API tools faq
paste
paladin316

Docs_cd99e32dfd8ea9a3caaeaf988d971c18_doc_2019-07-09_08_30.txt

paladin316
Jul 9th, 2019
2,090
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 213.12 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_cd99e32dfd8ea9a3caaeaf988d971c18.doc"
  7. * File Size: 267473
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "009feed74713bb688fa34d8c35300de11a149898e3d2194059167c97bce743ce"
  10. * MD5: "cd99e32dfd8ea9a3caaeaf988d971c18"
  11. * SHA1: "70106230e34c3391569aa78ef3b2418dfb5883c9"
  12. * SHA512: "27e8f8dcfb0f2661b71895bd81241f5d9623baf86aff99112342f1ac1076d97b41c777af75ce4959ce411cbc9a6a82eb0b13e3686e734afadb926540ab428e34"
  13. * CRC32: "343325AF"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLewfslP24DTbF0kVB6rX/zVxcjsjZ9HWHWyiqQZ:sxxQW3ywfw/6j/Es8c3AzJXzYiVTl2"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 744"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 321 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  41. "Details":
  42.  
  43. "IP": "69.192.108.32:443"
  44.  
  45.  
  46. "IP": "23.15.4.32:80"
  47.  
  48.  
  49. "IP": "104.93.33.19:443"
  50.  
  51.  
  52. "IP": "52.109.6.6:443"
  53.  
  54.  
  55. "IP": "104.18.25.243:80"
  56.  
  57.  
  58. "IP": "72.21.91.29:80"
  59.  
  60.  
  61. "IP": "52.109.16.4:443"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  67. "Details":
  68.  
  69. "ioc": "rc.glox"
  70.  
  71.  
  72. "ioc": "ontent.inf"
  73.  
  74.  
  75. "ioc": "ist.glox"
  76.  
  77.  
  78. "ioc": "rocess.glox"
  79.  
  80.  
  81. "ioc": "architecture.glox"
  82.  
  83.  
  84. "ioc": "chevronaccent.glox"
  85.  
  86.  
  87. "ioc": "ext.glox"
  88.  
  89.  
  90. "ioc": "iso690nmerical.xsl"
  91.  
  92.  
  93. "ioc": "rame.glox"
  94.  
  95.  
  96. "ioc": "sist02.xsl"
  97.  
  98.  
  99. "ioc": "adial.glox"
  100.  
  101.  
  102. "ioc": "iso690.xsl"
  103.  
  104.  
  105. "ioc": "rid.glox"
  106.  
  107.  
  108. "ioc": "..3b"
  109.  
  110.  
  111. "ioc": "rings.glox"
  112.  
  113.  
  114. "ioc": "gostname.xsl"
  115.  
  116.  
  117. "ioc": "quations.dotx"
  118.  
  119.  
  120. "ioc": "ccent.glox"
  121.  
  122.  
  123. "ioc": "gosttitle.xsl"
  124.  
  125.  
  126. "ioc": "chicago.xsl"
  127.  
  128.  
  129. "ioc": "ieee2006officeonline.xsl"
  130.  
  131.  
  132. "ioc": "e.gu"
  133.  
  134.  
  135. "ioc": "harvardanglia2008officeonline.xsl"
  136.  
  137.  
  138. "ioc": "mlaseventheditionofficeonline.xsl"
  139.  
  140.  
  141. "ioc": "pictureorgchart.glox"
  142.  
  143.  
  144. "ioc": "turabian.xsl"
  145.  
  146.  
  147. "ioc": "gb.xsl"
  148.  
  149.  
  150. "ioc": "nline.xsl"
  151.  
  152.  
  153. "ioc": "content.inf"
  154.  
  155.  
  156. "ioc": "rame.thmx"
  157.  
  158.  
  159. "ioc": "ividend.thmx"
  160.  
  161.  
  162. "ioc": "anded.thmx"
  163.  
  164.  
  165. "ioc": "ype.thmx"
  166.  
  167.  
  168.  
  169.  
  170. "Description": "Performs some HTTP requests",
  171. "Details":
  172.  
  173. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  174.  
  175.  
  176. "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
  177.  
  178.  
  179. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  180.  
  181.  
  182. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  183.  
  184.  
  185. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  186.  
  187.  
  188.  
  189.  
  190. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  191. "Details":
  192.  
  193. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$i\\xaf\\x84\\x02\\x1a\\xeb\\xefg3b^\\x94\\xc1\\xd5\\xf5\\xdc\\\\x02a\\x10\\xae\\x1e!dbv\\x0b\\x10o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  194.  
  195.  
  196. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3,h\\xd0\\xfb\\x94\\xc6\\x9d \\xd9\\xf0\\xdf?\\x9bn \\xc2\\x96\\xd4\\xcd\\xb9\\x8d7\\xb8\\x9dp\\xc4u\\x7f\\x18\\xf0\\x91\\xff_\\xd6\\xbf\\x18\\x03s\\xde\\x19lk\\x198bzx\\xf7mo9 \\xf3\\xe9\\x15x\\x036\\x013\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe68\\xd4\\xe3\\xf4\tn\\x971\\xd7h\\xcc^f\\xbc\\x945\\x95mk`\\xea\\x8e| f\\x1c`\\xb1\\x8f\\x00s\\x11g\\xba\\xd3\\x92lj\\xe2\\xdcq\\x1a6\\xd2\\xd9\\xa9"
  197.  
  198.  
  199. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc1\\xef\\x19\\x81-u\\xdbpdw\\xc3n\\x83\\xe2\\xc3\\xd3\\xbc\\xe0y#\\x93\\x9f\\x86h\\xa3\\xcf\\xa5\\xfa\\xe3\\x9e\\x9dl\\xd1\\x08\\x83\\xef\\x812\\xcd\\x0ee\\x85\\xdf\\xea:w\\x88\\x07i\\x85\tg\\xe1\\x8b\\x01\\x87\\xdfn\\xa3*\\xd2\n\\xd6\\xdfm\\x17\\xc2\\x86\\xf8w\\x12\\xa7\\xee\\xc3\\x88\"\\x00\\xf3\\xde\\xfe\\xe6.t\\x13+\\x93\\x95u\\x15c0\\xf1\\xef-\\xdc\\x89b\\xa8!\\xcc\\xf2k\\xe4\\x84\\x1d+x\\xec*\\x9d\\x92\\xeck\\x1avev\\xf0\\x98\\x15'\\xb8r\\xfdsz\\xbb\\xd8,i\\xc1ck\\x8e)\\xfdrj\\xab)m\\x91\\xb0<u\\xb9\\x93\\xe1\\xe4\\xd0t\\xae\\xe4\\x8a\\xd49\\xc57\\xb7\\x960\\xc9x\\xf2\\x0fa\tp\\xab\\x810\\x18.\\x93\\xfc\n-\\xda\\xdd\\xa4\\xf5\\xa1r>\\xc3\\x88\\xe1+.\\x168\\xe3\\x87\n\\xec&\r\\xec\\x10j\\xea8\\xf48~zpl_\\x08\\xc1\\xb6f\\x80\\x01q\\x0b5\\xf9~\\xe2\\x8c\\x84p.\\xdamvpiy8c\\x03\\xb4\\x7f0\\xe04\\x12\\xa8\\xb5\\x92\\x94\\xbb\\xd4\\xa0"
  200.  
  201.  
  202. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$i\\xb0\\xc4q\\xc3\\x03\\xc7\\xdf\\xb8\\xc17,\\x81\\xb1\\x0b\\xd9\\x8fyq\\x13a\\xe4\\xf8k\\x9a@\\xd6k\r8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  203.  
  204.  
  205. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff)*i\\xd0\\xd9\\xdbk\\xdc\\x17\\xe3vm\\xbdi\\x0e\\xea\\xf6a\\xcb\\x00~\\xc5m\\xb3=\\xd7l!\\xae\\xfb\\xcbe\\x90\\xd5\\x85\\xd3\\3\\xc9:j\\xaf\rn\\xdd\\xb3\\x9b\\xfa\\xa6i\\xf8\\x06\\xf1kn!tdv\\xa6\\x12\\xcc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\x98;9b\\xc1z\\xee\\x9f\"\\xca\\xb49\\xdd\\xf8\\xd1\\x19m\\xfa\\xd5\\xc2\\xd9\\xdfb\\xd0\\x12\\x84y,\\xe5\\x9e\"n\\x8eqlb\\xdf\\xfe\\xe6\\xbc\nm=y\\x08\\xbca"
  206.  
  207.  
  208. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  209.  
  210.  
  211. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  212.  
  213.  
  214. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$i\\xc1e>\\xfb\\xa1\\xd7i\\xde\\xadhg\\xc8\\x15m\\xcfhc\\x1ei\\x9e;\\xfa\\xd0b\\x16\\xc95\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  215.  
  216.  
  217. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xfba\\xddm|\\xbd\\xa0\\x94\\xf0\\xea o\\xfe\\x05#;\\x1e\\x17i\\xc0\\xfcu\\x08x\\x83\\x1a:\\xad\\x98~\\x1cm\\x96\\xf7h\\xb5\\xf7\"\\x1b\\xd6\\xe6ui\\x82\\xfb6\\xc5t\\x03?\\x7fm\\x90\\xa4=\\xfb\\xe6u\\xb5\\xe5a\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92\\x9c5\\x1d2wmzi\\x98x\\x98q\\xc1\\xbe\\xa2\\xe9vk5v\\xcatj\\x9dcr\\xc9;\\xf8t\\xdb<iw$g!\\xe2\\xdd\\xc2\\xdce\\xbe^u\\xf7\\xff"
  218.  
  219.  
  220. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pk\\xdch\\xaa\\xf9:\\xb3\"\\xfc\\x98\\\\xcc\\x83\\x1d\\xd9\\x16\\xb5^\\xfa4\\xf7\\xc4iu\\x8b\\x7f+n\\xc1\\x19q\\x01\\xee\\xdd\\xe5\\xc1,\\x1c\\x173\\xc9=h7t\\xd1w\\x94ff\\xc4\\xbb\\\\x10\\x91wh\\x9b\\xe5\\x8ek`\\x0cq\\xedt\\xa0?l\\xf9\\x11u\\x0fs\\x93r\\xdcn\\xe5\\xe4\\xbdi5\\xb5\\x08\\x12g\\x94\\xe1\\xff\\xec\\xbbuvs,\\xc9\\xb1\\xfe\\x1d\\xf6\\xa7\r\\x02\\xe9\\xb5\\x0b\\xa7\\x9c\\xbdr\\xf5\\xc0\\`\\xb5\\xfc\\x8f\\xeah\\x85\\xf7\\x0b\\x00+\\xcd\\x88\\xc5\\x12p\\xcc\\xb1\\x18\\x1a\\xb88=\\xd7\\x0c\\x8b\\xa7\\xc9\\xe9\\x95\\x89b\\x93ue\\xa9\\xf2\\x8a\\x07 fwatpp\\xc6\\x8c\\xa5|m\r\\xc1\\xc2+\\xf0\\xeb'\\xd0\\xbf\\xa8\\xe7y\\x0c\\xf6\\x83\\xf2\\xd7\\x03\\x84/g7\\x937\\x9f4\\xf5\\xd8y\\x87\\xbb\r\\x91\\xde\\xb8+b\\xeb\\xeecd\\x1fw\\xe5\\x96\\x08\\xb2\\xa4i\\xbdv \\x99)\\x1f\\xe9v\\xb7&n\\xf6\\xbc\\x8a\\xf1\\x90\\xb5n\\xb0\\xfcx\\xcf\\x13\\xfcdh*\\xcb\\xd4\\x16\\xb8\\x7f\\x8aa"
  221.  
  222.  
  223. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xae\\xdf=\\xe7s0\\x87\\xd2\\x1b7.h\\xf0%\\x84\\x9as\\xc7\t\\xf0!g\\xa0\\x91\\x05\\xc7\\x0e\\xb9\\x86\\xf3g\\x87\\xcc\\xa1m\\xe1\\x1a\\xd1~\\m\t\\xf99\\xde\\xa2s\\xfen\\xcd\\xba\\xbbe2\\xb6bpr\\xd28j8\\xab%\\xed\\xea\\xe9\\xff\\x19\\x85)\\xe0s\\xe4\\x12*7b\\x84\\xee\\xf7\\xed\\xe5\\xecx^na\\xa3_\\xe7\\xf7\\x10\\xeece/\\x1c\\x06j\\x10\\xb257u\\x84?=\\xd5\\xcf \\x92\\x8apj\\x03ig\\xe46q\\xb8\\xb1q\\x93\\xb7i\\xc9\\x19\\xe2z7\\xe2\\xbc\\x90c\\xe3\\xdb;\\x9b\\x01\\xce%\\xd7\\xfa\"5\\x95l\\xbe\\xc6\\xa6\\x05\\x11\\xbcv\\xa0\\xef\\x95:\\xeb \\xee\\xa1\\xdf\\xech\\xe9\\xc6\\x90\\xa0\\xf3\\x96\\xf0\\xa1\\xbc<y\\xfc\\xb7\\xeb\\x1az\\x04\\x04d\\xa8\\xc5%h\\xf7q\\xca\\xe2d\\xa0\\x14\\x10\\xdd\\xa7\\xfe\\xb9dh'\\xaag\\x87\\x96\\xb7\\xbe\\xe7\\xc8\\xb4\\xdb\\xac\\xdedl\\x92p/z\\xb9\\xf7\\x86\\x11z1\\xea\\x19\\xfcs#$\r\\xfc\\xab\\xb3\\xe3\\x85a8x\\xc0\\x9c"
  224.  
  225.  
  226. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 @\\xe1\\xb3k\\x8b\\xce\\x9b\\x85\\xed|\\xbd4\\xa0\\xac(\\xb2\\xe9\\xc9\\xc6m\\xe1r\\xf6:!.\\x8c\\xa0.\\xdf\\x92\\xff'\\xe8\\xc1=\\xd3\\xd6u\\x94\\x98\\x0b\\xf8\\xff\\xd6\\x0c_\\x05\\x8c\\xbe\\xce\\x0b\\x07\\x80fx\\xab@q\\x05!h\\x1f\\x1dq\\xc5\\xf3%'l\\x0b6\\xaa\\xcd6\\xc5\\xf1;5\\x12u\\x88af\\x17d\\xfb\\xf0\\xca+\\xe9t\\x95u5dq>t\\xcb\\xa3\r\\x8c\\x81\\xee\\xb4\\xe0\\xbeu\\x17\\xec:\\xb6t\\xba\\x9d\\xeb\\x1e\\x8f\t\\x00\\x06\\xab\\xf6\\x1dt\\xf7uz\\x12\\xa3e\r~\\xe7\\x10\\x84\\x1a<\\xe2b\\xcd\\xb8\\x90\\xe2r\\xc0\\xe1\\xd3\\xbe \\x9bd\\x85\\x0b\\xb2\\xf2:wg\\xfdm\\x8d\\xfa\\x15\\xbf\\xd5\\x8b\\xa1\\xfbwt\\x1e\\xe4\\xec\n \\xd9gg|\\xe3\\x84\\xfa@r\\xc1\\xebu%\\xdd\\x7fp\\x16m\\x872\\xfai\\xd1\\x80fq\\xda\\xf6f\\xb6\\x056\\xa9&?x\\x14\\xf8w\\x1c\\x8a\\xf3\\xb3&3\\xcd\\xfe\\x08ii`l\\xe6#\\x9b\\x1a\\xdc\\xf6\\xa6\\x10\\xc6\\x86\\xa0\\xcf\\xe3\\xbbd\\xdd\\xe4xy"
  227.  
