API tools faq
paste
paladin316

Docs_16545303a95cce51093b4eece9d09e66_doc_2019-07-09_18_30.txt

paladin316
Jul 9th, 2019
2,381
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 239.59 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_16545303a95cce51093b4eece9d09e66.doc"
  7. * File Size: 115602
  8. * File Type: "Microsoft Word 2007+"
  9. * SHA256: "5a4e5723e8774f03cd2bad5e98073b10a6042c935e112f5c28195047680422f3"
  10. * MD5: "16545303a95cce51093b4eece9d09e66"
  11. * SHA1: "b3c0e378d852b5d4de2c711a32dc8a490cad0533"
  12. * SHA512: "564ccb48f8d6451eb28432d6c63919a101cd11c8a5c9fa48224b09d459d7e612d922165770f3cbadb4544721dce83b30fa60a916925317b5f935f983cbc53d2b"
  13. * CRC32: "96EC492F"
  14. * SSDEEP: "3072:00AC9BnD3oUsAGFylzHXXLYulykiOkkWeEpA:00TBD4gGAlrXXkxOTN"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "A process attempted to delay the analysis task.",
  25. "Details":
  26.  
  27. "Process": "WINWORD.EXE tried to sleep 446 seconds, actually delayed analysis time by 0 seconds"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  33. "Details":
  34.  
  35. "IP": "52.109.16.5:443"
  36.  
  37.  
  38. "IP": "65.52.98.231:443"
  39.  
  40.  
  41. "IP": "23.15.4.26:80"
  42.  
  43.  
  44. "IP": "69.192.108.32:443"
  45.  
  46.  
  47. "IP": "72.21.91.29:80"
  48.  
  49.  
  50. "IP": "52.109.12.6:443"
  51.  
  52.  
  53. "IP": "23.199.190.133:443"
  54.  
  55.  
  56. "IP": "104.18.25.243:80"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  62. "Details":
  63.  
  64. "ioc": "ontent.inf"
  65.  
  66.  
  67. "ioc": "quations.dotx"
  68.  
  69.  
  70. "ioc": "ist.glox"
  71.  
  72.  
  73. "ioc": "rings.glox"
  74.  
  75.  
  76. "ioc": "rid.glox"
  77.  
  78.  
  79. "ioc": "..3b"
  80.  
  81.  
  82. "ioc": "iso690.xsl"
  83.  
  84.  
  85. "ioc": "turabian.xsl"
  86.  
  87.  
  88. "ioc": "gostname.xsl"
  89.  
  90.  
  91. "ioc": "gb.xsl"
  92.  
  93.  
  94. "ioc": "adial.glox"
  95.  
  96.  
  97. "ioc": "sist02.xsl"
  98.  
  99.  
  100. "ioc": "pictureorgchart.glox"
  101.  
  102.  
  103. "ioc": "mlaseventheditionofficeonline.xsl"
  104.  
  105.  
  106. "ioc": "gosttitle.xsl"
  107.  
  108.  
  109. "ioc": "anded.thmx"
  110.  
  111.  
  112. "ioc": "content.inf"
  113.  
  114.  
  115. "ioc": "chicago.xsl"
  116.  
  117.  
  118. "ioc": "asis.thmx"
  119.  
  120.  
  121. "ioc": "rocess.glox"
  122.  
  123.  
  124. "ioc": "ieee2006officeonline.xsl"
  125.  
  126.  
  127. "ioc": "e.gu"
  128.  
  129.  
  130. "ioc": "ext.glox"
  131.  
  132.  
  133. "ioc": "architecture.glox"
  134.  
  135.  
  136. "ioc": "iso690nmerical.xsl"
  137.  
  138.  
  139. "ioc": "rc.glox"
  140.  
  141.  
  142. "ioc": "chevronaccent.glox"
  143.  
  144.  
  145. "ioc": "set.dotx"
  146.  
  147.  
  148. "ioc": "ividend.thmx"
  149.  
  150.  
  151. "ioc": "harvardanglia2008officeonline.xsl"
  152.  
  153.  
  154. "ioc": "nline.xsl"
  155.  
  156.  
  157. "ioc": "eadlines.thmx"
  158.  
  159.  
  160. "ioc": "adge.thmx"
  161.  
  162.  
  163. "ioc": "ccent.glox"
  164.  
  165.  
  166. "ioc": "ype.thmx"
  167.  
  168.  
  169. "ioc": "iew.thmx"
  170.  
  171.  
  172. "ioc": "rame.thmx"
  173.  
  174.  
  175. "ioc": "rop.thmx"
  176.  
  177.  
  178. "ioc": "roplet.thmx"
  179.  
  180.  
  181. "ioc": "arallax.thmx"
  182.  
  183.  
  184. "ioc": "erlin.thmx"
  185.  
  186.  
  187. "ioc": "late.thmx"
  188.  
  189.  
  190. "ioc": "eathered.thmx"
  191.  
  192.  
  193. "ioc": "avon.thmx"
  194.  
  195.  
  196. "ioc": "esh.thmx"
  197.  
  198.  
  199. "ioc": "rail.thmx"
  200.  
  201.  
  202. "ioc": "amask.thmx"
  203.  
  204.  
  205.  
  206.  
  207. "Description": "Performs some HTTP requests",
  208. "Details":
  209.  
  210. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  211.  
  212.  
  213. "url": "http://crl3.digicert.com/Omniroot2025.crl"
  214.  
  215.  
  216. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  217.  
  218.  
  219.  
  220.  
  221. "Description": "The office file has 2 macros.",
  222. "Details":
  223.  
  224.  
  225. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  226. "Details":
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$\\xd5\\xfe\\x06?\\x17\\xa02xq/^b\\xa7\\xa6s\\xc0\\x80\\xa6pyz'\\xa6\\x01\\x80y\\xee\\xff\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c\\xfc\\xf2n\\x03\\x81\\x86\\x87\\x1a\\xe5\\x83\\xf6w\\xec%\\xe4s^\\x19\\xcf\\x19\\xf9\\xb9\\x14c\\x0b\\xec\\xcb\\xa6/\\x11\\x89\r>\\xe1\\x86\\x9b\\xc28\\x1c\\xa6\\xd8\\xc1a\\x07w\\xfd(\\x9b\\x8d\\xe5\ni\\x8fd\\xd6\\xdd\\xfb\\xa3\\xa16\\x81\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x12\\x85\\xda\\x10\\xb8\\xd3\\xd3#\\xa7\\xdf\\xbb\\x1a\\xbc\\xa6\\xe6x\\xa8\\x8d0\\xe5#\\xbcn\\x0f\\x89\\xe4\\xafj\\x82.\\x81%p\\xf2<\\xdb\\x12\\xb64\\x0c\\xdd\\xe7x\\xb4\\x1f7"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf52\\xcb\\x7fb\\xcf`1\\xefy\\xd9\\x85\\xaca\\xd3\\x1d\\xd2o\\xfc'\\xd2n\\u\\x1c~\\xc7\\xca9\\xc7\n\\xb6g\\x80\\x93?~e\\x1f\\xaf\\xfc\\xe7\\xf9^_\\xe1\\xbc\\xbar\\xb9\\x99\\x91\\x05\\x9d\\xe2a\\xfc\\x13ug\\xd5\\x84\\xf3\\xbb,\\x81d\\xba\\x92\\xddb\\xe5\\x12\\xc1\\xba\\xe0\\xc0d\\xab\\x87\\xab9\\x86i\\x88k\\xf6\\xe3\\x1av\\xff\\x00\\x81\\xdc\\x97x\\xf0\\x9e\\xb3\\x85x\\x85\\x89\\xac\\x10\\xfa\\x9f\"\\xe1\\xf3\\xf2\\x03\\xc8\\x17\\x0b\\x10\\xe4)\\x85\\xb3\\xcf\\x143\\x986\\xf2\\x13<\\xfc^ row\\x808_\\x18a\\x15\\xa3\\x1a\\xde\\xaa\\xd2a\\x03\\x00p\\xab\\x94n\\xc51\\xf3&\\xee\\xf8\\x8f\\xd8v\\x08#\\x0fx\\x0f\\x14\\xa6\\x8f\\x12\\xb1\\xf1\\x95\\x0c1\\xdbd\\xda\\xb4\\xec\\xb2v\\xe8#\\xa05\\x80\\xf2\\xad\\xad\\xe0\\x89\\xe0\\x83\\xb0\\x114\\x0ctt\\xb0\\xb5\\xfa\\x19\\x9b\\x047\\x88\\xbb\\x95\\x0c\\x1e8\\x17f\t\\x94\\x88\\x8b\\xa1e\\xb8\\xda\\x1ee\\xfb\\x10\\x1b\\xaf^\\x05\\x7f\\xb0\\xe7\\x903\\x85\\x16\\xd7*=;\\x8d\\xd8\\xb3m"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$\\xd6\\x0fq\\xf9\\xeeb\\xfaj&,|\\xf2\\x17js\\xdfb4\\xe9@\\xd2\\xcfh+\\\r\\xc3\\xf3/\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n(^!\\x13\\xb4s\\xd8\\xcf_-\\xff\\x1b\\x83\\xcf\\xc7\\xf1\\xf9\\xae2\\xf2\\xf7\\xb1p\\xfb\\xb3p\\x12\\x12\\xa2\\xeby).\\xa4\\x93;9\\xcd\\xe6\\xc0\\xaf\\xbd1o\\x83\\x06\\xbb\\xcf!\\x7fp\\xae\\xcf%8 \\xa9a\\xc6\\xf0\\x7fr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c2\\x9da\\x0c\\xde\\x14+\\x95\\xaa\\xc1o8\\x91\\x14\t\\xfc|d\\x83\n\\x8e/\\xe5\\xf1-gc\\x1b\\x1b&lz\\xcd\\x0fa\\x04\\xbb\\xd8\\x0f\"\\xb9\\xf9\\xeb\\xa1y\\x98"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$\\xd6\\x10\\xd7\\x03\\x8f\\x12\\xe4\\x15vm\\x1e\\x99\\xe5b\\xf5\\xa9\\xa5\\xb9\\xb0j\\x804\\xf2\\x92\\xc43\\xedr\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xfa\\xdd\\xe89\\xb9-@\\x85l\\x1f\\x94s\\xe6\\x06\\xfb\\x11itq\\x80\\xb1y\\xfb\\x04\\xbf\\xac\\xa9\\xc5\\xb1l\\xc9g\\xa1\\xaa7_d\\x81\\xf9\\xb3ax\\xf1x\\xber\\xec\\xd1\\x06q\\xb4?\\x81\\x89p7\\xdct\\xb0\\xd2(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\x04id\\xa3\r\\xec\\x88\\xafy\\xca\\xbep\\xad\\xfbi\\xe2nj\\x83\\x8bc\\xb7\\xa9*\\xe6\\x9d~\\xde\\x93x\\x84\\xbd\\xb4\\x8a\\xbe\\xd9\\xf0k\\xffq\\x1b\\x8f\ni\\x0f\\xf5x"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xea\\x85\\xbf\\xb1\\xd7 g\\xc6uxsy>\\xfbd\\xf8\\x1d_\r\\xdb\\x86\\x86\\x91\\x1e\\xf3\\xf1\\xf3\\xa4\\xebk1c\\x1f\\x81\\xccz\\xb53\\x14&s\\xb3vp(\\xaag\"\\xdb\\x99hfa\\xc4'4\\xecpn\\x86\\xd7\\x85\\xb8u!\\xcc\\xbd^jws\\xe07y\\x13w\\xb3(\\xb7a\t\\xd3\\xfc\\xb6\\xa0\\xfcw\\xa2k\\xc8\\xc3\\xab\\xe1u\\x83\\xcb-\\xfd\\x0ev&ir\\xdc\\xf8\\xc7\\x81\\xb6\\x89\\xdd\\xc9\\xa0\\xe3?\\xb6\\x1c\\xee\\x11e\\x12\\xca\\x0co\\x17\\x1f\\x92\\xb9.\\x0cxs\\xcc.\\x8ae\\xd7\\xd9\\xff\\x02-\\xa7\\xae\\xcd__\\xff\\xae\\xa9\\xf1o\\x99\\x15\\xf9\\x1a|i\\xa1/;rk\\xf2\\x8bv\\xce\\xb4\\x8f\\xe0\\x13\\xda\\xd6s\\x86y\\xb4\\x8e\\x96\\xdc!|\\xea\\xb44q\\xe4\\xfe\\xc1\\xfa\\x80wc\\x83\\xe8\\xf45np\\x96x\\x1a\\xefk\\xbb\\x9e\\x1b\\xd2\\xc0lg\\xa6\\x01j\\xc9\\x1f\\xc0\\x86\\xb6\\xef4e;\\xba?\\x9c\\xaf6\\xb2\\x02\\xf6\\x98\\xa9\\xaf\\x01p\\xf0h\\x8a\\xe8\\x05\\xc0\\xcdsdn$\\xdc\\xc9u(p"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_get /omniroot2025.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl3.digicert.com\r\n\r\n"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x81\\xc4\\x07\\xd9\\x91ac6\\xa8\\xf6d\\xc1\\x83\\x9c\r\\x0c\\x82y\\xd8\\x1f\\x17\\xbb\\x9c@(\\xff<\\x05;\\xab\\x1aw\\xf4\\xe2\\xa2\\xaf*\\xd9\\xa8\\x8d\\xf14\\x0er\\x87\\xdca\\xd5kz\\xccs\\x0ep\\xb7\\xcc\\xde\\x961\\xd1\\x8et\\x93\\x14/\\xb3\\xc2c\\xfa\\xc7\\xe3`!\\xda*\\x0e\\xc3\\xba\\x0b\\xf1=\\xfa\\xa8uzk\\x7f~v~\\x18\\xafr\\xfc\\xa9\\xf1_\\xbbxs\\xfe\\x15\\\\xf7\\x0b\\xd2f\\xaan\\x81 \\x1d\\xf5\\xdf\\xda\\xea\\x15\\x99%\\xf9\\x9f\\xf0\\xde\\xc6\\xf4v\\xf3\\x0f\\xfc\n\\xfa?\\xbbw\\xd1\\xf9\\xbd\\xf9j\\xd9\\xa8\\x15\\xab\\x04%\\xeb\\xdd\\x94\\x957\\xcb\\x0ff\\xf5v\\xf3ak\\x055:0ps\\xc0p\\xcb\\x06\\xbaw\\xb4q(\\x91\\xea\\xda\\x9dbd\\xc8\\xb9\\xc6\\x95\\x06\\xe1\\xfb\t\\xdf\\x1f\\xff\\x87\\x0c\\xba\\xea\\xd2\\xb7\\x19\\xed7y.;(@\\x91j\\xc5h\\xa3*\\xd3\\x02j\\x8d\\x06\\x97e\\xbe5\\x90\\xdbm\\x8a\\xcf\\x1d\\x03\\x16^k\\xe9<\\x029\\x8d\\xd3\\xfb\\xd0mk~\\x7f\\x14\\x98\\x1cb~\\xf7"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 `\\xb8\\x7f\\x92.\\xe5p1\\xd0\\xf3d\\xee\\xb8\\xc1\\xadb\r\\xf7\\xc0\\x88\\xd6\\\\xfe\\xb9e\\x98\\xcb\\xd4z'dl\\x10\\x97@\\xb0\\x99\r\\x81\\xc0jg\\xc2\\xe0\\x1b#t\\x12\\xb8\\xf8\\x0c\\xad\\x1fm)c;+d\\xc2\\x16\\xd8v\\xear\\x92\\xd3hp\\xe8\\xaf\\xbb\\xd1\\xdd\\x89\\xc4m\\xed\\x88\\x8b\\xee\\xe0\\x01/%\\x8d\"\\xf1\\xe5\\xd5\\xde\\x08\\x8a\\xe4\\xe0\\xa5k\\xf4\\xae\\x06pp`\\x0f\\x9cqn\\xf9+\\xdeoopo3\\x93=p\\x96\\xeee\\xcc\\xbf?\\xc7%<\\xb7\\xcc\\xd7\\x84#\\xd4h\\x85b\\xf6jz\\x014<\\xa4\\x99\\xfd\\xdet4\\xcb\\xdc46,\\x8aj\\xab\\xc9\\xd1!\\x1d\\xc5t\\x96u_&\\xaa\\xa0|\\xb0\\xb9ke\\xf0\\xe6\\xba\\xf25\\xe9\\x02\\xa8\\xcd.\\x19\\x9e.\\xfc\\xfej0\\xd2\\x9b`\\x7f \\x96v\\x8a&lg,\\x079\\xac\\x18uc\\xa1\\xc5\\xe1\\xa5!\\xa1z\\xc4/\\xa5i\\x1af\\xc2\\xf7\\xfe\\xde\\x13\\xfa\\x97\\x153\\x08r\\x05\\xe5\\x19\\x99\\xaey\\xc0\\x8fi\\xab\\x140\\x9e\\x82\\xae"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$\\xd60\\xa0\\xa9 \\xebj\\x8f!\\x97\\xa3\\x80\\x04\\x80\\xec\\xd0\\xfe-\\x80\\x9aa\\xab\"w\\x8f\\xf0\\xcd\\x89\\x14j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xa0\\x9d\\w>\\xc1\\x0b\\x07\\xaf\\x17\\x9b\\xfccu\\x1a9\\x17h\\xbe\t\\xe2$\\xdc(\\xc2\\xf0ovh\\x05\\x08\\xd70\\xb7\\xf4\\xc1\\xcc\\xfa!l\\xf6l\\xfc\\x90\\xe5\\x00\\x19\\x94\\x80\\xb8\\xe8\\xab\\xbf\\x0b\\x83/'a\\i\\x84\\x9fr+\\xd0\\xff\\xe2@\\xbfm-\\xb6^h\\xeccw\\xf7\\x97\\x84\\x18\t\\x97\\x16\\x91)\\xec3\\xc0i\\xfc\\x17\rn\\xea\\x88\\xfbs!u\\x07\\xc3e\\x1d\\x85\\x82\\x1dnf\\x07a\\x85\\xc6l\\xe6vf\\x8d\\x13\\x8a\\x99n\\x10\\xf0\\xc9;\\xddf\\xa9\\xe7\\x06m\\x81_\\xe5\\xfa\\x04\\x13\\x0b\\xb1d\\x07\\xa9\\xf5\\x97(\\x12\\x00s\\x17\\x9a\\x103\\xab\\xd9,\\xb7:q\\x95\\xa3\\x93\\x95\\x1c\\xdfi`\\xf8\\x00c\\x8a\\x0b\\xd5m\\xa4\\x94r\\xfe\\x86n|~\\xd5u\\x17`\\xd3\\xc7\\xc7\\xfc\\x13)j\\x91\\xa1\\x8b\\xddw\\x15\\x83\\xef\\xc1\\xe8`\\x18\\x8fx\\xa5\\x9d\\xbbd\\xbds\\xdc\\xec\\xd0\\x97\\xbd\\x93\\x7f\\x81\\xd0\\x8c\\xc4c\\x85\\x10\\xd3'\\xf4\\x9c\\xc8\\x08\\xbb4\\xc6\\x872\\x83\\xd5k\\x9b"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`xn\\xae\\xb0\\xcc\\x8d\\xae\\x88\\xf05\\xe4\\xf1\\x9d%\\xde\\xd2l\\xc9\\x1cj\\xf2n\\xdc\\x8b\\x95p1\\xa9\\x01\\xc8\\xdc\\x1d\\xdd\\x161\\xff\\xe4`\\xbb1\\xb7@dk\\x8bgx\\xa7l\\xec\\xd8\\xf7\\x8a\\xf7;\\x86\\xb7el\\x11\\x96\\x94tgy\\xdejd6\\x01io\\x92\\xe8\\xe6f\r\\x1bip'\\xb5;\\xee\\x9d;\\x12\\xc6&\\xbf\\x9c\\xf6\\x85\\x96o_\\xa0k\\xc9\\xb8qd$\r\\xd5x\\xe0\\x8b\\x02\\xbc\r\\x82?\\x01\\xa0d\\xe0\\x1ap\\xb9kq\\xe2\\xecs\\x87/\\xf9t\t\\xdble\\xf9\\x11\\x19_\\xc6\\xb8\\xb4\\x08n\\x8dzo\\xcei\\xd9nd\\xa0\\x03\\xcbk\\x8d\\x8a\\x9e\\xa45\\xbb\\xd6k\\x91\"\\xc8\\xbf#\\xea\\x82\\xedud\\xdb d+\\x86\\xa2\\xd2v\\xa8i\\xc6s:\\xa7\\xae\\xf6\\x1a,\\xab\\x82w#\\x0b\\x19e\\xda.\\x1b\\xaf\\xf1\\xa8c\t\\x19\\xa3\\xf7au\\x1c\\xb9\\x90\\xf1`\\xd6\\x82\\x89\\xc1\\x1a\\xfe!22\\xbb\\xa7ffu\\xe4\\x87\\xc5\\xadi\\x0fh\\xc5\\x1a\\x00z\\x02\\xac\\x1b\\xf8\\x98\\xba\\xf2r"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x06\\xacj+\\xa02\\xe6l\\xab\\xa0\\xe2nn\\xa0\\xa3\\xe7ju\\xd7r\\xf0\\xe6aa\\xb6\\x90\\xa9j\\xc7\\x10\\xbb\\x13\\xbdk\\xe6t\\x8e\\xd2\\xd8a\\x7f\\xbe\\xc9\\x92\\xac\\xe6\\x1a\\xf9\\xb2l\\xd96\\xed\r\\x07\\xf8%\\x81\\x9f*\\xd7\\xcc\\x9d\\x80\\x1f\\xc3\\xcavy\\x10y\\x19w\\xab\\x9ek\\xa3\\x02om\\xadb\\xc7\\x1c~\\xb8\\x01\\xfc3\\xf8\\xe8$\\xe56`l\\x02\\xcfz\\xa4\"u\\xf2#\\xb3\\\\x19\\x9fi^!