  711.  
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\xa3\\xafh\\x06,\\xc9\\x8f\\x8e?\\x82$\\xf9\\x05\\x131\\x1e|\\xf1\\x04\\xa2axr\\xdc\\xeb\\x98\\x81\\xfbq\\xbas\\x8a\\x07f\\xb0\\xb6s\\xfc,\\xd2\\xdbz\\xea\"\\xc5\"\\xc4\\xe3\\xd7\\xa0\\xcc`j\\x974\\x9bv \\xa7\\xc8\\xa9v7\\xe8\\x9e\\x8d\\x92\\xc6\\xef+k(\\x881\\x0b\\x1a\\xa4\\xd0\\xbbj_\\xc3w\\xd2\\xb7\\xfex\\x9f\\xfb\\x8dg\\xfd\\x06\\x86\\xde \\xcb\\x05\\xcf\\xe1s\\xb9e;\\f\\xe53\\x03z\\x81\\x1bv1|\\xdfi7~n\\xb1\\x83gvv\\x80\\x8c\\x82\\xca\\x1c!\\xf90\n\\x13\\xdcta@\\x9b\\xf8\\x9f\\xbd\\x16\\xa2o\\xcbk/e\\x06@\\xa2_69t\\xb5$\\xaa\\xd8\\x959t\\xd5\\xcf\\xda\\xfd\\xd1k\\xaa\\x14\\xf5\\x9b\\xa53\\xe9\\x80d\\x86\\x8f\\x15\\x9bz@\\xcc\\x17\n\\xa7\\xffj\\xd3)a\\xa4#\\xe2z8u3\\xd7\\xc9\\xe1/#\\x11\\x8b\\xb2-,\\xcb+\\x01\\xe5\\x1b\\xe5&\\x8c\\xbdwax\\x8b\\xb6\\x91c\\xd8k\\\\x06\\xa3\\x85\\xf5\\x96\\x81\\xb5\\xedb\\xe8\\xdf\\xe6\\x0f\\x0be\n\\xaf"
  713.  
  714.  
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15+>\\x8a\\xfb@\\x12\\xc3fk\\xae \\x18\\xd2h\\xec\\xd8\\x87|\\xadl\\xa0\\x81\\x1ad\\x1a\\xe3r\\x0bo\\x1c0\rl\\xa6\\xf9\\x91\\xebh\\x8e\\x9f\\xe3\\xf2\\x14\\x96\\xd2@3|\\x96(\\xb1l^unz\\x9b1~\\xe3gq\\xfd\\x0b\\x146\\xa9\\xcezj \\x9a\\xe3\\x95 \\xb2,\\xf1\\x9f\\x84p\\xaf\\xd2o\\xa9\\xf3\\x1b\\x9d\\x11\\x16\\x0f\\xbf\\xdbkb\\\\x02\\x97\\x05\\xa8j\\xf5\\xa6\\x0fq\\x00c#\\x1f\\xcee\\xa4\\xab\\x8b\\xfds\\xca=\\xfe:\\x7f\\x9b\\xb3\\xa3\\x0c\\x08\\xae\\x1f\\x8a\\x9f\\xc5_t\\xd0p\\xedsa\\xb2qr\\x8a\\xd2\\xfd\\xad\\x02\\x9a\\xb0\\xbe\\xac\\x88(\\xf3\\xda\\x9fn\\xc8\\xa9c\\x92mxz\\xe4\\xb1ux\\xbbz\\xc4\\x05\\xc3\\x073\\xc4r2>\\x07#\\xc4oqkh\\x06\\x0b?\\xe1\\x80!\\x95\\x98\\x98y(\\xdf\\x0c\\xab\\x8d\\xf0\\xc1\\xa5*\\xeb\\xb4\\xd6/\\xb3\\xecjd+3k\"\\xe6j\\x873b7\\xe8\\xcc\\xac\\xad7\\x96\\xefl\\x833\\x80\\x0f\\xb8\\xbc\\x03\\x81n\\x07\\x9b\\x83y\\x132\\xa9\\xcf\\x07\\xe6"
  716.  
  717.  