  228.  
  229. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01$i\\xd0sb\\x13v\\x983m\\x19z\\xa9+a\\xaafzw$\\xd4\\x81^\\x1e\\xdf\\xdf.\\x97;\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  230.  
  231.  
  232. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xd1\\xb4wg\\x8c\\xaf\\x0e\\xb3o \\x91\\xd8\\xb8\r\\xb4\\xef\\x0b\\xc0l_\\xeb\\x9b5i\\x8d\\xc2l<g\\xea\\x81\\xe0f\\x16f\\xab\\xf0\\x95.:\\x83\\x8b*\\xb8.2z\\xbd*:?\\xff\\xa3\\xc4\\xf4\\xa4\\x92a\\x9csm\\xed\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x1a\\xe3\\x11\\x08\\x0fv\\xe9\\x13\\xab\\xcc\\xd2\\xd2ow\\xeb\\xfahy\\xbd\\x7f\\xf0\\xe7u\\xae3\t\\x02\\xef\\xfb0\\x84-\\xb7o\\x8fr \\xd0m\\x19\\x9c\\xd1\\xaa\\xe2\n\\xb3\\xf4"
  233.  
  234.  
  235. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p!\\xe2\\xf5\\x85y\\x9d\\xa7s\\xe1\\x1e\\xeay\\xe4\\xdap\\x9ap\\xa3@\\x1f\\x02\\x91(\\x9e\\xb5\\xc4\\x8a\\x0e\\x10\\xc92\n~\\xdd\\xac\\xd1uvl\\xaf\\xe36\\xca\\xd2\\xcd\\x1b\\xb3\\xdf\\xba\\x9b\\x82(\\x19 5\\x8am\"wb\\xaay\\xb8\\xb0\\xd6\\xa6\\xf3\\x93\\xf4\\x17\\x12c\\xb9\\xa5\\xef\\xdd`i\\xa1i\\x07l\\xdd\\xb43w\\x84\\xe2\\xef\\x1b\\x85\\x9c\\xb2\\xf1,\\xae\\xba3\\xa8\\xd9\\xa4\\xa2!\\xc0`\\xc2\\x1c\\x9d\\x84\\x84\\x83%\"\\x86\\xf1\\xac\\x85\\xf5\\x88\\x16\\x01\\x8e`um&!\\xccux\\xc6\\xef\\x00\\xf5:\\xd8\\xe5\\xe6\\xa39\\xc6\\x1b >\\x05\\xb9\\xb2\\xe8\\xbb\\xe7\"\\x8d\\xdb\"\\xea\\x1a\\xc2 \\x02l\\xf8r)\\xd3\\x17\\xa5am_\\xc8\\xc3\\xa9\\x9d\\xddy\\x97\\x04\\xae!\\x94\\x83\\x9c\\x9f\\x18d\\xd5\\xdcd\\xb9\\xb9\\x8e\\x80\\xd9\\x14\\xb4\\xd2\\xc9\\xbd\\xb4gn_\\x040\\x1f\\x8c\\xb3?\\x10\\x8do\\x9e\\xde\\xc4a\\xcf\\xcb\\x1b\\x919h\\xd8v\\xc1\\xaf\\xfb\\xb37o\\xc7w\\xbd\\x1f\\xc2u>\\x83w8q\\x86\\x93m\\x98\\x96"
  236.  
  237.  
  238. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdbmmn\\x83g6\\xef\\x04,\\xdc\\x8a\\x97\\x93\\x1c.\\xd5.\\xdc\\xect\\x9d\\xc5\\xea\\x1a\\xe2\\xbc\\xa2\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  239.  
  240.  
  241. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb6\\x0e\\x130\\xe6|\\xd2pc\\xf6\\x88p\\x0b8\\xd3\\x9f\\xb8\\x1f\\xca\\xb5\\xe9\n%v\\x1e\\xce\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  242.  
  243.  
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdbf\\x0f#k\\xe1\\x0b\\xecl\\x03\\xbdu.\\xa7\\xbf\\xcd\\xcb\\xc8\\x89\\xdd\\xfc\\x94!\\x03\\x9b\\xbdu\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245.  
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdbb\\xb4s\\x94w\\x1c\\xd4\\x02\\x88\\xcb^\\x83\\x0e\\x9f\\x0c\\xbd2q\\x17\\x11\\x8a\\xb4a\\x06\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xbd\\x8cul4\\x14\\xb2\\x99\\xd2ky\\xc3l\\x8a\\xe0\\x85\\xf4\\xde\\xf6\\x85\\xe6i\\x05\\xb9\\x89^\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb!\\xc5\\x80\\x80\\x9e\\xf5\\xd4\\xe2\\xb6ppg|\\xe3\\x1e\\xc5\\x0c`\\x9def,\\x15e\\x8c\\xb2\\xcc/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xf5\"r~y\\x1dl\\xba(e\\x14\\x8a\\xdf\\xb9\\x0b\\x81\\xa7\\xfb-\\xe8|\\xdb\\x04$\\xd8\\xa9w\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xa3;x\\x1f\\x06fz\\xaac\\xbb\\xc8\\xbcz\\xf1a&`\\xba\\xa0llt)g\\xfc\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xeee\\x8b\\xc5\\xc7\\x08\\x99'\\xea\\x86\\x06\\x1d$\\x1d\\xf7*\\x14\\x85v\\xe0\\xdfj\\x08\\xb4\\xb9\\x02\\x89.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdbqtbjfw\\xa1\\xd1-\\x9f\\x92,x\\xb3k\\x16\\xde\n\\xe4\\x0b\\x8f\\xde\\x06\\xf4d\\xa8\\x1b\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xc4_\\xa0vo\\xbae_3\\x17\\x9d\\x8a\\x85\\xd7la;j\\xdc\\xd5i<\\x00\\x92\\x8c\\xd8kt\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdbm\\xa1\\xa1\\xd4c\\x11\\x9ao\\xf2\\x18l_\\x10\\x90\\xee\\x9b\\x06\\x1aj\\x90\\x8d\\xbbc\\xc6\\x8b\\x10\\xfe\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\w\\x0e\\x1b\\x96,_\\xfd\\x81\\xab\\x0b\\xaf\\xb4k8\\x84zq>8\\x0c,f\\xcd\\xb8\\xbd\\xa0*\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\x9e\\xbc9\\xaf\\xe2d\\xe4\\x1a\\xc7\\x94\\xd7w\\x83\\x08y\\xf9\\x95\\xdd\\x94\\x12!j>\\x86\\xd8\\xc3\\xe6\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xb3\\x0eo\\xb2\\x80\\xbc\\xdf\\xd2va#\\xbb\\x07\\xb4\r\\x94yy\\xd7=n#\\xf2\\xb78_\\xf9\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdb\\xe9r\\xe9qg\\xc1v\\xf0z\\x9a\\x1a5b)\\xdb\\xafs\\x076\\xbf\\xde\\xa9\\xc7\\xe9\\x9d\\xf8\\xe5\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x91&\\xb9\\xed^\\x99\\xee\\xf2\\xcd/\\xe6\\x9a\\xa6\\xf1i\\xc0\\xfa-?\\x80\\x99c\\xfcok\\x13c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x93\\x9a\\xda2\\xcb~.0s\\xa1\\xe9\\xac\\x82\\x0c\\xf0v\\x97\\xf6\\xfe\\xa0\\x11\\xaa\\x93_b\\xce\\xe8\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xb2\\x06\\x943\\x06%n\\xa8\n\\xc2)\\x0e\\x19\\x8a\\x88e\\xe3\\xd9le\\xe7\n\\xb1\\x8ceh\\x8e?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdcg\\x15\\x19x\\xc8\\xad\\xf9t\\xfd>\\xffw%\\xa6\\x80c)\\x1b`\\xc1\\xb2\\xc6\\x8dy\\x93b\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x80_\\xb0\\xf0-\\xc1\\x8fg\\xe8\\xed\\xc20\\xad\\xd1u\\xe2af\\x1b\\xa0\\xea`\\xbe\\xc87p>\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xff\\xe3j@\\x89<\\xb4\\x9e\\xca\\xb1\\xe5\\xa5\\xd0\\\\xb6\\xb0\\xd5\\xd1\\xa7g\\xd2\\xd0\\x1b\\x83kn+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xf3k,\\x89\\x0b\\xc7\\x8f-\\x0c\\x9e!'\\xae\\x81\\x93\\x17\\xb9(w\\xbe\\x93\\x04\\xe2\\xb8*\\x9c,\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x94v\\xa2\\xcc\\xdd\\xb5\\xf4!id\\xf8&\\xc5\\xa1\\xf5\\xaf6\\xb6\\xbf2\\x0c@\\xeas\n\\xb1\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xd9\\x19\\xa0p \\x96o\\x88\\x06`fm\\xea\\xe2t\\xd4\\xeb\\x9da\\xc2=\\xade\\xfd` \\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x84'\\x1f\\xa5\\x86:\"\\xe8\\x98\\xf2\\x85<$\\x06\\x1f.\\xd8\\x9c,_\\xd8\\xc3\\xae\\xf9\\xea\\xcd\\xfam\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc)\\xa2\\xbf\\xb9\\xb5\\xf0\\xa1\\xd0\\x18@\\x8f\\xfcu\\xa5\\x95)p\\x87\"p\\x05xn\\xb5\\x94e(y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x88h\\xca\\xc3\\xb1\\xa9k\\\\xebte\\xef+\\x10\\x90\\xb5<\\x8b\\xa0\\xbe\\x0e\\x07*\\x136\\xda\\x03\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\x12\\xa9\\xf5\\x17\\xf5\\x0f0z\\xfeuv\\x9e\\x01\\xcfu\\xc3\\xf9\\xa8\\x87\\x1f\\xa3\\x7f&\\xa1\\xdd\\xdfr\\xf0\\x03\\x9d\\xee\\xfa\n+\\xdc\\xbe1\\xa7c?k\\xcc\\xb7\\xf0\\x8e<\\xcd\\x90\\xdf\\x17\\x9d\\xe5\\x1a\\xbb9zyo-t\\x80c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f4\\xb1+\\x9d@ 5@\\x88\\x14\tpy\\xa5=^\\xc6\\x10\\xc9+\\xfa!\\x98k\\xe9\\x05~n\\xaa\\xe1\\xe6\\xbe\\xf9os\\x89\\x9f\\x87\\xac\\xf7f\\x8e\\xbb\\xcbvt\\xf1"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xce\\\\x15m\\xe0v\\xaa=\\xef\\xe0\\x96\\xee?;\\x02\\x7f\\x1bf\\x93\\xbbj\\x8b\\xfcq\\xad\\x9c2\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xcag\\xf3qf*\\xaa\\xb1v\\x07\\xc1~\\x1b\\xdb\\x02\\xee\\x0e6la\\xe2mu;\\xf0v\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xd1\\xa9;>t\\x96v\\x1c\\xeb_\\xad\\x8cs\\xe0\\xf2jly\\xe4\\xf1\\x9a \\xe3\\xc2c\\x7f\\xe4ub\\xd27\\x8aua\\xa3hk\\x94\\xfc\\xa8:1\\xffu\\x1cm\\xd8\\xcbj`\\x98\\xd2\\x98\\xa8\\xaf4\\x8a\\xf1\\x01\\x8bar\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x13\\x97c\\xb0m:%\\x8b\\xd2\\xb0p\\xe3\\xa6v\\xa1d\\xd5\\x06\\x84*4g\\xa2=\\x13\\x87\\xf2^\\xac\\xee,\\xff\\xd6io\\xe2\\xca\\xa9\\xdapg\\xe7\\xb8\\xedorg"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xd1\\x1d\\x9b\\xd3\\x9d3_\\xa1\\x00%\\xe2\\x8d\\xb9r\r0\\xcf\\xce\\x9d\\xd30\\xbf\\x11\\xa0|\\xb6\\xad\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\xa0\\xd1r\\x101e\\x17=\\xfb\\x08\\x83!\\xddq\\xe6\\x84|\\x8a\\x9f\\xf0\\x95ck\\x82\\x89\\xed^\\x87&\\xab\\xa9\\xc60l\\xc8\\x1c4\\xde\\x11\\xaf\\x06a\\x82wf)\\xffkh\\xa6^\\x8b\\xa2\\xf5\\xe4\\xb0\\x17\\xb7\\xae\\x02\\xa28\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1\\x17ei(.\\xae1\\x9d\\x06b\\x0e\\xdf\\x80a-\\xea\\xdf\\xea\\xa5\\x8e\\xa8\\xda\\x8dt\\xd0\\xb1\\xc6,\\xef\\xfd+\\xa9\\xe9:\\xd62\\xb0\\xfd\\xbd\\xa4\\xdbdk\\xf3"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xder=x\\xe8\\xbak\\x9e\\xb9\\x85\\xda\\xcev\\xfdx\\x1a\\xac\\xc0p\\x0c\\xa1\\x02u\\xecx\\x00\\x89p\\xadj\\xf3\\xea\\x1e\\xa1b4j\\x0fv)\\x8ap\\x0biu*\\xc6z\\x8e\\xda\\xa3h\\xb8\\xcd?9\\xafs.