\\x19@\\xf4\\x86\\x16\\xe5\\xd1x\\xc9\\x82s\\xb2\\x06q\\xefl0\\xfb\\xeck#\\x0c\\xa9\\x03u\\xe1\\xd0r\\xaa\\x01+\\x91\\x13\"*6\\xa4\\xb8\\xf7\\x12\\x8d\\xf7\\x0c\\xb6\\xbe\\x9f\\x9a\\xd6\\xf4\r*\\x01\\x8dv(k\\xc7\\x8e\\xe1i\\xa9\"\\xd4\\xbb\\x98zc\\xb2\\xdd3\\xbd\\x9e\\xf19>\\xe9\\xa2\\xd6\\xea\\xd2\\xfc\\x91fr8wv\\xb3h\\x90\\x10\\x87\\xe6+\\xcd\\xd3\\xb6\\xc5\\x00m\\x00'\\xf98\\xd2b\\xca\\x90\npdf\\xa11\\x92\\xff\\xc0\\xf2\\xe3 \"r\\xc2+\\xa9\\xea*<#,\\x07\\xd8\\xc4~\\xe7\\xf0\\xf6\\xdb\\xb8"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01$\\xd61\\x0e\\xbb#\\xeal\\xa8\\xc2\\x0e\\x7f\\xe8\\xb6\\xb9zit\\xbdk\\xa5\\xe6=a\\xb4l$p!*n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\xc89\\xe1?\\xc2ub\\x14\\x9c\\xa8\\xd7\\x9b3\\x83\\xcc\\x99\\xd8v62p6\\xa9.4\"\r\\xedz\\x15\\xcb\\x03@\\x8c.\\x16\\x0f:\\x07\\xa8r!\\xf2bq%\\xe2\\xd9hhc\\x80\\x1482\\xace\\xbd\\x0b\\x8d\\x05u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8cj\\x01\\xe7>x\\xcaq\\xba\\xd4b\\x9dz\\x81\\xd6$\\xd4<\\x18\\xf6\\x91q\\x9br\\x86\\xc6j\\xfep\\xc4x0bl\\x0fo\\x1a\\x1e\"x\\xa8\\xf1|\\xbf\\xd8.\\xb6"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe5h\\xd3\\xc7i\\x94\\x85\\x82\\xd46\\xec\\xf2\\x89\\xe6\\xad\\xef\\xfcs\\xf2\\x8at\\x16\\x8e\\x8a\\x05\\xe7\\xf2\\x8b\\xdc0\\xf0\\xd3\\xfa\\xb0\\x1d\\xcc\\xb8kq\\x9a\\xc4\\x03g\\x0f\\xd6cy\\xd9\\xbd\\xa9o\\#\\x84sih\\x1a\\x01\\x06u\\x92s/\\x101f=\\x85^5w1fo\\xb6\\xf9\\xd3\\x17\r6\\xda\\xb9\\xad\\x86\\xbf\\x85w\\x8c\\x1e\\xe2;\\x8f\\x9e7\\x11yw\\x15u$\\x95\\x9e\\xb3\\xb2\\x14\\xc6\\xdf\\xa3\\xf3\\xab\\xdf\\x85\\xbfm\\x89=?\\xb9\\x9b\\x83\\x08\\xc3\\xf3e\\xa3h\\xd9\\x1c;yw\\x1c\\xac+\\xb5\\x06\\xd2\\xfa \\x8f\\xb0k\r7ds\\x08\\xe0\\x82\\xeb\\x92\\xd8\\xe9\\xb1f1\\x85a\\xca\\xc9q\\x00ymzc\\x08\\xdc\\xdc*\\xe3i\\x1e\\xd7-\\x0eh\\x00u\\xec\\x99\\xc13\\xbd\\xc6\\x1c1\\x93\\xef\\x17\\x94\\~\\xbb\\xf0\\xd2o\\xf9\\xf4\\xb6k\\xfa\\xed\\x16\\xb2\\xbe\\xe8^\\xa8s\\xdb#\\xafe\\xc3\\xc7\\x88\\x0e\\x15\\xaf\\xd1`&d\\xad/\\xa5ta4=zhv\\x15t\\xff\\xce\\x19\\xed\\x128k\\xefi\\x19h\\xad"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62k\\xb1+e\\xfe,w\\xd0\\x1d\\x1a\\xad\\xa9\\x9fyw\t/\\xa7b\\xae<fs\\x08\\x9ck*1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\")?\\xb4rk\\x83\\xae\\xdeu#+2t(z\n61\\xa90i\\x9b\\xbc\\xdc\\xd2y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xf9\\x98\\xd9\\xdda\\x17\"9\\x1f\\xa5\\x1e\\x0b3\\x0b\n\\xbb\\xd9\\x839\\xec~mx~\\xc9\\xdev\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62k\\xe5\\x92n\\xca\\x1c\\xf5!\\xf7\\r\\x17`y\\x81vr,8s1\\xb8\\x9d\\xdd\\xd4\\xad\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xf4\\xac \\xb1_\\xf7-\\xefl\\xa1\\x1br\\xe3e\\xe6\\xd7dj\\xa6\\xb8\\xc0\\xe0o\\xf0\\xfe\\xf5\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\x90\\xf9,v^\\x05gd\\x8cbz\\xc2q\\x06\\x99\\xfd\\xf4\\xe2\\xfa\\x1bi\\xd8\\xf3\\x87\\xa2\\x94\\xf6y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\x89\\x0b\\xbe\\xa7x\\xce\\xa3#\\xfb\\xb9-1)n\\x03\\xee#9?tt\\x9a\\xf8s\\xad\\x98\\x911\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62t\\xe2clxdeifpa\\x00\\xec\\x8c\\xe4\\xa0\\x06\\xf3\\x0ez\\xf3\\xd3b\\x10\\\\xb0\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62e\\x10\\xe5\\x1a\\x18eh*\\xc0\\xda\\x99e\\xbdv\\x13\\x8c\\xff\\xcf\\xe5\\xffhh\\xae\\x87k\\xd2>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xf5\\xaf\\xab\\xb3\\xba=\\xe4:\\x04\\x11\\x8e_/\\x8d\\x12\\x96a\\x8br\\x80\\x88\\xcb\\xf9\\x9d\\xf2\\xa0o\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62k\\xad1\\x93\\x80\\xdc\\x1f\\x8e~\\x04\\x19\\xb1\\xbb%\\x91\\x16\\xb2\\xfd\\x93&\\x04=\\xbb\\x0b\\xe4\\x8a\\x8fr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xd7\\xba\\x89\\x88\\xa9b\\x13\\xa5\\x01'\\x128<\\xb5\\xe00c@ad\\xfc\\x87l\\x1b\\xc4\\xae\\xdd\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xf1-\\x88o\\x89\\xac\\x10d@u\\xb4\r\\xc8w\\x7fl*j\\x0c\\x80\\x80m\\xe08\\xf5`t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xea\\xb0'\\xb3\\xef\\xdb\\x93\\xb6v\\xf2q\\x1c\\xe2\\x9f\\xbc\\xbb\\x952=\\xa2\\x14\\x16\\x89\\xabl\\x8d\\xf7\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\x91\n\\xd4r\\x8e9\\xba\\xc9_\\xee\\x84\\xce\\x07\\xd3\\x87\\xfdg8\\x8a\\xbb\n\\x0ca\\xaf\\xb43\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\x84\\x17x\\xc2\\xb6g\\x8a\\xb7\\x84l\r\\xc2\\xac\\x8b\\xcc6a\\xc5c\\xbd\\x89\\xe9\\xe4\\xe3\\x0b\\xd8u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xab\\xd8\\x98\\x1bq\\xc6v\\xc0\\xf5\\xd7\\xe1#0\\x96\\xf5\\xe7\\xf7r\\x90\\x1d'\\xcf\\xc5\\xcd\\xd3\\xbd\\xee\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xb2s\\xbb\\xac\\xe7\\xc9*6,\\xfdzl8mz\\x9a,\\x18\\x18\\xff\\xfa~\\x04\\xd52n+\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xd9\\x9ba^\\x83\\x9e\\xbav\\xb5\\x82\\x1c\\x97\\xd4|\\x841u\\xdb\\xd7\\x7f<\\x92\r\\xef\\x15zp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd62\\xdc\\xba\\x80c\\xd8\\xcay\\x92\\xbfz-\\x81\\x93\\xb8\\xf9\\x86ag\\xcew\\xd6\\x95\\x83r\\x1bgc\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd622\\xc5\\xb1\\x83i\\xb8\\xd1\\xc7(\\x8d\\xd4\\x13l\\xc4vs\\xd1/\\xb5\\x0b\\x92\\xd0\\x06k\\xa7\\xa7\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\x85y\\xa2\\xef\\xab\\x06\\xad\\xe4\\xc9\\xf3\\x8fr\\x88\n\\xee(t\\xbaz\\xf6f6\\xc8\\x1a\\x1d9\\xdb\\x08\\xdfh\\x02\\xd9\\x19u'\\xc1;'\\x07\\xc9\\x88t\\x92.~wg8\\xcf=r2\\xbe\\xe8m\\xb0x\\x19\\xfdz\\\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1\\xc6yy\\xd8\\x14\\xc9l\\xde9\\x1e)\\x1d\\xdc\\xca\\xde\\xc1\\xcd\\xf1\\x01\\xa6\\x95\\xd4\\xdc\\xbc\\xf4\\x9f\\xfd&\\x1b\\xda\\x0ec\\xfc\\x8c\\x0c\\x8e\\xe3|\\x9c\\x10\\xd1\\x1b\\x17"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xeb7\\x18\\x91\\x84\\x08\\xc4\\x17\\x14\\x937x\\xe2\\xb6\\x93\\xfa\\x01\\x8e\\x08q\\x98\\x08(\\x06\\xb9\\xfe\\x8b\\xa6\\xfb\\xbcc\\xa7>-\\xb0\\x07\\x12\\xf3\\x9ck\\xda)z\\x08\\xear\\x97&c\\x88\\x04^\\xb4\\xfec&\"6\\xce\\x11hy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\x1e\\x9ad\\xfe\\x87^\\xbd\\x82?\\xc0\\xcd\\xf3\n3#\\xf4#\\x88\\x92\\x9es\\xdf\\x16nd\\x00=\\x8c\\xe2\\x82\\xaa&\\x81\\xb5\\x0b`d\\xd6@\\x1f\\xd2=\\xb0\\xd9\\xedo\n"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\xd5t\\xaf\\xd7\\xb3\\x11a\\x1dv\\xe5(o\\xc3\\xbf\\xe5\\x11`\\xd33\\x07\\xc0\\x18\\xf96\\xb2\\xb5\\x10m\\x04\\xb6\\xbb\\xcfo\\xf0lm\\x967\\xb7~\\xad\\xaf\\xfc\\xfb\\x98\\xbf\\xf2#\\x9a\\xdb`\\x04\\xf5\\xee\\x17u\\xc8 \\x82\\xeb\\xe8iz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xce\\xf5tc\\xbc\\xbe&u\\x18\\x84\\xad\\x1e\\x89|\\xa7\\x8f\\xb2)g\\xdd<\\x86rs\\x9b\\xbd\\xcf|\\x80a\\xc4\\xd2\\xa1\\xa5`\\xe8x\\xe1\\x94\\xf8\\xf5\\x87b1\\x10\\x05"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\xcc\\x83\\x908\\*\\xf8\\xc5h\\x85\\xf0\\x8a\\x10\\xd6v\\xda\\x85\\xba\\x8f\\xed\\xcc\\x17i\\x98v\\xd3t\\xdb\\x0e,$\\x1dv 6ccxghe\\xc8$\\x95\\xf4o|h\\x87u\\?\\xfc\\xdf\\xe2\\xeb\\xd2\\x99&1\\x05k\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\xebv\\xc3\\x9e\\x0c\\x90.?\\xf9\\x07q\\xc8\\x08\\x0f\\\"\\x9fa\\xbc\\xa2\\x97iamd\\xcb\\x04\\xe7\\xd5~\\x95cw\\xdb\\x8c\\x1b\\x12\\x14\\xc1\\xb2c\\xdc\\x9b\\xa1\\xc1\\xda\\xb5"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\xa7\\xe8\\x12\\x12<r\\xae!,\\x84\\xf9\\xcf\tx\\x9d\\x03*\\x99\\xdc\\x11\\xa9-a\\x18\\x00\\xb0\\xe9\\xd7\\xa1\\xed\\x93\\x1d\\x87\\x93h\\xf0\\xc1\\x1a\\xe4\\x14\\xf7\\xa6!\\xaf\\x14\\xc3az^\\xcbv\\xeaq\\x01,\\xfb\\xb3\\xa2\\x146\\xaa\\xb3#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\xbebzp\\xb7\\xdb\\xd9f8s\\x98p\\x8c\\xd69\\x98\\x0ek*\\x08\\x00\\xf0\\xe01k\\xe1uaw\\x9e\\xac\\x94\\x16%\\xc0~\\xd1\\xe6d\\x96\\x93\\x1aqi\\xde\\x80"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\x14\\xf0\\xf3\\x8b\\xe5\\xfe\\xb3w\nn\\xae~\\x8e$)\\xb8\\xc9!\\x01\\x19g\\xd4\\xff3\r\\xe2\\x83f\\x85\\x03\\\\x07\nd\\x84\\xfe\\xb7\\x10\\xf9\\xe6e\\xd5\\x1b~\\xe4\\x80g\\xc6\\xe6\\xba=\\xcd\\xbay\\xc4\\x95\\x04b'\\xe0\\x13e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l7\\x0e\\xd4\\xe3\r\\x84\t\\xb6\\xff\\xc3\\x80\\x9avs\n\\xf8c~\\x87\\xe4\\xc8\\xf8\\xce1\\x8dz\\x08\\xac\\xe2\\x88\\x1e\\xed\\xd1\\x97\\x88\\xa4'\\x99k1\\xac\\xb4,\\xd5\\x86o"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x97\\x7f\\xf6\\x03\\x07\\x02\\x1a\\x98ta\\xd0\\xdf\\x1f\\xda\\xfc\\x12n\\xf3\\xb8\\xca\\xcf\\xb9\\x01\\xaa\\x01\\x10\\x82\\xf1x_\\xb3\\xa2\\xf2\\x1e\\xc2u\\xfd\\xe9l-\\xa9i1c \\xfa\\x99\\xb8\\xbdxt\\x00\\x06\\xe2\\xc1*\\xecw\\x8f\\x87\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l6\\xce\\xef\\x8fz;:w\\xa7\\x16\\xff&u\\xc4\\xc0\\x95\\xde\\x9d\\x81<'\\x94\\xcci\\xcd*fy\\x06b\\xa0o\\x17\\x88\\x95\\xcc\\xcc\\x0et\\x95\\x14\\x11!\\x100\\x99"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x8e\\x83e\\x9a\\xd9\\x9f\\xb4\\xc7\\xc1\\xfcr\\xd5\\x06u\\xb8\\xdc\\xf8q\\x9bh\\xdf:l4y\\x95\\x06\\xb3l\\x8ab\\xfbvv\\xb4n\\xb0\\xb3\\x0b\t\tvn\\x163\\xb5\\x90\\xd6\\xa6^f\\x9b\\xf0z\\xf9\\x19m\\xe1\\xdf\\xa6\\xa1\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x80e\\x1bv\\xf9x\\x9c%\\xf2\\xd2\\xc1;\\xc0\\x1a\\xdc==\\xdb>\\x058\\x8e\\x96\\xb6\\xc0rq\\xa2e\\xd7\\x17\\xf1\\x14h\\x8am6\\xac\\xfa\\xbd\\xae\\x8c\\xcf\\x86\\xa7\\x98\\xd2"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v7\\xa8\\x12\\x16\\x9fc\\xcd\\xf0\\xf0\\xc1\\xc8x9\\xf5\\xc8~\\xe1\\xf7\\x0cfm\\xd0\\x92\\xa4\\xeb\\xeeum\\xbc\\xaa\\x95\\x12/\\xa7\\x8f\\xda\\xa1j@ig\\xd9\\xb1\\xcfz\\x96\\x83(\\xcf\\xfa5\\xbbm\\xca\\x054q\\xe8rv\\xcch\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0y\\xe6\\xd2\\xa3\\xf5\\xd7\\xff\\x03k\\x84\\xb3\\xe8\\xad\\x12m\\x94\\x9d\\xb3lb\\xdf\\xfb\\xe5x\\x7f\\xe6\\xac\\xc7p\\xbe\\x82\\xa4\\xda0\\xef\\x01\\xf5^\\xbaz\\x9e\\xee\\x08\\xa2\\x1b"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041\\x9c!\\x87\\xd3u\\xb0?\\x89\\xdee\\xfd\\x7fgj\\xa6\\x0exk|\\x1d\\xd5o\\x7f4\\xa1\\x92r\\xe1\t\\x13-n\\nv\\xc9\\x89\\xed\\x1e\\xaf\\p;\\xdc\\xaa\\x00ant\\xbe\\x99\\xd7m2\\x82\\xadt\\x0f\\xf5\\xee@!\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x1c\\xde;\\x19b!\\xc4\\xbe\\\\xa1\\xd1\\x1aj\\xc9\\xc5\\xcd\\x98\\xf6\\xe2\\xafq\\xd7\\x0f\\xa5i\"\\xe0\\xa3\\xfe\\xe7=\\x0b-\\x9f\\x06\\x0b\\x86!\\xec\\xf2\\xec4\\xfc\\xe8:\\xb6"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xe0*\\xf8\\xc8\\x1d\\xdd~\\xce1\\xe6\\xc5tm\\xb6\\xa4\\x02\\xe7\\xef`fw\\xbe\\xd6ct\\x98\\xe1\\x1e\\xcd(\\xd7\\xaf\\xe9yt\tg|\\xd5\\xcd\\x03x\\x97\\xd2\\xa9\tg\\x7f\n\\xc6\\x94n@u?\\8d\\xa0\\x95\\x94q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\x15t\\x0e\\x83\\xabkqj\\xdftk\\xffqe\\xbc(\\xd4\\xa2^\\xdc\\xd3\\xbc\\x1c\\x94@c\\xd4\\xa7\\x9c\\x89\\xbex\\x06\\xf6\\xc7\\xae\\xac<9?\\xeb\\xb2p/"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xa5p\\xa4\\x02\\xaa\\x99q\\xbb\\x7f\\xa8\\xdd\\x8eb$\t\\x84\\xd0\\xab ,aef\\x86\\xfen\\xa9i\\xefkw\\xde-\\xc3\\xb4\\xef;/\\x94_\\xb5\\x12\\xa6\\xd9\\xeb\\x91\\x1a\\xa2\\x1e:\\x00\\x0b\\xda\\xb2\\xd1\\xff\\x03\\x91\\xfcw\\xeb_\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\x19m9\\xfeup8\\xd6\\xed\\xab5\\xa8\\xfe\\xfa\\xe5\\xf25.\\xddg\\x00\\x04o@\\x8b\\x98f\\x8e!#\\\\xcc\\xf4tu\\xd1\\x12ix\\xeaz\\xdes\\x05\\x0b\\x04c"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xcd\\xbc\\xaa\\xe8m\\x84\\x179\\xfc\\xd1\\xee8ec\\xbe\\x81\\x03\\x8c;\\xd5\\xc1u\\xd5\\xa8*\\xfb\\xf9\\xf6\\x05\\xce,\\xcc\\xd2_\\xea5n\\x03\\x8f\\xc8\\x1by\\xac:\\x87\\x87h\\xcb\\xaez\\xaa@l\\x08\\xd1q\\x9f\\xac\\xa1m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x9c\\xae\\x83\\x9f-\\xd6zx\\x05st,\\x19\\x8f\\x05\\x1c\\x1c\\xbfn=qa\\x97\\xb0\\xaf5j\\x8a/e\\xe3\\x85\\xa9\\xf2\\xf0\\x0f\\xd8\\xc9\\xa5ht\\x8ao\\xb0\\xbe\\x91"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\x1d\\xc1'\\xe4\\xfe/a*\\x1e`\\x99\\xef\\x9cm\\x8b\\xb51\\x87\\xa8`\\x91\\xc1\\x07\\x9c\\xf8\\xb8j\\x81\\x9b!#\\xe1\\xe6\\x17\\xbf/\\xf6.w\\xd8.\\xa1\\x8d\\xb9s\\xbcf\\x8e\\xf7\\x81\\xd6\\x7fo\\xe4\\x14\\xf2\\x01\\x04\\xdc\\x15\\x7f\\x1d\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9\\xe9\\xe22\\x86i\\x94\\x1b\\x91\\xd5\\xb2\\x8f\\xfd\\xba\\xeaec\\x8cbr\\xc0-x\ngvz\r\\xbej\\xc5t\\x11\\xa3e\\xd9\\xf2; wt'\\xbf\\x94\\xce>."