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7i\\x91\\xa8\\xfb\\xe1p1\\x96\\xec\\xa0\\xfd\\xeb\\x04\\xc3\\x0c\\xcejsm\\xa8g\\xc33\\x05\\xa4\\xe6\\xb1c\\xb4\\x92\\x8e3\\xb9\\xe7\\xb9\\x07\\xfcv\\x04l\\xa5$\\xf8\\xe0\\xd9\\x982\\xf77~_o\\xcby\\xea8\\xa0p\\xf8\\xbc\\x94\\xea\\xbc\\xb7\\xa8\\xef\\xe6\\xb8\"+d/\\xe9\\x00h\\xbeb\\xf9\\x06\\x8d\\x00$\\x90\\xbb\\xef\\xb6\\xfc\\xa6bg\\x97\\xc5\\x8a\\x98\\xf4\\xce\\xd1n~fy\\xc4zj\\m\\xac',\\x96\\xeb\\x98\\x91\\x93\\xa0\\x11p2\\xc3\\x9c f\\x07';\\xa3\\xfe\\xa46\\x8f\\xc9\\x98\\xe7\\xfa8\\x94\\xcc\\x98k\\\r\\xacs\\x91\\x8f)+\\xa1ye#\\xef\\x94\\xa3\\xbe\\xbd\\xfe\\xfe\\xbd\\xae\\xadga\\xc1itg\\xba\\xd3\\xa8\\x02|\\xae\\x96i?e\\xf3q\\xad\\xa3\\xa2x&\\xda^u\\x996\\xc1\\xc8ac\\x19\\xa3b\\xda\\xddl\\xba\\xcf\\x83nj\\xe9\\xd1\\xc4\\xa4\\xf3f\\xc6\\xff/k\\xba\\xa5\\xd2z\\xf1\\xee+x\\x8c\\xadlk;\\x95\\xb3\\x05;\\xa8@\\xae\\xd6\\x15\\xad\\xb5=(\\x19\\xff\\xf0s\\x7fb"
  719.  
  720.  
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18\\xccu\\x05\\xb7ap\\x15re\\xcd\\x85frf2l\\xf9\\xadkp \\x17\\x1b\\x87-\\xba\\xec22\\xfb\\xc4?\\x82\\x12a\\x82\\xaa\\xd4\\\\xbc+ay\\xbel\\x0e\\xfb(\\\\xd3m\\xdb\\xb9\\xd4\\x99\\x82:g\\x1a\\xbd\\x99\\xe8)\\x86\\xba\\x86v\\xc4)\\x98nl\\xba\\xce\\x08)\\x8c\\x9d\\x8e\\xc4\\x86\\xf6\\x92pk\\xe0\n\\xe00\\xf0\\x81\\x9e\\xb6qp\\xbd\\xef\\x11+\\xfa\\xb1\\xcf@\\x8b\\x1a\\xa0~\\x95\\xb9g\\x0b@\\xb7ta\\x7f\t\\xc5t\\x921\\xb2\\x83@\\x83x\\xf2\\xa3\\x17e\\xad\\\\xd8um\\xa2\\xb8\\x00\\x11\\xd2\\xf7\\x86\\x04\\xcd\\x87~\\x1b\\x95\\x13\\xdc\\xcc\\xf8y\\xdbx\\x84\\xd2zw\\x0fr\\xdb\\xe0\\x90\r,\\x06\\x84d#\\xd4\\xcc_\\xaa\\xe6yl\\xaf\\xad\\x14\\x9enu\\xfe\\xf6\\xd5\\xf6\\xf0\\xe9\\xbal90\\xa5\\x7f8s3w\\x94ar\\x7f3\\xe0\\x8f%\\x11t`\\xddn \\xd1\\x1e9\\xaa\\xec:\\xc9;3\\xadl\\xde\\xef$\\x06\\xad\\xd7\\xcey\\x93\\xf4\\x16\\xd1t\\xaf\\xf6\\x95\\x13\\xbb\\x85\\x1a"
  722.  
  723.  
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab_\\x99g\\x9a\\x936\\x9eg\\x9e\\xbc\\xd5\\xca\\x07\\x9d\\xe3\\x10\\xad\\xe5\\xbes\\xed\t\\x11g\\xf3d\\x94b\\xc5\\x18\\x88ev\\x84\\x8ao\\x94\\xf1v,\\x00\\xcc\\xacj \\xba\\x00e\\x0ey\\xb5|\\xc8 y\\x12\\x8dp\\x14\\x92bk\\x9ex\\x1b/\\xe6\\xfd_\\xd7\\xc4\\x8a\\xf5\\x0b\\x13b\\xd2\\xe2\\xfb\\x1bu,\\x88\\x0c\\xd5\\x18\\x1b\\xf9\\xe9f\\x80\\x1fz\\xd8t\\x07\\xa0\\xb9\\xaa\\xee\\xfb\\x0b \\xbc>\\xcd\\x11\\x93\\xf8\\xc5\"\\x97\\xfd\\xb7k\\xc8\\xf4tf\\xde\\xfb\\xd1\\xa2k\\xcf\\x9c\\x8at\\x85-\\x8f\\xab\\q\\xb4\\xd4\\x18\\xd6\\x04\\x89cv\\xa1\\xbf\\x8a\\x9a\\x90\\x1a\\xe8:\\xb6\\xc3'v\\xa0\\xea\\xcc\\x9a1\\xe9\\xef\\x8e\\xdd\\xc4\\x9c\\xff\\x8a)f\\xe6\\xff\\x7fqd\\x01\\x82\\xa3\\x13\\xd0\\xf6\\xde\\xcf\\xdf\\xb0\\x11yq\\xe9&\\xc2\\xdd'e\\xaes\\x9e\\xfa)\\xdb\\xe4\\xe5\\x92x\\xb2\\x84\\x1f2\\xa8q`\\x04\\x192\\xf6\\xe2\\x94\\xebf0\\xbb\\xf0\\x1fb\\xa4\\xd6\\xbf\\xf6\\x1f'\\xdd\\xc8+\\xa6qg\\x98\\x7f@\\xb6/y?\\x8dt"
  725.  