\\xbal\\x15f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd4\\x99\\xa9\\x18\\xd2\\xbc\\xafg\\xad~&b\\xb1\\x9f\\x11\\xd7\\xb4\\xb0rb\\x91\\xc8\\x1f\\x13\\x06\\x13\\xaf/\\xf0\\x81\\x1d\\x10\\xb9v\\xe2\\x0e\\xf5\\x82;\\x8874\\xdf\\xdfw\\xe2\\xde"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\%\\x1e\\xdd\\x14\\x11\\xe7~ef\\xb0\\xe2\\xc3\\xdcr\\xfc\\x0f\\xcfi\\xb5\\x01p\\x9a\\xae\\xc4\\xden=\\x17~\\xd7\\x91\\xa3\\xdc\\xb5\\xfe\\x02f|\\xa3\\xed\\xa2\\x8d\\x0cb\\xfa\\x15gas\\xe5yb\\x8a\\xf4\\xbe\\x85.\\x8dx+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc6\\xbb\\x82.i\\xb4\\xa5s\\x1a\\x9b\\xc6\\x0c\\xbd\\xb6\t\\x98\\xfd\\xbb\\xfa5\\x88\\xc6\\x91?r\\xd6d~\\x82\\x86dii\\x970\\xf9\\xd3+\\x17\\xb2_\\xe7\\xf5\\x16y\\x99\\xcf"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xabl\\x89\\xe7\\xd7\\xa8\\x031\\xd3c\\x03?\\xbck\\xd3\\x80\\x1e\\x1f\\xd7e\\x93\\xec$\\x91 \\xbd\\xef\\xfa\\x07e-\\x1b\\xe1\\xc6\\xaf\\xa5@\\x08%\\x17\\x8d\\xaf\\x1b\\xdd\\x81\n\\xfb\\x1f\\xa0k\\x88p\\xb5a\\x9c\\xd4\\x99\\xf7\\xa3\\x808\\x18\\xbe\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xbf\\xae(\\xee\\xb6\\xa6\\xb9\\xa8\\xa4u'\\xcb\\x03\\x8fk\\x9at\\xbei\\xda\\xfa\\xb7\\xd9khx\\xe1\\x93m\\xc5\\x81\\xed\\xe1\\x9f4\\x9b\\xfe\\x18\\xe6\\x9e;\\xe3@\\xc8\\x92f"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf<\\xad\\xcf\\x94dc\\x83\\x9dq\\xf0\\xee\\xfb;0\\x11k$\\xbf\\xa2\\x1cad\\xa0\\x1d\\xadw\\xcc\\x06\\xd9\\x85\\xc6\\xa1a\\xc8\\xc4\\xd08\\xfa\\x9d\\xe4\"\\xd8\\xb7zg+h\\x1aved\\xd1e\\xb8-\\xb2o\"\\xaa\\xb9\\xc3\\x0fz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xd7\\xf8\\xe0\\x94\\xa5\\x9e\\xadq\\xb6\\xd10\\xd1\\x8e\\x00m$\\x90\\xe1\\xa8\\xd8\\xec(\\xf5\\xf2\\x13w\\xb9\\xa9\\x87\\xb0\\x1c\\xa0\\x07n)\\xc4\\x8a1\\xc5\\xa0st\\xe7l\\xbb\\x8d\\xf4"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xf9\\xb7\\xa7\\x8c\\x87&\\x99\\x84\\xf8\\xb2\\xd1f\\xf4\\x8d\\xad\\xe6\\xf1\\xd3n\\xb2\\xe9\\xd6\\xd8\\xcaq\\xa0\n\\x19\\x8bii\\xff*q\\x9efj\\xdd\\x99j\\xa20\\xd9$9\\xbd\\x95\\xdd\\xd2w\\xf6$j\\x8f\\xf7\\x06\\xe5\\xbf\\x81\\xa3\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xf7r\\x00\\x95%\\xbb\\xc1b\\xd4\\x94\\x17b\\x00\\x86b\\xe6\\xec\\xden\\x9f\\xc7\\xa7\\x01\\x99u\\xd6\\x8f\\x97,\\xecy!ci\\x10\\xc44\\xd9jl\\xd9wb\\xbd\\xb1u"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc*\\xab\\x07\\xe4s\\xcaw\\xba\\xe1\\xd7a\\xcf\\xe1\\x9b\\xe9w\\xa6\\x13\\xab<\\xc5(no\\xfe\\x8c\\xc0\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xad^\\xd0f\\xe7\\xbb\\xcd\\xfak\\xe6\\x00\\xbf\\xc0\\x97o\\xb6c\\xdb3\\xc9g#\\xa7\\xbb\\x9c\\xf1\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t^\tf4\\xcd\\xa3\\x0b\\xa0j\\xd3\\xa6\\x0e\\xb5\\x9b\\x15\\xc3\\xd6~\\xf0r\\xed\\x9c\\xc75\\xd8h\\xaa\\xcf\\x8f\\xaba\\xf0\\xbcstr\\xb3\\x0e\\x98\\xfe\\xa0d\\xc9\\x12\\xcf+\\x83\\x93g\\xdd\\xd4\\x80\\xbd>\\xd4\\x87\\x1c\\xf7z\\xbe\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\xca;\\x86\\xad\\x19t/\\x85\\xae\\xd4\\xed\\xb9\\xcf=\\xa9\\x07\\x18\\xd8i\\x9d\\xdd+\\xe4\\xf4\\x17\\x89\\x1ee\\xd0a\\x06\\x8eahqkbv\\xa8\\x8e\\xaa*\\x92\\xdc\\xb8lo"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\xe8\\xa1\\xa07\\x1bf1gqz\\xaa\\x86\\xc1\\xb6\\xe4\\x1a|g=\\xd1fd\\xf9m)\\x12\\xafe\\xff\\x82\\x12m\\xbcx\\x01-\\xc23\\x15_0\\x7f\\xf2t(\\xf5g\\x93\\xa9\\x13\\x7fz\\x19\\xfdvq=\\x84\\x83\\xed\\xf7\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?\\xff\\x89\\x10\\xd2ls\\xc1\\xc7\\x05\\xf8r\\x1f\\xd6\\xea\\xab\\xe4\\xf2\\xefy!\\x17\\xe5\\xb5b\\xb2\\xba\"\\x1f\\x15p\\x1e\\x1b\\x0b\"\\xd9\\x0f\\xb9\\xd7@vs\\x92\\x00\\x0c\\xacl\\xb5"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xc7 \\xb2\\xcb7\\xfdy\\x11b-\\x1d\\xc6\\xe5\\xd22wy\\x0bf\\xabu\\xf9\\xbe\\x89\\xccze\\xd9\\xb2\\xe2\\xea\\x8d\\xe95j\\xa5r\\x19\\xd6\\xa5\\x84\\xe1\\xbfa\\xd7c\\xe0\\x1f\\xc2\\x0b%d\\xdd\\xde\\xe9\\xb5\\xe9\\xc8\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5rk'\\x12\\x96\\x0e\\xdfysl)y$\\x99\\xfb\\xcb\\x116\\x10\\x18\\xdct\\x9f\\xbf\\xe1\\xc1\\xe1s\\x89\\xeb\\xdf\\xb9\\x04#b\\xfea\\xa3\\xe3\\x04\\xcf\\x1a\\xf0n\\xb3\\xa5"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xd0\\,\\x1cd4rx\\xbf\\xcfp\\xcb\\xf3x\\x1cf\\xa5\\xb1\\x18?k\\xd7z\\xe7(\\x84\\xfbb\\x1dn\\xd5h&\\x0f\\xb1\\x8a(\\xf5\\xc11\\xdd`\\xdfz\\xcdo\\xc0\\xa9>\\x85ch\\x13\\xe7j\\xcf\\xb73\\xeeg@<\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k$\\xe0\\x9a\\x89\\x83!\\xfbu\\x10vd\\x1dc\\xcb#\r\\xff\\xf1\\xf0\\x8e*q\\\\xb5\\xe0+\\xe4\\xaf?\\xder\\x81\\x18\\n5\\x11\\xe2f\\x0e\\x87\\xc4a\\xe0\\xd7\\xc3"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97\\xa56'\\xe6\\\\xe3e2\\x9d\\xec\\\\x11m\\x8c\\x96&\\xadz9\\x80\\x87dw\\x17wk\\xba8\\xd1\\x1b \\x95f\\xdaj$\\xf8kr\\x88x`\\xec\\xae\\x04%5\\x13>\\xda\\xd4\\x07mc+\\x86\\xb8v\\xda\\x8e\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005\\xb6\\xc9\\xc8|\\xaaag\\xa4\\xa2\\xf7\\xc8\\k\\xae\\xc9y\\xde`\\x81\\x13\\xad\\x1e#\\xcck\\xcf\\xa3\\x16\\x1b\\xe4\\xaaeg\\x8e\\x97\\xbaiwb\\xb0\\xc8lx\\xbe\\x9eeo"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xbf\\x97\\x9dnd\\xfb\\xf3mo\\xb3\\x07\\xb3v\\x8d6\\xaa\\x81\\x9e\\xc40\\x89\\xb5d\\xda#(\\xfbc\\x94k\\x17\\x92\\xf5w/\\xd0h\\xc1`\\xcb\\xbem\\xbd\\xf2\\x0f\\x80\\xb0\\x9d<b\\x11\\xd6\\xbfw\\xb3\\xd9\\x9c\\x88\\x06\\xfc$?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82uk\\xcb\\xa6>b\\xd0\\x95\\x9d\\xbf\\x98\\xa2/\\x17r\\x1c\\xff\\x04\\xbc\\xce\\xb79\\xf6&d\\xb4\\xa3\\xe9,\\x85\\xd3\\p\n\\xefgj\\x05\\xd2\\xbf\\xcb\\x87\\xf2.\\x8e\\xf0"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\x98\\xd9\\xc0\\xdd\\xceo\\xed\\x86\\xbd\\xda9hl\\xc2(\\x04i \\xc7z\\xbe`\\x93\\x9c0\\x02|\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdcw\\x8a\\x9f5\\x12\\xea\\xab\\x1e\\xc8\\xdd;\\xc5\\x95(n\\xef\\xba\\xd1\\xadz\\xa7\\xc8\\x93\\x15\\x9f\\xcc\\x80 \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdc\\xd9\\x9dv\\x19\\xf379\\x0c\\xce\\xa5\\x82>\\xf9\\x95\\xe2\\xf5\\xfe\\xc1\\x12\\x0f\\xac\\xdd\\xfb<\\xb4\\xe6\\xba\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdcp6\\x02(\\xb3\\xbf\\x9c\\x9f\\x07\\xab\\x80\\xa4\\x9f\\xcc\\xf3\\xd9\\xce\\xc6\n|pl\\xbfo\\xefb\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14w\\xa0\\x89$\\xf9\\xe9/\\x88\\xae\\xebr\\xea\\xe9q\\xf8\\x02\\xfc\\xbc\\x11u3\\xf3\\\r\\x89\\xcb\\x8fs<\tt<\\x11+\\xea\\x15\\xdd4oq\\xfc\\xca\\xf5\\xc6|a\\x06\\x860\\xa1=\\x86\\xde\\x0f\\x86\\xbbyo\\xc3\\xff\\xda\\x9fk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xa5\\xa6\\xcb\\x16\\xae7\\xee\\x82\n\t8c\\x8b\\xe0\\xf3h\\x89\\xbd\\xf6\\xdf?\\xe0\\x1b\\x88m\\x04\\xad<\\xcd\\xe9\\x86\\x0ce\\xc4\\xbfv'\\x8c\\xe4r\\xe2\\xf2\\x1c\\xe4\\xb9j"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7e\\xc4c\\x95\\xeb\\x05kb\\\\x03p\\x14b@.\\xbb\\xde\\xc8o\\x13\\xa0\\xcf&z\\x06\\xfea\\xba\\xe7\\x0f\\xb2nn,`w\\xdb0\\x94;\\xdf\\xaf\\x951f_\\x00\\xe1kx\\xc3\\xb1b\\xb9\\xd7\\xa4spm\\xb6\\xc1\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\x9f\\x0eq(\\x1b\\x91\\x99~\\xc9\\x16j\\xfex\\xc1\\xf7c\\xa9w2\\xe4\\x8a4\\x81kxpva\\xd25\\x8d\\xb8\\xae\\x9b\\x01\\x88\\xcah\\xe0y\\xdd\\xc5l\\x10\\xc1\\xab8"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\x8b>\\xb2a\\xdaal\\xb0\\xaf\\xd1\\xc7\\xe11\\x97j\\xfbc)\\x05\\xc4\\xe2\\xb8\\x83\\xbcm\nd\\xf0\\x8d\"\\x05\\xff\\xdf\\xe7/\\xb20\\xfcq\\xe4rj>e\\xd1'fh\\x1a\\x8f2\\x0f\\x1a\\xc6\\xfe\\xf7d\\x9a\\xbd\\xc1\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000pj\\xd3\\xdb\\xdb\\x80\\xff\\x81\\xca\\xcb\\x90\\xb6\\x82\\x83a\\x11\\x9d\\xf1\\xb7o##\\xb4k\\x97^\\x93\\xb2\\x0f\\x9e$\\x80k\\xa2/3\\xc9\\x06u\\x16\\xacjw\\x9a<"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe5nt\\xcb\\xf34'&\\xef\\xed\\xa5<e\\x16\\xe4\\x06l(\\xf7\\xcep\n\\xc3\\xe81\\x9e@\\xb4\\xeb\\x86\\x90\\xf0\\x1ah\r\\xa3\\xb9\\x8afn\\xe9\\xf9\\xdf\\x96\\x92\\xa5\\x01bp\\xe7\\xf7f\\xe3h\\x1ekr\\xde#\\xde8\\x93x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\xf2\\x1fk&\\xc0\\x9bn\\x9engp\\xf6\\xa4\\xcb=\\x03\\xb8\\x16\\xfa\\x9e\\x00\\xfb\\xf8/\\xaf\r\\xff\\xb8\\x16\\xc5k+\\x17g\\xb4\\x85p\\xc8\\x1dj\\x17\\x0b\\xd9l\\x05\\xb6\\xa7"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\\x0c\\x05b\\xd4\\xc3\\xfc'\\xcb\\x81\\xe3\\x01\\x9eqci\\xc6\\xf1\\x1f\\xadf\\xd3\\xcc'\\xeb\\xbf\\xd6\\xa0\\x03\\xd8\\xe1\\xc7\\xc8\\xfa\\xbcr\\xf42\\x10\\xc4\\x0f\\x94+n\\xa3\\xdd;\\xda1g\\xde\\x95f\\x80\\xbf\\x07y\\xfb\\x08\\xec\\xd1\\xaa\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfavvl_\\x1a\\xb2\\xe0\\xf8t\r\\xb8.