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;rez\\xec\\xffr\\xeao7\\xf0$\\xb8\\x84\\xd2\\xe6c=\\xd3\\xab$\\xfd\\xd4v\\xd4i\\xa4nur\\xc5\\xfd\\xa2o\\x9d\\x1c,a\\xac\\xe3\\x8ad\\xad\\xa0*)\\x15\\x14\\xadk\\xb63-j\\xb8\\xaf\\xaem\\x05\\x81k\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\xc1j\\xf2\\xfeoy*4\\x92(\\xce\\xcav\\xe0\\xa3f\\xda\\xf7\\x0fg\\xa8\\x80y%\\xd3\\xd0\\x0e\\xfb \\xdf\\x14\\xb5\\x03\\x97/\\xf6\\x82\\xad\\\\x89|\\x97\\xf1h\\xaa"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19m(\\xa9\\x10 o\\xa4a\\xde\\x86p\\x01#k*4\\xad.v\\xe19\\xc4\\x8f\\x91\\x06q.6a\\x8f\\xfc\\xbaw\\x96\\x10\\x1e\\x1b\\xe3\\xe1\\x8c\\xa8\\xaa\\xae\\x06\\xbdz\\xd7mg\\x1f\\xf2\\x99\\xb5\\xba\\xe8\\x9f\\x9d\\xcd\\xbb\\xfc\\xf9\\xe4;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000att\\xfb\\x8c\\xf5b\\x82\\xf4\\xf1\\x96\\xeb\\xeb1\\xfd\\xc5>\\xd7\\xb0\\xa8\\xf3p+9f\\x92\\x88\\xe3\\xd9\\xf2\\x0e\\xc79\\x95\\x80\\x8f)+\\xb11\\x15\\\\xeb\\x99\\xeb\\x90\\x18"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6,\\xe4\\xfd\\xd1\\xb6\t\\xa5n\\x80\\xa5\\xf6\\xdf\\x18c\\x7f \\xca\\x99qa |\\xb5\\x94|u<\\xd3\\x95\\x08\\x03\\xb7b\\x12\\xfcgdn`#\\x95\\x8d\\xba\\xe9\\xc5\\x99\\xdb1\\xd3$\\x86=\\x92\\xd3\\x9a\\xde\\x03\\xe0\\x14\\xb2\\x04\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xadqv\\xcf-\\x9am\\xcb2\\xc9\\x06\\xa5f\\x90\\x84\\xea\\xa8h\\xf3\\xa0\\xec\\xf9\\xae\\xfem\\xbe\\x9e<\\xcc\\xdc&\\x06\\xbd\\xf2\\x02r4\\xaf'\\xef\\x9a3\\x9b\\xf1\\x92\\x8cv"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xd9\\xfd)\\xa2\\xb1\\xec\\xb7\\x125\\xad_\\xb3%\\xc5\\x02\\xcfz\\xa4=\\xcf_`\\x92\r/\\xc3m\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x8c@\\x19\\xa7\\xf1\\x08-\\xfc\\xf6\\x0f\\xf8\\xd24k\\xb9\\xef\\xdd\\x0c\\x9d6\\x0f\\x8dk\\xdd\\x8e\\x06\\x8a\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63e\\xff@\\x03\\xc5\\xd6\\xbb>\\x1f\\xab\\x1d82\\x85x\\xfa\\xdb\\x895(\\x90\\x9f\\xe1*\\x01r\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xc5\\x95\\xcbn,\\x10=\\x9b\\x8c1\\x82\\x8d\\x14\\xda\\x10\n\\xb3\\x1c\\x9d|\\x87\\x7f\\xab(\\x81\\x93j\\xf0\\xb3y\\xcca\\x8dya\\xf6\\x8f\\x1a\\xc4k\\xf4\\xd2\\xb7\\xfe\\xf8\\x19\\xbe\\xf6\\x96\\x8d\\x0e>\\xe5\\xa4p\\x1b\nmsh\\xb6(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcdb\\x07\\x88\\xf5\\xf2=\\x02\\xe2\\x7f\\xca\\x06`|\\xf9\\x81\\xa6z\\x19\\x1d0!(\\xf0\\xa6\\xc9(\\x02\\xd5\\x9c\\xda\\xe9\\x0cq\\x8b\\xc3v\\xb7<\\x1dc\\xa5a\\x90\\xe7j\\xf8"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5\\xf8!\\x87\\x0eo$!\\x192d\\xbb\\xd7\\xc0\\x82\\x80v\\xe5@\\x11\\xeed\\x88p\\x10\\xd7\\xb4\ro\\x8a\\x05\\xf3\\x18.8g\\xfae\\x129~\\x17\\xa6\\xcb\\xedh\\x85\\xeel\\x883\\x1e\\x99b\\xf0\\xfd\t2\\x88v\\xa9\\xfe@\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xc5=\\xb5p\\xc5\\xe8\\xb9\\xb0sx\\xad\\xcb.\\x9d9p\\xfa\\xdf\\x87\\x07\\x945\\xa3c\\xbf\\xccr\\xf0\\xeciowfs\\xa1\\xdd\\xb0\\xf4\\xcd\\xd2\\x9f8+\\xc2\\x16\\xd1q"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\xa7n\\xec\\xd0m4f\\xc0\\x8b\\xb5\\x99\\xb9\\xcd=\\x96\\xefs\\x91\\xeep)c\"n\\xf2d\\x87q\\x11e\\xd2h4\t\\x19\\xa8b\\xe4\\xd5<\\x82f\\x9a\\xe6\\xe5\\x17o\\xe8\\xd7\\x0e\\x94x\\xaf\\x1ao\\xdb\\xb3r\\xb9\\xe0\\x16\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xa7\\xd7\\x8d\\xb1e\\xb3\\x0769z\\xca\\x86\\x89\\xfed\\x8fm-p\\xad\\x9e\\x0b\\x00\\xd7\\xaa`\n?\\x1e\\x1f\\xb0\\x06\\x8ae\\xef_\\xde\\x85f2\\xdb=\\xaa\\xe8\\x8279"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04yb\\xa6\\xe6o\\x0c \\x80\\x9d\\x8a7\\xeaz\\xae#\\x06j\\xaes\\x0eao\\xaa\\x88cr\\x02\\x00?\\x15\\xb0s3\\x1c\\x86\\x8fvk7\\xd0\\xfc\\xf1&\\xef0s\\x9bn\\xe9;+o\\b\\x11\\xdc@\\x8e\\xc7\\x95\\xad\\xdf\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000roi\\x0ej4lml\\x84\\xa6\\xc3\\xdez\n\\xe4\\x9c\\xe9\\xe2.\\xe2\\xf0\\x93\r\\xf0\\xd9\\x8e\\x88\\xa3h\\xd6\\xf5\\x0cns\\x8f4f\\xb4\\xb0ohd\\x05\\xd2\\x8d\\x06"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xe1vm>b\\x94\\x8c\\x02v\\xcd\\x94\\x9b6\\xef3\\xec\\x11\\xd2\\x08vz\\xc9\\x8dvi\\xd1\\xf3\\x87\\xbeh\\x05t\\x0b\\x99\\x93\"\\xa8\\xf3f\\xed\\x18\\xd8\\x85\\xbc\\x13\\xc0\\x92\\x160\\xda\\xa8\\x14\\x18\\xff\\xfc\\x1b\\xdc\\xa1\\xa0a\\x10\\x91\\x11\\x92\\xffo\\xf5\\xe7t\\xac\\xa3\\xe2\\x18\\x8a\\xdc\\xe9\\x94;y+\\x90\r\\xc9\\xcdp\\xec\\xf8\\xeb\\xf2\\x97n\\x1cm\\xe2\\x9f`\\x8a_\\x860\\xbc\\xddc\\xb3\\xe6d\\xb5\\xb2\\xf4;\\x1eo!v)\\xdff\\xa2_c\\x8a*\\x80h\\x8e\\xf2\\xf9\\x93\\x8e3\\x81\\x9bn\\xe61\\xe6q\\xae\\xb99\\xd7\\xa5f\\xf1\\x18\\x9dm\\x94\\xc5\\x9d\\xd1\\x0f\\xbf\"\\x99\\xbdv\\xe8j#\\xf7\\xd9\\x15\t\\x1d\\x10\\xd6\\x02u\\xe6y;\\x17\\xf3t\\x93i\\x81\\xea\\xdc\\xe4\\xe9\\x1c\\x06q\\xc1\\x12\\xbe\\xa47\\xd7\\xf1#\\xa9\\xe1\\xa5v\\x12w\\x1a\\xe3 \\x97e\\xde\\x81i\\xab\\x1c\\x0b\\x94\\xbc\\xbd\\xc9\\x15w\\x1b\\xe8\\xcfn\\xcc\\xa5\\x90\\x8e\\x89e\\x97\\x88\\xdeh\\xeb\\xff\\xd9d\\xbc\\xaed\\x88\\xe2\\x90\\x96\\xcd\\x15:\\xe3\\xad\\x0b\\xd6\\x84"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeci\\a\\xcd\\x16\r\\x9e8\\x81#\\xa2\\xcc0\\xe3\\xd1\\x8e\\xb3r@\\x8e\\x0c\\xd6\\xf7\\xb5\\2\\xcfks\\x80\\x0e\\x03x\\x1e \\xa1\\xa3\\xa5\\x92\\x04\\x97\\xb1\\xc0\\x12\\x06\\xb0\\xe0\\x02\\xf3\\xab\\x1f\\xcdkl\\xa2\\x83\\xe1\\x81w\\xe6\\xdd\\x1d\\xbe5\\xad%\\x1d\\xe6\\x97 \\x8d\\x11\\x0fs.\\x07\\x14\\xeb\\xc3\\xd9\\x1b\\x97z\\xe2\\xb6\"iyok\\xf5p\\x95\\xbe\\x92i\\x7f\\x9fp\\xad\\x0c\\x16\\xe8o\\xd7\\xc0\\x04\\xd5\\xb1\\x04\\xacx\\xacy\\xd94\\xb6\\xdc%\\x8f\\x9d\\x8eq\\xec\\xb7\\xf0x\\xe3\\xd5\\xf1\\x80\\xc6f\\xa5,v\\x8b\\xad\\xa5\\xb4\\xd6\\xdc\\x15\\xb5\\xbep#\\xc4\\xe5\\xbci\\xc1\\xca(\\xcc1v\\xdao\\xbf\\x90\\xb3\\xcb\t4\\xb4?h\\xf1\\xbe\\xba5\\xd0j\\x8f5t$s\\x9f\\xab\tu\\xacg\\x93\\xd7w\\xc1-\\xde\\xb6\\x8a\\xdb\\x15\\x93~\\x04\\xddz\\xee4\\x12\\xe4i \\x12\\x10\\x07\\xd4-\\xe2\\xfe\\x8c\\x8f\\x9et\\xbe\\xd0\\xb2\\xfe\\x19\\xa3t\\xb0\\xb1/\\x01\\xf9\\xf1\\xa7\\xd4\\xf0\\xe8?\\xc9-8n\\xe4x\\xbd\\x92\\x8e\\x90g-5"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\x11t\\xa9\\xcf3\\xa7\\x07\\xf8\\xcb\n\\xa4\\x91\\xe1\\x8f\\x14\\xf4\\x87t\\xc9\\x9e\\xb9\\x10:\\xf9\\x06\\xc2\\x04\\x82\n\\x95h\\xea5\\xa2\\xce\\x12\\x87\\xe2\\xc9z\\xb9%\\xd0*8d\\x80\\xf3\\x9f\\x1b\\x8e\\x0c\\xc6a\\xb3o\\x13 \\xc9o\\x96p\\xb2\\xfe\\xeb9\\x02mu\\xf2\\x01\\x86\\xe1v\\xe4\\xd7\\x19\\xc9\\xc5\\xb7\\xbax\\xf9\\xe14*\\xb7;\\x90\\x14\\xc9\\x08'\\xbb*\\x07\\x10!\\x8f\\xca\\xc1n\\xc8\\xd6\\xbb$>\\x95\\xe37\\xb4\\xa6\\xda)\\xbep\\xddc\\xd1+\\xf1v\\x1c\\xe7f\\xa4p\\x15ipj,\\x16\\xe5\\x84''\\x01\\xc3\\xa2\\xa2t\\xed\\xf81\\xeb\\xc8t _\\xb0\\x15\\xdd\\xd2\\xdc\\x07\\xbf\\x16\\x9b39\n\\xe5w\\xba\\xbd#\\xb9#\\x8f<-\\x9a\\xa6x\\xaa\\xbc\\x80\\xdef\\xb3o\\xc3>\\x14=\\xee\\xf4sg\\xfe5;\\xc3\\x01;m\\x0c\\xae\\xb2\\x9c\\x18\\x16\\x98\\xadq\\xe8\\xd9\\xd3*\\xd5\\xef\\x1fj\\xc2\\xbd\\xa5s\\x10\\xba\\xf2'\\xbc\\xf7\\xac\\x83\\x02ra\\xe5\\xd2\\xf6ho\\xe3u\\x90c\\x88q\\xe0\\x905\\x90\\xfd"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\x9e\\xa8\\x82\\x85\\x93\\xbb\\x0bva\\xbayg\\xa3\\xc4\\x00a$0l\\xdc=\\x9f&rc\\xf8u\\xf9\\x16(\\xf19`<\\xf3\\x93\\xb6h\\xc5\\xfe\\xfaf0&~;\\xab\\x0e\\xa8\\xc0,\\x9emc-\\xcb\\x83\\x84\\x9df\\x8fv_\\xa2\\x94l\\xda\\xf6\r#\\xcd\\xbd\\xbd\\xfd\\xc9tn\\x9b\\x94\\x7fu\\xb7\\x0b\\xeb\\xdd\\x00nd\\xd8\\xd9kd0p\\xa8\"*k\\xd5_2_\\x16/\\x8a\\xaa0\\xe0\\xea\\x86wjsf\\x0em\"m\\x85:b\\xb0u\\xb4,\\xbb\\x1a%\\x9d|\\x95\\xa1r\\xfe\\x95a:\\xf2\\xed\\xc4a\\xd8\\x9b\\xc0\\x8c\\x8d\\xae\\x90x\\xa4y\\x10)g\\x1e,\\xa9\\xbe_(3\\x88\\x8au'\\x17\\xff/<\\xb2\\x1bh#mb\\xf1\\xac*?g\\x9cr\\x0c\\x82)\\x16\\xae\\xf0\\xb5\\xb9\n\\xc5f\\x9b?\\xa9?'\\xfa\\xa4\\xc1\\xc5\\x8bu\\xfdr\\x84\\xe6m\\x05\\xdf-\\xa5t\\xe7e\\xf0\\xe4\\xef\\x9e\\x1f\\xe9\\xcdn\\xe6-\\x83\n\\xb5=\\xf1\\xed\n\\x94\\xe7s\\xfb\\x86\\xb3p\\xf0\\xban\\xa9\\xbc$\\x1c\\xfd"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63s6\t\\xf7\\x0cv\\xb2\\x95\\xd3\\x90\\xbc\\x81;w\\xb7\\xca\t\\x10:1\\xa3\\xec\\xefi:\\x9b\\xfcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63d\\x9bb\\xb6\\xfd\\x96\\x91\n4\\xfd\\xad!\\x18d\\x96\\xd8l\\x15>\\xcd\\x87\\xb3.\\x82\\xd4\\xa2e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x87\\x85\\xdehd*~\\xba\\xe4n\\xdfw\\xf6,\\x990ep\\xde\\xd2yq\"\\xc7\\x87/v\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xf6\\xf7\\xd78wp\\x9c\\xfcv\\xcb\\xa2=\\x06\\x88\\x88\\xb0i\\x804\\xab\\xda8?\\x1a\\xbfs\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x9b\\x85\\x87\\xda\\x8e\\xd7\\x8a\\xe6\\xcfh\\xfbo\\x17\\xf3\\xdf\\xfei\\x92\\x17\\x04\\xd3\\xa1\\xfc\\xd5\\x91\\xf5\\x06\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xf8k\\xe3\\xfcv\\xc9i\\xd8\\xaaa\"5\\xcf\\xaf\\xb3\\xc0x\\x0b\\xec\\xa5xd\\xdc\\x1b\rsu\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63p\\x1fn\\xab\\xd3\\xbf\\xdb<0\\xb0\\xc7\\xa7\\xf6'\\x84\\x11\\xf2\\xc4\\xa4\\xad\\x13)\\xac\"\\xde\\x00\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x13r\\xbeg\t\\x92\\xeao\\xf8k\\xbc\\x96(\\xc47|\\xd7\\xb58a\\xb7@\\xd3k\\x9fl\\x19\\xe5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xe8\\xfe\\xae`\\x97\"\\xe9/,\\xaf\\xddc\\xaf\\xfb\\x07\\x11\\x0f\\x1f\\xcb\\x90\\xdf\\xeb\\xcf\\x00\\x82s\\xbah\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63mm\\x0e\\xac\\x9a6\\xe1\\xc5n\\x979\\xeb\\xad\\x9b\\x83\n\\xee\\xb9\\xbf\\x96\\xd5\\x95\\xd6\\xa2\\xa2\\x97\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\cu\\xfa$\\xec\\xe3v\\x19\\x95\\xe8,\\xe2|\\xec\\xe1(\\x8e\\x8a@a\\xe7\\xb9(\\x80\\xcb\\x18n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x89\\x1f-\\xf1_\\xa8\\x81\\x1d\\xaa\\xa1\\xb4\\xb5\\x14\\xe7pfp@dy7\\xe3\\x08|\\xcb\\xc3\\xfe\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x1a\\x08\\xa5'l\\x00\\xda\\xe6p\\xc2\\xb5\\xf9!o\\x86\\xb0\\x82\\x0c\\x9c\\x91\\xeb\\xfd*\\xb1`5w9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x91\\x93\\xda4\\x9b\\xfer\\xc9;\\xe7\\xad&\\xe1q#\\xc74\\xbfb\\x9d\\xff1\\xc2\\xb4j\\xd62\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63|\\xde\\x96\\xa0y\\xf9\\xd9\\x92lf\\xc2\\xc0\\xcb\\xf3pyi\\xd9\\x18\\xb1\\xcf!\"\\x9e>\\xe37\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xf7\\x83\\xbd\\xac\\x1a.>\\xf1\\xe5ik\\x07\\xf6sl\\x9aaygp\\x93\\xc7\\xc9i@n?\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18\\xa6<\\xb7?\rho4\\xbff\\xcb0t0\\x12\\x90\\xd8\\x08\\x03\\xe7\\x1d-90\\x00\\xc8\\x8de5\\xe4k \\x94\\x86\\x86h\"(\\x92\\xb8w\\x8e\\x98\\xf5\\x00v\\xdc#\\xc5\\xf3\\xcbu\\x8ah\\xa1\\xa1\\x80\\xc7\";\\xa2\\xce\\xb9\\x8c\\x07\\x01\\x81\\xea\\xc3\\xd8\\xd1\\xee`;)'\\x88\\x83,\\xf1l)\\xf3\\xe9\\xe9(\\xdb\\xaan j.m\\x0f\\x7f\\xae\\xb1\\x1f\\xa5ek\\xe4\\xd5*\\x08\\xd1\\xe4\\x8f1\\x8a=\\x89!jz3\"\\xb5\\x9f\\x90\\xe5\\xbb\\xfcs\\x82\\xebi\\xcc\\xe8qr\\x9f\\xb5\\x9b\\x94\\xcf\\xe40\\x08.y\\xf0\\x92\\x17\\xb8\\xa7\\xb0\\x06\\xf1\\x8b\\x9c\\xac\\x12\\x96\\xd4ea\\xdd\\x8f\\x0ey\\x9b\\xea\\xd0\\xcc\\x89/y\\xab9'\\xf9\\xc1\\xf5\\xc4\\x04\\xfei5\\xa7\\x80\\xa4\\xff\\xffd\\xb1\\x98^\\xfb4\\xa6\\x15\\x7f\\xb1\\xb9\\x9e\\xb8\\xd7\\xa0\\x9b<\\xaf\\xaf\\x99t\\xb2e\\xac\\x8b\\xde\"\\xa6\\xf1\\xce\\x02x`n\\xf72j\\x02@\\x89\\x81\\x9b\\x0epq\\xd7\\x1fs\\x18\\xa5e\\xd5\\x98\\xf3\\xd8\n\\x1bi"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103p\\xb9\\x137.\\xac\\xbaa@cni\\xec\\xb1\\xaf\\xa9\\xbdu\\xc7\\x8f\\xf3\\xc1\\xc2\\x83d\\\\xc3\\x88\\xa8w\\xd0\\xbb\\xcf\\xf2x*345\\xb7cw\\xff\\xf6\\x08#\\xfa\\xbc?\\x18f4\\xc0\\xcd\\xcc\\xdbp\\x94\\xd8ei\\\\xdb\\xe3fge\\xea\\xc1j<\\x8f\\xd2\\xf5\\x1e'\\xa9$\\xae_\\x1c\\xd73\\xaak\\x01<\\x89m\\xa9\\x0e\\xab\\xed\\xb1i\\xa7\\xa1>\\xa0\\xcb\\x89/\\x90,\\xb8\\xf3\\xc5g\\xef\\x85\\xe7\\xb5f\\xf2\\xf5\\x7f\\xd0`\\xb0\\x9fih\\x04\\xec\\xdf-\\xa8\\xf3\\xa1l\\x9eb\\x80\\xfdy\\x10t:y\\xf0\\x8b#5m!\\xbb\\xf7\\xae\\x83\\xd0lq\\x82\\xfe\\xa5\\x0c\\xcfdvw\\x89|i\\x07-\\xdc\\x93\\xc6\\x89\\x0c;\\xd6\\xea\\xc7\\x1c\\x1d<om\\x95sd\\xb2/\\xc2\\xec\\xbd/o\\xf1\\xe1m\\x14\\xe0\\xff\\x91\\xdc\\x8a\\x9f\\xfcwm_\\xcf\\x98\\x16\\xb3\\xb0\\xeb\\xc5\\xf15\\xb1\\xcf^h(\\x06u&\\x8a\\x16\\xb7`i)l\\x19\\x03z\\x91)o\\x1c\\xf7\\xeeq\\xaa\\x0b\\xc4\\xafpg\\xd6\\x02\\x07b"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010fg\\xa3\\xddd\\xd1\\xc5p\\xbb\\x12\\x0f\\xe7fh\\xe0\\xce\\xee\\xaa\\x0b\\xf7$\\yn\\x1f\\xb2c\\xdc^\\xa6\\xca,%\\x10\\x7f\\xe8!\\xc6j\\xa6:=\\xb0\\x19\\x97\\xda\\xb9\\x82':_\\xa7\\x95\\xb2\\xc4\\x16\\xd4\\xda\\xc7k\\xcd\\xefd\\xf4s\\xeft\\xdc\\xdc\\xd3`\\xd7\\xf4\\x01\\x9f\\xedc\\xa3hy\\xb3\\xec\\xb7\\x83\\xc9f\\xcd\\x8fe$\\x9b\\xc8m=z7\\x15\\xa2c\\x07\\x1c\\xcdl\\xa8\\xa9cz\\xc5\\xfe\\xbf\\xcbu\\xbe\\x10\\xb4)\\xe0\\xff\\x00\\xb6\\xebb\\xdc\\x8bo\\xd6\\xeb\\x9c\\x15\\x9a\\xb4\\x0b\\xc9*ote|\\xdcw\\xbe\\xe5\\x7f\\xf5\\xea\\xbc\\xf4\\x9c\\\\x1c\\x8d\\xf9\\xfe\\xb8\\xac\\x08\\x84>\\x96\\xc7a\\x86\\xa2\\x9a\\xa1\\xd0\\xba\\x1f\\xd7\\xed\\xdeviy=8$\\x89d\\xd5\\x08\\x0e\\xa1\\xb5\\xaf\\xba\\xe0\\x02\\x16\\x99\\xbaf7\\x17<l*e\\xda\\xbe\\xe8\\xb4r\\xafr\\x1f\\x02\\x1d\\x1a\\xef\\xa0\\xfa\\xbe\\x84\\xd2\\xf0\\x96\\xa0?*\\xa6\"\\x17\\xd4\\xe1\\xb1\\x1b\\xd5\\xbe\\xc7b\\xc0\\x11e\\xbe\\\\xc6ma\\xd1\\xb9,p\\xa7\\xd3"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x07h\\x11\\x13\\xeb\\x98\\xd6\\xe6 \\xdb\\x05\\xed\\x9f|\\xd1du|6\\x1fwd\\x8f\\x8b\\xc0\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\r'\\xad\\x031l`yb\\xbf\n\\xf1\\x81\\xa3\\x8ay\\xff\"poe\\xd6\\x9cbg\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63a\\x88\\xac\\x17\\x0e\\x99\\x80,bp\\xd6\\xd2\\xc2\\x01k\\x9cp\\x0e\\xf9\\x97\\x195n\\x9a\\xd3p\\xe4\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x91i\\xfbo\\x81jb\\xa7\\xccej\\xd3\\xed\\xc2/\\xb7j\\xd6\\xe6\\x8f\\x91,\\x13h\\x0e\\x94\\xe9\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x1d\\xfd\\xba\\x1d'op\\x86l/\\xa9vqm\\xc6|j\\x07\\x97!