  726.  
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?1\\x17?\\xbabg\\xac\\xd5\\xc5\r*\\x8a\\xfe\\xd2\\xf9\\x0f\\x1d\\xfcs\\xba6\\xb6\\x893\\xc0\\xcde\\x0ch\\xe7\\xedh\\x94\\xab\\x0be\\x8f\\xc8\\xa0\\xcd\\xc8\\xd2\\x1f\\xc9\\x00\\x14c\\xa3\\xba#\\xfa\\x00taaw2\\xf47@\\x93m\\xc93\\xad\\xd9\\xd6\\xbc\\xb8<q\\xf4\\xb5\\xffl\\x1bf8,\\x01j\\x9f\\xdc%w~fq\\xe5mfw\\x17e\\xbe\\xeb\\xd7\"\\xd8\\xd8\\x06\\x15\\x849o(,1\\xd0\\x17\\xb1\\x83\\x08\\xfe_y\\xb7\\x1fn$i?\\x8b\\xe0g\\x07\\xb3\\x14\\x83b\\x1b\\xe9^\\xd4\\x9d\\x9b\\x05i\\x07\\x9ev\\xb6p\\xb31g.\\xa2\\x9f\\xb8t\\xaevr\\xe3u\\xd7\\xfci/\\xa3\\x90\\xed\\xf3\\x0c\\x81\\x98\\xd3\\x9b\\x0b\\x9b>n\\xfe\\x06!\\x02\\xc4a\\xdf\\x11%7q\\xf4oy\\xbdjn\\x1a\\xce\\xb6\\x87?:\\x81\\x07v\\xcf3\\xf91\\xf7\\xdc5zi\\xael\\xc0\\xb5\\x97\\xfa\\x7f\\xc5\\xd9c\\x06y\\xa2\\xf2\\xbdh\\xd0\\xe1)f\\xf7\\x11\\x9a\\x94>\\xa5\\xd8e\\x01\\xa5\\xb7\\x19nr\\xeaf\\x87\\xff"
  728.  
  729.  
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x84\\xd9\\xf9\\x99t\\xc4\\xa7\\xdb\\x9d\\xdaq\\xcd\\x96\\xf3\\xf9r\\x0e\\x9a&\\x12\\xf4m|5\\x94q\\xc2\\x13wx+\\x97:\\x04\\xc2\\xbf7&\\xc3\\x7f\\xcc\\xf34\\x06\\x87\\xe9\\x9e\\xb4)~\\x01/v!9wa\\x99\\xf1\\x8e\\x97\\xbfv\\x95d\\xdc\\xa3\\x9c\\xe6g\\x88\\x9es\\x0e\\xf3\\xca\\x82\\xec\\xd3\\x83-\\x9d\\x91\\xc1\\xf7e\\x99^\\xad\\xb8\\x1ea\\x10\\xe2\\xf4w\\xae;\n\\xd0\\x97 \\xcdi\\xca\\x0cv\\xf7\\x12\\xb6u\\x00d\\x8f\\x96\\xab/\\x15\\xe7;5\\x8d\\xa7\t\\xfes#\\xa7\n^bg\\xaer\\xe6\\x83\\x8f&c\\x8b\\x1ap\\xb6dc\\xb6\\xbe\\x87\\xac\\xd0\r\\xcc\\xb2\\x19\\xa3#\\x81\\xf7\\xf6\\x95q\\xe4e\\xa6\\x94\\xb4j\\xaf\\xday\\xe8\\(\\x9de\\x1a\\x95\\xea\\xd7\\xd4\\x8c\\xd6c\\x16\\x8em*\\x06!h\\x8f\\xf5\\xd5y\\xa1e:z14\\xfe=\\xd5|;\n\\xed\\xd2\\x9a\\x9c\\xe5s\\x08)\\x8c\\xa8`\\xeceh\\x0f\\x89\\x00\\x96\\x86z\\xf4\\xe4~\\x10\\x93\\xe4a\\x0f\\xd6x\\x1ds\\xf2q\\x12\\xa0\\x89m\\x93\\xfaw\\xe6"
  731.  