\\xc8\\x1a\\xbfu\\xf4\\xc1f?\\x06 \\xf6\\x9f\\xec\\x7f;\\xac\\x0b\\xc4`\\xf1:\\xa9\\xbb\\xa5j')\r@\\xd1r\\ij"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x83\\xc7\\x1da\t'\\x16:\\xbe\\x9cn-2\\xe9^\\x06\\xf6~9\\xc0\\xeev\\xe8\\xd8\\xaad\\xd3\\x19\\xa2\\xa8)\\xa7\\x85!\\xf2\\x10\\x88\\x8a\\xb7\\xda\\x80(\\xf5\\xfc\\x1b\\x95\\xe0\\x04$h\\xe64\\xcd\\x1b\\xb0\\x08$ne~f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0f\\x1db\\xdb\\xad$\\xa0|\\xb6?\\x11\\x85\\xa4lc\\x97\\xcc\\xa9\\x91\\xb2\\xf6\\x97\\xbb\\xa9\\x98e\\x9f\\x8dj\\x032\\xba\\xb0p\\x84\\xccw\\xfd\\x85\\xc5\\xa7\\xcf\\xe0-\\xb9\\xb2\\x91\\x96"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\\\xda\\x90:w\\xed\\x9f\\xeeu\\xa08\\xf3\\xce\\x18\\x9e\\xb6\\xd0cqd\\xdd\\xcf\\xbc\\xfc\na\".\\xc7\\x07c5\t\\xf6\\x1am\\xc9\\xdf\\x15\\xe3\\x89\\x13w\\xfebq\\x87\\xb9\\xa8x\\xfc&\\xcbpp\\xbc+\\xfa|\\x14\\xb3gf_\"\\xac\\xac\\xdf\\xdb)1\\xd3@\\xa5\\xf3\\x83\\x7f7do\\x9d\\x96\\xb3s\\x9b/\\xad\\xdcg@9l\\x8b\\xa9\\xbf\\xe3|\\xf6'ah<k\\x86\\xbegu|\\xceka(\\xed\\x89\\xa0\\x94\\xfdm\\xc8pu\\x82\\x197tn\\x9a\\xe5\\xd8\\xac\\xdd\\x0e\\xef\\xa2\\xdao\\xce\\xdeu8q\"\\xa3\\x83\\x06u\\x18\\xc2\\x17f\\xe2s\\xd4\\xe3\\x0et9|\\x8f\\xd0\\xc1\\xdf\\xa3\\x90\\xc0\\x17y\\x17\\xa5\\x89\\xedm\\x1a?\\x96\\xed\\xf1\\xea\\x97/\\x9c\\xf9\\xdf\\xc5p\\x8f\rb\n\\xbc\\xca\\x9e\\xf8\\xee\\x15\\xa3\\x1c?\\xd4q\\x848\\x9a\\xe2kya\nc!\\xdb\\xa6\\xd9\\x10\\xef\\xe0(\\x1a\\x9fyn~<h\\xac\\xfd\\x88&\\xeb\\x0eyj\\x12\\x07\\xfa\\xfair+<\\x15\\x99\\xe9\\xd0\\xc6\\x06"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\xbc\\xa2kw\\x1blx;\\x95\\x06\\xb7\\xb7\\xdfon^\\xfe+\\xd7lg\\x80\\xee\\xa3r\\xc5\\x0f^\\xa7\\x1e\\x17~\\xdf\\xab\\x03\\xa7\\xdfldt\\x8fd\\xb9~jhj\\xe4\\xbbq\\xb0\\xf8s\\x9an\\xf6\\xe1\\x15mwi\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\x87y\\x99\\x84)q\\x18\\x8eg\\x06\\xc8j\\xedq\\xad\\x19\\x86\\x96\\xd8`\\x8a\\x9a\\xa4\\xafq\\x89#\\x1e\\xf1\\xa2,7j\\xa1r\\x96\\xaf\\xfe\\xa66\\xe9\\x7f\\xaesh\\xc2"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t\\xbd\\xf3\\xa8*\\x81\\x15pw\\xc9x\\x9f\\x0c\\x8e\\xba\\xaa\\xdd8\\xf1\\x00\\xc4/\\x1fjv\\x86\\xb3\\xff\\xf4\\xe1\\x12m\\xc1\\xb5t\\x8a\\xc4\\x9a\\xdb\\x02\\x1a\\xc4\\x12\\xdd\\x16\\x18\\xb6\n\\xd8\\x963m\\x05\\x99\\xde\\x14\\x03\\x86k\\x96\\x7f\\xee\\xb6\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84p\\x8d\\x87qj\\xc7)j\\xde\\xe2\\xa4\\x98\\xf0\\x06\\x15=\\x98\\xae\\xf2\\x16\\xe0\\x9c\\xbb-\\xca\\xc1|\\xa5%\\xc9p\\xf7\\x99f\\xdc\\xd7\\xff\\x8a3\\x1f\\x98\\xba\\xd3\\xae\"\\xd7"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\\x18h0\\xa9z>\\x9f\\xd7\\x98@\\xcf\\x8d\\xf4\\xc2\\xfb\\xe7\\x0f\\x01b\\xadl:\\xb7\\xb0x\\x82\\xeam\\xed\\xfa$\\x05o\\xbf-\\x88g\\xd6\\x9f\\x13\\xc4\\xc9\\x93\\xeb~\\xf8\\xe7\\xd9\\x0f\\xe6\\xec\\xe9t\\xdf\\x1b&~d\\xadg\\x02\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86;\\x04\\xc3@\\xf1\\xab\\x8e\\xa9\\xe3\\xa0\\xbb\\xd9\\xb6my\\xf4\\x9e\\xa6\\x0f\\xf60\\xe5\\x12\\x9bd\\xc74b\\xee\\xc7\\x11\\xb2\r\\xfe\\xb1\\x9e\\x7f\\xa8\\xea\\xe5\\x13\\x03\\xec\\xd9\\xd6\\x9b:"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\t\\x8f\\x87\\xa8\\x8du\\xeb\\x9a&\\x8a\\x9c\\x1c-\\x05\\xa5\\xbfx\\xb1\\\\xdep\\xbb\\xb23p\\xac\\xa2\\x8c\\xdca\\x13\\xb4%\\x92\\xd5\\x9f\\xf06\\x03/\\xff\\xaf@h\\xe3n\\xcc\\x0b\\xa7\\xb6,\\x82p\\x10t\\xf6\\xb8\\xc4\\xb6\\x00\\xe6\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000vlt\\xe6\\x9d\\x9a\\x0ch\\x90\\x86(\\xec\\x9e7\\xef\\xe5fy\\xfa\\xba\\xa5r6\\xf1\\xf2cv\\x88i\\x07pl\\x1b\\xbeok\\xbc%_\\xd6\\x8b\\xbe.'\\x93\\xc4x\\xb3"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\xd3\\xade\\xc7m*\\x9e\\x1cr\\xe5\\x82\\xd8\\x1af+\\xab&\\xaf,\\xae\\xbc\\x98\\xace\\xa8\\x02\\xa8_\\xa4\\xa7x\\xf8*\\xda\\xb6\\x8bmt\\xc2bn\\\\xc85ve\\xd83\\xbb\\xf0:\\x16\\xf6\\x93\\x98+%\\x8e\\x9b.\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xfeb\\xe3k\\xc7\\xf5\\x18i\\xb5\\x98\\x15\\x0f\\x05\\x0b\\x08\\x8d\\xdd\\x9c\\xa4\\xe8\\x1b\\xf4\n\\xfd\\xb2\\x07\\xd5\\xd5\\xb1g\\xd8rdn\\x9b\\xa0\\xe3o\\xb2g\\xad\\x92\\xcd\\xa7"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbfx\\xbf1l\\xe0\\xda\\xfdc@\\xdb3\\xd4\\xf7\\xb6k\\x1c\\xb1\\xff\\xedv\\x1f\\x94\\x96v\\xbf\\xbd\\xc0\\xa1\\x02\\xd5\\x13\\xf7\\x1dd\\xe6\\xf3\\xa4l\\x10\\xbe\\xd2\\x01\\x14\\xc4\\x12_\\x80\\xe5\\xe78\\xe1\\xfc\\x9ei\\x1fo\\xf1\\xca\\xfen\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4u\\xb2\\x00t\\xfev\\xf2\\xa9p\\x97\\x0e\\x1d\\xc8y>\\x0c\\x8f\\xa3p(\\xd2\\xb6\\xa39\\xf72\\xf35\\g\\xab\\xa4\\xbd\\xa7k\\xae\\xeau\\x07a.r\\x83\\x99\\x11\\xb5\\x87"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\x04\\xb2\\x1fmi\\x04\\x12\\x08\\xd8\\xee\\x91*\\x8e>\\xf4\\xf0\\xadp\ra`\\xc5q\\x03\\x11\\xe6'9c\\x9bf&\\x9b\\x0f\\x1c\\xdd\\xf9\\x10^)z\\xf7\\xb5\\x8f\\xdc\\xaa\\x96\\x82\\xb6wg\\xe9oz\\xac\\x8d\\xa9w\\xf3&\\xc8\\xe8\\xd9\\x0e\\xc6?\\xa5=\\xb9\\x1e4\\xfe*\\x1a\\xa5~q\\xe39r\\x1b\\xb5\\x13\\xb1\\x7f\\x13\\xd9\\xfe\\xd7\\xd9\\xa3\\x86v\\xecf\\xf5\\xdd\\xdbu\\xb6!\\xc4\\xab\\x98\\xc0\\xe71\\x97p\\xb7/\\xa3\\xe3\\xf0r\\xf7\\x9cc\\x18\\x0c,k\\x04~\\x1a6\\xc9\\xbai\\xb6\\xa2\\x9fut\\\\xb0va\\xaf\\x87r\\xf0\\x95<!\\xaaq \\xba\\xa2a\\xf99\\x03i\\xdf\\xe3\\x0c\\x8c\\x80\\x8d\\x16\\=j\\x05\\xd3\\xd2\\x191\\xa0\\x08o8\\x08\n\\x98\\x0el\\xcdp\\xbcd+\rj\\xd8\\xc7\\xc2\\xcep\\x90,\\xd3\"\\x9a\\xb5\\xa3\\xfc\\x99f\\xe6\\x85\\xc14m=4\\xa3\\x1d\\xdc\\xc3^\\x17\\x1d!\\xd6e\\xa9\\x82\\xae\\x169\\x1f\\xc9\\xda\\xfbh\\xd2\\xe9\\xf3\"\\xfd`\\xd7\\x9e\\xe8\\x1c\ncy\\xb8<\\xf3\\x06"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xedycwxqru#y\\xed\\xa5/\\xef\\xf1\\x96mq\\xdf!\\xfe\\x14\\xbfcv\\x10/&\\xf7\\x1du\\xfa5\\xdb\\xe4\\xb8\\xceih\\x84\\x13\\xf2\\x9ag\\xab\\x9c4\\xfe(j*\\x02\\xb2\\xbb\\x19\\xa6\\x98\\x0e\\xec\\xcd\\xfc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#!\\xfe?o\\xbd\\xaa\\x9cr\\x85m\\x14\\x1c\\x12\\xb6\\x1a\\xfe\\xcdo\\x8f\\xf0\\xe8\\xb7qq\\xccd\\x18\\\\x1b\\x93\\x02,4bh\\x08<\\x085yi\\xb4\\xbb\\xf6h8"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x8c|x\\x1a\\xb3\\xef\n+\\xfa'@\\xca\\x1c\\xb4)\\xa9\\xc9\\xc5\\xb4\\xe6b'\\xfe\\xf6\\xce\\xa1$\\x07\\xb8\\x00\\xd8\\xc6\\xe8\\xfe\\xc1\\xe6\\xe1h\\x98\\x9e\\x15d\\xb3t\\xcej\\xef\\x8e\\\\xaeeaa\\xc8\\xa7\\xac\\xfc\\x0c\\xda\\x16\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xa5k\\x1de\\x82\\x8d\\x9d\\x89\\x05\\x80\\xa2\\xd82\\x9b\\x0f\\xe5\\x8dl\\x03\\xc7\n\\x914/\\x9a\n\\xbe\\x16-t)\\x7f.\\x82rz\\x83\\x0f\\xec\\x99;\\x02\\x14\\xbfa"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\xcf\\x12\\xc5\\xee\\x85a\\xa4\\xadgv\\x8b\\x80\\x1a\\xb3yz\\xcd\\x97e0`\\x92a8r9\\xed\\xbd\\xb0\\xa9\\x8b\\xe2\\xd3i\\xe5@l\\x1c\\xfa\\x1a\\x08f\\x9b\\xfa\\x06\\xf9\\xee\\xff\\x17h\\x11x\\xa4e\\xb7\\xa7\\x1b<\\xf4\\xa3w\\x06\\x08\\xeb\\xa9\\xa7\\xa6\\x9a\\xae*\\xb1\\x95\\xe8\\xfe\\x9c\\xf6\\x90-hb.