\\xd2\\xa1\\xbf\\xf2`\\xe6\\xd1\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xa1\\xa0\\x83\\xa2x\\xd7q\\xe1\\xe6'\\xc5'\\xbf\\xf5\\xe7\\x13\\xfa\t\\x0f\\x881\\x917\\x1b\\xf9\\xa3p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x96\\x01\\x1ae\\xdag\\xc0d\\x962\\xf6\\x93\\xed\\x9b.*w\\xec\\xea\\xdd_c\\x9a_n\\xa6\\xd5\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63*\\xea\\x03\\x8ao)qi\\\\x8f\\x15\\x9f\\xce<\\xd2\\x0f\\x16\\xc6\\xd6\\\\xca|\\xba_\\xc4\\x0c\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8bg\\xe2.\\x07\rg\\\\xfc\\xa1\\xb0\\x93\\xbee\\xba\\x06\\xd5\\xae&\\x10e#)\\xf1\\xb6'\\xcb v\r\\xce7\\xe8\ti`\\xa7\\x8c\\xcd!\\xb1\\x92\\x18\\xcc\\xec0\\xa2\\x89\\xe34\\x86\\x14\\x94\\x0e\\x9d\\x02\\xb5\\x94.a\\xdf<\\x08\\xbd\\x8f\\x8a\n\\xc71\\xfe\\x82y\\xd9u\\x89\\xd5\\xe5\\x7f\\xb1\\x14h!o\\xd7\\x84\\x83\\xee\\xa1\\x0f\\xbc\\xcev\\xcae\\i\\xc8mx\\xeb<\\x1f\\xf4!\\xa6zo\\xe9~,\\xf5->\\x03k\\xb6p\\x1b\\xae\\x1b\\xa1\\xad\\xd1\\xbb\\xd7\\xd7v\\x19y\\x89\\xf3\\x1c \\x8e\\x13\\xef\\x00\\x92m\\xa0t3\\x86\\x97\\xce\\xa0\\xcd6\\xf1\\xf6vl\\x17\\xd1\\x82a\\xfe\\x96\\xc5\\x9d\\xc3r;\\x90\\xed\\x9d\\x9a\\xe1v\\xb0\\\\x87\"\\xb0#\\xccu\\xcbk\\x8ch\\xb7\\xaf\n+\\x03*\\x17?\\xf7\\x1bi\\xe2\\xcdy\\xad\\xf3\\xc3\\x94uh\\xd4\\xc63#\\xbc\\x14\\xb6\\x88\\xea\\x06y\\x08\\xca\t\\x1f\\xd1l\\x9c\\xac6\\x0f\r\\x81r\\x87r\\xe0\\x05\\xf4\\x93\\xfc\\xbc=\\xd2\\xa2\\x0fk\\x10h\\xd8>\\xfc>?"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63y\\x90t\\x97\\x1a#i 4\\xc3\\xd4\\\\xbd\\xc2\\x98\\xa8v\\xf0e\\xf0\"\\xdci\\x13\\xf1\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\xe4ko\\xa04\\xce\\xc9g\\xa3#\\x046\\xfc\\x87\\xa0s\\xe4\\xf0\\x06y\\xaa\\xb2\\xb2\\xfc\\xfd\\xcdf\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63i\t\\xab\\xa7ef\\xfb\\xaah\\x89\\xed\\xe3a\\xc5\\x9c\\xa4\\xef\\xb1\\x1d\\xe7p/\\xa4qt/&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63 0\\x97\\xd5j\\x9e\\xbf>\\xce\\x8d\\x17\\xae\\xe2\\x99\\x89\\xe6\\x06\\x03q\\x10\\xfan<\\xbc\\xc0\\xda\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63\\x1c\\xfc\\xbb\\xfb\\xae\\x94\\x1c|f\\x86\\x97\\xce\\x99=\\xc5k\\xcca\\xbd\\xa27\\x14\\x98\\xe9\\xb4\\x80\\xe3v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63qal\\x8a\\xb07\\x06\\xce\\x95t\\x19\\xb5\\x89v\\x84\\x19#\\xe8&\n\\xf3\\x04'\\xf4\\x07\\xaa\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\"b\\xb4>\\xc0\\xa4kq\\xa4\\x1e\\xfef)\\x148\\xf0\\x9b\\xd9\\xcf\\xb0\\xe3g\\x99\\x1bv$\\xcf\\xc4\\xd5\\xfe\\x95h\\xd1\\xbfe\\x1d\\xb0\\x00\"\\x87\\xda\\xcf\\x85\\x04/e\\xe0n\\x8e\\xddf<9\\xe6&\r\\x0fh:&\\x8f\\xdc\\x1d=f\\xf6h\\xd6.\\x8di\\x0c\\x9c-\\xcdk\\xf4\\xda\\x7f\\xac\\x83\\x14\\xd2\\x02\\x80\\xda\\x9d\\xb2\\xeb@\\xfaoxx\\xee4\\x10\\xfd\\xe7\"\\xd8j?\\x18\\xaf\\x867\\xd6p\\xfa\\x83c\\xb4\\x88'\\xb2\\x1b\\xd6\\xba\\xec\\xda\\xf5t+c\\xba\\xf5l\\xc8\"y=\n\\xd1k\\x96\n\\xb5\\xd9u\\xf1\\xbe\\x86p`\\xcf\\xcbt`r\\x9e,\\x94\\xe1\\xe36\\xc2\\x1b1\\x17h\\x03vn\\x8205l\\xf9\\xd0\\x85av\\xf3\rga\\xf6\\x12\\x98o\\x19f\\xcd\\x0b$\\xec;\\xf7\\x0e+\\xeb!\\x97tb\\xfb\\xe9\\x18nuc\\xf8\r\\x0e\"\\xa6d?&7\\xfc%m\\x97\\x0bna\\xf1\\x96\\xd7et\\x93k\\xf2\\xc5\\x93s7\\x8f\\xc5\\x17\\x8a\\xedd-\\xa1\\xab\\xb4\\x9e\\xd1\\xdb\\x06-y\\xad"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd63ix\\x05\\x11\\xde\\x84h\\xd5\\xd8\\xff\\xf8\\xa3\\x14\\xf4v\\xc8\\x1b~\\xba\\xd7j#\\x95k*\\xa5\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe4\\xd3\\xfc\\xd9\\xc2\\x91\\xf2q\\xa8\\xc8\\x14\\xd7\\x08\\xc6\\xfasv\\xd8\\xcf&a3\\xdd\\xaf\\xae\\x0b\\xc0#i\\x90nw\\xc3*\\xf9\\xab\\x9e\t\\xd2*\\x9a\\xaf\\xe4\\xf6x\\x98\\x87\\xd4q\\x95\\x0c\\x11*\\xc2 \\x04\\xf3\\xd3\\xc2\\xfcx\\x02rf\\x13\\xf1\\xee\\x17\\x8e#\\x865 \\x81\\x8c\\x90\"\\xa2\\x16\\x86\\x18\\xc8\\x89\\xc9\\xa1\\x98\\xe6\\x93\\xeaw\\xd4\\xef\\x9f!\\xf3eb\\xd7\\x13\\x82\\xc8j\\xcd.\\xbe\\x94q\\xf5\\x8cg\\xf1\\xbc\\x85\\xf6\\xbfl\\x808u$\\x8b3\\xb5\\xa7\\xe0!\\xb7?\\x86\\x93q\\xef\\xe4\\x811\\xd1\\x83s\\x8c\\xff\\xda!q\\xa70g \\xc9\\xb9\\xb5qh|\\xf7\\x02\\xa6\\x83\\xc4\n\\x19\\xe0\\x97\\xb4\\xf3+\\xc2\te\\xc2uc+i\\x08\\xb7\\xa6r\\xcd\\x9a\r=t\\x0b\\xb9.|\\xf2gp\\x89u\\xa9wlyp\\xa5\\xf3\\xe0\\x94m\\xa2;\\x024w\\xf6v\\x900\\x08k\\xd1\\x07\\xa9\\xa0e\\xbf\\xe1\\xc6\\xd6%\\x18\\x9f\\x84\\x9a\\xcd\\xd7\\x0ceb^4\\x82\\xaat,2\\xa1\\xa8a\\x96\\xc1\\xc5i\\xeb\\xff"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\xa8\\xed\\x95\\x10\\x90\\x82\\x91\\x10\\xab)x9b\\x8em\\x17\\xac\\xad\\xd2\\xfdw<\\xd8=x\\xeb\\xcd\\xde\\xa3\\xd5\\x8c\\xe3\\xa8f\\xd2\\xa0=c, \\xda\\x10\\xfc\\x9cy\\x05\\x1er\\xdf\\x88t\\xfex\\xd4\\xfb\\x9c\\xca\\x84w1#\\x8e\\x93\\xf9\\x14+0(\\xdf~\\xa4h\t\\x04fg\\x8a\r\\x08\\xa7\\xf9\\x11\\x05\\xe1k\\x82x\\x1b\\x8dpy'\\xf7!\\x1f\\xd7>\\x970\\xb3\\xeel\t\\xd7\\x14\\xeae\\xfb\\xff\\xec\\x84\\xc7\\xcf\\x86zlc\\xb4\\xee\\xb1s\\xd5\\x10\"\\xadt9\\x0c\\xf2\\x15%h\\xfa\\xefi\\x958\\xa5\\x94\\xf7\\xfb\\x0b\\xfb\\xf7l\\xbd\\xca\"yv\\xa9\\x10;h\\xf6\\xde\\xd5\"t\\xdd\\xb0\\x14\\xff\\x92\\x96\\x93\\\\xb9\\xdc\\xa31\\x9c5;\\x8f^\\xd2\\x05\\xfde\\x14\\xbbk1\\xf15\\x08\\xe6\\xbb\\xc5\\xd4\\x89\r\\x81$\\\\xbb\\xa1a?\\xd7\\xbc\\x8b\\xce\\xca\\x19\r\"k8\\x19\\xdc\\xdf\\xfa\\xfe\\xd5a\\xb0\\x95\\xf7l\\xf9\\xa7\\xa2\rr\\xc9m\\x9c\\x9c\\x98\\xb1\\x81\\xf4g\\x0f5\\xea\\xeb\\xdb\\xb1\\xb3\\x80\\x1d \\xf5p\\xf4\\x96^\\xed>&\\x12s\\xf4"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xa0e:\\x86jg\\xb7\\x05\\xf1j\\xf6\\xbc\\xbe\\x01\\xee\\xeeda/pz\\xeb@\\xfbf\\xf7\\x17\\xe6\\x02\\xddi|\\xd1@up\\x93j\\xefa\\xb0\r\\xd1b2\\x14y\\xb0\\x0f\\xa1\\xd3\\xbao@\\xe6y\\x0b\\x1b\\x89pb\\xf7\\xdcm9\\xde\r\\xf8u\\x11o\\xb8\\xc3\\xe5\\xb1w\\xb4\\x80\\xbf\\xc3\\x96\\x9ev\\xecc\\x97e\\xa5#\\xe5x\\x0fvs\\x0b\\x86?\\xba\\xfbv=df\\xf0\\xc9\\xb1a\"\\x0e\\xc2\\x7f\\x8az7m\\x9d n\\x1c!\\x91\\xe0\\xe8k\\xe1o\\xe2\\xfd\\x7f\\x87\\xe4\\x08\\xf7\\x02\\xfd\\x19\\xb6\\xc2h\\xa0\\xd3\\x1d\\x8e\\x99\\xf6!\\xa4\\xdc\\x8dog^\\xde\\xc0e\\x0f\n\\xb5\\xc8\\xb9i\\x8c\\xc5\\x1c\\x1a\\x1e\\xb3\\xaak\\xa9ib1\\xec\\x85\\xf6r+\\x82;\\xccb\\xcf\\xe9\\xd6\\x83w\\xe3\\xd4\\x9c\\x96\\xd5\\x08hl\\xa1\r\\xf1\\xd9\\x9e\\xa8\\xdd\\x14\\x0f\\x84%\\xf1\\xaf\\xec\\x80g\\xff:\\xf9wo\\xa1\\xea\\xb1v83s1\\x16\\x99s\\xe2\\xf8\\xb8g\\x94\\x8a\\x9f\\x02\\x8b\\xed\\xe95\\xa5\\xda\\xf85?\t\\xfa"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\xd9\\xba\\xd9q\\x0b\\xae\r\\x9468\\xde\\xe6@\\x19\\xa8f\\x90\\x06\\xees\\xd1\\x12|\\x9d2wx\\x0c\\x15\\xee\\x17\\x97s\\x8a7j\\x9a\\x0f\\xebf\\xa2\\x0f\\x90\\x02i\\xb8\\xadk\\xa4\\xb4j^\\xb6\\xcf^\\xf5\\x07\\xc6\\xc1\\xde%/\\xd6k(c\\x12\\x8dv\\x01\\xa4%.\\x8b\\xba9\\xfc|o\\x1c\\xd7=\\xe4d%l \\x1e\"9c\\x95\\x19x\\xb6\\xd1\\xd2\\xed'\\xf0\\x96\t\\xd9#p\\xa5\\xda\\xe0>\\x9ez4e\\x9d=\\xf1i\\xf7!\\xe5\\x119\\xf4?p\\xc5\\xf9\\x8eu\\xa0\\xed\\x1b\\xe2d\\xe8\\xed\\x8b/\\xaa\\xdf\\xe1a\\xd0s\\x99&!e\\x06\\xb7\\xa6_^\\x146\\x06\r>\\xc2\\xf2\\xbeo\\xe4\\xac*8\\x08\\xd5\\xfb\\xd0\\x17\\xb4\\xc5\\xb4\\x99k\\x15\\x06\\xbf\t\\xe0~\\x1e\\x0f\\xae\\x8f\\xf7\\xe7<\\xc4\\xce\\xd6\\xfc\\xce\\x7fl\\xdd\\x9e45\\xe6\\xdcea\\x1b\\x8c\"\\x0c\\gh\\xa9\\xcdr\\xaf\\xb0\\xc6\\-8\\xd6zn\\xf6\\xe6\\xf1\\x12\\x988\\x83q\\xaa\\xbc\\x97\\x91\\x8cd\\x97\\x0f\\xcf\\xd6\\x9d\\xef\\xbb\\xf19\\x02,"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xb3\\x08\\x85\\xdc\\x93:\\x81\\x7f\\xd2\\xf6\"\\xe0\\xa1h\\xef\\xd7\\xa5=oe\\xf1\\x14\\x1b\\xad\\x91\\xef\\xa8\\xbe\\x8d\\xfe\\x19\\x91\\xe5\\xa0\\x8a4i\\xa9\\xe2\\xfd\\x1fxa\\xb0\\x11\\xf2\\xd8\\xc4\\xf3\\x88\\xee\\x9a\\xa3\\x19\\xb7a\\x08\\xf6\\x15\\x0f\\x92l>\\x01\\xfd6\"\\xf5\tu\\xdcxvy\\x96\\x1e\\xca\\x94\\xc5uehr\\\\xda\\x85\\xd3g\\x1f-q\\xce\\xc6\\x95\\xb7(l\\x8b\\x9394\\xaf\\x0f\\xca\\x81~\\xcde\\xa4\\x96y\\x85\\x9a\\x84n\\x11\\x1b\\xad|\\xb0\\x93\\x15\\xa3\\x03\\xc8?\\xf3o\\x8ed\\x97\\x86$8\\x9a\\xad\\xb9\\xcc\\x7f\\x85x\\x85h\\x83c\\x99>,\\xc0\\xdd\\xa7\\xaf7\\x92\\xf8?\\x13\\xc1\\xd5\\xcfc!\\xfb\\xdb\\xc4?\\x80cs<\\x83$\\x8a\\xde)2@\\x0e=k?\\xdd\\xd3\\x05_\\x9e\\x04ry\\x11\\xa2\\xe8ba\\x88\\xdb<\\xc8\\x96\\xbc\\xf5z$\\x8d+\\x97\\xb5l\\xb0\\xc2\\xd2| a\\x9b\\xd1\\x9b\\xd7\\xde\\x8c\\xfbo\\xdfd3\\x17\\xaa\\xccni\\x9f\\xdb\\xef?9\\xade\\x00\\xfb\\xec\\x1a\\x1f7yj\\x960"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xcc\\x18\\xdd\\x05\\xf57\\xf8?\\xdd\\xaf\\xb3\\x9ffdpy\\xa2&\\xd9\\xdc\\xf3\\xa2hbums\\x18\\xd2\\xf3\\xff\\x90\\xa2\\xdd\\x11\\xc47\\xbfx\\xfc\\xaa\\xfd\\xbe\\xec\\xf7\\x13\\x13\\x04\\xd7\\x8bi`\\x00\\xe3\\x84j\\x8dco\\x127:\\xef\\xef\\xe2\\x88\\xe8\\x124\\xce^nev*\\x9f\\xd8\\xabx\\xb8\\xd7\\xb1tl\\xcd'\\xf1\ra4\\xf88\\xc3\\xa3\\x15\\x91\\x8f\\x13\\xdd\\xc4\\x963m\\xca\\x0cb\\xdby\\x80i\\x9c\\xe5\\x82\\xad\\x0f\\xcf\\xab\\x80!'\\xd1;\\xf2f\\xd1n\\x85\\xff\\xf19!+\\xaf\\x87ag'\\xbd\\xfap\\x90~pq\\xaf\\x15\\xd8\\xa3\\xeb)\\xe5\\xad\\x14\\xb4\\x00\\xbe\\xdde\\x1a\\xbc\\xc4\\xd0\\xe0\\x11f\\xa6*1\\x8f\\x0c\\x14\\xef\\x16i\\xd0\\x92q\\xa3\\xff<p\\xb2.t\\xb4w\\xce\\xa4i\\xe1-v\\xe9\\xebads\\x0c\\x01r\\x11i\\x9e\\x84\\x05\\x8e\\xce\\xb5\\x03\\xc8\\xc5\\xda\\xba\\xd0&h,\\x13\\xe173i\\x07t\\xf3\\xa2%\\xc4c)\\x15h!\\x0c9\\xd9w\\x16\\xefxm\\xbc\\xe9*\\xd3\\xe8\\x08"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xb9\\x18q\\x9c_\\xad~f\\xbe\\xf54\\x9d\\xdd\\xd4)=6\\xdc\\x15b\\xbdg\\xdf!\\xc1+\\xd3\\xa5\\x99\\x8dn\\x04\\x17%\\xcbb\\xb1\\x9a.\\x8cp\\x9a\\xfb\\x1edk\\xf4\\xd8\\x07j\\xe8\\x86\\xbbh\\xd1\\xf9\\x0eq\\xf7\\xbb\\x87!\\x13\\x04\\x93bs8\\x83\\x8c\n\\x18#=4\\xdem\\xca8_d\n\\xdf5\\xf9\\xdd\\xdb\t\\xf8\\xec\\x03\\x16c\\xc7cv\\x95\\xd8\\x86z\\xff\\xe8u!\\xe88\\xccc&\\x80\\xcf/\\xe1f\\xdc\\xdc~\\xcd\\x91n\\xfa|v\\x86\\xce)dfr%\\xfc\\x90\\xa9 \\xfd\\xbf\\xa5g\\xa0f%m9\\x86\\x96\\xc9\\xd2\\xfd\\xabcfs\\xf0zp\\x8d\\xf5\\xc1\\xef/r=\\x82\\x04\\x89\\xac\\x94\\xde3\\x02\\xba`,\\x8cs\n\\x8a\\xda\\x8e\\x02\\xe6\\xf8\\xf7\\xdbr\\x05\\x19\\xa7\\xfd\\x14\\xf6kh\\x1fq\\xcb\\xcab`\\xff\\x08\\x15\\x87;\\x92\\xe8\\xcdq\\xc9\\x80?t\\xa5\\xba\\xb6t\\xdd\\x1a~\\xfe!>\\xfak3b\\xd9\\x92<\\xf1\\xd4\\xa2\\xf2\\xc6\\xce\\xc4\\x06j3;q\\x0fmd\\xe3\\x99\\xd4\\xd6"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r)\\x86&\\xe4;\\x1e&p|g\\x0fsc\\xaf\\xd6j\\xa5qi\\x08\\xd5\\x12\\x83\\xbebzqx?\\xb1\\x98\\xd6\\x92\\xf2\\x01\\xc4^\\x04/\\xdd\\x84\\xf2#c\\x90\\x93\\xad\\xc7\\xb6do\\x93\\x0e\\x98s\\xc9q\\xb1m\\xc2a\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xb0\\x81\\xe2\\xb6\\xc6\\x11\\xb0\\x1d\\xe4\\x92\\xe9\\x99g\\x8a\\xc3\\xbfd\\x00y\\xa7,8\\xa3d\\xc3\\xdf\\xe5\\xc8i\\xc1\\x8eg\\x13\\x06\\xbf\\xfc8\\xae\\xcd1\\x9e\\x1c`\\xf0\\xb7j"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xcc\\xb3b\\x14i\\xab@\\xd9\\xfb\\x14\\x06\\xccw\\x0f\\x83r\\xc4\\xe9m\\x04\\xcd\\xdev\\x99\\xf9\\xf1j/\\x1b\\xc7\\xe3y.nr\\xd8g6\\x82\\xee\\x1bzh\\xa2kz\\x9a\\x89\\x85>\\xa3\\x8d\\x86\\xc1p\\xf3v\\xc54\\xdam\\xf8\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(\\xea\\xd0<\\xf9\\x966\\xfcj\\xf959\\x93\\x14\\xedy\\xc1\\xe3d\\xff\\xcbn\\x92!d^\\x06\\xaef\\x14v\\x8d9\\xb1\\xf3\\x0c\\xa72i0\\t2y\\xa9q;"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\x0f\\xcf\\xf1g\\xc8qoq\\xe5\\x19\\xa7j\\x10\\xfdv\\xc6\\x0f\\xe3-\\x85\\xc6f\\xb2\\xf1\\x00\\xe2eq,\\x9au\\x98\\x85h\\xf9a\\xaa|\\x04x\\xe0\\x18\\x90\\xd3\\x8ac\\x17\\xda\\x7f\\x01|`\\x8f\\xce\\xd5\\x0e\\xc9\\xa4\\xb9q\\xde\\xc1k0\\xffc\\xc7f\\xe9\\x0c\\xa8%\\x16\\xe8\\x80\\xb7~%hka\\x8c\\x93hxw\\xc3\\xae\\x80\\x8fk\\x851\\x81\\xde\\xe9\\xbfpbbxqjh\\xbe!f\\xa7l\\xd3m\\\\xb5\\x90\\x0f\\x16\\xa1\\xacy\\xa1\\x8c\\xcew\\xcb)\\xd5\\x8c-+\\x89\\xa9\\xf1\\xff\\xce\\xb5\\x892\\xfa\\xc0%m\\x1b\\xca\\x02\\xa2\\x0es\\xe1\\x82\\x1f\\x11j\\xc2\\xc5;\\xa3\\xcb\\xbeg<\\x8e$\\xf2\\x02\\xe3\\x04\\x9d\\x94\\xec\\x8b\\x88\r\\xaa\"\\xb9\\x17^\\xf3z\\xa0\\xd3i\\x8ao\\xa9:s\\xcdb\\xf1v\\xf4\\x19\\xffp\\xe2\\xb6\\xb1\\x86\\x13\\xfc\\x1b\\x00\\x9e\\x89\\x17e2\\x99\\xfb\\xe0\\xdb\\xd3\\xa0e\\x9a\\xe3\t\tu7x\\x01\\xd9\\x85\\xde\\xfd\\xa7\\x86\\xdc\\xd3\\xbe\\xd2\\xc0\\x9f\\x14o\\x08\\xad\\xbd\\xde\\xc0\\x88s\\xb4q\\xaf\\xcb\\xaf|"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\xe6\\xb9\\xfa.\\xb0j\\xa9\\xf1\tj\\xd3\\xf0%\t\\x80z\\x89xk\\xbcg\\xbcsco\\x06\\x8d\\xdeh\\x8c\\xb7\\x8c\\xdd\\xa3\\xbe\\xe9\\xeb\\xfd\\xb0%=\\x05\\xa6\\xa5\\xa2\\xd4\\xf7w\\xc7\\x04\\x10\\xaf\\x84\\xdf\\x8b\\x87*\\xc3\\xb1\\x11\\xbb\\xac\\xb9\\x0f\\xea\\x1f\n\\xd0\\x12\\xd9\\x9d\\x01\\xabr&\\xe0!\\x1b\\x1da\\xf9\\x1a\\xb5\\xcb&\\xbf\\x14\\x92\\x1esz\\x99\\x93\\xd45nv7\\x92*d2\\x97\\xcb/\\xd0\\xe7\\x8b;\\x87\\x81ink\\xa6\\xb6\\x16\\x89umfq3\\x0f\\x97uy\\x95\\x07\\x99f?\\xc3\\xd2\\xba\\xb9\\x80\\x17\\x86p\\xe8\\x85ro\\x94\\x88\\xd9\\x1c\\xa4\\x03\\xb1\\xe3_\\x9a\\xd2r\\xefh\\xccu\\xd5q\\xcc~\\x8b|\\x01,\\xac/b\\xb4\\x0f\\xa0+\\xcc\\xa1\\xd9\\xc9\\xc1\\x8fu`l^ho\\x866\\xd4\\x1d\\x95'\\xe0z\\xfc+\\x80|y\\x9e\\xe9s\\xe2\\x10\\xb9u\\xd7\\x1c\\xce \\xe2k\\xbb\\xf0\\xe2-\\xce\\xec\\xbb\\x97\\x85\\xcf\\x0f\\xee\\xca9c\\xc1\\x9a\\xa05p@g\\xa2\\x91ufl-\\xdb\\xfau\\x98"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e%\\x0e?