  732.  
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\s\\xabg\\xe5\\x00\\x83\\xb3\\x02vg#\\xc7od\\xbaz\\xc7@\\x00^,\\xf7\\x95\\x99\\xf4\\xbbl\\x15l\\xf6b\\xb2\\x92|\\xf3\\xb0\\x87f \\x19\\x04n'(i_\\x1clt\\xb5\\x81\\x17\\x92\\x85\\x00\\<\\xf5\\xea\\xf8\\xeabe\\xf3\\xbf\\xfa\\xc3\\x18>\\xdb\\x1f\\x1f\\xea\\xdd\\xc4p\\x8d\\x0c\\xb6\\xbc\\xdd\\xf7\\xa0\\xc3\\xaeg\\xae\\xb0\\x89\\xe9\\xa3\\xa7\\xdc\\x84\\xb6lk\\xa0\\xc9\\x89\\xc9\\x02g\\xe7z\\x143\\x7f\\xc2\\x9eu\\xad\\x80r\\xcd\t\\xd1\\xab?\\xd1\\xcf9\\xa9;x\\xe8\\xa1\\xbe\\x91\\x80z\\x8886e\\xc5\n\\xdd\\xdde?\\xd1\\xd5zs\\x90\\x8fl4\\x92\\xd3h\\x9al\\xde\\xbf>\\x19\\x8d\\xca\\x95\\xd3\\x1e\\x89\\x02\\x12\\xa4\\xa2\\xfb|\\xf4\\x9f\\xa6f\\xd8\\x05\\x85\\xa1\\x92nf\\xd9\\x84\\xf4\\x80\\xd8&\\x874ib$sm\\xc7\\x18n\\xed\\xc4\\xechr\\x17\\x81n\\x95\\x0e<\\x12gt\\xa9\\x81\\xe2\\xaf\\xd8$%:p7@\\x05\\x97\\x85\\xa8f\\x1b\\xd78\\xa6'\\x8b\\x00)4\\x9ba\\x18\\x132c\\xa4"
  734.  
  735.  
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xe9'\\xe4vx\ti9\\x9d6o \\xa9\\x0e\\x9f\\x9b#bn\\xa1\\xfb+\\xc5\\xe4nn^\\x9an-\\xcd\\x94jv\\x1aw\\x1d\\xa1\\xfd\\xe1\\x88\\xc4\\x98d\\xda\\xca\\x14s\\\\x8e3\\xa7\\xeef\\xe2>\\x9e\\xb4+\\xfd\\x0ea\\xcb6\\x8b\\xbf\\xc2\\xc9\\xf2\\xd1\\xaf\\x06\\xbcnmy\\xd5_\n\n\\xa6\\x04.\\x0c\\x11$yu\\xbf%\\x80e\\x9b\\xa3e-\\xb6\\x81\\x05g\\xa6\\xe5\\x15\\x90hy-n\\xc7\\x80\\\\x17\t\\xf2)\\xc3\\xb0\\xfeg3\\x05\\xea\\xe6\\xd7\\x88\\xcfe\\x1dd_\\x8a\\xc0o\\xc6\\xa8-\\xcf-\\xef\\xd0\\xbc\\xd0\\xc1\\xce\\xc0\\x9d\\x06\\x7f\\x98\\xd2\\xf9\\x98\\xcc9\\xe5\\xee\\xa9\\x07b=\\x9f<\\xc5\\xea\ri\\x02q\\x01;\\xa5edj8f\\x82\\xe9\\x83*\\x88\\xc7\\x9d\\xedlpd)3\\xadt<\\xf7\\x04h\\x7f\\x19\\xfa+\\x94q>o\\x08\\xf2\\xf9twr_ d\\xad\\x90\\xaa3&\\xe4\\x9f%q\\xcb\\x98\\x14;x\\x05\\xdelm\\x84f\nf\\xb8\\xa7\\x1f\\xb3\\x00\\xb96k\\x93;\\x10\\xf6\\x8c"
  737.  
  738.  