\\xc66\\x7f\\xb5tj\\xa4\\xae\\xa2\\xe0x\\xf8\\xd5\n1\\x81\\x9be\\xde\\xda3\\xaf\\xb7g\\xf9w\\x88\\x89\\xdbi\\xe2\\xf0\\xdd\\xfa&\\xe6\\x9ana\\xf0k\\x18\\xb2\\xdc5\\x14\\xaf\\xbf\\xc0\\x90(1,\\xf9\"\\x15ci\r&(\\xc5n\\xcd\\xef\\x81\\x1by \\x08\\xec\\xc6\\x95m4\\xd0x\\x1cn\\xf8\\x8d\\xe8\\x94\\xb6b\\x1d\\x16\\x04\\x96\n(\\xdc\\x10\\xa8\\xb0\\xe8\\x05\\x13\\xd52;9\\xb8\\xb7\\x7f7\\x12\\x05\\x13\\xaa\\xa8`)e\\xc4\\xe0\\xc3z\\xeb\\x02rmc=o\\x14s^\\xdb\\x1b>\\xd1j\\xb6~\\x83\\xa8\\xfc\\x01\\xd9\\xdd\\x0f\\x9c^\\x1c\\xbfo\\xe9u\\xe7\\xd6jq\\xc6q\r\\xd6\\xf2\\xc3b\\xfbt\\xedv"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe)\\x1c\\xe3\\x13c\\xb8\\xe1\\xd8\\xd7\\xf0\\x82\\xa2\\xcbc\\xf2\\xca\\x97\\x15lwq`lz)\\xfb\\x8a\\xe6\\xf7\\xa1\\x9a\\xacyg\\xf2j\\xb1f\\xda\\xf1x\\x17b\\xb9\\x90_hc\\xa8\\x02\\xa6m\\xff\\xdd\\xe3\\xb4\\x12\\xdfh\\xb5\\x82\\xffow6<a\\xf9\\xa3\\x06\\xb2\\xe3\\xb5y3\\x8b\\x19\\xce\\x12\\xe6n\\xe6\\xf0\\x84\\xde\\xe89\\xad\\xb4\\xb5\\xa4\\xad\\xfc\\x82\\x00-\\x83\\xca\\x81\\xa4\\xf2%\\xa0\\x82\\xaba\\xdd\\xd7t\\xf4\\x1d\\x8am\\xc4d\\x7f\\xb9\\xbf\\x95\\xe0\\xd7\\xd4/\\4\\xe7\\xb2\\xe0\\xd5,\\xc3\\xc7o\t\\xbb\\x0f2>\\xef\\x0f\\xb9\\xc8\\x1e,\\xd2 k\\x9c\\x9b\\xf2)\\x83\\x8f\\xf8\\x9d7\\xda\\xa8\\xa6\\xed)qd\\xf8.7\\xd7*m\\x9c\\x06\\x81\\x12\\xa0\\xfa\\x0cp\\xefma\\x02\\xc6\\xe5q(\\xdd\\x929\\x94dw\\xf1h\"\\x15\\x0fs\\xd7(\\xdaz\\xba\\xa0\\x0e\\xa7\\xf9\\xea\\xa2\\xb7b\\xc6\\xdbp\\xa7\\xf7t\\xb8\\x1fq\\x9a\\x9f\\xe5q\\xea\\xb8cq8u\\x15\\x89\\xb1\\x92\\x86u\\x82h\\xb1<<s\\xd7`\\x87\\x7fz\\xd3\\x86"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8x?\\xc8:sdm\\xad\\xfd\no4\\xcb9e\\xd2\\xf8\\xd6p\\x94\\x16o\\xa5pit\\xbe\t\\x90g&\\xdd\"\\xfe\\xf5\\\\xc0\\xc4\\xa4t\\x078@l\\x02\\xdc\\x8b'x1\\xc3h\\xb9x\\xb9a\\xaf\\x98hzsyei\\x8b\\xe8\\xf4h?.x\r\\x04!,\\xab\\x85\\xea\\x1ezz\\xea\\x98~\\xc0\\xfdb\\xa3\\x04\\x0b\\xbe-v\\xd9\\x16\\x06n\\xb5\\xf4:\\xfb\\xb0\\xb9@6\\xdd\\xd2\\x95\\xf9u\\x8b\\xd1\\xfck\\xcdg\\xf7t\\xe1v<\\xb1\\xc7\\xe3<#\\xa5\\x80\\x1d\\xaeaq\\xca\\x86j\\xd1\\xfe\\xbc\\xee\\xdax\\xcf\\xc0$t\\xb3\\x18\\x17\\x8d\\x18\\x80\\xfb\\xa5\\xc7l\\x1b\\x9f\\xd0\\x84b\\xc1\\xcd\\xcf\\xda1\\x88 #\\x13\\xba\\xc5\\xdfwh\\xc4gv\\xdc\\xdf\\x91\\xcej\\x10\\xcc\\x18\\x0c\\x19\\xdeoy?\\xd0\\xafp\\x88\\xb9\\x01fm\\xc8\\xfb\tu?\\x93\\xb4\\xc2\\xe4l_\\xd7n\\xe4\\x00\\xd7pz#/\\x88\\x1cm\\x8e\\x00\\xf9r\\xb6\\xda~\\x94%%2<\\xd4p\\xf9z\r@\r\\x1b\\xf6o\\xd3\\x1a"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04cs\\xc4\\xa4\ng\\xbc\\xc6\\x19f$>hd\\xcf\\x87\\xad\\xf2\\x80\\xbbs\\xdb\\x8c\\xe5i\\xa6\\x9b,\\xdf9t\\xb4\\x05\\xe4\\xdc\\x9d#\\x18\\xc9\\xd7*\\xbc\\xc4\\x18\\xda\\x8a\\xa2\\x90%o\\x02\\x97i\\x9e=\\xd5\\xddo\\x02l\\x970\\x80\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xad\\x7fe\\x1e\\xfao\\xb5\\xec1\\x8ed\\xbf\\xf55\\x12\\x90f\\x073\\xb2\\x0c\\x87\\xfc\\x89\\xb9\\x85o^`\"i\\xd9v\\xd3\\xf2\\xe4.\\xec\\x18(t\\xbb \\x87(\\x84\\xc7"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xd1\\xa0\\x93\\xa3\\x1e\\xa4\\x06tz\\xae\\x8c\\xe3\\xf0\\xfa\\xacm\\xa4g\\xfb2b\\xa9\\xd7x\\x9f-d-\\x9a\\x90y(\\x02\\xba7\\xca\\xd1\\x82\\x18jp\\x9e\\xf7\\xdd\\x90/\\xdb\\xdeqt\\xdds\\xe0:f\\x91u\\x89\\xda9\\xde\\xc8\\xcf- $\\x06\\xaa2\\x96\\xdb\\xe0\\xa2jh\\xbe\\x9c\n\\xe8\\xb3f\\xc0iwuz\\x04\\xcd>\\xac\\x84i\\xf7\\xc7z\\x19h4fg\\x17p\\xb0\\xf5b\\xbf3\\xba\\xf7\\x1406o\\x96nx\\x19 a\\x00\\x80\\xf9\\xcf1ia\\xe6z\\x97|\\xa2k\\xc1\\x96z\\xd1\\xef\\xca\\xc5\\xfc\\x07u\\xad\\x1f\\xae\\x88\\xf3 \\$\\xb6\\xf7\\x8fy\\xcc\\x9eo\\x9b\\xb9\\x06\\x1c>\\xf2b\\x11\\x8fyk?\\xa1\\8\\xc1\\x06\\x07\\xb1\\x1f\t\\x9b\\x88\\x85\\xfd\\x18\\xe4l\\xd2\\x80\\xfe\\x12\\xc3 o\\x7f\\x18\\xfam\\x9c\\x104\\xb1\\xafu\\xad&b>\\xc3o\\xacyx\\xb3\\x1d\\x7f\\xa3\\x9d\\x87>$?&\\x03x\\x08\\xe0\\x0b\\x81$\\xa1\\xc1\\xd7b,\\x04\\xb4\\x9b5\\xd2\\xa7\\xf8\\x02\\x01\\x16gm\\xb6 \\x13\\x1f"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xa8^\\xe6!*\\xaf\\xe5\\xc0\\xb4\\xba/\\xd8\\xda\\x8b\\x0e\\xe5#m=\\xa2\\xad\\x11\\x95\\xb3\\x00\\x1f\\xb3ha\t\\xd9\\x0b\\xf1\\xe3\\xaae\\xa7\\x02\\xfa- \\xd1$pti\\x0b\\xf1(\\x17p\\x88\\x19\\x13i\\xa6#/7\\xaa\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`;\\x06)\\xbb\\x9d\\xdb\\x8c\\xe5&\\x13\\xdex_i8\\x88\\xba4\\xe4\n\\xf4\\x8c*wp\\x80\\xa1\\xb8\\xd5\\xc0\\x1a*\\xe0\\x01?t\\xa9\\x8e\n\\x05 ,\\x1d\\xd6\\x85\\x98!"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ti\\x12\\xe0\\xd64\\xd3z\\xec\\xf8\\x93\\xc1\\xcawc\\x8d\\x8b\\x00o\\x1c*z.-\\xa8\\xe3g\\x90\\xb0\\x1fru\\xb4d,x\\x8efs\\x9f\\xd22\\x1d\\x9dzf\\xce:\\xba~\\x0bq^i6\\x9b&p\\xf4\\xe8f\t\\xff7q\\xf0'%\\x85b\\x07\\xa9k`?_\\xf8\\x95\\xdb\\xc8b\\xd3\\xf4\\x9e\\x95\\xb1\\xe5\\x8d@\\xde\\xb5\\xde0`\\x83o\\xe4\\x82\\xc8xr\\x9dte\\xedx\\xd7\\xcb\"*\\xf4\\x07'\\xf0+z\\xd7\\xa7\\xdf\\x04 \\x0bfqt\\xab\\x1a\\x1a\\xa9$\"\\xe0u\\xcc\\x96(\\x87\\x94\\x8b\\xeb\\xdd\\xbeq\\x8a7\\xa6\\x1b\\xd9\\x00\\xb9ycjl\\xcf\\xd5\\xc0hn\\x93\\x8d\\x1c\\xb0l\\x17\\xb9\\xc8\\xb4,.*gs4\\xc7e\\x91\\xaa\\xbe\\x15\\xef\\xc6\\x9f3h\\xa9k\\x1a \\xee\\xe5v\\xd8\\x00`\\x11@khw\\xc2\\xf2\\xe7o1*\\x9dz\\xaem\\xcc-\\x83gr%\\xe3\\xaa\\xa3\\xdd\\p\t\\xa3\\xbc\\x8f\\xd1x\\xce&\\x8c\\xbe\\x17/\\xa7\\xbc`\\xb1+\\x97\\xe3\\xb1\\x0b/\\xbfe\\xa1\\x8f"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xfe\\xc6m\\x83\\xbf\\xd7\\xbc\\x9f8q\\xe8f\\x00\\xd1s\\x1af\\xa5\\x81\\xb1\r\\x0f\n\\x8d,1\\x86\\x91\\b\\xd2\\x88\\xd8^\\xaa\\xae\\xb4\\xb3\\xa7\\xebi\\x16g\\x02s;\\xbe+`y\\xe9\\xc3\\xc0\\x03\\xb7\\xf6\\xa2\\xc0\\xac\\xa3:is\\\\xdf#\\xa6\\xd1\\xfb\\x8d\\xde\\xd3\\xbf\\xfe\\xca2+\\xe2\\xbce\\xbf\\xaez\\xcc\\x88^\\x9eg_\\xb4\\xfe\\xb4\\xa8e\t\\x86\\xacq\\xc4\\xd9\\\\xf0\\x11\\x9ai\\x1b\\xe60\\x94\\xb0\\x004\\x01n\\x1f\\xab\\x12\\x91nboh\\xd3\\xebf\\x8b\\xbf\\xb4\\xcc\\x8co\\xa1'\\x9e(\\x1b:\\xbd\\xc1\r\\x96\\x03jg\\xf8&r\"`-e\\xd7\\xe5\\x13\\xeb\\xa7\\xee\\x93\\xa4\\x98\\x8e\\x85\\xf5\\xb8\\xc0sq\\xbej3f\\xb6\\xb4\\xc8\\xc0\\x1bzh\\x8a\\xcf\\x87\\x18\\xc3>\\xd8\\x1b5\\x82\\xcc\\xf2\\xec*b\\xa2\\xb0\\x8c\\xab\\xf5\\x89\\xb1\\xed\\xd4\\xcf\\xbd\\xa7%\\x95e\\x13\\x99\\x13\\xc6\\xc9<\\xb4\\xb5djae7\\x04\\xa3\\x05\\x8f\\x11z\\x90\\xef\\xe3q\\xce8\\xaa\\xa4e\\xc6\\xbf7\\xf7\\x0f\\x05\\xd4\\xc1\\x9d\\xc2-"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xa0:\\xafpa\\xa4t\\x14\\xd1\\xd9x\\x8a\\x80\\xefs\\x14\\xcb92\\xfe\\x15\\x148\\x9f\\xc7d\\xc4k\\xcb\\xcb\\x1f\\x88+mo\\x89\\x1c\\x80_\\x86\\xe9z\\xd4\\x85u\\x9d\\x90\\xc8\\xe1\\xffsi\\x0b%\\xec\\x14g\\xd9\\xa3\\xb4@\\xf1\\xb5\\xc7\\xb9\\xe1~\\x8b\\xf8\\x17\\xa6\\xee\\xd1l\\x99ob\\x151\\xa1u\\xcb\\xee\\xaf\\x98\\x0f\\x15~\\xf3\\xc5\\xa0\\x81\\xac\\xc7\\x01\\xf0\\xd9\\x9a6\\xb7\\xd7\\xbe\\x01%qd\\x9dqy\\x9c\r0?\"\\xe19\\x9d\\xe4\\xc9\\xe3\\xc9\\x19\\xba\\xdd=\\xb8\\x9em\\x0b\\xdcp\\x06eq\\xe3\\xa3\\xc7\\xd3\\x8b\\xc41\\xc5o\\x80\\xb9\\xbe\\xc6\\x1c\\x18\\xdf<*mu\\xd5\nu\\xfc\\x93\\x9e\\xb6\\xdb\\xcd\\x1d\\xbf)\\xabw\\xd4\\x191 r\\xaev\\xeb*\\xf2\\xa6\\x8en\t\\x89\\x05^\\xd2\\xb2\\x9b5-\\xa0\\xb3\\xe2zal\\xd6\\x18\\xd9e\\x06n1c\\xe8\\xf0b\r\\\\x12\\xcd;\\xfe\\x92\\x07\\xf7um\\x18thm\\xbcu\\xe9\\x04c\\xe7\\xc8\n\\x81\\x18\\x11\\xb8y`\\x10*\\x00x\\x07g\\xe50x"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\x08.\\xe0\\xac\\x85v\\xa5cp\\xd6`\\x83q\\x10\nn(&$-k\\xb6\\xdf\t,\\xd7\\xcc\\x00o\\xf2\\xdegz\\x9f\\x92n\\x0c\\xbenb\\xc7\\xc9\\xbe*\\x1bj\\xcb8e\\x81\\x98t\\x1e\\xf2jd\\xd7m\\xa3\\xc6\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x15\\xb8\\xb0\\xc0s\\xe1\\xee\\xc6e\\xb30\"\\x92\\xab\\xbe\\xdc\\xa1h\\xc1\\x02\\xd5y\\xf4\\x15\\x924\\xf9-\\xc6 \\xd2\\xb0\\xf7\\x93\\xd6\\x1b\\xbc+r\\xec4\\xf3\\xf4\\x8e\\xe7\\xeb\\x1d"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff\\xe5\\\\x01\\x01x\\xc3y1\\xce\\x19\\xe1\\xf4\\xda\\xefn#\\xfb\\xf0\\xb0&\\xb1\\xe4\\x12\\x07=\\xcd\\xa4\\x86\\x04a\\x82\\xcd\\xd7\\x93\\xefb\\xaa\\xef\\xec\r\"w\\xd9r\\x16\\xad>\\x0b\\xfd\\xf0n\\x96\\xab\\xff\\xaa\\xb6bb\\xa7\\xe4\\xe9\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\xfda\\xaf\\xd8\\xc1v*k\\xb1_1?;\\xa8\\xea\\x98\\x84\\xf3\\x8e/\\xd4\\x154\\xd6\\xdc\\x90uqj\\xf1\\xc8\\xe3\\x06\\xf7ku%o\\xab\\xb8\\x07):h\\x12\\xff*"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+cw\\x1c\\xf2\\x1eo\\xe4\\xfe\\xa7\\x03\\xb5\\x84p\\x10'\\xe2\\xea\\xe74\\xc2\\xa7_\\xf1\\x92\\xfe\\x02\\xc5m)hv\\xbe\\x1a%\\xea\n\\xbf\\x16\\xcc\\xf9\\x19c\\x0cz\\xb2\\xcag+-^\\x8d\\x8b\\x0f\\xae\\xe84\\xdf>gn\\xec?m8\\xd8\\xd5v%\\xef\\x91\\x90i\\x89>#\\xca%\\x1f\\xcca\\xad\\x8a\\xba\\xd5p\\xd1>\\x0c%\\x85\\xd1_5\\xeb?