\\x86r\\x03\\x80)q\\x08l\\x97u\\xd5\\x1b\\xe3r\\xfep\\x05\n\\xe9\\xe2'\\xf0\\xfa\\xf2j@\\xbe\\xc7_p\\xa6\\xbc\\x8f\\x81y\\xe8\\x9f\\x9b\\x80\\xf1\\x9b\\x15\\xf4\\xb1f\\xda\\xb3\\xdb\\x1b\\xaa\\xa6\\x8b6\\xcas\\xeck\\xc6\\xb6\\xad\\xcc\\xdf\\xde \\xf1'\\xaad\\xb1b\\x89f\\x03\\xf6\\xc2\\xd3\\x1e9\\x13i\\xe5\\x05\\xd0\\x13\\xe7\\xc4i\\xc1\\xe7\\xe5$y\\xca\\x05\\x99\\x8a\\xa3\\x1d9a\\x84\\xe8\\xa21\\xed\\x1ex8\\xfae\\x90j\\x847\\xd8\\x9a\\x8f\\xea\\x88\\xe9s\\xb0\\xa8\\xf2fbv\\xfff\\xad\\xfe\\xa6\\x0b'\\x0f\\xad:\\xb4\t!l\\xe6c\\xb7\\x08 \\x8c\\xea\\xa3`p\\xabn\\xaf\"\\xdd\na\\x07\\xe4\\xe7\\x82\\xc9\\xa4\\x97\\xf58\\x0f\\xdc*\\x7f/i\\xfb\\x08\\x8d\\x03\\x0b\\x1f\\x00\\x97\\x0fk\\x94\\x9f\\xff\\xa4\\xaf\\xe7\\x90\\x99(n\\x91r\\x95\\x04\\x97\\xf0\\xc6\\x80*\\xba19\\xaa-u\\x1dm\\xa5\\x81\\x03\\xb6\\xa3u\\xff\\x9b@\\x84\\xd5\\xe0\\xdff\\\\x97\\xff\\x1d\\x17\\xbf/\\xa5a\\x12\\x9ap\\xb7ax\\xf1\\x9cf\\x89"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\\x1c\\xf7\\xc0^\\xba5du\\x81f!%\\xfd\\x02\\x14\\xa0\\xd1\\xfe\\xb3\\xfe\\xea#\\xcf\\xabd\\x10cf\\xf3\\x13\\xcf4\\xc8\\xb45m/\\x8c\\xb1->\rj\\xfeq\r\\x92\\xc1\\x88\\xb7o\\x89q\\x9a\\xe1\\xbblz\\xbd\\xc2<\\xf2\\xa9ae\\x8ai\\xad'\\x91\\xe0\\x14g\\xf10u\\xfb\\xc4\\xa2\\xda\\x94\\xb2\\xe4r\\x1e\\xa3\\x92\n1\\xbc\\x83 >d\\xebl\\x89\\xc7\\xf9\\xde\nh\\xd48\\x0c\\xf3\\xa8\\xffar<l\\xfc\\xb5\\xd6\\xb9+r\\xf9t<\\xf9rz\\xcci`\\x05\\xf8\\xf4\\xd6%\\xe7\\xd0\\xca\\xd6\\x84\\x8bx\r|\\x92\\xc4\\x80o<\\xe7x\\xd48\\xd2\\xa5\\xbf>\\xb4\\xf2\\xaenp\\x94\\x9f\\x0f\\x07\\x0b\\x1b\\x1e\\x13\\xc3\\xc6\\xd4\\x1d\\xe2r\\xb7\\x03\\xa3\\x06\\x94\n\\xcb\\xa1\\xe3%\\x82\\xde4s\\xd0\\x9e\\o\\xc0\\xd5\\xcf\\xc3%\\xb33'\\x00\\xd7\\x830\\x99\\xd7u\\x06my9gn\\x85'm\\x0e\\xfc;2\\xe7\\x8d\\xa2o\\xe3q\\xb69(zgw_\\x11p\\xd4)0\\x8ek\\x07\\xc0\\xf5\\x11\\xafp\\xd0x\\x00\\x12"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\xc4\\x00f\\x00\\xe0\\x14\\x92\\x10\\xf5\\xfbv:\\xb8ria!x\\xe0\\x8c\\xae%\\x0c\\xe8\\x9d\\x02om\\x86\\xad^\\xb0\\xee\\xe4\\xb2o\\xbe\\x7f@\\x99p_\\_\\xce,\\xd4\\x02`\\x9dis\\xe6\\xee!\\xb9*)\\xd7\\x90@r$:|\rh3\\x9fo\\xaf\\x8b\\xe2\\x93\\xd3\\xec\\x83\\xd7q=\\x9e\\xc5\\u\\xda:\\x80\\xe3\\x0fh\\xca\\x17\\xd9\\x9c\\xb5\\xa16e\\xd6~\\xd7\\xfb\\xe5`r\\xbf\\xaer\\xe2d\\x80`\\xcb\\x93\\x1f\\xfa$s\\xde2\\xd5j\\x04\\x9e\\x9b^.\\xea\\xbc\\xcacc~n\\x04\\x8dx8\\xd4=\\xce\\xdb\\xf1kt\\xbf-s\\xb7\\.u\\xa7\\xa8\\xbb&\\x1c\\xa3\\xca\\x0f\\xe0\\xd0\\xca\\x91\\x97\\x1b\\xad\\x8bt\\xb58\\x10u\\x86\\xf8\\x1d\\x8af\\x12gf\\x80\\xaf\\xee7zp>p\\xd8&@\\xef\\x97(\\x88c/\\xa6\\x97\\xd8s\\x89\\xb0>&\\xfb\\xf6a\\x8a\\xecc\\x1d0)\\xdf\\x17z\rib/y\\xfd\\xe3_e\\x8e\\xec\\x0ed:\\x1f\\xcdkw\\x11%\\x859\\x1c\\x160\\xdeyei\\x84<\\xdeh\\xe6\\x0b"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xef7%\\xe7\\x1f\\xcev.\\x93\\x83\\xbc-?qg\\xb9\\xda\\x1d\\xe0\\x90j\\xaa\\x96\\xf4\\xe8\\xae\\xf6\\xde\\xcc\\\\xca\\xf4o\\x1c\\x86j\\x0f\\x8a\\xc2\\x12h\\x92v#\\x9ap5\\xf7@h\\x9a1g\\xf1\\xd5\\xcf\\xba\\xa8\\xe3~\\x05%\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000hd/\\xc4\\\\xd2\\xc8\\xc4\\xb6\\x14\\xe6\\x03\\xbcm\\xc9p\\xa3k\\x8e\\x10*)\\x8ao\\xb1\t\\xcd\\xa3\\xdd\\x86,wu1o\tv\\xb9r\\x9au\\x83l,\\xe1\\xf4\\xbc3"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\x08\\xad\\xce\\xa6\\x94\\xbd\\xf3\\xae\\x90\\x85\\xc4i \\xae\\xbe\\xbf\\xd23\\xb8v\\xdd\\x9a\\xeb.q\\x7f\\xd7\\xe3h\\xc7m\\xdf\\xd9\\x9f\\xdb-\\x0c\"p\\xd4:\\xb9'l5@\\xe3\\xbcx\\x93*\\x16'\\xa5\\xe5\t\\xc4\\x81\\xfd\\x00h-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xb6\\xe1`\\x15a\\x1aw\\xb6\\xa5\\x00b\\xb5\\xd6\\xd2\\xe9\\x9fs&r68\\xccr\\x10\\x1b3\\xa5\\xd4\\xf2\\xc7\\xce2\\xeb\\xb1\\x03:\\xa4k\\xf8\\xdbk\\x1b\\xc0\r\\xf4\\xcd"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xecg\\xcej63g\\xb3\\xef\\xb8\\x12\\xc8\\xba/\\x08s@\\x8c,\\x0flx\\xf1#\\xc2\\x1e\\x88\\x977\\x11\\xf9\\x19o\\x036\\x0ecu9\\xca\\x8ftau\\x11\\\\xd0\\xdd\\xc4\\xa4(m?\\x14r\\xc5y\\xd9\\x1dp\\xa4\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x1c\\xa6\\xcc\\xbe\\xe2\\x13\\x82\\xcce\\xdf\\xb6c@\\xb8y\\x87\\xd2~\\x93\"\\x11m\\xa85f\\x93\\xc2\\xfb\\xd3\\xeb\\xc5$\\xc7$t7z\\xd0\\xd0s\\xdec\\xack0\\xd3\\x04"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\xd1\\xcbt1r\\xa0\\x15\\xfc\\x8c\\x02\r\\x0f+u\\xf4\\x92\\xd0\\x81-&\\x98\\x1a\\xae'\\xd9-\\xed\\xda3\\x13\\x14|\\x95\\x85\\x86\\x15\\x8cr^\\xed4\\xf0\\xfb\\xa3\\x16\\xfeu\\x9c\\x95\\xab\\xa6\\xc0f\\xe0n\n\\x8c*za\\x90\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xcc=\\xe5\\x1e@f\\x14\\xb1\\xea\\xea\\xfe5\\xfc\\x82@y\\x00\\xe0\\x10\\xce#\\x08f\\xe2\\xde\\xf1>\\xe1\\xed\\xd1f\\x87a\\x9b\\xd5\\xe6\\xaff\\x04\\x9f\\x15\\xd34\t\\x9e"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\xf9p\\xfae\\x8c\\x04\\x10\\x14\\x1cyi\\xe69\n\\xb7\\x13\\xa3\\xf9?\\x1f\\xb2\\x1d\\x89\\xcd<\\xce/\\x80\\xea\\x14\\xfe\\xcf\\x8e:\\xb9r9:\\x17\\xb1\\xcc\\xfa@\\xe2\\xca\\xb2\\xafc7\\xdb!\\xd2\\x0e\\xeb\\x9f\\x9e\\xa5\\x02\\xdf%\t(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#9\\x16!v\\xdd\\x83\\x02hzl\\xb2\\x9e\\xfc\\xa2l\\\\x90\\x14\\xe5p\\xfd\\x92?8\\x80n\\x11wfxe\\xdev\\xd0bqt/\\x96>t`\\x06\n\\xeb\\xdd\\xcc"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xd5\\xea\\xba\\x0e\\xd3\\xea\\x13\\xa8\\x03'\\xcez\\xad\\x90x9\\xfa=\\xe3_+\\x82\\x01j\\x08v$rsd\\xeaz\\>\\xe23!ky8\t\\xcd\n\\xed\\xf2\\xd2\\xa0tzp\\xce\\xf9\\xb5&a)\\xd3\\xc1\\xe2usc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xfbb\\xbb\\xf1\\xbd\\xc4\\xa8\\xc4o\\x12eh\\xce\\x1c\\x8bx\\xad\\xc1\\x97i\\xf9\\xe1\\xea\\xbfc+\\xd3\\x86hmy*wg\\xe4\\xeag\\xab2'v\\xb4\\xfc\\xe4%b"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_f\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdfk\\xfa&`/\\x82\\xf2\\xc7\\xc0\\x8a\\x10\\xbc\\xfcc\\xcb\\xeb1,|f\\xe8\\xa8v\\xb8n\\xba\\xc3\\x8a\\x86\\xa8cbnfi\\x9a\\x90\\xf8\\xb4\\xe1\\x05\\x18)ia\\xab@f\\xe8f\\x92?\\xe3\\x86\\x9b\\x84\\x1d\\xdb#eb\\xc5^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xff\\xa8\\xf2\\x94e\\xdf\\x94q\\xd5f;s\\xa21\\x9e\\\\x11+\\xbf\\xc3\\x01\\x0cx\\x94#s\\x7f\\x04n\\x95\\xb5h\\xa9\\xad\\x1e\\xf7\\x89\\x89\\xf3\\x10\\x96p\\xd7+\\xa7\\xcf"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6\\xc9\\xe3/~\\x04q\"\\x8c-\\xafz\\x8a\\x0c\\x0b\\x9f\\xa2\\x15\\x0ek8\\x12\\xce\\x8b\\xfaq^\\xb8\\xfc\\xfew7*z\\xd1\\xa5e\\x90\\xa1\\x16\\xc6\\xf7\\xf5\\xef\\x146\\xf0\\xff\\x0c\\xad.\\xea\\xfd\\xe5\\x9bk \\xdc\\xb6;\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\xf0-\\x19\\xe6\\x0e\\xd0\\x98g\\xf8\t\\x0f&\\xf0\\xb8\\x01\\x86\\xaf\\x05\\x17*\\xff\\xf0\\x15#x\\x16n\\xd4\\xb6\\x037\\x8a\\xaac\\xee\\xcf\\xdbux\\x13\t\\xa1\\x95y\\xa7\\x87"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08f\\xc5\\xd6\\x0f\\xf9e(w\\xb6/\\x91l\\x84\\xca\r\\x82f6\\xaa\\x93\\xb5\\x95a\nh\\xa91i\\x93\\x01\\x0ekp\\xc6m\\xc0\\xec\\xc5\\x15(\\xca\\xa4$\\x9e*\\x10\\xab\\x17\\xcc\\xd6>\\xe2_\"\\x8d\\xa2\\xd5\\xabi\\xa7\\xa8|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xddi\\xcf\\x87\\x9d\\xe7\\xb0\\x94g\\x11\\xaa\\x1b\\xf9u\\xbd\\xab\"c\\xda\\xb0\\x18\\xa5s3j\\xff.ci\\x93\\x0cw\\xc4\\xd5q\\xb2\\xc7\\xf4p\\xd4\\x94\\x80\\xfc\\xf1:\\x8c:v"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x9f!c?\\xe8\\x80e\\xa9\\x0b\\xaf\\xb2\\x08~\\xf3\r\\xad\\x95:p\\x10\\xf9=?\\xcf.\\x0b\\x0fk\\xcb\\xe2\\x18\\xca\\x14\\xea\\xebml\\x91\\x01p\\x88\\x8c\\xda\\xf2\\xb2\r%\\xc0\\xf2s\\xe3\\xb5\\x83d0\\xcew\\x18^d\\xe8\\xdft\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8g\\xe3~\\xae,w\n:\\x8d\\xbc\\x91\\xdb\\x0c\\xfd\\xe5\\xbb\\xae\\xcc\\xfe\\xd5\\x11\\x81\\xf3a\\xc0\\xb54d\\x91\\x98\\xc6x\\xf1\\xa9\\x05\ru\\x97\\xe6\\x83\\xc2v\\xc2b"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb(\\xe7\\xdc\\x80\\xf8\\x1f\\xeal\\x9a\\xd8k\\x13\\x9a\\x0f\\x02\\xb3\\xe0\\x129\\xe3.\\xffz\\x91\\xdeq\\x0el\\xaff\\x96\\x80\\x15ik\\x8b\\xe5\n\\x9f\\xb9\\x0f\\x82\\xabvad\\x90\\xeb\\x19\\x1518!\\x94\\x16\\xf22~\\xd4\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\x15@0\\x8e\\xe1\\x10\\xf5\\xf8\\xec7v\\x9f+\\xe9\\xb2l\\x9b\\x11\\xbb|v\\xb4p&\\x9b0b\\x8ayl\\x1c\\x9f\\xb0\\xdd\\x04\\xb1$-\\x9e)\n\\xca\\x9c\\x07\\xbaa"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x9d\\x04,\\xae\\xa7g9\\xe87\\x04\\xc3/fo\\x08v\\xdb\\xd4\\xbe\\x1e\\xde\\xe8\\x16\\x91' \\xa4\\x1c8\\xea\\x8d\\x1a\\x0ek*\\xb7\\xa9w|;\\xbc<\\avv\\x97f\\xec\\xfc\\xa8\\xdf\\xda>\\xe8\\x87\\xa8*\\x07\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3w\\x9f\\xc5\\xfe\\xb0g\\xd1@\\x92\\\\x87\\xb57\\x00\\xa3r\\xe5\\xbf9b\\xc5\\xb4\\xfb\\xfb&\\xe0\\xc1\\xd64hn\\x1f\\x8a\\xb0\\xe7\\xb8u\\xaf1\\xcb\\xb3\\xbf\\x054\\xc7\\x88\\xe8"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_f\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9c\\x98\\xc7\\xc4f\\xce\\xe3q\\x9c\\xb2\\xd0\\xe6\\xa9\\x9cd\\xc7.2\\xe3\\xe2\\xa1\\x07\\xa5\\xa0\\x0f\\xa9n\\xe12\\xd0\\xe7\\x99k\\x00v\\xa6\\x18\\x9d\\x8c\\x1eq\\xbd\\xfb\\xb3\\xac\\xcc\\xf9aq\\xc3g\\xea\\\\xc3\\xb6f\\xf8\\xd0$\\xd6.\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3x\\xd1\\x8f\\xe3&!\\x14\\xa4tn\\x85\\xf1_\\xe0\\xecs\\xae\\xa0\\x80\\x9d\\xc5'\\xc2j\\x17\\xdf\\xc8\\xee\\x9b\\xff~g\\xa8g^\\xbb\\x9c\\xf5\\x81\\x9e\\xe6\\xa5\\xaf\\xf8\\xe2\\xac"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m=\\xf2\\xb8qq\\x0e9|\\xb5x\\xdf\\x95\\xf8\\x1e\\xc6\\x1e\\x0b\\xd9\\x81c\\xec\\x86\\xe1\\xa8a\\xc5km7\\x1bw\\x94e\\xcc\\xe0\\x88\\x15\\xa1\\x92\\xe8>\\x8e\\x0e\\x96.jywa\\x96\\xd8\\xe8v\\xdc\\xd7pl;h\\x7f\\x9c\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\x14>\\xb9\\xe7i\\xc4n\\x12\",t\\x10\\x0c\\x05\\xec\\x03\\x82\\xb2\\x0c\\x9b\\xe2\\x02::~o\\xb8z\\x88k g\\xcd\\xbbo8\\xe3\\xbc\\xa9\\xab\\xab9=\\xbc\\x183"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_f\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x04\\x93\\x04\\xf5\\xe9\\xb8:\\x88x%\\x8f7\\xff\\xabu\\x91\\xae8w>\\x9an\\xd7\\xf7\\xd9\\x10\\x99\\xd9\"\\xc7\\x9c\\xfa\\x00\\x0c\\xb9\\x08\\x83\\xdc\\x10w\\x93\\x997\\x07\\xe4\\xaf\\x9b\\x1c\\xdb\\xd9\\xe9\\xbb\\x88w\\xbfjk\\x93@\\xb3\\\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\x9c\\x05\\x13\\x94v\\x0fb~\\xd8\\x06\\xca\\xf6\\xffjl\\xc8\\xa6p0\\xc8\\xa8%n\\xa4\\x9f\\xf8\\xb8k\\xd6%\\x04\\x92\\x08\\x9e\\xc7\\x06d\\xc7\\xc1\\xa3\\xf6\r\\xf0\\xac"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\xde\\xfe\\x97-\\xcf\\xe5\\xb5\\xe5\\xda\\x87d\\x9f'37\\x95\\xfe\\x1e\\x01i\\xd8\\x87\\xb9\n\\xd7g\\x81\\xa5\\xc1\\xb8\\xde\\x1cpb\\x07\\xb0\\x84\\xc0\\xbf\\x9b\\x0ft\\xcf\\xa7\\xe4\n\\x05\\xeae9\\xc3\\x83\\x12>\\xbf8\\xf1\\x87\\x08\\x9a&6\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\x88\\xd1\\x87~l\\xdc\\x05dy\\xa1q\\x9b3e\\xd8\\xcf\\xfb\\xb6\\xc2\\xe0acq7\\xf8\n\\x88\\x8f\\xaf\\x98a\\x9d\\x1a>p\\x99\\xbf\\xe9a\\xf0\\xd0\\xf4\\xa35pb"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8ce\\x17\\xe8\\x072c\\x01wao\\x02\\x8dfd\\xbb\\xa8g9\\xdf5\\xb1&/t7b4\\xc6\\xc6m\\x8dj\\x9e%\\x9dd6\\x89\\x92b\\x81\\x08f\\x9e\\xdf\\xec\\xfb\"\\xcbgyzw\\xbb\\xe6\\xe2\\x0b\\xdf\\x1a\n\\x97\\x80\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\xfa\\xbb\\x93\\xbdlz\\xc4\t\\xec\\xd3\\x0e\\x87\\x9a\\x0e\\x07\\xb4\\xf0\\xc5i/\\x11\\xd1m\\xcc\\x04bz\t\\x01\\xed\\xd0\\x06\r 0w\\xf7\r\t\\xc6\\x1ar\\xe4h \\x142"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d=\\x11\\xe9\\xd2\\xbcd\\x13\\xdd\\b(\\xd8\\x9c\\xdc\\xef\\x00\\xaa\\xd7\\x85\r\\xb3\\x84\\xaaw\r\\xfb\\x8e\\xc3\\x81\\x81\r\\xa9q\\xaf\\x0f$i\\xc8\\x00zl\\x84\\xeci\\xa81z)\\xc9\\x87\\xe5t\\xd5\\x86!\\x18\\x91\\xd6v\"b~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e$\\x945\\x88\\xb8\\xfa|m\\xa8\\x02b&\\x1c\\x15zo9\\xed\\xf5\\x98)\\xde\\xb0,\t\\xdd\\xb9\\xfd\\xf1\\x14\\xce\\xe5,%qy\\xc65t\\xafz8\\x81\\xcb\\x07\\x18"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xcf\\xd2r\\xddb\\xfd\\x81ic\\x06\\x8e\\xf6\\xcd\\xf4\\x03f\\xeb\\xa9^e\\xe2,\\x01\\xf1\\xe7 n%\\xf4l\\xb1b\\xcf\\xabpdj\\x18k\\x11\\x99rv\\xc6d\\xec\\x02$\\x8e\\xe5\\xa5\\x04k\\xfa\\xa7\\xa6u*o\\x8e\\x0e\\xc2^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\x0fso\\x83r\nl\\xe3\\x12\\xd8?\\x1d9\\xc7e\\x8f\\xf0\\xdf\\x9e\\xabe\\xd4\\x86\\xb56\\xdemo\\xa0\\xbb,\\xa1f\\xec\\x05&\\x80y\\x15;\\x19\\xc5n\\xf0\\xeb\\xb4"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041b\\xbc\\xd7\\x80\\xf9\\xbc\\xf0\\xe9\\xe1\\x84i\\(i\\xed\\x18\\x1d\\x910\\xa5\\x86\\x0f\\xa3.\\x19\\xe1\\xa1.\\xf1\\x1e\\x99\\xedili<\\x039\\xea>\\x02sc\\x89\\xac\\x18jo5\\xa6\\xed\\x133\\x8f.\\x8aiw\\xda\\x8d\\x0eg\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc97\\x17\\x91\\xd0;y\\x18x\\xee\\xa1\\x9f\\xfbrh\\xf6\\xc9\\xad\\xfa\\xd7\\x16>\\x13!dg\\x92\\xccnf\\xe5\\xcd\\xf7b\\x1eo\\xd64?0\\x03\"\\x8b\\xf0\\xcb\\xc7\\xfd"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\xdf\\xdb%cn.\\x16\\x9d'\\xa3\\xff\\xb7<\\xf9h\\x8ev\\xe5\\xf3\\xc3\\xc66\\x95\n\\xbc\\xaa\\x0f\\x92\\xb5m\\xebjc\\x1c\\xf2\\x89:\tc\\xfa\\x98j\\xa9)\\xe2\\xa8\\x14i\\x0e\\xe9\\xf3rpz\\xdf\\x86j\\x0c\\xe0\\xd8%w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j%\\xad\\x08l*!<h\\x9d\\x18\\x8cnu\\x18\\xe7\t\\xa6\\xe7\\xbe\\x9ee\\x00\\x0e\\xfc\\xcc\\xd8rl9\\x99\\x8c\\xf8s\\x90c\\xb1s\\xdc\\xc4\\xbc\\xf3c:\\xf0x\\x95\\xd9"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x0bz\\xb78\\xa1\\xe7@\\xdf\\xcb\\xf1\\x96\\x03z@\\xdd)\\xb1e\\x1b\\xc1+\\xd1\\x1ac\\xbf\\x85p3;\\xeam\\x1a\\xa1\\x8e\\xcb\\x0c\\xa3\\xa0\\xab\\xef\\xc8\\xee\\x87-(\\xaa\\xc0\\xe8\\xf9n\\x1d\\xd8iwv\\xf0j\\xc96o\\x9a\\x0e~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdcn\\x85*\\x0c\\xd5of\\xba\\x99c \\x80*\\x19\\xbd\n\\x82\\xe9c6\\xe7\\x90\\x06kgv\\xc8!\\x1e\\xaf\\xe4\\xcc\\xf3xw\\xbdu\\xc9\\xb9p\rnz;1\\x98\\xaf"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e_\\x9f\\xbe:\\xda\\x92\\x84,;\"i\\xff\\xf1z\\x9a\\x03\\x1b\\x97\\xe7~\\xd3u\\x0b\\x1f\\xc2\\xd9\\x00\\x98j\\x89u\\xa8\\xb7\\xfa\\xa9\\xba\\xff\\x1e:\\xbdu!u\\xb1\\x7f\\xb3'l\\xa9\\x10(?