  739. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda8\\xf9\\xa36\\x80v#\\xd0\\xf8\\x88\\xfd\\xaa\\xfb:`\\xf5d@i\\x048\\xf9\\xe9i\\x8a\\xd3\\x1es*)\\xd6\\x7f#\\xab\\xb81\\xb1\\xbf/\\x11\\xc6\\xeb\\xb8*\\x19;>\\xec\\xdf\\xea?c\\x06y\\xf2\\xc8\\x82\\x06\\x88\\x11'\\x84\\x9c(\\xa8#,\\x13\\xf4\\xb8c5|$\\x80\\x9d\\xe0\\xacn\\xc93^\\xe5\\xa4x\\xcez\\xae\\xcc>\\xbd\\xaf\\x02\\xdd\n\\xc7\\xe7\\x81s\\xf3\\xeak\\x83\\xb0\\x06\n\\xbe\\x10\\x07llb\\xc9\\xa2\\xc0~\\x97\tk\\xf4\\xe9k\\x00\\xf7y\\x1d;\\xd1n \\xfdrl\\x1fh\\x86\\xd2\\x82\\xd6v\\x85:*\r\\x00\\x84\\xf0b\\x12d\\xb9\\xa7\\xb2\\x0b\\x9f\\xf2^\\xce\\x04\\x8c\\xd1\\xfd\\xb1\\x83\\xc3\\xbbcu\\xfc\\xcd\\xfc\\x1bz\\xfb\\xac@\\xcc&\\xceq\\x94.\\x8d\\x0c\\xc3\\xc5\\x0e\\xe75\\xea\\x86kbs\\xfc\\x04\\x8au,\\xb1\\x0f\\xf7u6lm\\xbf\\xe7,\\x1a\\x89\\x9e\\x9c!~\t.\\xabd\\x07\\x14st\\xdb\\xcd\\xa6\\xc7f\\xbf9\\x02\\xd9\\xb0\\xc6t@n\\x12h\\xc5\\x91nm\\xbc"
  740.  
  741.  
  742. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  743.  
  744.  
  745. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  746.  
  747.  
  748. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: tue, 16 jul 2019 05:01:15 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  749.  
  750.  
  751. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  752.  
  753.  
  754.  
  755.  
  756. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  757. "Details":
  758.  
  759. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  760.  
  761.  
  762. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  763.  
  764.  
  765. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  766.  
  767.  
  768. "McAfee": "Exploit-CVE2017-11882.ah"
  769.  
  770.  
  771. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  772.  
  773.  
  774. "Symantec": "Bloodhound.RTF.12"
  775.  
  776.  
  777. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  778.  
  779.  
  780. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  781.  
  782.  
  783. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  784.  
  785.  
  786. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  787.  
  788.  
  789. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  790.  
  791.  
  792. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  793.  
  794.  
  795. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  796.  
  797.  
  798. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  799.  
  800.  
  801. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  802.  
  803.  
  804. "TrendMicro": "Possible_SMBCVE20170199"
  805.  
  806.  
  807. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  808.  
  809.  
  810. "Sophos": "Exp/201711882-P"
  811.  
  812.  
  813. "Cyren": "CVE-2017-11882!Camelot"
  814.  
  815.  
  816. "Avira": "HEUR/Rtf.Malformed"
  817.  
  818.  
  819. "MAX": "malware (ai score=94)"
  820.  
  821.  
  822. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  823.  
  824.  
  825. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  826.  
  827.  
  828. "AhnLab-V3": "RTF/Malform-C.Gen"
  829.  
  830.  
  831. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  832.  
  833.  
  834. "GData": "Exploit.RTF-ObfsStrm.Gen"
  835.  
  836.  
  837. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  838.  
  839.  
  840. "Zoner": "Probably RTFObfuscation"
  841.  
  842.  
  843. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  844.  
  845.  
  846. "Ikarus": "Exploit.CVE-2017-11882"
  847.  
  848.  
  849. "Qihoo-360": "susp.rtf.objupdate.gen"
  850.  
  851.  
  852.  
  853.  
  854. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  855. "Details":
  856.  
  857. "target": "clamav:Rtf.Dropper.Agent-7076494-0, sha256:e579215a73e2e33a07f007bb162ef69c534c7227b78d1e905957a471199cb6d6, type:Rich Text Format data, version 1, unknown character set"
  858.  
  859.  
  860. "dropped": "clamav:Rtf.Dropper.Agent-7076494-0, sha256:e579215a73e2e33a07f007bb162ef69c534c7227b78d1e905957a471199cb6d6 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_03ea1072931ef1d9fa24e9605413b4b6.doc, type:Rich Text Format data, version 1, unknown character set"
  861.  
  862.  
  863.  
  864.  
  865.  
  866. * Started Service:
  867. "osppsvc"
  868.  
  869.  
  870. * Mutexes:
  871. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  872. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  873. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  874. "CicLoadWinStaWinSta0",
  875. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  876. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  877. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  878. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  879.  
  880.  