\\x03\\xb6\\x8b\\xb8\t\\x14i#)\\xeej\\xed\"\\xfd\\xb2\\xbc\\xd3xg\\x1d\\xa5\\xd0\\x8b\\x10*,)p\\x1b`^\\xa7\\xd9\\xf4y5\\xcc\\xech\\xe8\\x854\\x93t\\x0e\\x8d \\x92\\xdaqm\\x92a\\xbc\\xa5\\xae\\x87\\x1c\\xe5\\xb0\\xbf</\\xc0\\xab\\x06\\x0b:\\xdbi\\x01`\\xa7\\xae\\x12\\xcdb+\\xa7\\xa7\\x10\\x00qh\\xed\\xb2;\\xafu\\xae\\xd0\\xa4=\\x9a\\xda\\xa3s\\x82\\xad\\x113\\xcb\\xe2iy$\\x03h \\x15\\xeaop\\x03i\\x08b\\x1cqbt7?z\\x84\\x16\\x98\\x1a\\x10\"@7\\xfb\\x10#\\xcec\\x99\\xd0\\xbf\\xee\\xc4\\x8b49\\x93\\xc9\\x19j\\x05"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xd0\\xdar\\x0ex\\xc7\\xa7o\\x1b\\x1e\\x84\\xf0\\xba\\xf2\\xdc\r\\xcf|\\x1a\\xc7\\xec\\xedu\\x02\\xa8\\x97\\xa9!zawp+\\\\xff\\x9bm\\xba\\xb5\\xf1\\xa6j&\\x98\\xa4\\xd3\\xa0\\xa4<\\xe6\\xd8\\x82\\x85\\xc5\\xa8\\xf3\\xa2i\\x037\\xf3\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(\\x84\\xa0\\x07\\xeff'\\xbe\\x83\\xd4\\xf9f\\x80\\x8b\\x9ay\\x8bl\\x06`\\x03\\x12 |\\xbc\\xc8\\x07\\xdcf\\xfa=\\x12\\x93@\\xd6hl\\x07\\xcbf\\xb1\\xd5\\xd1\\xf9r\\x11\\x7f"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95a\\xb1`\\x17\\xb8#c\\xd8\\xfa\\xd4\\xf3g\\xd8p\\xc5\\xf55\\xe8k;l&\\xfch\\xcb\\xc0\\xec\\xdcyt\\xcc\\x01r\\xe5\\x07u\\xf8\\x84\\xd3\\xfc\\xd3\\x08`\\xb9(\\x90\\xdf\\x16\\xb7\\xc0d\\xce\\x82\\x0b\\x8a\\x90xu#\\x96a\\xf2tc\\xfc \\xec\\xaa\\xeb\\x95\n\\x0e\\xa9\\xcb2)h\\xa7>l\\xee\\xbe\\x81\\xa6\\x0e\\xc8\\x86\\xb0\\x9a\\x9e\\xcbz\\xab,\\xb3\\x12k\\x16\\xdciu\\x12\\xd6;l`p6\\xc3\\x92\\x1f\\xc6\\x85\\xf1~og+e\\x9a.\\xf6a\\xd31\\xc2\\x83\\xc7l\\xc7\\x19\\xa8\\xf6uz\\xd8\\xad\\x1d\\x9d?\\x92;:n8\\x17^8\\xb4\\xe2\\xe0b\\x86\\xa5\\xd5;\\xbd\\xf9i\\xda\\xb0\\x96u6g<\\x9e\\xf2\\x84lw\\x83s\\xea\\x16y|\\x14\\x02\\xc8\\x963m\\xe2\\xbd\\xfb\\xfdz\\xb70z\\xf9b\\x8f\\x90zp\\xd3\\xef,\\xb6\\xb4\\xb9l\\xdf\\xb9\\xcfz\\x83\\xdac\\x12f\\xa7\\\\x11z5)\\xb76\\xd0g\\x88/w\\x9e_c\\xb7\\xdd\\xed\\xab\\xa7\tuf\\xb2~\\x0bu\\xf3\\xf1x\\xeb|"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\"\\xf3drd\\x1f\\xac\"\\x06es\\xf8\\xdd\\x93lu\\xf4\\x8f\\x19s\\x85\\x16\\x04\\x98#\\xc6\\x1e\\xf6:qn\\x8e\\xa1\\x89\\xed\\x80\\x17\\xd6\\xba|\\x16@\\xf5a\\x81lr\\x19f\\xf1j\"\\x81\\xbeapb\\xd6\\x98\\xecy\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\x11\\xdfk\\xec\\xae\\x93y\\x91m,\\x1c\\x81\rb\\xf8\\x8f\\x8fm\\x10z\\xff\\x9e+\\x02\\xaf\\xb8\\xa9-c\\x10j\\x97m\\x83v\\xd2>\\xba\rd3uj\\x81\\x89"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jqi(\\xf9q\\xcb\\xd9\\xaeh\\xc0$\\xcb\\x80\\x94l|\\xb0\\x87m(\\xcezmv\\xf2b\\xc4u\\xd6p;\\x18i'7al\\xfc\\xba\\x86\\x1bm4\\x1f\\xa8s\\x0c\\x06\\xac\\xce\\xaae\\xf5\\x06\\x91\\xed\\xd5\\xe5\\xd9\\x97x\\xdc\\xaa\\xd5\\x89\\xf3\n\\x97wi\\x82\\xf0\\xe2\\x82h?9\\xf4\\xa7o\\x92\\x80w\\x05\\x87em\\xd0\\xd0\\x00kc\\x17\\xb0n\\xb9\\xbd\\x85\\xe7\\xf0v\\x0e\\x18tq\\x8dv\\xaa\\xa8\\x92\\xe5d\\xb4\\xc5\\x9f\\xdc\\x87y\\x82rry=\\xe5|\\xb1a\\xea\n\\xfcc\\xc8\\xad\\xe6\\xec\\xc7\\xce;\\x1b\\xfe\\xb7h\\x9c\\x11\\xbb\\x12e|\\xa1\\xd07\\xab^\\x87\\xc4\\x97\\xd5\\x0f\\xaf>\\x10\\xd4\\xeep\\xde\\xa4\t\\xefr\\xd3\\x99\\xe4\\x9c0\\x8f\\xf3\\x1a=p\\xc3\\x9b\\x0e\\xa7sxi\\x1d\\xb9\\xc4|!e\\x8c(0*\\x8d,3\\x97\\xc1lu\\xb3\\xb6oae7\"\\xe3w/\\xa4/t\\x98\\x88\\xa4\\xe3\\xd0s\\xa9\\x8d\\xbb\\xd9\\xdb\\x00\\xdd\\xc1v\\xe0n(8ym\\x1f\\x8a\\xdf,\\x18z\\xdf\\xc6\\xc0\\xd8\\x1c"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\x1c8f\\x92\\xd6\\x07\\x9f\\xbb\\xccvd\\x98;\\xdc\\xa6\\x0bj\\xe2\\xa1\\x1c\\xe2\\xa5sl\\x0c\\xc5\\x9a\\xe9\\xd8\\xed5\\xd6\\x9a\\xcb0\\x90'\\xc4\\xb0\\xae'\\\\x1f7\\xdd\\xde\\xeaa\\xaf\\xf15\\xf1vd\\xf6\\xa3\\x1a\\xc0z=\\xe44\\x1c\r\\x95\\xb8t\\x96\\xeb\\xe7r\\xdb\\xb7\\x98u+=on\\xf7\\xe2\n\\x9di\\x9d2\"\\x12\\xda\\xb0\\xdd2\\xa0\\xb9\\xd5o\\xe1?\\xa8u\\x14\\xc8i?\\xe0\\xe8_5\\x0e\\xf3\\xfd\\x1d)\\xaf\\x8d\\xad\\xd1\\xd29\\x1c\\xf1\\xc0\\x00\\xe0\\xf5uw5k3\\x0fzf\\x05kk\\xb9\\xde_'f\\xc0\\xc2v&a*\\xf6&\"pa\\x17\\xd6\\xba\\x01\\x1co\\xe9\\xc7\\xa6sn\\\\xc1z\\xd2\\x942t\\xc6\\xfch\\xe1\\xb2\\xff,\\xea\\x9dp\\xfb\\x92\\x15\\xea\\x98h\\x19@\\xd7\\x01\\x90\\x87b\\xfb\\x9b4\\xfe\\xe6\\x17\\x1a\\x1a\\xa2\\x01\\x10\\x01\\x14\\x8a\\x07\\xf9\\xf3,\\x8b\\xd3f\\x1d/z\\xf8\\x08\\xbe\\xdf\\x11\\xff\\xd7\\xea\nq\\x9a#\\xd0\\x91\\xaa\\xa9\\xf8/1\\xd3\\x0b\\xe83\\xee\\xf3&\\xe0\\xda\\x87\\x81"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2\\xbb\\x8b\\xb51\\xec\\x05\\xf6\\xa1\\x0e\\x0c\\xf1\\xb9\\xfb\\xf1&a\\xd2\\x84\\xcf\\xd8\\xc0%4l$\\xb4uli\\xf6\\xb61\\xb3e\\xe5n\\xc7\\x0e\\x88\\xbft\\x95\\x18\\xd7\\x15\\x1b!$_t\\x0f\\xbdd&u\\xbf\t\\xce\\xdb \\xb1\\xeb\\xf81r\\xf0\\x97\\x7f>\r\\xae\\xe7\\x17i\\xe11\\x06\\x9c\\x85yl\\xc2\\xe1%%>\\xd23+6ai3^\\xe5\\xeaab\\xf0\\xcfgg\\xc9\\x03\\x84\\x07lm\\xa8\\x00-\\x16\\xc2\\x97$\\xed\\x10\\xcf\\xf1\\xc9\\x84\\x1f\\x1b\\xad\\x80\\xf3\\x8b\\xb2j\\x1d\\xf6\\x12b\\x11\\x04\\x92\\x9c\\xd7<\\x10\\x94\\xdb)\\xa0\\xf8\\x033t*\\xe1\\xc3\\xe9\\xa8\\x15z\\x0fl\\x8e\\xe4,\\xb2p\\x0e\\xbb\\xb5h\\xfc\"'\\xacrf\\x89\\xc6\\x9ftz\\x96\\xb7lxk^c\\xa1gu\\xfb\ro<\\xc2\\xc4)\\xb9\t\\x0f\tf;?\\xb5&\\xf08\\xcb#\\x90\\xeax\\x1co\\x96q\\xd9\\xf1\\x16\\x93\\x86\\x13\\xf6\\xdb\\xe8\\xe2i\\x94\\xd7\\x95\\x9bh\\xcb<\\xb3\\x94\\xd6?\\xe2\\x92\\xe9i\\xe2\\x95\\x8d\\xa5o~"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xc11\\x83on&\\x0e5\\xf6k\\xc4\\x83\\x85n\\xc8f\\xc4\\xdbyc\\xb0\\xba\\xb3\\x9a7+j,\\x9d\\xd1\\xe2\\xe8u\\xb4#\\xbc\\xc1\\xc7ounc\\x7f3\\x83lad_\\x00\\xdau\\xff_3\\x1a_\\xba\\xa6e\":\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xe8\"p\\xd9\\x88\\xcah\\xc3\t8\\xdf\\x03z\\xf4y\\xab\\x7f\\xe7\\xfd\\xf7\\x046s\\x83\\x9e\\xad(\\xcb\r\\x06\\x07\\xdc\\x08\\xa8*\\x02\\x9e\\x8a\\xad\\xdc\\xed\\xb8\\x9b\\x8dj\\xb4k"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xde\\xad1\\xc3?i,\\xa67\\xae\\x07\\xa2a\\xf3\\xc6\\xado\\xe6\\xfa\\xb0\\x98;\\x06\\xc2\\xb8\\3t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\xbd\\xc10ej\\xc2\\xaf\\xf5\\xe4\\xa9\\xa8\\xf3@4;\\x07\\8\\x8f\\xbb\\xe6k\\x08\\xfej<\\x93\\xd27\\xcah\\xe6\\x87o\\xc0\\x98ziq\\xd7r\\xb9a\\xf9\\x14\\xd6\\xb7\\xdb2\\xd1k?a\\x8d3\\x93=\\xa1\\x90\\x9ak8\\x81\\x8d\\xd3c\\x83c\\xfe\\xc0\\x8f(p~0p1\\xf2\\x83\\xb6\\xbb\\xd9\\xa5\"\\xfb\\x02v=\\xe1>s\\x83\\xcfhnz\\x83\\xa5\\xf8s\\xd7\\xf0:)\\xb3\\x90\\xfa\\xed\\xdb\\x18*\\xec\\x95\\xc9\\xc63\\xae\\x81^%\\xb0\\xd2\\xad\\xe9$\\xaf\\xf1\\xa6$\\x00m\\x83\\xa86c;zp\\x12\\x13\\x86-\\xe1\\x05\\xf2\\x9f'2&w\t\\x8b\\xdd\\xc1\\xd2\\x92_\\xe6\\xfe5\\x0c\\xec*\\xc1h6\\xb1-\\xa50\\x92l\\xfb\\xc9\\x11<\\x7fe\\x0e\\xd1\\x8d=\\xfd\\x06\\x02\\x88f\\x9c\\xf9v\\x0e\\xcb\\x14\\xa3o\\xb0/\\xc4+\\xd7k\\x8c\\xc2\\xacnp1!ye\\xc8\\x9c\\x97\\xc8\\x88h\\x9c\\\\x8f'x\\x9f\\xad\\x19_\\xff*\\xe6\\x0c\\x8f\\xab\\xa4\\x8c\\xeej\\xc2\\xc0\\xb2\\xdb\\x8b\\xdd9e\\x04"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\x0c\\x86 \\xb0\\\\xe7\n)\\x1c\\x17h.\\xf9\\xc43\\xd0\\xef<\\xa3\\x19\\x83s\\xdf\\xfb)w\\xe9\\x90jqm\\xcd\\xe13ek\\x1e5\\x8408\\xa0\\x11\\xfb\\xd5\\x95.\\xff\\xba\\x8d+e\r\\xb9f\\xa9\\xb9\\x08\\x00\\xa6\\xc3\r\\xd7b\\x8b\\xe6b\\xc3t\\xde\\x13?@\\xf86\\x9b\\xdd\\xe3$i\\xed`\\xce\\x9bhz0\\xfb\\xfa\\x88\\x9d\\xff\re\\xcb\\xaa\\x887\\x94\\xb6nhh\\x94\\xc8m\\xe6\\xf7\\xbei\\x84\\x1e\\x04\\x8f\\xf2\\xd1q$\\x030\\xae\\xdd\\x92\\xc1l\\xdcn\\xad\\xa8\\xcfy\\x8a\\xee\\x8b\\xe9m&\\x8e\\xcb\\xb4\\xe6s+\\xd6\\xdc\\x0fg\\xdb\\x9bn\\x12\\xc6\\xda\\xdc\\xcd\\x06\\xeelwb6\\xe9\\xf7\\xa0\\xac!\\x86\\xe0o_e\\xe4c\\xfc\\xd5\\x04;\\xbc\\x9f\\xdd\r\\xb1\\xe6c\\xcf\\xe9\\xe0\\xa2~\\xc0\\x9c\\xa2\\xfb\\xd9\\xb0)6\\x83\\xe7\\x10oo'5kaw\\x1f4\\x8b\\x85`\\x1es^\\xf7\\xf0:\\xc5\\xf9=\\c\\xbd^\\x9da\\xfc).\\xbd\\xdc\\xfe\\x12`\\x13iv\\xf2\\xf4\\xa6h\\xac\\xd4"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xde0\\xb4t\\x00\\xe4\\x11\\xf1\\xe3\\x93\\xc2\\xe2\\x0bg\\x07\\xe3m\\x04q~\\xcc\n8\\xf9\\xaf.s<c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xde\\xd4\\x1a\\xb5g\\xf9\\xc8'\\x17\\xfd\\xc4\\x8d\\x99o\\xd0\\xdf\\xa7rjp'\"\\x14s|:j\\xbf\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\xaf\\xc4\\x12|mj\\xffz\\xbc\\xd2t\\xe4\\x99\n%\\x15\\xc5\\x93;\\xbd\\xa5\\x82\\xbek\\xe3\\x8e0\\xdb\\xc1\t;sw\\xd6\\xacs`\\xd4lye\\x95\\x04\\x04\\xda9\\xc2\\xc0\\xa2\\xe6\\x89\\xac\\xb4c\\x1fa\\xc6\\xc5\\xc9\\x898p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\xd0\\xc7ede\\xbc,j\\x88\\xf0\\x90c1_\\x83\\xa5\\xba)\\xec\\x8a\\xa6\\xab\\xd2\\x95\\xac\\x17q\\xd4\\xb9!!