\\x03\\xa9b\\xc5\\xe1\\xee\\xb4\\xc8\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdz\\x04~h\\xf1o\\xff\\x07)p\\x9e\\x17x\\xdc^l\\x9d\\xb5\\x8b\\xf5k\\x8ci\\xb2v\\x98e\\x97;\\x8c\\x93\\xc7\\x81\\xedu\\xdc;\\xc2m\\x152b\\xff\\xd70\\x82"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\x08\\xed<\\x0f\\xe8\\xe7\\x85\\xc9$\\xb7\\xf8x8\\x99<\\xa1\\xa1\\x87\\xc4y\\xac\\x13k\\xf5^ly\\x10\\xe4\\xd5\\xf0\\xcfo\\xf21\\xca\\x18*\\x8a\\x10d\\x11\\x8ca\\x9ex\\x894\\xcam\\xbf\\x17\\x1f'vt\\xad0v\\xd8\\xde\\xcb\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\x0frs\\xd7f\\x86qs-`\\x10k\\xc7\\xeey\\xa5j\\xf7\\x00\\x87\\xa1\\\\xf4\\x032!\\xa4f(\\x16\\xf4\\x87\\x02\\xb2\\x7fy\\xdd\\xf3\\x87(\\xf27b\"- \\xef"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\xd4\\xd0d\\x96p\\x8d\\xb1j_wk\\x1d\\xabmc\\xa2\\xcc|\\xc3\\xe8\\x16\\xf9\\xd58+\\x03\\xdf\\xe9\\xad\\x86\\x9dk\\x8e\\xf2\\x16%\\xa1p\\x90\\xf9\\xc7\\x9af)\\xfb\r\t\\x93\\x86\\xcb\\xe5\\xb0\\x95+\\xa8&a\\xce\\x18n\\x8e.\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14$\\x17\\xa3*\\xe8\\xddc\\xcfi^\\xe1\\xa7\\x13@\\x88\\xfe\\xaeeit\\xe5\\xac8g\\x08\\xa0mu\\x854\\xae\\x0c\\x88\\xb1&\\x08\\xe1\\x9a\\xa3\\xe8\\xacy\\xfc\\xb1f\\xb0?"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcf9\\xaf\\x97,\\xcc\\xbb\\xd4;2u_\\xaa\\xa5\\x92\\xe1\\x9e\\xe2\\xe0n\\xae\\x18\\x8dw\\x0ca>\\xb0s\\xac\\x8eq\\x06\\x85:\\x98\\xb0\\x8d\\xfe\\xac\\x12\\xac\\xda\\xd4fp\\xa2\\xd6\t\\xe7\\x03\\x89ml\\xb2\\xcf\\xb7\\xa4b\r1\\xbfk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7k\\xad\\xb5\\xb0_\\xd9\\xb4^\\x96g;\\xbd\\xdf\\x91\\x9d\\xe5\\x87\\xf4\\xf2k\\xa2\\x89%\\x8cs/\\x9e\\xa9m\\xc8\\x17b\\xca\\x92,\\x92\\xe60\\xab\\x06\\\\xff\\xa6\\xfd4\\x91"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xfc\\x1ew\\xbf^\\xcd\\xbd\\x1c%\\x0f\\x02\\x10\\x0e\\x04\\x990\\xe7j\\x7f0\\xd2z\\x1d\\x16)\\x1e\\xf4\\xdf\\x15n\\x93\\xe1z\\x12!\\x07\\x98\\x8f@\\xb8n\\x92)\\x9c\\xcb\\xc9\\xa0\\x04\\x94q\\xe9d|\\xd5\\x10\\xb9\\xa3|\\xb8\\x0ca\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u>t;\\xd0$\\x99\\x98\\x9b9w\\x91\\x99rg\\xcb\t\\x8adk\"\\x19=\\xec\\xc8\\x88f\\xb7n\\x8c\\xc2\\xb8i\\xd8\\x14\\xc3\\x86!h\\xd7\\x0b2r\\xdd\\xde\\xfa"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\xbcqq<?/\\xfe|\\xfc\\x15\\xc5\\x9f1i\\xf3an\\xa8\\xb5:\\x91\\xf8\\xf2\\xb0\\x12f\\xad\\xa8$\\xe1\\x0eu\\xf4\\xc1\\x9eg-\\xa2\\xfd\\xaf=t\"\\xb3rxb\\xf4\\xc0q\\x1c\\xc2\\xc2\\x85\t\\xed\\x1e\\x94>\\xff*\\xef\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xc7\\x16;\\xf1af\\xf2\\xad\\x00s\\x9a\\x17\\x87k\\x0e4\\x03l\\x84a\\xf59@ss\\xed\\xae\\x8c3\n\\x0e\\xe0\\xdd\\x7fq\\xe2\\xec\\xf43\\x05q\\x87\\xf2\\xa9\\xf7o\\x9b"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xec\\xf4\\xeb\\x85d\\x89rrc\\x14\\xcc\\xa0s\\x9c/pd\\xd2\\x11\\x9e\\xccn\\x894\\xa0\\x9ds\\xac\\xb8\\x1c(\\x82\\xd2(5q\\xff\\x84o\\x9bv\\xff\\xd5\\xc3\\x12\\xd24\\x9a\\xaf\\x18\\x07\\x8e\\x85\\xcfe&k\\x1cug\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*`\\xd2\\x88\\x94\\xa2u\\xfe\\x04\\x88\\xfc=\\xa2\\xa1p)\\xd6\\xa1\\xb3v^-zj\\xf6\\xcf(\\xa6\\x98\\x863\\xf8\\x06e\\xcb\\xf2kcs\\xdf\\xc0\\xbc\\x80\\x06\\xfdm\\x85"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\x89a\\xb6,\\x82\\xfbc\\xd2\\x9a\\xf48\\xdap\\xc8\\xcfx\\x10s\\x94\\xd7\\xc8\\x02\\x03&\\x1d\\xf3\\xda\\x98\t\\xcewbh\\xd1?r\\xefop\\x7fh\\xc2\\xfah\\xb6n\\xe3\n\\x14\\x9c\\xca\\xf1(\\x8b\\xbe'\\xe8e\\xb4\\x89%\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92,umuar\\x87\\xbci\\xce\\xb3m/\\xec\\xb8\\x03\\xde\\xbf\\x08\\xf41\\xba\\xd9\\xc7\\xf7\\x8a\\x12\\x1a\\xccko\\x1dgpf\\xf4\\xbe\\xd7\\xd8y)7\\xa3\\x13l\\x8a"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\x823\\x0ek\\xbc\\x1e\\xa7\\xe6\\xef\\xbb\\xde\\x1ck\\xfc\\x8f\\xe0\\xd6\\x91\\xbf\\x06\\xbe\\xce\\xe3\\xd2\\xe7\\xed`\\xed\\xec\\xb3\\xd7\\xf5\\xa3y\\x8d\\xdcm\\x13lv\\x02\\xd6~\\x06\\xbf\\x87\\x13k\\xd3%\\xbd\\x99\\x88\\xcf\\xc8\\x94rh\\x1c\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0nv\\xd0\\x06\\xda\\xc1\\x97\\x13s\\xc4\\xba\\xde\\xef\\xe2\\x1d\\xcefa\\x94\n\\xaf?\\x03\\xd8\\xae\\x7f\\xe9\\xdbu\"r;.je\\xf2+\\x86\\x0e\\x19i\\x81\\xdefm"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\xd2\\xf5\\xad\\xf1=_^\\xf6\\x8bn\\xa5\\xc0\\xc6d/\\x98<\\x95\\x94\\xf1\\xb6e\\x12<\\x83u2\\x19\\xf9r\\x03\\x12h\\xca\\xd9,\\xcan'\\x02u\\xdd\\xbd\\x10\\xd0\\xac\\xe9\\x16\\xce\\xe7-#\\xcf\\x0e\\x01\\xa7\\xa6,\\x19\\xbc\\xdd\\x10\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xect3\\xd9\\x96\\xd3,je/^\\x81\\xe5+\\xb9\\xaevl\\xcc\\x15\\xad\\x01\\x99\\xd9\\\\\\xd5\\xd8\\x15o\\xa0_\\x95\\xc3+\\xa1ec=\\x15\\xd7\\xd4\\xd9r*/"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!u\\xf3qc2\\xbei\t\\xcc\\xddt*\\xa74\\xc5\\xb2dlo;\\x829,\\xc1?\\xba\\xed\\xfe\\x84\\xab.\\x1d\\x18m\\x86\\xe1j\\xba\\xb7\\xf35\\xa9\\x9e\\xef\\x07\\x9e\\xb3~\\x1a\\x8a\\xc6\\xf0\\xd1\r5\\xd9\\xb2f\\xecn\\xc9\\x9e\\xa00\\xcb\\xf3\\x07e\\x00\\x8c\\xa1g\\xf9x\\x7fh2\\x07\\xdc\\xa5\\xe9\\xe52\\x1d\\x1c9\\x17\\xf5b\\xe1\\x8f5\\xecj\\x14j\\xf6\\xce\\x9d&\n\\xe2y\\xaff\\xaa\\xc5\\xb9\\xd9n\\xa4\\x03\\x1e\\xfb\\xa9i\\xf4\\x82o\\x84\\x7f\\xf4\\xdf\\xa9\\xab\\x05~.aa\\xd8\\xb5m\\xb7-\\x15r\\xbf\\x00\\xa3\\x1f\\x106\\xb0\\xd5\\xda\\x89\\xff\\xec\\x84\\x13\\xd46\\xd6\\x04\\x85\\x9f\\xb2(\\xae\\xc0k\n\\xa4\t\\xffxax\\xcabp_\\xbe\\x16\\x8fz\\xd7\\xa14`o8\\xbc\\xd5q\\xeb80\\xfc\\xaba\\xb4h\\x84\\x80\\xa5\\x8b*\\xbd\\x0e\\xa5\\xd5\\x82z\\xf7q\\xf5\\xc4\\xac\\xe1\\xa3\\xb78=\\xac\r.26\\xab\\xa1=u\\xb9\\xc2pm\\xadio\\xed\\x0b\\x90\\xa2\\xd3\\xe6\\x0f\\x16u(\\xfcz\\xedi\\x04/\\xed"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb5\\x98\\xe4\\xb5y\\xa5e\\xbam\\xbf@&\\x96\t\\x8f<\\xb8\\xfc\\x7f\\xd4g\\xa0\\xb1/-2\\xe1x\\x96a\\xc9/\\xff!m\\xccz?nwb\n\\x979g\\xfa\\x1a\\x83\\xe3h&\\xaa\\xb0e\\xe8\\xd8\\x93\\x99\\xc8j\\xbbu\\x85\\x15573\\xe2\\xc7\\x98n#\\x08\\xf9\\xbc\\x02\\xde\\x89\\x1da\\xc0\\x17\\x83\\x0e\\xaed\\xd6cve\\x98\\xfa8p\"<\\xe17|\\xdf\\xbe\\x934\\x9cp\"\\x9a?\\xce\\x9a\\xa1;\\x15c\\x869\\x85'b1\\x1a\\x98 y\\xb2u%\\xa33\\x17\\x97r\\xa1fp6\\x1d\\xea\\xe5\\xaf\\xb5\\xf8k'\\x04\\x1fs\\xfe\\x15o\\xa2\\xf8\rd\\x95\\x1f\\x13`gvg^\\x9c\\x87\\xd5\\xa0\\xb5\\x97\\xaf5\\x0b\\xf7\\xdfs\\xfa\\x0c\\xc7\\xce\\x99jn\\x8e\\xa1'7\\x9c)\\xc4a\\x1f<)\\x93\\x17l\\x7f\\xf6t\\xfe\\xa4\\xc7\\x8c\\z\\xca\\x9c\\xc5\\xa8j\" z\\xedr\n\\x0b\\xcf\ti|\\x8d\\xde\\xfb\\xc5\\xf2|\\xf0\\xed,!\\xe8<\\xd8a\\xe2x\\xbbe\\x825\\xf8u\\xf8\\xb91\\xfe\\x84\\x84\\xac"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xea\\xad\\xa5!\\x83\\xb7\\xc7\\xe7\\x8ajp\\xb0\\x087\\xbc\\xcd\\xde\\x86\\xfc4\\x96\\xad\\xcc\\x99\\xbeh\\x18\\xd8\\xdf\\x8ew;b\\x82\\x0f9\\xd2?\\x11\\xa9\\xb43\\x94\\xec\\x9d\\x00\\x88\\xfc\\x96\\xa8\\xf8\\xbe\\xa6\\x01\\xc1\\x0f\\x17\\xbc\\xbe\\xad\\xd9e\\x91\\xd4\\xf3\\x9be\\xf2\\x85\\xda\\x1d\\xed\\xe7\\xb3g\\x87\\xb8\\x1a\\xd3ak\\x91z?\\xc8u\\xabc\\x97\\x84=o\\xca\\xdf=\\xcb\\x94=wg\\xb9z\\xcf\\xc0\\xc0|\\x9c\\xedh6j\\xf1sz\\xe6&\\x11\\xa3/\\xb6\\x9b\\x8d\\xaa\\xc0\\xbb\\xa9\\xf888:\\x9e\\x07@\\xe2\\xfb\\x1ci\\xc3\\xc7\\x0f\\x95\\xaa<\"v\\xbc'\\xda\\x0es\\x05h-o\\xb6\\xbf\\xcb\\x02\\xa0\\x83\\xb5\\xe7\\xbe\\xf3\\x89gx\\xda\\xc11\\xbe!\\xea\\x81\\xcf\\xdds?\\xc6\\x85\\x8e\\xb5jb\\x84\\xe5\\x1e\\xcc\\xc9o=\\x1fm\\xec \\xf9l\\x00%\\x94\\xf0\\xfc-/o\\xaec\\xe6\\xf4\\xf0\\xa2\\x96\\xff\\xb9\\xd2w\\xc4\\x8e\\xcex\\x14\\xec\\x0f\\xd9jw\\x1c\\xf0\\x81n\\xa1s\\x11ml_$z\\x98c\\xe0\\x96\\xff\\xd9\\xb5\\xaep"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xdd\\x8fg\\x00\\xb9\\xac\\x17zl\\xa1\\xe4d\\xe9?\\xfd\\x0c\\xf2n%p7\\x9d\\xd3\\x0e\\x82\\xc3\\xbe\\xb01\\x10rv\\xfa\\xb8\\x02!\\x1fq\\xe894\\x8d\\xc2\\xb8\\x1aj\\xfc\\x9b\\xeaf\\xe7\\xd2\\x81\\x0c\\x92\\xfdb\\xf4\\x1f2c\r\\xbayg\\x96\\xd7\\xf9\\xe6\\xa2\\x04\\x87|c\\xd4\\x13\\xdb\\x8c\nfl\\xb7\\x80\\x94\\xeaz\\xea\\xb7\\x06\\xf9\\x03\\xb7\\xb5\\xf5\\xef+\\x1a\\xfcylb\\xf0\\x97\\x11\\xfa\\xb4h\\xdb\\xda\\x01\\xd9#\\xed\\x92\\xe5|3\\xbdr\\x80,j\\x03\\x01c\\x91\\xa6h\\xb1a5b\\xf2\\xe6\\xe7\\x10\\xae\\x17ksg\\xa1\\xf5\\x8cv\\xad#\\xe7\\xdd\\x15\\x12\\xa2\\x88\\x18)\\x86\\x9b@m\\x91\\xeb\\x93a\\xa0\\xa1\\x13\\xbf\\x91?\\x99q\\xd2\\xd0\\x00\\xe0wk\\x98`e\\xda\\xcb\\x1ey\\xa1\\xb2\\xf8\\xde\\xb8\\xe8\\x97\\xa5:y\\xcb\\xb4\\x82\\x87w\\xb7\\xaf\\xc9du\\x8a\\x1fki\\xda\\xc8bn\\x89\\x93\\xbf\\xa3i\\xdf\\xa4ua\\xfcx\\xc1\\xe1\\xe3\\x1b\\x89o\\xe8\\xad\\xb2\\xe3`\\xdd\\xf0kwm\\xbfj1\th"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\xfcwe\\xe5\\x98\\xb6\\x8fk\\xdbaf\\xe2\\x93\\xf7yx\t\\x9f\\xbc+\\xd778-\\x85\\xb0\\xbb\\x15;\\xd3p\\x98\\xb7d\\x95\\x01\\xcd\\xb1z\\x17^1\\x98\\x1f\\x11q\\x02\\xb0\\xe1\\xc0\\xa3\\x1f0\\x8fn\\x0f\\x07g\\xf5\\xc1\\x11&\\xda\\x8a\\x01b\\x9a6\\xaa\\x10\\x81\\xe8\\xa2\\x1c\\x06w)-\\xc6\\xc8m\\xba\\xe9\\x8cd\\xff\\x06\\x9a\n\\xe7\\xc4\\xdb\\xf9\\xd1k6\\x8e\\xe1\\x83\r\\xc83%/\\xc5:t7\\xbc?\\x05#i\\xaa\\xfa\\xa4\\xfc\\xfcg\\x1a\\x953\\xe9-\\x80\\xb6\\xcd\\xd4\\xfb\\x9av\\x03\\x08\\x90\\xf8\\xf2\\xc4\\x86\\x1b^\\x81r&\\x19\\xa8\\xd0\\xad\\xe3\\xaf\\x00\\xfb\\x01n\\x13c\\xe9s\\xb1\\x8a\\xd1\\x83\\x95\\x9e\\xe6\\x8a\\x82u\\x86\r\\x8a\\xd4\\xbd\\x93c+\\xa2\\x1e\\x81_q\\xbf\\x9a\\xca\\xca\\xd1e\\xbb\\xc4\\x97\\x07\\xb9\n`\\xfb\\xb9\\xc5\\xcf\\x15\r9\\x03|6\\xf9\\x89rq\r\\xaet\\x1b\\xafx\\xae<\\xb8~\\x1a\\x10,\\xfa_\\x03\\xc9gn\\xb6l3\\xe8-6\\xa2\\x17 \\xc9\\xd5\\xf1\\x17pd\\xd7\\x88\\xf1q#\\x1e\\xb8"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6x\\xa9\\x06\\x82\\x83\\x04\\xbb\\xd7\\x0f\"\\xd4wv\\xc8qq\\x8b\\xbd\nw|\\x16a3\\x06e\\xe4e\\xfa\\xf7\\x0fu??nz,\\xbfh.q1n\\x9d\\x8ff\\xb37\\x84x\\xa6rh\\xd61\\xe5\\x84\\xa1\\x8d;7+\\xb9s2m\\x8c\\x9d\\xd7 \\xd7\\x95\\xc2\\xc9%q\\x90j\\xd3\\x01cei\\x1c\\xe8\\x84\\xf8q\\x11m\\xd4\\xf2\\xe9\\x03\\xb5;5\\xe2j^\r\\x10\\x10\\xc0\\x1c\\xe0\\x86m0\\xa0?\\x86/ \\x07o\\xbef\\x07\r\\xbe\\xab\\x90rt /'\\xd2\\xf1s\\x84\\xf0\\xc1\\x83%\\x11\\xff\\x9c\\xd0a\\xe5i\\x10k\\x10\\xbdt5)\\xab\t(\"\\xd0n\\xb4s\\xe1\\xe0\\x12\\x96\\x10t2\\xb3\\x98\\xa9\\x07h\\xf6\\x08\\xe7\\xf6\\xf1\\xfa\\x07bh\\x9d\\xd7\\xa5\\xdah\\xdd\\x0c\\xda\\xe6\\xfe\\x91\\x1f\\xa5\\x92*<\\xcb2\\xec\\xa1mp\\xb0q9$\\xecz\\xf1\\xd8b\\x1c\\xa7+\\x90\\xb7\\xa6q.-\\x01\\xf4\\xb0h\\xfcbj\\xfc\\x8b6\\x95\\x86nu\\x8b\\x80z\\xbe\\xe7\\xfde#\\xa0m\\x182r\\x01in"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1\\x1asn\\xba\\x1ey\\xac\\x07\\x984\\x8f\\xc8\\x8fb1q\\x08\\xdd\\xd7\\x12\\xba\\x80\\xa0\\x98?\\x8c\\x105\\xeb\\xdc9e\\x9c\\x08\\\\xe1+\\x88\\xde%\\x1aru\\x17c\\x96>\\x0e\\xd4\\xc3%\\x13\\x16\\xed\\x0be\\xef\\x7f\\xbai\\x14\\~\\x89\\xbct\\x0c\\x88\\xec,\\xd4x?\\xc2\\x94-\\xebq\\xb3\\xfb^\\x8a\\xcb\\x84\\x98\\xae\\xa9\\xf9\\xea\\x9adwqp\\xc2\\xc9869#\\xbemey\\xff\\x8a\r\\xe3\\xd5&1\\xf7\\x02:m\"\\xa4\\x1b\\x1c\\x95\\x08w p\\xfeqk_\\x8e\\xb17$\\x9b\\xddu\\x8c\\x0c\\xed.~9|\\xf3\\xe3\\x80\\x17od\\x9a7\\x06\\x8e\\xbe\\xce\\xef\\xe07\\xcf\"k\\xc5\\xe3\\xe5o\\x83\\x14\\xd7\\x87\\xea\\xec\\x1d\\x1e\\xa1\\xbe\\xd2\\xf2!mp\\xfb\\xac\\xed\\xccip\\x00dr\\xc1\\xfd\\xa6ta?w\\\\x9d\\x05\\x10\\xa5\\x18l\\xb1|\\x8a\\xbb\\x15\\x06\\x86x\\xf6\\xf4%\\xe4\\x7fz\\x90\\xe8&`\\xc93\\xec\\xa5j\\x15$\\x03y\\xdd\\x7f\\x8d\\x92\\xc7q6\\x96\\xc8\\xd8\\x0f\\x936\\xaf"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xa9\\xfb\\xdf$\\x80\\xc2\\xd98:\\x0fo?\\x8c\\x12\\xd0\\xf560\\xc6\\x87c$\\x8f\\x00\\x8dd~\\xc6d\\xe1@/0\\x02e\\xc4/\\x83\\xf7\\xf16\\xa7*%g\\x1e\\xe7\\xf3\\xe2\\xbb7/\\x1c#\\xac\\x07\\xf9\\xca\\xd8o\\xcb\\x9f'n\\xfcn\\xec\\x14\\xbc\\x7f\\x14_2\\xe1\\xe4\\xdd\\xa8d\\xad\\xa2<\\xf3q\\xf0\\xdf\\x1c\\xa6c9\\x1ev\\xa2>.\\xb4\\xfa\\x15/\\xf3\\xc8\\xee\\x0f\\xd4@\\xd5m_\\xa4-\\x8b\\xa3\\x9a\\x12d,\\xe2\\xa8-\\xda\\xd7\\xaaa\\xba\\x10\\xa5\\xce\\xf8\\x0f\\x08\\xc8\\xe1\\x14\\xa0\\xc2;\\xa9tdk\\xca\\xec\\xd0\\xba0\\xda\\x02\\x03\\x17d\\x97\\xa1\\xc2\\x10f\\x19l\\x01\\xf7\\xf7\\xf9i\\xc4q\\x1ed\\x15\\xc4\\xb7\\x89\\xb9r\\xd8.1\\xae9\\x8e\\xd0\\xf6\\xa5\\x02\\xd1\\xfdt#o \\xb0s\\xa60u4\\x88t|\\xe4\\xf6\\x9dju\\xb9\\x8c\\xf9<\\x83)\\x82|x\\x9a\\x97\\xc8\\xa8\\x88r\\x9d<3\\xad\\x84\\xd7>t\\x84\\xfd\\xb0\\xc4\\xb9e\\xfd\\x98tk\\xe9\\x08\\xd3\\x8e\\x80\\xca\\x87\\xbd2\\xd5"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010kx\\x1e\\xe8js\\x90sca\\x9fs\\xf6\\x19m\\xd8lv\\xbd\\xbd\\x06\\xae\\xf4:\\xf2\\x7f\\x10\\xcf\\xb7\\xd8_x\\x14\\xdb\\x93\\xf4\\x17;\\xa4\\xaf:\\xaar\tl\\x1a\\xb0\\xc2\\xcddc\n\\xa7:\\xf3\\xfa`o\\xe3\\xe5\\x89\\xefh\\xef\\x94\\x86\\x04$\\x0b'\\xab7\\x97\\x05h\\xff\\x04\\xe7\\xb8\\x9d,\\x81\\xe0\\xe3d\\x958\\xafc\t\\x1a\\xc9\\x1dk\\x10\\xb79$<1\\x1d\\x0ec\\xb5a\\xb5\\xc8\\xf6\\xe5\\xbb\\x97%\\x10\\x87\\xf1\\x9ebv$\\xc7c\\x11o\\xea*\\xd2\\x82\\xc0\\x18\\x93q\\xe0woh\\xfd^\n\\xab\\xf8\\xbc\\xab)\\x1c\\xe8\\xf02jwu>\\xeex\\xec\\xd6\\xac\\xf1\\xb3\\x9d\\xe5\\x0c\\xa2\\xb8\\xb3\\xbc\\xf4\\x87\\x8d*\\xda\\xaa\\x91\\xed\\xe6\\x8a\\x82\\xa6\\x98\\xa1=\\x90\\x99$u\\xea\\xa5k?\\x84\n8gu\\xef\\x95\\xd7\\xff\\xd2\\x06\\x88hd\\xdc\\xb8\\xe5\\xbc\\xc4\\x98\\x8b)\\xe1xh2\\xa2\\xf6\\x9f\\xf2\\x8d.\\xb4a\\xd7\\xa9\\xb4<yd+\\xb5\\x92\\xb2pi\\x87\\xd8hd\\x8fb\\xa4v\\xa6\\x19(c\\xc4\\x8a\\xb3\\x98"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\x81\\xb3\\x8e;%p\\x1a\\xd4\\x06\\x10\\xd7\\x1f\\x97\\xe1\\xfb~\\x96(\\xb3\"=\\x9d\\xd22\\x92s\\xe8\\x93\\x95x\\x00\\x16\\xcao\\xd4o\\xc1n\\x05\\x84\\xc6\\xf2ka\\xcbal\\xbej\\x10%\\x8c$\\x15\n\" \\xee\\xc7!-\n7\\xfc\\xe8\\x0e(\\xbc\\xdb\\xbe/\\xac\n\\xd4\\xdd\\x15j$\\xdb\\xe9~\\x9f\\x0e-w,=\\xf1\\xbdl_h\\x0f~5\\xe7\\xa3\\x7f.\\x04\\x803\\xd6\\x12f+\\x93\\xc3\\xfd\\x03\\x92\\xe8w\\x0bm\\l\\xddq>t\\xea\\xd2p\r\\xb1\\xe3x'\\xf2\\xe6\\xc4\\xb9nqv!\\x1e\\x94\\x19\\x01\\xe9\\x96\\xa5\\xd3\\x7f\\xef\\x12u\\xd4\\xd0d\\xdfon8\\x83\\xcf\\xad\\xe6\\xb0\\xc4\\x89\\xca\\xbed\\xf9\\xfd\\xcbl$k\\x95\\x7f\\xa6\\xf3j\\x9f^.