  881. * Modified Files:
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_03ea1072931ef1d9fa24e9605413b4b6.doc",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_03ea1072931ef1d9fa24e9605413b4b6.doc",
  884. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF61436E6B-329F-49CA-8103-0DDC165ACC4E.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28B3C6E4-9F6A-45D2-B305-9A1F79AF28B9.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A4F9D5C-E077-4212-AB3F-0255F170043D.tmp",
  887. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  888. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  889. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  890. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C1.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C2.tmp",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B66.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C22.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C24.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C36.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C23.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C25.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDE.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDF.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDD.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DEF.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E1F.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E31.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E41.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E42.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED0.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED3.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EE4.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EE5.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E30.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF6.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED2.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED1.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF5.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F39.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F49.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF7.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F37.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F38.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F5A.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F99.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5094.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50C4.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50E5.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50F5.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab528C.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab529D.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab554E.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55CC.tmp",
  932. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  933. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57B1.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57F0.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab592A.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5969.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59E7.tmp",
  939. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B9E.tmp",
  941. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D54.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D55.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EFD.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EED.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F0E.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F30.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F2E.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F42.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F53.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F41.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F75.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F2F.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F52.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FE6.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFD.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FD4.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFC.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FD5.tmp",
  960. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F64.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FE8.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F76.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFB.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FFE.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FEA.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FE7.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FE9.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar600E.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar600F.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60DC.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6020.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60DD.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab614C.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar619D.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD616D.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD615C.tmp\\BracketList.glox",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD615C.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625A.tmp\\chicago.xsl",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD622B.tmp\\RadialPictureList.glox",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62BC.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD616D.tmp\\Content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD622B.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AC.tmp\\chevronaccent.glox",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AC.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\gb.xsl",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625B.tmp\\PictureFrame.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62CD.tmp\\architecture.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625B.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62CD.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD634D.tmp\\content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD632C.tmp\\InterconnectedBlockProcess.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD633C.tmp\\ThemePictureAlternatingAccent.glox",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635D.tmp\\Banded.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD636E.tmp\\content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63BE.tmp\\ConvergingText.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD639E.tmp\\Equations.dotx",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD634D.tmp\\View.thmx",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63BE.tmp\\Content.inf",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD633C.tmp\\Content.inf",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625A.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63CF.tmp\\APASixthEditionOfficeOnline.xsl",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD632C.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD636E.tmp\\Dividend.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD648C.tmp\\Headlines.thmx",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD639E.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD645C.tmp\\mlaseventheditionofficeonline.xsl",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD64EB.tmp\\content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD64EB.tmp\\Quotable.thmx",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6628.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab66D6.tmp",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63CF.tmp\\Content.inf",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6606.tmp\\VaryingWidthList.glox",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD648C.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6617.tmp\\Berlin.thmx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66D5.tmp\\TabbedArc.glox",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66E7.tmp\\Circuit.thmx",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD645C.tmp\\Content.inf",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar66E8.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66D5.tmp\\Content.inf",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6719.tmp\\ThemePictureAccent.glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6606.tmp\\Content.inf",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6686.tmp\\content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6719.tmp\\Content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6708.tmp\\rings.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6739.tmp\\ieee2006officeonline.xsl",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6686.tmp\\Wood_Type.thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635D.tmp\\content.inf",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A8.tmp\\Metropolitan.thmx",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6816.tmp\\content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6827.tmp\\gosttitle.xsl",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67F6.tmp\\iso690nmerical.xsl",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6708.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68C4.tmp\\gostname.xsl",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6933.tmp\\Crop.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6816.tmp\\Parallax.thmx",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68E4.tmp\\content.inf",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A70.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A2F.tmp\\content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D0.tmp\\HexagonRadial.glox",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6827.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6739.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A2F.tmp\\Frame.thmx",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67F6.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68C4.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66E7.tmp\\content.inf",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A30.tmp\\iso690.xsl",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D0.tmp\\Content.inf",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B3C.tmp\\Feathered.thmx",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BE9.tmp\\content.inf",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6933.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6617.tmp\\content.inf",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BE9.tmp\\Savon.thmx",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A30.tmp\\Content.inf",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6E0D.tmp",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E3C.tmp\\content.inf",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E3C.tmp\\Damask.thmx",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B3C.tmp\\Content.inf",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7245.tmp\\content.inf",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7245.tmp\\Main_Event.thmx",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab73BD.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73DD.tmp\\content.inf",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD745B.tmp\\content.inf",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD745B.tmp\\Slate.thmx",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cab74C9.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab74CA.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar74DB.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD752A.tmp\\TabList.glox",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7666.tmp\\ThemePictureGrid.glox",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7666.tmp\\Content.inf",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7645.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD75F6.tmp\\turabian.xsl",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76B5.tmp\\content.inf",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76B5.tmp\\Vapor_Trail.thmx",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7752.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7753.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD75F6.tmp\\Content.inf",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD782F.tmp\\Element design set.dotx",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD782F.tmp\\Content.inf",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD784F.tmp\\Content.inf",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD787F.tmp\\Insight design set.dotx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78DE.tmp\\CircleProcess.glox",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78DE.tmp\\Content.inf",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\pictureorgchart.glox",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD794F.tmp\\Badge.thmx",
  1135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1136. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1137. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD794F.tmp\\Content.inf",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD787F.tmp\\Content.inf",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A69.tmp\\content.inf",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1145. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1146. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A9A3B170.tmp"
  1147.  