\\xd9\\xdeku\\x97\\x13'0\\x0cdj\\xa4t\\xe4,\\xea"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\xf5\\x9c\\x81\\xbds\\xdc\\xb95\\xe3a\\xfe-y\\xd0\\x8d\\xfc;vi\\x88@\\xa3d\\xa1\\x00\\x05/\\xb1c-\\x03\\x91\\x96o\\xd8\\xbf\\xcc\\x85\\x00\\xc0\\xfd5o:\\xc7\\x83\\xfc\\xa3c\\x1c\\x18`o\\xf88\\x1ec\\x89|\\x9bsm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\x1d\\x8fa\\x02/|rc\\xb8\\xcd\\x84-d7x\\x97t9\\xc9\\x1a\\xb6\\xc8/z-5q;\\xbfy\\xb9\\xc9`\\x96\\x8c\\xee\\x7f\\xe2t8\\x1e\\xf6\nlf<n"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xde\\x0b\\xb9y:\\x18\\xb9\\x93?\\x05b\\x81\\xe4\\xcc\\x1e\\x12\\x81_o\\xaa\\xbea\\x1d\\xe3c\\xec\\x12\\xb8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\x9e\\xcdcp\\xc3\\x96\\xf2\\x85<\\xbfh\\\\xcd\\xf9wiu\\x1e\\xd1qair\\x12\\x1d\\xe3y\\xfa$0\\x109\\x9bt`>\\xd1\\x8f\\x89khiw~\\xd9\\x15\\x8a\\xc6\\xb7\\x83\\xfaf\\xe4\\x1e\\x08\\x84\\xa5a\\xda\\x98q\\xd5\\xac\\xe9'>/\\x9d\n1\\x10-x\\xad\\xaeq6\\xb1\\xac\\x9b\\xc4e\\x8bfl\\x02b\\xc5\\x0fc\\x85\\x8d\\x9a\\xb7\\xa0-\\x04\\xe58\\x0b\\xd0\\xa8\\xdebz\\xf3$|\\xc6\\xeb\\xacxh\\x81\\x99\\x926\\x13\\x18\\xf6\\xf9$\\xa3\\x89\\xb7\\xffm\\xb2\\\\xeb\\xed\\xa9\\xcff\\xc94.5\\xcb\\x847\\xbcf\\xd3h\\xde\\xbbtq\\x82\\xb4\\xca\nv\\x91\\xf2\\x8a<\\xaf\\x80t?\\xae\\x18\\x82d\\xf6\\xf5b\\xd85\\x80\\\\x19m\\xe8\\xd7v:\\x83(7l\\xf7\\xfd\\xcd\\xeeb\\x91\\xbc\\xf9\\xe7\\x11\\x13\\x94j\\xb0d\\xbe\\x18\\xb6\\xfb \\xa88\\xa3\\xb2\\x84m\\xb1~1\\xfbmr\\xdao\\xf5\\xe5=\\xf3\\xe7\\xef7\\xffd\\x8e4\\xd8\\xbe\\x84_\\x1f\\xab\\xcd%\\xcb\\xb8\\xbc\\xf8\\xa0g\\xdc\\xfa"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3\\xe2\\xe9\\xd2\\x14\\xe2e\\xdf8z.\\xfa#\\x17,\\x1f\\xf4\\x0eu\\x18\\xd3\\xfe\\xfd)\\x80\\xecqqt\\xefz\\xfe\\x9f\r4\\x80z@\\xaa\\x82\\xf9\\x19\\xa2\\xe6#\\xef\\xd4\\x7f=q\\xcd\\xd0:\\xf3p\\xa3\\xea\\x0ce\\xf0\\xa7\\xb7\\xb0g\\xa7\\xde\\xee\\x95\\x90\\x85&\\x89\\xb4|\\xf6\\x97w\\xd1\r\\x87dq\\xe6b\\xb3\\xac\\x0cwn\\x1d9\\xaa%.\\xd9\\xa0\\xf5q\\x99\\x1e\\x89\\xd9\\xc8\\xbf\\xe4\\x9fw\\xf6\\xb0\\xebjgw\\xf32*\\xbe4\\xb7\\xd1kl\\xb0sy\\xe6\\xe8\\xcc\\x8d\\xef\\xed\\xc5j\\xb2x\\xe1\\xa4\\xb9\\xe8\\xa7\\\\xa8\\xfc\\x0e\\xdc\\xb1\\x003\\xc4\\xc9\\xf5\\xe4\\x90s\\xd2l\\x0c\\x05\\xe4\\xedu\t\\x97\"y\\xfb\\x92g!\\xe0\\xf0-p=\t\\xe8\\x9b\"\\xe6zm\\xa0\\xad\\xaa\\xba\\xb6(\\x16>\\xee\\x8d\\x87\\x9d`\\xb1\\x84\\xfdq\\xbc\\x04 \\xd8,9i\\xf0\\xd4kc\\xc2^\\xa6\\xed|\\x12;\\xa5\\x08?:z\\xc2\\x19\\xb1\\x1a\\xe1|\\x01\\x88s\\xea77mt\\x9c\\xd9\\xf3xw\\xd6\\xf3\\xb2;\t\\xa4"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xde\r\\xb4m\\xd3\\x15\\xa3\\xa0j\\xd7a\\x87n\\x9c\\xb3\\x9f\\x96\\x9c\\xe2\\xe8\\xce\\xf1k/\\\\x0f\\xbdl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf!\\xefz\\xf39\\x14~a\\x87\\x02\\x80\\xe5\\xd8\\x05\\x9e\\xc7c,%\\xe5\\xd8\\xe4e\\x96n\\xfb\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\xf7\\x92~\\x91d9\\xad\\xf4\\xc5\r\\x99\\x15\\x80\\x1f\\xd7\\x1f\\xe6\\x1d\\x9cd1o_gp'\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\x8bm\\xf1r)\\x90\\x8d\\xf6\\xce\\x0ed\\xfeq;\\xf9\\xff\\xae\\x8b\\xa4\\x82:7s\\xad\\x1d6\\x82\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\xac\\xb6\\xce\\x06\\x0c\\xba8\\x11\\x88v\\xe9`\\xfas\\xdf\\xca\\xa5\\xe5\\xa6\\xd6\\xdf\\xf6p\\xfc\\xffw&\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\x04\\xe8\\xc8\\x81\\xd0\\xa30eg\\xa4w\\xe7\\x84\\xf2\\xaf\\xbe\\xc2\\x9a\\x8a!\\x10\\xb0\\x8d\\x8d=\\xba~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf.h5\\xfc\\x16q\\xf0\\x15\\x9fx\\\\xb4\\xcf\\x8a\\xf2\\x87\\xf3@l_\\x11e\\x0f\\x81\\x9a4@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\x9b\\x17\\xe6\\xdc\\xd9\\x8b\\xf1qc\\xb7fr\\xe7\\x93\\x7f*(b\\xf1\\x80\\xeec9'\\xbc\n\\xbdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8czb\\x99v\\xf6\\xb660\\xd5\\xcc\\x14x\\xca\\x04e\\xce\\xc8x@k\\x1b2\\\\x90\\x9f\\xf4\\x9d\\x08\\xa8\\x9d\\x8e\\x86\\xdba\\xf3\\xe0\\x89\\x9e\\x0f\\xd8\\xd1\\x1c\\xcb\\xad\\xe1\\xe4 \\xbc\\xd8e\\x9e\\x96_!x\\x17r\\xc7\\x8f\\x14\\xcay5-<\\xa6k\\xcb^ne\\xcd\\x8a\\xaaz\\xf5\\xe6\\x054\\x87\\x84\\xd8s\\xaa\\xa4'\\x08xr\\x11\\\\x8c^a\\xf1\\x05~\\xb2\\xe2wb6\\xdb\\x83\\x13\\xb0qv\\x1f\\xaa\\xd3\\x10j5\\xfb\\xba\\x01\\xa4e\\x08\\x90x\\xb02\\xae\\xb7\\xd9 o&\\xf7r\\xdd\\xa5~\\x10)\\xd7\\x11\\x0b\\x86\\x1c\\xf7\\x1dec\\xd2\\x93\\x89\\x8d\\xd9c\\x84\\xc4n\\xa1\\xa5\\x10\\xd0\\x04\\xf4\\x84d\n\t\\x1ay\\x18\\x84|\\xe1\\x9b\\xc3\\x17\\x10\\xf1x\\xd1\\x1b\\xac\\xe7d\\xd9\\xb3\\xeb\\xa6\\xb4\\x84\\xd4\\xcbw@\\xcds\\x06\\xd5\\x83\\xd5o\\xa6\\x94w_\\xf6\\x8e\\xa9\\xb0l\\x17g\\xbb\\x81zp\\xfd\\xae\\x04\\xee\\x92\\xe1\\xa2\\xd4\\x15\\xd8\\xf3\t`\\xa1\\xe0\\xa7\\x92\\xd4\\xa6\\x8d\\x9f\\x86\\xb1\\xa3\\xdd!ut\\x90a\\x8f\\xd6_\\xe2"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\xa5\\x07\\xb1\\xadw\\xad\\x8e\\xc9\\x01;@f\\xf2\\x8e+\\xff1\\xe8\\x97\\xa3\\xe7|\\x98\\xd1v\\x8d1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xdf\\xdf\\xd6\\xcb\\x11\\xa3\\xe5\\x1cx\\x80\\x1a\\xc9\\xd0\\x16\\xac3s\\x97\\xd3\\x13\\xee\\x05\\xc3s\\xfa\\x1a\\xf5\\x19\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xe1wvm-e\\x98h^\\x9e\\xdb\\x88\\xea\\xfe\\xefl\\xbcn\\x93\\xcfh;\\x00/\\x17\\xc9\\xedz<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdaka\\x93\\xa4/\\xecn\\x18\\xa1\\xb2\\xb2\\x03\\xd7\\x9d\\xa0ksi\\xc0\\xc4\\xfb\\xb52\n\\xdci.\\xda\\x10dwu\\x945,m%%\\x99r\\xda\\x04x\\x930\\x9c\\x04nr7\\xb2\\x96\\xc4~@\\x89(\\xf4g7\\x17\\x9e\\xc8\\xcb\\xa6\\xd3x\\xd1<\\x8e8\\xbdt>\\x82\\xb1\\x19\\xa6\\xfa$\\x90j!\\xe1\\xc2~ \\xdc\\xaa\\xf9\\xed-\\xaa\\xabm\\x1c\\xe7f\\xc6\\xee\\xba\\xd3\\xa3*\\xceb\\x084\\x14s\\x95\\xd3yxc%\\xf0(^\\x12\\x85\\x07\\xdd?fq\\xaa/\\x81i\\xf8\\xbd\\#x\\xb9\\xee'\\x83\\xb8$\\xcd\\x96s\\x8b4\\xa6\\x81\\xd4s\\x08\\x0b\\x80)\\x9d\\xb4iw\\xcdu\\x9c;\\x1e;\\x8er;=`a~\\xf5\\xaatg\\x03\"\\x97\\x1d0\\x0b\\xed\\xef\\xf6f\\xc8\\x98\\x10>\\x1c7l\\x0b \\x95i\\xb0\\x04\\xee\"\\x0c\\x84\\xaf!\\x87tn(\\xf8\\xc6\\x89\\xa1k\\xc7\\xd9\\xd5\\xb0\\x97\\xb5\\x1a\\x99\\xa4\\xaef\\x9e\\x86r\\xd7\\x08\\x15\\xc6fd\\xf5l=_\\xfcr\\x9a\\xffe\\x83,\\x13\\x99"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\x81=j\\xeb\n\\xb5\\x90\\x1br=\n\\xe8g\\x8b\\xc2\\xce\\xf6\\xb9\\xddd#\\xe4\\xe0\\xfd\\x08m\\x919\\xe2fe\\x18s\\xc7\\x8f1-a\\xed/\\x9c\\x9a-\\x9669\\x9c\\xaa6#\\xd0wq\\x00\\x94\\xccf\\xcd\\x0e\\x99\\xf3&xp\\xbcqf\\x9a/\\xdd\\xd3\\xb9\\xed\\xb5t\r\\xd9lk\\x0fqc\\xc1\n\\xf6=90\\xc28g\\xc8lv\\xc7n\\xca\\xaf\\x9e\\x9fcm\\x82w\\xaa_\\xfa\\x0b\\xa1?5\\xb8\\x8b/7\\x86^g\\xff\\x08\\xf2\\xb3\\x9bu\\x80^\\x1cl\\xba\\x89v\\xbc\\xb6\\xb1\\x955\\x99y\\x03c\\xdb\\x12\\xfa\\x96s\\x81\\x89v\\x90\\xf1\\xfb\\x9d\\xba'\\xd8\\xb6\\xb6n\\xe0\\x1b\\x10\\xeb*d&\\xa68\\xea\\xe5\\x99\n\\xe4i\\x97\\xda\\xc2\\x9e$\\xc9\\xed\\x8f\\x1c@8\\xbawl\\x16\\x972c\\xe2-\\xee\\xc9v&\r\\xaa;\\xf3\\xba\\xd1b0\\x1e\\xa2\\xa35\\xe9\\xeei\\\\x12\\xfb\\x06\\xf3\\xd3\\x82z\\x87\\x80\\xc4\\x9a~\\xb3\\xd9k\\xed\\xbf\\xc7s\\x1c\\xc1\\xe2\\xb11\\xb3z\\x12\\xb2\\x96\\xf6\\xa1\\xe1"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad\\x16\\xd5\\x9e^\\x92\\xd3\\xbc\\x9au\\x95=\\xbc\\xc1\\xd2\\x8d\\xc1\\x14bw\\x95\\xa1\\x89\\x05m\\xd9^<u\\x9a\\xcf.\\xaem\\xdc\\xd7d\\xf6u\\x98p\\xf8j'\\xc8\\x87s\\xd2v\\xc0\\x00mv\\xeeh`t\\xe7h5b\\x08\\xa6\\xa6y;\\x9f\\x13\\xd3\\xc4\\xcc\\xf8\\xc3c\\x1503\\xe3<s\\xfb\\xbd\\x8f&l\\x81\\x1e\\xb7\\x06\\xa1\\xc3\\xbaf\\x0bs`s_\\x1c\\xaa\\xe8\\xf57\\xa3\\xb4\\xb6\\xcdy#cu\\xe8w\\xf0f\\x1a&\\x89\\xc0\\x80hw\\xff\\x9b\\xd6\\xb1\\xf7\\xd5\\x1d\\x01\\x17\\xd8\\xef\\x80\\x1aah=\\x15\\xdb\\xc3\\x17\\xe3\\x85\\x8f\\xce\"-\\x81\\x87\\xfe\\xdb4\\x99\\xbf\\x91\\x80\\x8b\\xeb\\xc2\\x1aw\\xd6\\xf3\\x98\\xedrg\\xf9\\x91i\\xf4/\\x044\\xad?y\\xd2\\x95\\xfa/\\x90\\xdb\\xc1\\xdfe\\x85\\xe0\\x02u\\xd1\\xd8v\\xfc\\x1c\\xd6\\xb8\\x08b\\xc6\\x19t\\x99;l2\\xb9\\x0b\\xee\\x0c.\\xbc\\xfd\\x03g\\xfb\\x99\\xe3\\x07\\xddt\\xa3h\\x0ck\\x83\r\\xc9s\\xc4\\x84\"\\x9b2\\xfb\\x87\\x079\\x86\\x10\\xab\\xf6\\x83\\xff"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xe2\\x96n\\xebe%\\xba\\xd9u\\x86\\xaa\\x05k\\x8f\\xdd\\xc7\\xa0\\x8e\\xc6\\x9fd\\x0e\\x17\\x91\\xac\\x1e\\x84;\\xed\\xdc\\x9f\\x9d\\x9c9l\\xe1z\\x16\\xc5cy\\xb0\\xf4\\xcfsq\\xbb\\xce\\xea\\x9f\\x0cu1\\x06|\\xc9~\\xa4\\xd0\\x02\\x98\\xde\\xba@\\xf1m\\xe9mo\\x12#\\xd4\\xa5\\xbbb\\x0e\\xfe\\x9c0a\\xdd\\x81\\xd4d\\x90\\x0e\\x9f\\x89b\\x11|\\x06^y>a\\xba\\xe7ll\\x03?b\\xcf\\xe0r\\xbb\\xaax\\xac;\\x95y9n\\x02\\x95\\x94\\x17c\\xc3\\xf1\\x91\\xc1$\\x8c\\x05\\xa2\\xb4\\xe2\\xc0\\x00\\xa8\\xaes\\x80\\xa4i\\xb9\\xda\\xa6b\\x99\\xfd\"\\x03.