\\xa4\\x9c\\x8d\\x7f\\x7f\\xd1\\xa4\\xab<\\x17b3\\xdc\\xbd^\\x99\\\\xe5i\\xb8_\\xc8c\\xb5dj\\x8e\\xa8\\xec\\x12'a\\xb9\\x8ad\\x05\\xbfe\\xf2`w\\xfe\\xac:\\xfc\\xf1 1\\x17&z\\x8f\\xbf\\xfc\\x1f>\\xc6\\xf5\\x8b\\x8c|\\xa4\\x88\\x1f\\x0240k"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\x96r?\\x90\\xa6\\x97aa\\x9f\\x1c\\x95\\x9d7\\x1f\\x91\\xf0w\\x93\\x01\\x9a\\xdb\\x8c\\x95\\xdf\\x90&|\\xdbx\\xa1\\xf0\\xf3\\xcf\\xed\\xe4\\x9e\\\\xbb\\xc2\\x8ef\\xff5\\x10\\xf4\\xd7\\x84\\x89\\x0f\\xba\\xe1\\xf9\\x11\\xd34-r\\xfd'!\\xc7\\x17\\x89\\x9f\\xacf\\xc1q\\xf1\\x84\\xd4\\xad7\\xb2\\xf7\\xa4\\x9d\\xddu\\xaa\\xd5\\xfb\\x0e\\xdd\\xe0\\x0f\\x1f\\xb7\\x96\\xb60\\xc7\\xb5xemf7\\xc8\\xd0g\\x1d\\xef\\x07\\xc9\\x17\\xeb\\xe7\\x86*\\x7f\\xbc\r\\xe0\\xa8w\\xdc\\x7f\\xecpj\\x0c0\\xa0\\x9f\\xdd9*\\xd2\\x9b\\xec\\xff=2\\xb6\\xdbsp\\x93?yt\\x13\\x81u\\xd2\\xc3\\xb8h\\x81\\xc2\\xe5!\\xb7\\xb3\\x94\\x03w\\x97g\\x1fo\\x1ft\\xe5s>\\xb0\\x04\\x15\\x88!|p;\\xe8\\xab\\xb6\\xa4(\\xc2\\xc9\\x1c\\x15\\x89\\xdb\\xd4\\xda\\x8a\\xb1\\xf2\\x1a09\\xe8\\x15\\x85\\x10\\xa0\\xe9\\x01\\xe5\\xab\\xaf5w\\x88s\\xcc\\x1a\\x86\n\\xb0\\x85\\xd9\\xffb\\xfc*i\\x90\\xc2\\xbe\\xeb\\xaa\\xb0\\x98b\\x0c8\\xd1\\xad\\xb4\\xba\\xfe\\xdf\\xc5\"u\\xcd\\x86\\xe1\\xcc>\r\\xd8"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\x93\\x08\\xa2\\xe8&3\\xd2\\x87\\x8d\\x00~\\x13\\x14\\xc8\\x0c\\xa3\\xd7\\xa5\\xa6\\x88\\xdb\\x10\\xc8h@\\x0c@\\xceg9\n\\xeb\t\\x11\\x8e\\xd3\\xc6\\xdc\\x99\\xc4\\x89\\x9a\\x8e\\xa7\\xf2\\x8c\\xcd1\\xd3\\x01\\xd0\\xa4\\xc6\\x98\\xa9\\x01\\xdb\\x9cn\\x06f\\xe2\\x13\\x7f\\x98\\x06l\\x9e\\xfe=\\xc0\\x17\\xc1\\xa1\\x80\\x1f,7\\x0e\\xef\\xda|*m\\x88n)z.\\xc9\\xdew,x$\\xff(\\xa6n\\xf5\\x0b\\x1d\\x88\\xa9n\\xeci\\x05$\\x9a\\\\xe9\\xa1\\x07j\\xf2+\\x00\\xb8f\\xdag\\xe8\\x81x\\x95\\xa0\\xdf\t8\\x02\\x02u\\x07\\x0f\\x11\\x0e.\\xc2\\xed\\xe1\\xa9\\x0e\\xc2\\xe9wiq\\x15\\xb5s\\x8b\\x8c\\xad\\xe1\\x86\\x9c\\x96\\x17\\x9dt\\xf8\\x17k\\xe0p)\\xf1\\xa1\\xdf3\\x0ee\\xae\\x1f\\x92'r\\xe6\\x9f\\x8cr\\xe9r\\xe1\\xe0#\\xe9\\x862\\xc6\\x00\\xfd\\x915 nf/\\xbc(\\xb5\\xf8\\xac(\\xabv\\xeb\\x10\\x04\\x8a\\xebb\\xf4\\x08\\xd3\\xbeh:\\x1b\\xe8\\xd0d\\x16)\\xc7\\xafe\\xcfw\\x90\\xfe\\x9e\\x06\\xc4\\xe9zf\\xda\\xce\\x94\\xe9\\xe8_\\xd6"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\x17\\x19\\xe9n\\xfd\\x99(j*h\\xe8\\xa0\\xb8)\\xf7s\\\\xe0\\x87\\xee\\x95\\xdb\\x12\\x94\\xcf\\xe9j\\xd8\\xfa\\x9d\\xb1\\x13u\\x8c\\x1e\\x9f\\xbe\\xae\\x8d\\x85p_\\xae&\\xec\\xae\\x92\\x80l:\\x95f\\xb3\\xe9\\xc2\\x12\\xae\\x8b\rw\\xf8nygp\\xc3f;\\x00\\xbflg\\xc8\\xd1\\xb9/\\x14\\xf9\\xa5\\x85\\xd8\\x1a\\xc3\\xb7\\xaf\\xa7_$d\\xaa\\xc6\\xa9\\x03\\xb5\\x97\\xd2\\x0b\\x95\\x04\\x86f\\xa2\\x13\\x8c\\hc\\xd9:\\xd2\\xc2\"\\xf1\"|\\xa508\\x8f\\x0b\\xcepsk5s\\x0e\\xf5\\x85\\xee\\xbfy\\x9b~\\x1d=\\xf4\\xad\\x95\\x8a+p\\xa3\\xc5\\xa7\\xe2\\xb3\\x9f&\\x0bn\\x18\\xe1\\x15\\xd8q/5v\\xd7\tz\\x95@\\xb3\\xc0*\\xd6?\\xbb\\xa6\\xec\\xa4\\x12\\xf3;b\\xf6bk\\x11\\xfbod\\x91\\xca\\xa9\\xd6h\\x17\\x01\\xceo\\x99\\xce\\xa8\\xb1igcp\\xdeddt\\x06\\x91\\xea\\x82`\\x19\\x83\\x1f\\xadi\\x82\\xbe-%\\xa7\\x88\\xc1\\x10\\x9dl\\x02\\x07ls\\xb2v\\x0ex\\x85+\\xce\\xdee\\xe7\\xbat\\x96"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb50\\x88\\x0c\\xb7\\xec:\\x00\\xd0y\\xc6\\x836\\xb1\\xb3\\x8e-\\x8f\\x93'\\xff\\x03 =\\x12\\xad\\xd9\\xec\\xfa\\xaa\\x8f4\\xf4\\x85\\x0cu\\x93\\xbd\t\t\\xd1aod\\xe8\\xaa\\xbd\\xeaba\\x96\\xa59\\x1f\\xf72+>\\xee\n\\xdcn\\x9f\\xbf\\xa1\\x8e\\x18\\x89\\xefr\\xf1k\\xed\\xcdz\\xb5.\\xbf\\x06\\xc4\\x02\\xfa\\xc4\\xe2s\\x9d\\xb9;\\xa3bdz+\\x02\\x9ctd\\x8c\\xf7y\\xf2vd\\x08\\x06\\xa5\\xd5\\xe3\\xe2\\xcf\\x0e\\xd4\\x1e\\xa0\r\\xf2\\x87\\x13\"\\xfady\\xa0\\xac\\xae)\\xda\\x1cv\\xb8\\xfcfdo/\\xff\\xe6ev?\\xdep\\x96hh\\x02\\x07\n\\xea\\x83\\xb5\\xfb\\x07\\xfeb\\xb6\\x85\\xed,\\x98m\\x10g\\x95\\x08lh\\xe1x\\xfds\\x14\\x89\\xc1\\xb7\\xdc6\\xaa\rh,d\\xf8s\\xe0\\x15\\xb1\\x98\\xd06\\x7fbx#\\xc9y\\x07/.\\x0c(\\xc4\\xabq\\xbf\\x1c\\xfe\\x8d\\x1e\\xdfu\\xfb\\x81l\\x8b\\xf6\\xb0\\x88\\xb4\".\\xa2^\\xac\\xc8<\\xe2;\\x02\\xdb\\xeb)\\xe9m\\xd0\\xe8ug\\xc2\\xa9\\xb0n\\xcbj\\x08`"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90w\\x9c~q<x\\x87mv\\x87\\xce@zj\\xf8\\xd7b\\xfb\\xeb\\x98;3\\xe2\\xfcn\\xe7\\x8f\\xcf\\xc6\\xa3\\xc2\\xda\\x8f\\x03\\xde\\x9fe\\xd0\\xdd\\xfe\\x9dt\\xc3\\x9bl!\\x0c\\x9c\\xf4\\xff\\x11\\xa7p\\xcez\\x0e\\xcce\\xf3\\x873\\xc7ea\\x93d#\\x16v\\x15\\xd9\\x00\\xe9\\xb2\\x83\\xae3vt\\xe6\\xc2`\\x7f\\xd9-\\xf6'\\x191r\\xb7\\x0e:\\x92\\xe6\\xcc@\\xfdz\\xfc\t\\xb3\\xdex\\xfd\\xf9\\x17\\xf9\\xe5*x\\x0c\\xff|\\xa4^\\xb2\\x07x\\xb3z\\xc6?\\xea\\xce?$zql|e\\xf8qv\\xf3p\\xe5\\xeb\\xcd\\xc8u\\xd9+\\xe4zg\\xdd\\xc3d \\x87\\xef\\xe3x\\xbe\\xd5\\xe5\\x0c\\xd1\t\\xca\\xc18vq\\xa1+cf-r\\x85\\xe8\\xbfoa\\xb5\\xe7\\x1d\\xe8|d\\x13\t\\x89\\xb2\\x12\\xfb_(\\xb5\\x05b\\xee\\xcd\\xff\\xc3\\xda\\xfb\\x12\\x18v\\xce\\x9b\\xf8v/d\\xb8\"\\xe0k:\\x96\\xd9h\\x06\\xe0\\xe0\\xbd_\\xdc\\x8ah\\x81\\xd3\\xb59r\\xcb\\x17.\\xb6\\xf4\\xaarj\\x98\\xdb\\xb3\\xec\\x11\\xffv\\x15l"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)\\x13h\\x19d\\xa2\\xda\\xdd\\xa8\\x8cs\\x1d\\xc3\"\\xc1\\xd7\\x07\\xcc\\xb4\\xc5\\xe6\\xbd\\xbb\\x90\\xec\\xc6'\\xc0\\xfbnf\\xe4\\x94\\xa7\\x99\\xbc\\x9b\\xcb?j>\\x8b\\x9c\\xd9\\x9cked_\\x9a\\xdc\\xc9\\x8b\\x82\\x17\\xb3\\x9b%y\\xd7\\xae\\x0c\\xb6\\xd9ir\\xd7\\xedb\\xe7\\xb9\\xf1\\xca\\xb3nn\\x1a\\xfb\\xe0\\x83+\\xb0\\xd4\\x1c\\xe9\\xc8p\\x916\\xd5\\x0f|\\x87j\\xae\\xa2@\\x15\\x13\\xae\\xc9\\xa029!\\xff\\xb4s\\xed\\xb4\\xbf\\xe4\\xdd\\xbf\\x9d\\x1dn\\xdc\\x03\\xb8\\xfd\\x96\\x13q\\xa0\\x18\\xba\\xbeg\\xee|\\xb1\\xbctw\\xcd\\xcd\r\\xf1\\xf8\\x8db?~7\\xd6pee8\\x1c\\xa8w\\xabjj0(\\xc6\\xe38\\xc9\\xc4\\xf0\\x07*\\x010l\\x08\\xa1\\x16\\xd7:\\xaa\\xbc\\xe3\\x84;\\xb5\\x11\\xd9\\x87\\xe1\\xdf\\x11\\xf7$\\xb3\\xf2m\\x16\\xf2d\\x02\\x18\\xf7\\xa9\\x11\\xe9\\x04\\x8c\\xbc\\xb0t\\xd1\\x12\\xa8\\xe2\\x0c\\xd5\\x0fh/\\xd4\\xee\\x86\\x1f\\xbdpe\\xf4u;\\xba\\x0b&\\x1c\\xc7\\x94\\xdb\\xdb\\xf3no\\xa0#\\xfc\\x9a\\x91$2d\\xb7\\xc6\\x8d"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0\\xf6$\\xdd\\x98>\\xfdq\\xa9y\\xc8m\\xb2$e\\x81\\x83\\xc44\\x13>mjh\\xa1\\xbcx\\xef\\xe4s\\xd5<'\\xb4\\x9f\\x08\\x8e\\x0f\\xce\\xa2\\xe8\\xb4>a\\xe7\\x92\\xb6 \\xcd\\xc7\\xee\\xb7\\xb6w\\x8f\\xd6\\xb1h\\x01\\x89\\xf1\\xebh\\xa8\\x01\\xa9wb\\xe3o\\x11\\x82\\x81,\\x03,\\xa0\\x8d\\x8d3\\x07\\xfcp\\xae\\x0f8h_\\xa4vs\n\\xa4\\x811e\\xa3\\xee\\x01\\xbf\\x18eis\\x93;\\x95\\xe7\\xd9\\x02\\x17z\\xce\\x11vo\\x1f\\xd6s2\\x8do_\"e\\xe6\\x17(z#\\xa43\\xfa\\x82'z&\\xf6\\x7f\\xd0\\xc3\t\\x8c~\\xceb\\x13\\xc2~\\xa3\\x16u\\xe7v\\x8dws\\xa3j\\xb6\\x1d\\x84u\\x18\\xcbo,\\x89ks1\\xe6@ud\\xbc\\x1c\\xbe\t>\\xa7\\xc2^\\x98x0\\xd5\\x0c\\xdc\\x81\\xc3_\\xd8\\xad!d\\xa0\\xack9\\x02v,\\x90\\xae\\xf3\\xd1\\xcat\\x1f\\x92\\xbc\\xe2\\x031\\x7f\\x1e\\xb3a\\x85\\xa7\\xc4\\x08\\xb5\\xfau\\x1a(\\xac)\\x02\\xd1\\xe2\\xab\\xe3\\x82\\x12\\x85\\xb0gyak\\xdb\\xde\\xcd"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xdem\\x1c\\xf3\\xc0\\xc2\\xb6\\x05\\x02\\x1e\\x81`,a\\x06u\\x9d\\xd6\\x14\\xf8j\\xdb\\xba\\xb2\\xfem\\xc2\\xc5r \\xc1\\xde\\xe8\\xcbo\\x84\\x07\\xacp|\\xa1\\xeb\\xdc\\xeb\\x87\\xe9\\xa8t\\xaag\\xf3\\xbb\\x0b\"n\\xb5kl8\\xa0s,\\xfag\\x07l\\x89;c\n4\\xe2*\\xd7z\\x95\\xbfpul\\x06\\x01\\xd1\\x9cf\\xe8\\xf7\\xaf\\x88\\xb6b\\xe0\\xf3\\xee\\x1c\\xfd\\xb6\\xd0\\xe0\t:\\x13,r\\xca\\xc3\\xfc>\\xaa\\xc1e\\xff\\xee\\xd5 \\xfe\\x01z4yq^y\\xdf7?4=\\xa6\\xfb!)\\x08!\\x00.\\xed\\x81\\xde?w\\x86\\xfe\\xef\\xea\\xb4\\x86\\xcb+\\xe8f\\xaa\\xf6\\x13yu\\xf3y\\x95\\x86\\x0b\\y\\xeeoo\\xd3\\xb6z\\xec\\x1a\\x81\\xf5pr\\x07m\\xf9\\xa8t)?\\xaa+%k\\x00\\xc3%\\x84\\x1b\\xee/<t\\x8e\\xaf \\x08\\xac\\xee\\x00tw\\xe5\\xcfd>y\\\\x97t ra\\xdc\\x9f\\xd5\\\\x92j\\xb1\\xb7\\xef\\x80 q\\xc3\\xae\\x04n\\x1f\\xdb\\xd3g\\x17\\xbc1p\\xbd^.\\xa3\\xedhe"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9k&\\x7ff#\\x80\\xa8\\x07\\x18m\\xb2\\x80s-\\xc3g\\xe3to\\xeb\\xdb\\xf1\\xef\\xa5\\xe1\\x8ex-i\\x16(y\\xa8\\x97\\x93<\\x11my\\x9f\\x98\\x9c\\x05z\\xbc\\xe6\\x93c\\x10\\xe9\\xd3\\x00\\xabw\\xd9b \\xf0\\x9e\\x02\\xad\\x13\\xf0r\\x03\\xc6h\\xea\\x8d\\xda\\x0b\\x80q\\xd4\\x1c\\x06\\x1e`\\x0e6\\x93u\\xb7\r\\xcf\\x1f\\xbbu\\xa3\\x88\\x8e\\xa8q\\xfc\\xedd:\\x8e\\xc1^\\xba\r\\xf5\\xf6\\x159blte\\x93\\x08&\\xcb\\x90\\xd9@\\xe7\\xda\\x11b2\\\\xa1\\_j\\xe4\\xf0\\xef\\x9b\\xab\\x99\\xcb^\\xd5w\\xa3\\xc9w\\x89#\\xc3#t\\x17\\xb8\\x8ff|\\xd6\\xcd6e\\x04\\xbd\\x9a\\x8c\\x8d\\x0e\\xdb\\xb5\\xb5\\xe9\\x1bj'\\xf8c;*\\x83(\\xab\\x9evu\\xa96\\x8f\\xcbmt\\x8c\\xbc\\x9cii\\xe4)h\\x14#=t\\xaf\\xc6ddt_'6p\\x05'\\x94\\x9e\\xb8zl,i\\xdb\\x93!\\x91\\xed<$-\\x86\\x07u\\x08\\x8ao\\x95\\xf0\\xfd<o\\xb5\\x0e1\\x8f\\x11\r1knoa:p"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010tikv<\\xfa\\x0b\\xc9f\\xe1\\x0c\\x827\\xc2\\xee<\\xefk\\x10f\\xb6.\\xac\\xca\\x90\\xd3\\xb6\\x97\\xd6\\xc2n\"p<;ua1\\x87\\x92\\xae\\xe3q\\xc2\\xa0sa\\xd9(!\\xc8\\x91\\x05b\\x15\\x99\\xfc\\x04\\x12\\xc9 \\xc0\\xbfic\\x83\\xb6.\\x16\\xda\\xb8\\x18\\xe1\\xa7\\x03\\xc7\"\\x98\\xbf\\xfa\\x8f\\xf9\\x87f\\x10\\xb0kg$\\xf0\\xe1\\x84\\xfcs\\xcb\\x93a\\xa1\\xccv\\x92\\x8d\\xde\\xa5\\x94b\\x03v<a\\xbf;$h\\x04\\x8e\\xe5:\\x99\\xf6=-\\x84\\xb3$\\xf3\\xa4\\x1c\\xf8h\\xff\\x0b?$\\x1e\\xefg\\xaf\\x9f\\xc9\\xe7\\xf5c\\xfa$6\\x14z\\xc4\\x0e\\xbdq\\x95\\xf8\\x8b\\xb1\\xe8q\\xf0\\xa4\\xac\\xcf\\x90\\xe6\\x83x\to\\x81\\x8a\\xd3\\x99\\xce%\\xdb%w\\xa7k\\xb92\\x0c\\x00\\x97\\x1d\\x89\\xa9\\x9e\\x86\\xb58\\xfdf\\x9c\\x99\\x96\\xb4p\\xd1\\x/ j\\x08er\\xd2\\xf3m\\x11<a\\x94>\\x9f\\xdey\\xe50\\xbf\\x8ez\\x06\\x17w\\xc7\\xfa\\x81\\xa7\\x8e\\x06\\xec|\\xcd\\xd8i\\xf0\\xbdy\\xcf\\xfe\n\\xeb\\xa1\\xdc\\xf3\\x12"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15%\\xf8\\x82\\x1b\\x13-\\xcee\\xa4\\xa6h\\xa1\\xd3c\\x83js\\xd6\\x1d\\xcba;k\\xb7\\x02@\\x8b@\\xe5\\x93v\\xdf\\xcd\\xae\\9 \\x85e\\xa4\\xcfr\\xe4\\xbd\\xb4t\\x0e\\xa6\\xd3\\xa9\\xf2\\x1dg\\xfee!nm\\x18\\x8ej\r^\\xeb\\x9d\\xeb0\\x84c\\x04\\xb8c\\x90\\x1c\\xf1\\x96\\x9e !\\xc6j\\x82\\xbc\\x97\\x14\\x89;\\xae\\xd2\\xb2\\x9a\\xd1\\xb3\r\\xbd\\xca\\xc7\\xe7\\xfd\\xd5\n\n!\\xd2\\xc8\"\\x10\\x80\\x985\\xb8\\x1evcr\\\\xfb\\xf3\\xd80\tk\\xf3\\xfan\\xc1m\\xe2c\r\\xf3!\\xef\\xc8\\x821\\xe4n\\x91\\x10\\x11\\x04*g\\xd6\\x955\\xa0\\x19\\xfd\\xb1\\x02\\xf1\\xf8o\\xca<:\\x96\\xb4zh\\x85\\x92\\xdbg\\xd9#\\xb4\\x12&\\xedbh\\xff\\x1byg\\xb2$\\x7f\\x07\\xf5bx\\xb5\\x04\\xa5\\xf4\rp\\xde\t\\xaf\\x15\\xd7p\\x98a\\xaa\\x06d?\\x15\\xf23\\xdc\\x84\\xd4\\x0c\\x1e\\xab\\x12\\x03\\xb9>\\xee\\xced\\x82&\\x12\\x94\\xe3\\x8d\\xbf\\xfc'\\x16p1\"\\x04\t\\xf9\\xc2je\\xfb\\x13\\x97\\xaa_\\xf7"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\rnl\\xe4\\x96\\xff\\xe2\\xe8i1\\xb4\\xa7<&&c\\xe1\\x86\\xccx\\x00\\xba\\xebao\\xe1\\xcf\\x89\\x95\\x0fxj\\xa1j\\xe3\\xde\\xd6\t\\xa2\\x16f\\xa9&\\xb5\\xaec\\xe3\\xd4\\x04+f\\x89\\xcd \"~i\\xb1%\\\\xab\\xbe\\x02\\xc0\\xae\\x1cz\\xe8\\x17b\\xe7\\xfag\\xae\\x8a5\\xb7\\x91\\xd8\\xb7\\xffw\\xd3g\\xf4\\xd7\\xd4\\xe5vk\\xf7\\xd3\\xab\\xe2\\x9c\\xedt\\xc3\\x95>\\x14m\\xb4di\\xe8\\xab\\x01\\xdc%\\x80\\xc4p\\xa1a\\xf0r\\xf8t\\xe4\\xf39cf\\xa2\\xd38\\xe5\\xf0\\xd0\\xf1\\xd2\\x86\\xb77),\\x861\\x84\\xfa|\\x032\\xe6\\x9a\\xa1\\xaa \\xcc\\xfd\\xc7\\xe5\\xfc<\\x1b\\x013\\x0b2q\\xff\\xc0mdv\\x1d\\xea\\x14\\x0e_\\xbd\\xa8_\\x95oh(\\xc2:\\x19\\xbf\\xc3\\x13\\xe1\\x1f\\x1e\\xca\\xb6\\x11\\x06\\xfb\\xe6f\\xa2\\xfd\\x0c\\xee\\x08\\xddv\\xdex`u\\xaa\\xd0\\xec\\xb5\\xc9\\xeey\t\r \\xa7\\x8b\\xf3\\xf7\\x8f\\xff\\xafkor\\xd3\\x88\\.q\\xdc\\xd6d\\x82g`\\xed\\x11\\xc4\\x1ee\\x9f\\xc4\\xe3\\x9dc\\x91\\x937\\xdc"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\")d&\\xff\\x04\\xa1\\xde\\xe18\\xdd\\x88\\xda\\xc7\\xfe,\\xf4|\\x7f\\xd14\\x7fr^\\xde\\xae\\xf9\n\\xcf%\\x05az\\x03\\xb9\\x98\\xa2\\xa9\\xb1\\x96h0\\xd43\\x8c%\\x8e\\x8a\\xb4d3\\xd1j\\xfd\\x8b\\xa3#\\xd0\\x06\\x1b\\xe3wn\\x07\\x0c\\xe1\\x9a\\x19\\xe6\\x87\\xf4\\xbeo\\xb8\\xe7!\\x85e\\xe1e\\xbb\\xbdjg\\xf1\\xaf\\x9e\\x9b\\x8b\"\\xb9\\xb8\\x9d\\xe6\\xd1j'\\xb0\\xe7\\x1a\\x01\\xcd \\x01\\xae&%kla\\xd6\\\\x0f\\xc8l\\xfc\\x93\\xf9\\x0ec\\x97b8\\xa4l\\x91p\\x13\\xdd^k\\xa1+\\x0e\\xf0nt\\xe0\\xa4g\\x85a\\xfb\\xe6\\xe1\\x99\\x90\\xf7\\xb8\\xdf\\xbe\\x15\\xe2\\xd7\\x952\\xaa|\\xa1\"i\\xb3\\x00 \\x13\\xe5d\\xacg\\x92\\x08+x\rzz\\xca\\x80v&\\xd7|\\x93\\xc2\\x89\\x88\\x02\\x92\\x10\\x0b\\x17&!\\x00\\x88)\\xbfm\\xb4\\x08n\\x05.,\\xdb@1\\xb0\t\\xd3i\\xfd!\\x9f\n\\xd8\\xe5\\xce\\xac\\xab\\xf7\\xaaj\\xe9\\xec\\xe32\\x92\\xe0\\xb0ea\\x83c\\x8co\\xb9\\x85\\xc6\\xaa6\"\\xb5\\x9c6\\xdb "
  748.  
  749.  
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\x9ez\\xed3v\\xcbqdb\\xd70\\x86\\x97\\xb8\\xdd\\xe54(\\xf1o\\xb910\\xbe\\xc7\\x10\\x1b\\xcc\\x11\\x84\\xa7qa\\x0ej\\x00\\x98h\\xd6'\\xd2\\x0e\\xa0\\x1c\\xb3\"\\xbde\\x83n(q\\xb6g\\xd8\\xbc\\xa0\\xcc\\x16\\xe8\\xd1\\x0f\\xfc\t\\x15m\\xb5i\\x86s\\x8b\\xe8/\\x13/~\"%\\xa9\\x9d\\x90\\x92\\xe3\\xa6\\xce\\xaa;\\xe4b\\xade\\xc7\\xe0\\xb1u\\x03\\x10\\xb1\\x1f$\\x14\\xd4\\x90\\xc9v\\x87\\xe0\\x07\\x8bm\\x8f\\xc6\\xb2\\xb6\\xb9\\x8f\\xd2\\x9b^m\\x19\\xcf\\xd7-b\\xbb\\xf0\\x99\\xd1\\x95\\xa6\\xd4y\\x99\\x0bi\\xf9\\x1ba\\x96v\\xa8mj\\x15*\\x9e\\x90\\x7f\t\\x1b\\x1e\\xe9\r:i\\xeb\\xff\\xd0'|\\xa5\\xec\\xec\\x80\\x0c\\x98\\xf4\\x0c~\\xd3f\\xb1w\\xb2\nb\\xd8\\xb0$d\\xa6\\x9e\\xc7\\xa0\\xa4o\\xf9 \\x9cx\\xe5f\\xce\\x97\\x1c\\xb6d|ec\\x05\\xdcw\\x17\\xfb\\x16\\x1d\\xb1\\x92\\xb9\\xaa\\xd8\\xd1\\x82\\xb8\\xe1a\\x8e\\x8a\\x88\\xa3\\x1f(\\x16\\xfa\\xdeg\\xae\\x13\\xd9r\\x1a\\x99;\\xe3\\x94\\x97*#\\xca\\x8a\\x97\\x12\r0\nkx"
  751.  
  752.  