  1148.  
  1149. * Deleted Files:
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C1.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C2.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F2E.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F42.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F2F.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F30.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F75.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F52.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5F53.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F41.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F76.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5F64.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD616D.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD615C.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFD.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FFE.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FD5.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFC.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar600E.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60DC.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FFB.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60DD.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar600F.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD622B.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FD4.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6020.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FE6.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625A.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5FE8.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625B.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FE9.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FEA.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5FE7.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AC.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62CD.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD632C.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD634D.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD633C.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635D.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD636E.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD639E.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab614C.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar619D.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63BE.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63CF.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD645C.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD648C.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD64EB.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD615C.tmp\\BracketList.glox",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A8.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5094.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6617.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6606.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6686.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66D5.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD622B.tmp\\RadialPictureList.glox",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66E7.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED1.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6708.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6719.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6739.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AC.tmp\\chevronaccent.glox",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67F6.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6816.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62CD.tmp\\architecture.glox",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6827.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C36.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab66D6.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar66E8.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63BE.tmp\\ConvergingText.glox",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68C4.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68E4.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625B.tmp\\PictureFrame.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDF.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B66.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6933.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD632C.tmp\\InterconnectedBlockProcess.glox",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D0.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EE4.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A2F.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A30.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\gb.xsl",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C25.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B3C.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD616D.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BE9.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD633C.tmp\\ThemePictureAlternatingAccent.glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD648C.tmp\\Headlines.thmx",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625A.tmp\\chicago.xsl",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F99.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD639E.tmp\\Equations.dotx",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50F5.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E31.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E30.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD636E.tmp\\Dividend.thmx",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cab592A.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66D5.tmp\\TabbedArc.glox",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6933.tmp\\Crop.thmx",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6719.tmp\\ThemePictureAccent.glox",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF7.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E41.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cab529D.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E3C.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD634D.tmp\\View.thmx",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59E7.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6708.tmp\\rings.glox",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63CF.tmp\\APASixthEditionOfficeOnline.xsl",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F5A.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6827.tmp\\gosttitle.xsl",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E1F.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DEF.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D0.tmp\\HexagonRadial.glox",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6606.tmp\\VaryingWidthList.glox",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E42.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635D.tmp\\Banded.thmx",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6739.tmp\\ieee2006officeonline.xsl",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F37.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57B1.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F39.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD645C.tmp\\mlaseventheditionofficeonline.xsl",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6617.tmp\\Berlin.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67F6.tmp\\iso690nmerical.xsl",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C23.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B9E.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F49.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66E7.tmp\\Circuit.thmx",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6686.tmp\\Wood_Type.thmx",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A2F.tmp\\Frame.thmx",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EED.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\cab554E.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68C4.tmp\\gostname.xsl",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50E5.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A8.tmp\\Metropolitan.thmx",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF6.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57F0.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68E4.tmp\\Droplet.thmx",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6816.tmp\\Parallax.thmx",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD64EB.tmp\\Quotable.thmx",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B3C.tmp\\Feathered.thmx",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BE9.tmp\\Savon.thmx",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D55.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7245.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D54.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A30.tmp\\iso690.xsl",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EFD.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5969.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F0E.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDE.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E3C.tmp\\Damask.thmx",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62BC.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73DD.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD745B.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD752A.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab74CA.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar74DB.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73DD.tmp\\Mesh.thmx",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD752A.tmp\\TabList.glox",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD75F6.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A70.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7666.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7645.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F38.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76B5.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7245.tmp\\Main_Event.thmx",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6628.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7666.tmp\\ThemePictureGrid.glox",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED3.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7753.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD745B.tmp\\Slate.thmx",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7645.tmp\\sist02.xsl",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6E0D.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C22.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD782F.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD784F.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78DE.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD794F.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD782F.tmp\\Element design set.dotx",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cab528C.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD75F6.tmp\\turabian.xsl",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab78FE.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar78FF.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C24.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76B5.tmp\\Vapor_Trail.thmx",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD784F.tmp\\harvardanglia2008officeonline.xsl",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cab73BD.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\pictureorgchart.glox",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78DE.tmp\\CircleProcess.glox",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DDD.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A69.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4ED2.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EF5.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD794F.tmp\\Badge.thmx",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55CC.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD787F.tmp\\Insight design set.dotx",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A69.tmp\\Basis.thmx",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\cab74C9.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50C4.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_03ea1072931ef1d9fa24e9605413b4b6.doc",
  1352. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1353. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A9A3B170.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28B3C6E4-9F6A-45D2-B305-9A1F79AF28B9.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A4F9D5C-E077-4212-AB3F-0255F170043D.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1DEA.tmp.cvr"
  1357.  
  1358.  
  1359. * Modified Registry Keys:
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\mj8",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\92D31E",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\92D31E\\92D31E",
  1371. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1614. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1616. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1617. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1618. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1983.  
  1984.  
  1985. * Deleted Registry Keys:
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\mj8",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\z\"6",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\92D31E\\92D31E",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1994.  
  1995.  
  1996. * DNS Communications:
  1997.  
  1998. "type": "A",
  1999. "request": "indaiacollection.com",
  2000. "answers":
  2001.  
  2002. "data": "46.105.57.169",
  2003. "type": "A"
  2004.  
  2005.  
  2006.  
  2007.  
  2008.  
  2009. * Domains:
  2010.  
  2011. "ip": "46.105.57.169",
  2012. "domain": "indaiacollection.com"
  2013.  
  2014.  
  2015.  
  2016. * Network Communication - ICMP:
  2017.  
  2018. * Network Communication - HTTP:
  2019.  
  2020. "count": 1,
  2021. "body": "",
  2022. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2023. "user-agent": "Microsoft-CryptoAPI/6.1",
  2024. "method": "GET",
  2025. "host": "ocsp.digicert.com",
  2026. "version": "1.1",
  2027. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2028. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2029. "port": 80
  2030.  
  2031.  
  2032. "count": 1,
  2033. "body": "",
  2034. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2035. "user-agent": "Microsoft-CryptoAPI/6.1",
  2036. "method": "GET",
  2037. "host": "ocsp.msocsp.com",
  2038. "version": "1.1",
  2039. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2040. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2041. "port": 80
  2042.  
  2043.  
  2044. "count": 1,
  2045. "body": "",
  2046. "uri": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/bey.msi",
  2047. "user-agent": "Windows Installer",
  2048. "method": "GET",
  2049. "host": "indaiacollection.com",
  2050. "version": "1.1",
  2051. "path": "/modules/jmsslider/views/img/layers/dir/bey.msi",
  2052. "data": "GET /modules/jmsslider/views/img/layers/dir/bey.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: indaiacollection.com\r\n\r\n",
  2053. "port": 80
  2054.  
  2055.  
  2056. "count": 3,
  2057. "body": "",
  2058. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2059. "user-agent": "Microsoft-CryptoAPI/6.1",
  2060. "method": "GET",
  2061. "host": "crl.microsoft.com",
  2062. "version": "1.1",
  2063. "path": "/pki/crl/products/microsoftrootcert.crl",
  2064. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2065. "port": 80
  2066.  
  2067.  
  2068. "count": 2,
  2069. "body": "",
  2070. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2071. "user-agent": "Microsoft-CryptoAPI/6.1",
  2072. "method": "GET",
  2073. "host": "crl.microsoft.com",
  2074. "version": "1.1",
  2075. "path": "/pki/crl/products/microsoftrootcert.crl",
  2076. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2077. "port": 80
  2078.  
  2079.  
  2080. "count": 7,
  2081. "body": "",
  2082. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2083. "user-agent": "Microsoft-CryptoAPI/6.1",
  2084. "method": "GET",
  2085. "host": "crl.microsoft.com",
  2086. "version": "1.1",
  2087. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2088. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2089. "port": 80
  2090.  
  2091.  
  2092. "count": 4,
  2093. "body": "",
  2094. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2095. "user-agent": "Microsoft-CryptoAPI/6.1",
  2096. "method": "GET",
  2097. "host": "crl.microsoft.com",
  2098. "version": "1.1",
  2099. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2100. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 16 Jul 2019 05:01:15 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2101. "port": 80
  2102.  
  2103.  
  2104. "count": 2,
  2105. "body": "",
  2106. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2107. "user-agent": "Microsoft-CryptoAPI/6.1",
  2108. "method": "GET",
  2109. "host": "crl.microsoft.com",
  2110. "version": "1.1",
  2111. "path": "/pki/crl/products/microsoftrootcert.crl",
  2112. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2113. "port": 80
  2114.  
  2115.  
  2116.  
  2117. * Network Communication - SMTP:
  2118.  
  2119. * Network Communication - Hosts:
  2120.  
  2121. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!