  753. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9yayn\\x0f\\x94c\\xf6\\xf2)\\xbc\\xf7\"\\x15\riz\\xad\\xddvv#\\xbfc\\xf1_r\\x87\\xba\\xc8\\xbbmq\\xb6\\xfd\\xffk<\\xd7ym\\xb4\\xbc\\x19qt\\xee\n\\xda1\\xc5\\xd8\\xd2\"\\x1f\\xe5\\xec\\xdf\\xc6\\xcc\\x7f\\xacw\\xb0\\x13\\x8b?\\xddx\\xe5\\xb5\\xf5\\x00\\xc27\\xa2\\x19\\xd6\\xe5v\\xbev\\x883\\xb0\\xb8\\x17-\\xc30\\xa8\\xd0\rt\\xbfd\\x13p\\x99\\xa9$\\x92c\\xb2zb\\xe8\\x18\\xafl\\xd8\\x12\\x17\\xe0b\\xc9!c\\xe1\\x98&\\xf4\\xfa\t\\xde'\\xa0\\x00\\xbb\\xe9d\\x81\"\\x85g@3\\x02\\xa1\\x1f\\xbb\\xecp\\x938w\\x1a_\\x9fm=\\x07+/\\xad\\xd1\\x92\\xcd\rs1\\xd7\\xde\\xb2g3$u\\x99\\x81_\\x07u\\xda\\xe9\\xedj\\xa5\\x0bl\\xbb\\x8b\\x16g'\\xff\\xb8\\x01\\x873\\x90\\xea\r\\xa0\\xe7h\\xef5\\xef\\x10\\xaa\\xe7>p+@\\xb9\\xdd\\xae\\xd3(b\\x86\\x1fy1\\xcd\\x03\\x9e\\xdbrh\\xfal\\xe2w\\x9a\\xf0\\x00e\\xd1^\\xddq\\xb4\\xda\\xd5c\\xa1\\xb8\\x11u\\xd9\\xa6\\x10u"
  754.  
  755.  
  756. "http_request": "winword.exe_WSASend_\\xc4\\x00f\\x00\\xf0\\xbc\\xd1\\x10j\\xb4\\xc0ts\\xf7\\x0f\\x81\\xf8\\xae\\xa0\\xa1\\xef\\xd4=p\\xffs$$w\\x19\\xbcu~\\xfd:,\\xcf\\x9b\\xb5\\xa1\\x98\\x966\\xa1\\x14\\xb8\\xc0\\x1ak\\x07\\xf1i\\x8ebf\\x82\\xa3\\xec\\xd6\\x0c\\xf2\\xa1;9l\t\\xfa\\x84bn\\xe4\\xa5\\x13c\\xb6\\xef\\x19\\xc9\\x05\\x9e\\xacbu\\xf4\\xa2\\xd6eai\\xdd\\xfd\\xb6\\xef\\xe2\\x1b\\x1f\\x1bw+\\xb1l\\x9c\\xde\\xc9\\xa6\\xad&*\\xc00\\xf4\\xd2\\xf1\\x00\\xe7\\xaf\\x96\\xcc\\xe6\\xcb\\x11h\\xb1\\xf9\\xde\\xe2\\xe8\\xfbxy\\xdd\\xb9qe;\\xda\r\\xf30\\xe8\\xeb\\xa8\\x1a\\xe0cs\\xea\\x8c\\xaf\\xdf\\x985<\\xa6\\xb1\\x8df\\xec\n\\xcc\\x92\\x06\\x0e\t\\xf2\\xd2:\\x8fe\\xb63g\\x95:`\\xfc$a\\x06r\\xb4d\\x80\\x10\\xfa'mvxb\\xa23k\\x1d\\xd5\tc\t,\\xd6\\xb9\\xa9\\xb8t\\x99\\x1f\\x14\\x19\\x0fs\\x01\\x8c\\xd3\\xf5#\\xad\\xfc#\\xff`\\xa9a\\xa2\\xe1bn\\x0b\r\\x1ap5\\xd5^\\xbc&\\xc1\\x7f\\x7f\\xc9\\xd5\\xb6z:-\\xfc`\\xc8fz\\xec"
  757.  
  758.  
  759. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x08\\x19w\\x8crx\\x93\\xbe\\xd3\\xfb\\x90\\xd2\\xaa\\x86\\xe2\\xdc\\xfe\\xdfrzq\\xe82\\xf3\\x1f^\\x1a\\xf3\\xc2\\xcd|\\x10k\\xe9\\x94\\x8fj\\xffu+\\xc6\\xed\\xfe\\xe2\\x9f\\x89\\xab2(\\xcf\\x94\\xa0\\xc0g\\x88\\xb9yu\\x89\\x80\\xe3_e\\x14\\xec\\xa6#?ko\\x91b\\xc4f\\x94bq\\x87x\\x9f\\xbe\\xf1\\x0e\\x0e\"\\xd60\\xdaa\\xa6\\x93j\\x04\\xf0\\xf7\\x96\\xb4v\\xf3\\xb3\\xec\\xa1\\xe3t1\\xf0\\x81p\\xff\\x10\\xc1\\x07\\x16\\xd5\\x02\\xafl~\\x10 n\\x85\\x8d\\xb1\\xbbuq\\xe1\\x8f\\x87\\xb3g\\xdb,h\\x14\\xaa\\xf0*\\x13<\\x0bw\\xc5\\x81\\xa1b\\xe8_\\xa0\\x07\\xc4\\xad\\xe3\\x90)\\x05\\x85\\x7f.+k\\xfc\\xd9\\xe4 \\x05\\x18\\xb7\\xaf\\xb6\\x01%g\\x04\\xfe\\x88\\x1b\\xd8\\x93\\xb6\\xeb\\x0f\\xde\\x05\\xc7\\xb4tp\\x04)\\x06\\xae\\xe2uq\\xaf\\xf8\\xb2\\xdb\\xcd m\\xdc$\\x89\\xac\\x0e\\xf9\\xe2e\\xe1b\\xb0\\xa5\\x16\\xb6\\x92\\xc6\\xff\\xees\\xd5\\xc5\\xe0\\xed\\x98h\\xa0\\xcc\\xfd&\\x8b\\xb0\\xdd\\xd2\\xbb\\xab)u\\xfed\\xd5\tn"
  760.  
  761.  
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xa1\\xe7nr\\xeb\\xe3p\\xc4\\x86\\xf6\\xffij\\xca\\xc0\\x8f\\xf8\\xda)\\xfb#ej\\xc7\\xc0\\xf1\\x04\\xac\\xb0?\\xec\\xa0\\xe6\\xd6\\xd5\\x02\\xc58\\xab\\xbd3|\\xf8b\\x89\\xc3\\x04\\x82\\xdd\\xaa\\x97\\xea\\xba4\\xaa\\x17\\xd2\\xbcw\\xa29\\x1f-\\x1fj\\xd6t\\x1e\\x81\\x87t\\xe3za\\xc4x\\xd9\\x7fy\\xc8\\x0f\\xc7\\xe5\\xe6\\xbe\\x7fv\\x8fw\\xb8\\xb6t\\xf9\\xbeu\\xcf\\x11y\\xbacu\\xa2n\\xb7\\xae\\xf8\\x7f\\xe2f\\x10\\x97\\x16\\x19z\\xcdk\\xd3\\x07\\xdc\\x8d\\xa9\\xcdh\\x90x\\xcfp0\\xa15\\xd3\\x88z\\x92ll\\x0c\\xd3x\\x81\\xe4\\x82\\x10l\\x92\\x10\\x84f\\x1a\\x0b1\\xdd$\\xe0f2\\x84\\x00\\x8c\\x10+g\\xa1\\xa9q\\xa6\\x8ds\\x9a\\xc8\\x11%2kl\\x843\\xa0b\\xd5\\x96\t>\\x19\\xady\\xd3\\x99n\\xe8m\\x860\\xceb\\x0c\\x04\\x11\\x9f4\\x91\\l\\xc5k\\xb2\\x11v\\x08a\\xcf\\x90@\\xach\\xc0\\xc4u\\xb7\\x972@:i#\\x06\\xe8;\\xb0\\xcbzy\\xd8q%\\x03d\\x99-\\x15\\xcf\\xc8\\x1fi"
  763.  
  764.  
  765. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad\\x8a)iweoe\\x05a\\xdb\\xc4\\xea\\x0cw\\xa8\\x15\\x07\\x80\\xf5l\\xf2\\x87\\x8b\\x9a*%\n\\x9e\\xbew\\x93e\\x9e>$vg\\xef|r\\x1e\\xeb\\x8e@%+\\x02u\\x85\\x8b\\xe0c\\x01\\x17>\\xe5\\xdct\\x86 \\xde\\x06bs\\xbd\\x81\\x99\\xd4\\xdf\\x81\\xac\\xe0b9\\xd5:p\\x11\\xf5vy\\x01\\xd0kne#\\x9e\\xcc\\xf6f\\xfb\\x90e\\xa1i\\xcfa\\xa4\\xb21\\xdb;\\x08\\xc0\\x01s5ul\\xe1\\x96\\x00\\xd8\\xc8\\x90\\xf9\\xa7\\x80f\\x03)\\x9e\tb,\\xce\\x85\\x9d\\x85 \\x17\\x1f\\x01~\\x1eg\\xf8\\xd9\\xd9\\xef(\\x83\\xa6\\x95r\\xafx\\x82\\xd3\\x11\\x9d\\xfe\\x04\\x82n\\xb4\\x13o\\xef\\x14\\x87\\xa3!\\x1a\\x02\\x01\\x8c\\x04\\xe3,\\xa7z\\x8eh!g\\x05x|%\\xea\\x98\\xdf<\\x12o\\x08a\\xf0~\n\td\\xd6wx|\\xe6\\xfail,\\x95<\\xd6\\xd1\\xabs\\xe1f_d\\xfay\\x1ck0\\xb2\\xd6\\xa6\\x00\\x8f\\xc3,\\x987\\xe0\\xa7\\xcc\\xac?e\\x06\\x13\\x9d\\xf8\\x8b\\x13vm\\x8ep\\x82\\x14\\x8f"
  766.  
  767.  
  768. "http_request": "winword.exe_WSASend_\\x80\\xf6\\xd5\\x10\\x10\\x88\\xd0\\x10\\xce\\xc9n`\\x1e`u\\xce9r\\x81\\xcc\\xdaa\\x96\\x9f\\xe0\\xfe\\xdc\n~\\x97\\xf2\\xa3\\xa1;wdm\\x8b\\xdb-\\xd9\\x87\\x03\\xaazp\\x1bm\\x83\\x92|\\xf6\\xe7\\xaa\\x9e|\\xccx\\xe9?\\xa8\\x8b\\xa5\\xe9\\xe2\\xcee\\\\xa3/g\\x80c\\xde\\xe6a\\xc7\\x91\\xeb\\xdau\\xcb\\xa6\\x1dt\\x80&y\\x0b\\xa7\\xd3\\xd8\\x9aq\\x86\\xfdm\ryyu\\x7f3z3\\xea\\xa3\\x06d$\\x98\\x1e\\xf7t\\xdf\\xac\\xa1ce\\x03y\\x8d\\xb3\\xc0v\\xa0\\xf8\\xe9h\\xe6\\xa1?\\x80\\x1e\\x06\\xcb4g\\xe0,\\xc5z\\xbb\\xf4\\q`k^\\x08\\x91%.\\xc4l!s\\xb6x*y\\xef\\xd3r\\x97e\\xcf\\xf5t\\x1c\\x92\\x0eej\\x1b~\\x95ebsh\\xf20\\xdd\\xdd\\xe3\\xb6\\x17\\xa4\\x924\\x9f\\xeb!\\xe5\t\\x05|%\\xff\\x08\\xb1\\x1afj\\x19\\xf4v\\xad\\xca\\xb8\\xef\\xac\\xe7e\\xdf\\xca\\xc8ed\\xd4b4wm\\xe8\\xfa\\xaf\\x1axfh\\xfe\\xbd\\x84\\x93'\\x15\\x806\\x99\\x10\\x8c\\xd0e+\\x0c\\xe0p\\x02<0"
  769.  
  770.  
  771. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  772.  
  773.  
  774.  
  775.  
  776. "Description": "File has been identified by 13 Antiviruses on VirusTotal as malicious",
  777. "Details":
  778.  
  779. "CAT-QuickHeal": "O97M.Downloader.XP"
  780.  
  781.  
  782. "Alibaba": "Trojan:VBA/DocDl.7f41b596"
  783.  
  784.  
  785. "F-Prot": "New or modified PP97M/Docdl"
  786.  
  787.  
  788. "Avast": "VBA:Downloader-EHP Trj"
  789.  
  790.  
  791. "AegisLab": "Trojan.MSWord.Generic.4!c"
  792.  
  793.  
  794. "McAfee-GW-Edition": "Artemis!Trojan"
  795.  
  796.  
  797. "Sophos": "Troj/DocDl-HDH"
  798.  
  799.  
  800. "SentinelOne": "DFI - Malicious OPENXML"
  801.  
  802.  
  803. "Cyren": "PP97M/Docdl"
  804.  
  805.  
  806. "Jiangmin": "Trojan-Downloader.MSWord.Agent.ca"
  807.  
  808.  
  809. "Endgame": "malicious (high confidence)"
  810.  
  811.  
  812. "AVG": "VBA:Downloader-EHP Trj"
  813.  
  814.  
  815. "Qihoo-360": "virus.office.qexvmc.1070"
  816.  
  817.  
  818.  
  819.  
  820.  
  821. * Started Service:
  822. "osppsvc"
  823.  
  824.  
  825. * Mutexes:
  826. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  827. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  828. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  829. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  830. "CicLoadWinStaWinSta0",
  831. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  832. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  833. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  834. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  835.  
  836.  
  837. * Modified Files:
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_16545303a95cce51093b4eece9d09e66.doc",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_16545303a95cce51093b4eece9d09e66.doc",
  840. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  841. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF5620C06C-A4E4-4604-AD17-0914020C399F.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCB7309C3-34EF-4675-8124-6FA8C6AB035E.tmp",
  843. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  844. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  845. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F",
  846. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\82CB34DD3343FE727DF8890D352E0D8F",
  847. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  848. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCD8A.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCD8B.tmp",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF1C.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E6C.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E6D.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20EF.tmp",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20FF.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2100.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab245D.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246D.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2480.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246E.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246F.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cab25D9.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2649.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2638.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28FB.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2648.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28FA.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A28.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cab296A.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A29.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A17.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2969.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E12.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FE7.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E8F.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E6F.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46CE.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46CF.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46D0.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E33.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E54.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5058.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5098.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6113.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6134.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A3B.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A5C.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A4C.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D2C.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\C6556FB1.png",
  892. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F6F.tmp",
  894. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8135.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB362.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB5D4.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\CabBE9F.tmp",
  899. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TarBEA0.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCCFE.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC383.tmp\\turabian.xsl",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCFF.tmp\\HexagonRadial.glox",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3E.tmp\\chicago.xsl",
  905. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  906. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\gb.xsl",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC51.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCFF.tmp\\Content.inf",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC40.tmp\\Equations.dotx",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE67.tmp\\mlaseventheditionofficeonline.xsl",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEE6.tmp\\Crop.thmx",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED6.tmp\\TabList.glox",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD34D.tmp\\Basis.thmx",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0CC.tmp\\gosttitle.xsl",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC40.tmp\\Content.inf",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC51.tmp\\Content.inf",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE67.tmp\\Content.inf",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD766.tmp\\VaryingWidthList.glox",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD765.tmp\\RadialPictureList.glox",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED6.tmp\\Content.inf",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC383.tmp\\Content.inf",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD766.tmp\\Content.inf",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD9C8.tmp\\gostname.xsl",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\Content.inf",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDBFC.tmp\\Banded.thmx",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE2E4.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3E.tmp\\Content.inf",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEE6.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0CC.tmp\\Content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD765.tmp\\Content.inf",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEFB.tmp\\iso690nmerical.xsl",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE304.tmp\\rings.glox",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE5E3.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE304.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE8B9.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7A9.tmp\\content.inf",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CD.tmp\\Element design set.dotx",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDBFC.tmp\\content.inf",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEA6F.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\ieee2006officeonline.xsl",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEFB.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BB.tmp\\TabbedArc.glox",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BA.tmp\\InterconnectedBlockProcess.glox",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CC.tmp\\harvardanglia2008officeonline.xsl",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\Content.inf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD34D.tmp\\content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7A9.tmp\\Dividend.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BB.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BA.tmp\\Content.inf",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CC.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF85.tmp\\Headlines.thmx",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CD.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC94.tmp\\chevronaccent.glox",
  962. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  963. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD9C8.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEB9.tmp\\Badge.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD6.tmp\\BracketList.glox",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC84.tmp\\content.inf",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF07B.tmp\\Berlin.thmx",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFA7.tmp\\content.inf",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDDD.tmp\\ThemePictureGrid.glox",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF8.tmp\\content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC84.tmp\\View.thmx",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD6.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF00A.tmp\\architecture.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC94.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF009.tmp\\ThemePictureAccent.glox",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF96.tmp\\sist02.xsl",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF9.tmp\\CircleProcess.glox",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDDD.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF8.tmp\\Wood_Type.thmx",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFA7.tmp\\Frame.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD7.tmp\\ConvergingText.glox",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF059.tmp\\content.inf",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF009.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF00A.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF9.tmp\\Content.inf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF05A.tmp\\content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF85.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD7.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF059.tmp\\Parallax.thmx",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF05A.tmp\\Slate.thmx",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF96.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  995. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF07B.tmp\\content.inf",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEB9.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDE9.tmp\\iso690.xsl",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF53.tmp\\pictureorgchart.glox",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF63.tmp\\content.inf",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF53.tmp\\Content.inf",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF32.tmp\\APASixthEditionOfficeOnline.xsl",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDE9.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF63.tmp\\Droplet.thmx",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\Feathered.thmx",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B2.tmp",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\Content.inf",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\Mesh.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC87.tmp\\content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC97.tmp\\content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC87.tmp\\Savon.thmx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC97.tmp\\Vapor_Trail.thmx",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10EE.tmp\\content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10EE.tmp\\Damask.thmx",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD11AA.tmp\\Insight design set.dotx",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD11AA.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1056. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A677-DC18A9A3B170.tmp"
  1057.  
  1058.  
  1059. * Deleted Files:
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\tst21A4.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\tst21C4.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\tst2465.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\tst25ED.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\tst2B5C.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\tst522F.tmp",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCD8A.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCD8B.tmp",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\CabBE9F.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TarBEA0.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC383.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3E.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC51.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC40.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCFF.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEE6.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE67.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED6.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0CC.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD34D.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD766.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD765.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD9C8.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDBFC.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEFB.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE304.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7A9.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CD.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CC.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BB.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BA.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCFF.tmp\\HexagonRadial.glox",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD766.tmp\\VaryingWidthList.glox",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC40.tmp\\Equations.dotx",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC94.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC84.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDDD.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEE6.tmp\\Crop.thmx",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2480.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEB9.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46CF.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD765.tmp\\RadialPictureList.glox",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF96.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC383.tmp\\turabian.xsl",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF85.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD6.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD7.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE67.tmp\\mlaseventheditionofficeonline.xsl",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFA7.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\gb.xsl",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED6.tmp\\TabList.glox",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF8.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20FF.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46D0.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF9.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D2C.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF00A.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF07B.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF05A.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF009.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF059.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2100.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\cab296A.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A28.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC51.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246D.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\cab245D.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_16545303a95cce51093b4eece9d09e66.doc",
  1143. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCB7309C3-34EF-4675-8124-6FA8C6AB035E.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE304.tmp\\rings.glox",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD6.tmp\\BracketList.glox",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20EF.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46CE.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0CC.tmp\\gosttitle.xsl",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E6C.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3E.tmp\\chicago.xsl",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246E.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDE9.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CD.tmp\\Element design set.dotx",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF32.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF63.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD34D.tmp\\Basis.thmx",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BB.tmp\\TabbedArc.glox",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E12.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7CC.tmp\\harvardanglia2008officeonline.xsl",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD9C8.tmp\\gostname.xsl",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FE7.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDDD.tmp\\ThemePictureGrid.glox",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7A9.tmp\\Dividend.thmx",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E8F.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFD7.tmp\\ConvergingText.glox",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E33.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cab246F.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7BA.tmp\\InterconnectedBlockProcess.glox",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF1C.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A17.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEFB.tmp\\iso690nmerical.xsl",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\ieee2006officeonline.xsl",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2969.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF00A.tmp\\architecture.glox",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC94.tmp\\chevronaccent.glox",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A29.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDBFC.tmp\\Banded.thmx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFA7.tmp\\Frame.thmx",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2638.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF96.tmp\\sist02.xsl",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5058.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6134.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEB9.tmp\\Badge.thmx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF8.tmp\\Wood_Type.thmx",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF009.tmp\\ThemePictureAccent.glox",
  1187. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF059.tmp\\Parallax.thmx",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF07B.tmp\\Berlin.thmx",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF85.tmp\\Headlines.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E54.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF53.tmp\\pictureorgchart.glox",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A5C.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A4C.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB5D4.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8135.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7A3B.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E6F.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFF9.tmp\\CircleProcess.glox",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2649.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC84.tmp\\View.thmx",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6113.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDE9.tmp\\iso690.xsl",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF63.tmp\\Droplet.thmx",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF05A.tmp\\Slate.thmx",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\cab25D9.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F6F.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB362.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC87.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC97.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\Feathered.thmx",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF32.tmp\\APASixthEditionOfficeOnline.xsl",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE2E4.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28FA.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10EE.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD11AA.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\Mesh.thmx",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC97.tmp\\Vapor_Trail.thmx",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10EE.tmp\\Damask.thmx",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE5E3.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC87.tmp\\Savon.thmx",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEA6F.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD11AA.tmp\\Insight design set.dotx",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCCFE.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE8B9.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B2.tmp",
  1228. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1229. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A677-DC18A9A3B170.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1DAB.tmp.cvr",
  1231. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF5620C06C-A4E4-4604-AD17-0914020C399F.tmp"
  1232.  
  1233.  
  1234. * Modified Registry Keys:
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\hzd",
  1236. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1237. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\TCWP5FilesIntl_1033",
  1238. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\TCWP6FilesIntl_1033",
  1239. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1240. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import",
  1241. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Name",
  1242. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Path",
  1243. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Extensions",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5C494D",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5C494D\\5C494D",
  1264. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1265. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Toolbars",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\PropertiesWindow",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MainWindow",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MdiMaximized",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Dock",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\FolderView",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Tool",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\CtlsShowSelected",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\DsnShowSelected",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Toolbars\\Settings",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Toolbars\\Settings\\Microsoft Visual Basic",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\UI",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1889.  
  1890.  
  1891. * Deleted Registry Keys:
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\hzd",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\;?c",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5C494D\\5C494D",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1906.  
  1907.  
  1908. * DNS Communications:
  1909.  
  1910. "type": "A",
  1911. "request": "crl3.digicert.com",
  1912. "answers":
  1913.  
  1914. "data": "cs9.wac.phicdn.net",
  1915. "type": "CNAME"
  1916.  
  1917.  
  1918. "data": "72.21.91.29",
  1919. "type": "A"
  1920.  
  1921.  
  1922.  
  1923.  
  1924.  
  1925. * Domains:
  1926.  
  1927. "ip": "72.21.91.29",
  1928. "domain": "crl3.digicert.com"
  1929.  
  1930.  
  1931.  
  1932. * Network Communication - ICMP:
  1933.  
  1934. * Network Communication - HTTP:
  1935.  
  1936. "count": 1,
  1937. "body": "",
  1938. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1939. "user-agent": "Microsoft-CryptoAPI/6.1",
  1940. "method": "GET",
  1941. "host": "ocsp.digicert.com",
  1942. "version": "1.1",
  1943. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1944. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1945. "port": 80
  1946.  
  1947.  
  1948. "count": 1,
  1949. "body": "",
  1950. "uri": "http://crl3.digicert.com/Omniroot2025.crl",
  1951. "user-agent": "Microsoft-CryptoAPI/6.1",
  1952. "method": "GET",
  1953. "host": "crl3.digicert.com",
  1954. "version": "1.1",
  1955. "path": "/Omniroot2025.crl",
  1956. "data": "GET /Omniroot2025.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl3.digicert.com\r\n\r\n",
  1957. "port": 80
  1958.  
  1959.  
  1960. "count": 1,
  1961. "body": "",
  1962. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1963. "user-agent": "Microsoft-CryptoAPI/6.1",
  1964. "method": "GET",
  1965. "host": "ocsp.msocsp.com",
  1966. "version": "1.1",
  1967. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1968. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1969. "port": 80
  1970.  
  1971.  
  1972. "count": 29,
  1973. "body": "",
  1974. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1975. "user-agent": "Microsoft-CryptoAPI/6.1",
  1976. "method": "GET",
  1977. "host": "crl.microsoft.com",
  1978. "version": "1.1",
  1979. "path": "/pki/crl/products/microsoftrootcert.crl",
  1980. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1981. "port": 80
  1982.  
  1983.  
  1984. "count": 8,
  1985. "body": "",
  1986. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1987. "user-agent": "Microsoft-CryptoAPI/6.1",
  1988. "method": "GET",
  1989. "host": "crl.microsoft.com",
  1990. "version": "1.1",
  1991. "path": "/pki/crl/products/microsoftrootcert.crl",
  1992. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1993. "port": 80
  1994.  
  1995.  
  1996. "count": 2,
  1997. "body": "",
  1998. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1999. "user-agent": "Microsoft-CryptoAPI/6.1",
  2000. "method": "GET",
  2001. "host": "crl.microsoft.com",
  2002. "version": "1.1",
  2003. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2004. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2005. "port": 80
  2006.  
  2007.  
  2008.  
  2009. * Network Communication - SMTP:
  2010.  
  2011. * Network Communication - Hosts:
  2012.  
  2013. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!