\\xa5d\\xe2\\x9e\\x92v\\xba\\xd3\\xd0w\\xb3\\xd91\\xa8\\xa7+\\xa5\\xe2\\xf6i\\xdd#\\xd5x\\xb9\\xdb\\x81\\xc4z`2\\xe0w;\\xb4\\x9eu&\\xdb\\xe9\\xb7p\\xa5x\\xabgy:\\x7f\\xb9\\xdbb6\\x84.b^\\xd7\\xcb\\xf8\\xda\\xa8\\xb5\\xfe\\xaeb\\xd2\\x16\\x05\\xce\\xa4\\x98\\x8c\\xd6-\\xbe\\xdc\\xb6\\xb2l\\xb5#s\\xba\\xe8\\xc1\\xe7\\x0cxezbgk\\xdb\\xd8\\xe6-"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ahq\\xf6\\xdd\\xb6#\\x08#`\\xef\\x0f\\x8fn\\xfb\\x82\\xb0\\xaaz\\x8f\\xc7p\\xa1\\xa7h<\\x93\\x1f\\xb5\\x00\\xc9\\x9e\\xd5\\x84\\xd5\\x1bk*\\xe6\\xe0\\xa4\\x81\\x08b\\xb9\\xda\\xa7\\x88\\xbe$j\\x83\n\\x9e\\xc4\"*xz\\xef\\xa6\\xb2\"\\xfc\\x1d\\xf7\\x85\\xcaa\\xac\\xee\\x93\\xf0\\xc3<\\x1c\\x07\\xb1\\x14\\x98\\xbb\\x86 a\\xb8\\xcb\\xd2wi,l\\x10q\\xf7>om\\xf4\\x8e\\xa9\\x13\\x92@`p\\x84\\xe2\\x15c\\x9e\\xef#\\xae\\xee\\xfd\\xd0\\xff1gx\\xc0\\x08\\x8a\\xa2\\xf2\\xbcx,0\\xbeo\\x0b.\\x7f%\\xd8\\xe3z\\xac\\x9ac\\xcd\\xda\\xcfnn\\x92\\x8ai\\x01\\x9b\\xecw\\x90\\x1b\\x8b`'\\xcao\\x8c.\t\\xed$4\\xea\\x01\\x17\\xce+x\\xd5ct\\x9d\\x1c\\xe2\\x98x\\xd5&\\xf9\\x02\\x8a\\xf7\\x8dc\\x85y\\xd4\\xcfm+\\xfb\\xb5\\x832e#,\\xfd\\x8a~\\xf9a\\x93\\xc2\\xb3\\x072d\\xc0g=9\\x08'w\\xb0\\x86\\x1f*\\xc1\\x94\\xe3\\x98\\x8a\\x04\\xb9n\\xef\\x11\\xf5k\\x10r\\x0e\\xae\\xfd\\x84\\xefq\n\\xbbicmc1\r"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae'\\xa6\\x956\\xdfxpz\\xe56\\xa7^\\xd8\\xe9\\xcc%\\x8bj\\xb2\\xc9\\x9a\\xb8\tg\\x9a0s\\x9d\\xe9d\\xadkv\\x98\\x9d\\xdfi\\x08\\xf9w\\xdf\\xd6\\xe6g\\xd9\\xd4\\xf4kh7\\x9f)j\\xac0\\xaa\\x8b\\x1fq\\xef\\x1c\\x87\\x96u\\x19\\xf5\\x12ze\\x8e\\xf2\\xef)\\xc6\\xd3u\\xa2\\xc7\\x9c\\xfb\\xbf\\x01\\xc0\\xe8s6\\xbd\\xbe\\xcb\\x7fp\\x8f\n\\x08\\x07e\\x9b\\x96\n\\xe9\\xee\\x8ai$\\xbe\\x82w\\x8d\\xbf\\xb1w\\xe3\\xd8\\xa93\\xb7\\xc7z\\xc3\\x0c\\x86\\x92\\xbbgah\\xb7)\\x9e \\x92\\xac\\x1ca\\xfex\\xcd\\x8c\\x89h\\xc4\\xc1\\xd2\\xba\\xe7!|\\xb8\\x16p0x\\xdc\\xc30\\xe9s\\x80\\x19!\\x02lk\\xa52\\xc7\\xfc\\xd1n\\xc0w\\xfc\\xe5\\x85\\x9e\\xd05\\xbc%\\x80\\xf8\\xbef\\x1a\\xa3\\xedj\\xa7`\\x15\\x14\\xff\\xfa9g|\\x13/3\\xde\\xe2\\xeep\\x1d0\\x99\\x0c\\xads*\\xce\\xc9ti0l^\\x14\\xb3\\x97;\\xf8v-:\\xcdy\\x06\\x81\\xcc\\xf4\\xa8\\x07\\x9f6\\x16r\\x9b\\xa9p\\xe4;\\xcf\\x90\\x8f\\xc6\\xd9\\xc9"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4|\\xae\\xb6ck``\\xb1u\\x8b\\x18\\x86\\xc6l\\x06\\x10p\\xd2\\x0c\\xd6\\x99\\xb0+\\xea413\\xc1z\\x8bt_\\xc2z\\\\xe2\\xe6\\xa5\"\\x1atll\\xad\\xb9\\xec\\x07\\xbe\\xac\\xe9\\xb3\\xed\r\\x1b\\xa6\\xa5\\xf8z\\xdf4\\xd1\\xc7:\\xa0\\xb9\\x01\\x9ec\\xb7\\x84\\xf3@\\x10\\xd0)o\\x84@\\xf1\\xe6\\xd1\\xa0\\xe2x5\\x0c\\xe1\\xbd\\x8c\\x16\\x83d\\xcbr\\xce\\xd4\\xdc\\x1f\\xb1\\x85\\xd4\\xca\\xec\\x11\r\\x8d\\xd5.q\\x80\\x86x\\xd3\\x9e&\\x9ah+\\xaa\\xff\\x8b\\xec\\xfa\\xc8\\xe4\\xd9x\\xad\\xbb;\\xd8\\xa2\\xac\\xff)aoq\\xbb\\x9c_\\x07\\xa5\\x8fu\\x8b\\xb0o\\xdb\\xe3\\xf1\\x96\\x8fae\\x1f\\xf8cy\\xeb1\\x0c\t\\xd8\"z\\x1b_\\xe1\\xd8\\xf6\\xa5d\\x8bk6~\\xdehe\\xc2nb\\x99y\\x8cz\\xf2\\x7fmd\\xbaw\\x86\n\\xdd\\x1ah\\x04\\xf7c\\xc8\\x96g\\xdb\\xb3b\r\\xd9\\xa6\\xe6\\x89\\xfc9\\xdb\\xba\\xca\\xcd\\x0b(\\x13u\\x06\\xda\\x192\\xe8s\\x86t\\xa3\\x136\\xd7z!e\\xec\\xde\\xd1\\x9e\\x1b#erj\\xb1m\\xa5"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x11\\x12x\\xbb\\xf7;\\x13z\\x8av|\\xe1#\\xf2\\xf4(\\xd4(9\\x15:pxg\\x95s\\x88:\\xc0\\xea\\xf1\\xc8\\x91\\x14\\xa5\\x85u\\xb1\\xd4\\xa5\\xf3\\x894!^\\x8cv\\xfc\\xa8\\xe7<\\xd0\\x8ai\\x01\\xe8o5\\xf4y\\xc5\\xb6\\xacfu\\xb7\\xf4\\x11\\xe7\\xd2\\xc38z\\xa1\\x15\\xae\\xe3\\x98\\xa6\\x18\\xe3\\xc9%\\x0e\\xd0\\x018t\\x0bs :\\x9c\\x83\\xcfg\\xc2fv\\xedi\\xa8\\x0e\\x8fmz\\xa0\n\\x02@\\xc7\\xc3rxy\\xea2n\\xf1\\xe6\\x800u)#\\x96)\\xae\\xcdx\\xae\\x80\\xa3\\xdbp\\xac\\xb5\\xf5g?\\x0c\\xee\\xaa\\x07^f\\x1f\\xd9\\xf3_\\xaf\\xb2\\x04pu\\x19f<\\xf2\\x070\\xa3\\xf9rnzb=\rj3+\\xc9\\xff\\x99\\xcf\\x03\\xb3(\\xa4 rk9\\xe2\\x8aj.s\\xff\\xc9\\x90t\\x9bu\\xce\\x1c\\xa8y\\xef\\x12\\x02'\\xc2\\xd3\\xd7\\xdc\\xa2\\x1b\\xe7\\x86\\xf6\\xb4r\\xe3\\x98\\xe5z\\x05u\\x97\\xed\\x8e\\xe0sv-\\x1e\\xe1\"8\\xf7$\\xb9\\x10\\x9a\\xb4tz\\xab!h\\x13\\x88"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\x02\\ck\\xb4d\\x00\\xf7k\\xaf\\xea\\xa9\\xcd\\xacc\\xf3)\\x85\\xea\tx\\xed1\\xc8\\xd6\\xc3\\xa3\\xab\\xd5w\\x0c\\xa4j\\xe9\\xc6\\xb0\\x1e\\x10\\xb0\\xd3\\xa5\\x1a4\\xcb\\x8d\\xf46\\xb9\\xe1\\x9d\\xef6y\\x0b:4\\xbef\\xe4\r-s\\x97\\x16o\\x9ei;\\xe9\\xf8`$\\xc1r\\xebj\\xd6\\x83$\\x17\\x99\\x10h\\xcf\\xe9\\xa5\\xca\\xe8\\xea\\xbce\\x8f\\x15\\xd10\\xd6'\\xb7sf(\\xb5\nl\\x9d\\x068\\x8ai\\x01\\xcen\\x92\\xbf\\x86e#\\xbf\\xc3\\x17\\xbfs\\xef\\xeb\\xc2,b\\xba\\xb7u@6\\xa3v`v\\x9e\\x91\\x16\\x01\\xe0q\\xfd\\x15om\\x95b\\xd20\\x020\\xf0\\x83\\x16pp\\xd7o\\x83\\x078\\xe7\\x05\t\\xc2&h(\\xb2\\x84-\\xfb\\x7f\\xb2\\x1b\\x06\\x96y\\x9c\\x9a\\x97\\x1c\\x83\\xc5\\xfd\\xa2\\xfch\\xf2*2\\xd10=\\x88gs5dg\\xf6\\xa5\\xffa\\x84\\xea\\xfb\\x0b\\x0f.gk\\xffj\\xe2\\xf9se7n\\x19\\x17\\xca\\xc1\\xa51\\xc3\\xc2\\xd4\\xcc^\\xc0|eyt'\\xb1\\x7f\\x8f\\x8b\\xb4\\xf3\\x99\\x88\\x12"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8\\xfcn\\x92m=\\x0b\\xec\\x06\\x0b5\\xce\\xa0|\\x11|\\xa1\\xa1n9\\xcd\\x95a\\xee\\x11\\xdd~\\xc0w\\xd20\\xeds\r\rb\\x82\\x80\\xaal\\x0f\\xa8\\x7fb\\xee\\x087vx\\xb0w4\\x9f\\x1e0\\x92\\x80\\x05h25w4\\xab\\xcbx\\xee\\xb6\\xd5\\x87i\\x8c\\xe5\\xa7\\xa3\\xcc\\x99\\xdd\\x91\\xcd\\x1c\\x08r6\\x10\\xb8\\x1e\\xe6\\xea\\x19a\\xc6q\\x83\\xbc\\x9bv\\xb3.\\xc3#\\xcf\\x92+\\xf5\\xb9\\xb6\\xef\\xd6v\\xaec\\x84\\x0e\\x96yxpj\\xa0|\\xa7b&\\x975\\xb3\\x8c:\\x95h\\xd8\\xf6\\xc2\\x9f\\x84\r\\x0b7za\\x86\\xa2\\x03me\\xe2f\\xb3\\x06\\x7f\\xb1\\x16\\x88\\xa1\\x86\\x88\\xc7\\x02\\x192\\x0e\\xb2ct)\\xc3\\xe2<o9\\xdan\\xb1\\xda\\xe9\\x86\\xae\\xcb\\xac\\xd3\\xc2`c\\xe5\\x8c\\x8f2\\x9b\\xc8ua3\\xa9,#\\xff\\x86\\x07\\xb2~\\xdb\\x07\\xd9\\xdex3\\xad\\xfeq\\xfe\\x97\\xce\\x83\\x0f\\xb2:\\xa5\\xbfk\\xd0\\xff\\x81\\x02\\xdbw\\xb70\\xc5\\x8e\\xe2<f2\\xdd\\xdb \\x8f\\x1ac\\x04\\x12\\xbf\\xca\\xf8\\x06\\xc31"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbdz\\xb3q\\x0fk\\xeb\\xfc#\\x14-\\xe3\\xaa\\xe4\\x985\\x08eq\\xfb\"\\xa3\\xb4d\\x86\\xf5\\xfbh2d\\x03b\\x1a\\xd4d\\xd6\\x93\\x97\\x94@5&'/\t+a\\x11\\xf7\\xe3<&\\xcf\\xaa\\x9b\\xff\\xa0\\x8c\\x1e\\\\xaf\n\\xca\\x97\\xb2\\x99\\xac\\xca\r\\xca\\xd9^o\\x01\\xcf\\x81\\xc6~\\xf6\\xc0\\xf4w\\x9eb\\x99\\xba9\\xc0\\xcd\\xf8\\xab\\xd70c\\xa4d\\x14\\xf7\\x91\\xb9\\xe3_\\xcd\\x1b\\xb2m\\x04\\xf3|\\xf0\\xda\\x1fh\\xc1s\\xe6\\x1f\\xbd`\\xfbs\\xcb\\x05\\xaf\\xc9\\x97\\xe4\\xc0\\x08\\xf1\\x02z\\xf1`\\xf9\\x81\\xbc\\x9dx\r\\xe7\\xae\\x1c\\xf4v\\xed\\xc2\\x9dn\\x00\\xa9\\xe3-\\x15\\x15\\xb4\\xa2b\\xe9l\\xc3\\xf4w\\x80\\xd1+\\xee\\x17f\\xe7v\\x1c\\x7f\\xb7\\xb3\\x15ht \\xfa\\xdb\t(\\xa7\\xac8y\\xde\\xf6\\xcf\\xd2\\xb7\\xd8blz\\xba+\\xb0\\x82y\\xbe\\xe2)\\x95g\\xc6\\x90,\\x1e\\x85\\xa7\\xff;cj1i\\xdd\\x98\\x16ah\\x1f\\xcf\\x0en\\x9cs#w\\xd8\\x01\\x08\\xa3\\xe5b\\x9bb\\xdd\\x97$f\\xf9\\xcb\\x95\\x08\\xbc"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d.\tb7\\x0f6\\x13\\x0b\\xf4b\\xd1f2\\xb4\\xcf\\x19\\xa3\\xd1\\x8b\\xe6\\xeft\\x14t\\x8f\\x06,z\\xeb2\\xab\\xaa_?\\xab\\xf6\\xb6z\\xac\\xd2jms\\x9f\\xd7\\xc3\\xe1:\\x8ep\\xd5\\xbde0\\x84\\x9fu\\xc5s\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xddx\\xcem\\x91\\xda\\xd9\\xbf\\xa3\\xb4\\x17\\x9d\\xb3i%\\x1b\\xc06\\xf9\\xf2\\x85\\x07l\\x18\\xbe\\xb0\\xfdo\\xe3\\x9b\\xa8\\x17\\x1f\\xf5~\\xcf\\xa2\\xb5_k\\xff\\x86\\xf5\\xccw\\xff\\xde"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103zd\\x92\\x87\\x84xm\\x1c\\x06\\xbbj\\x1d\\xadc\\xfbx\\x14\\x88\\xd4ia1\\x86b\\xfa2\\x85\\x92\\x8f\\\\xa0\\xb4\\x06i\\xd5\\xf3\\xe5\\xd6m\\x9f\"\\xfa\\xb5\\xc4r\\xfa\\xf887|\\xe1\\x1d\\x19\\xdf\\x8c^\\x13\\xc2\\x1e\\x16\\xa9\\xa5\\x93\\x1b\\xf5\\x912\\xb3\\xf1o?\\x93\\x88\\x06\\x0c\\xbc\\xb5\\xd5v<\\x1bq\\xff1\\xa7|\\x98\\xb3\\xdfw\\x8as4o\\xd8\\xe6q\\xe7\\xef\\xa5k\\x1d\\t\\xa18\\x81\r\\xaa\\xe5n1j\\xe62\\x94\\xfc\\xf7\\xa1\\x88\\xf5\\xd3\\x86b\\x87\\xff\\x12\\x0c\\xa8\\x84d\\xa2)$\\x8c\\x16\\xfcw\\xf4\\xb1c\\xb01a\\xfa\\x0ej\\xb1\\x9e\\xd0\\xde\\x81\\xb6\\xb13\\xeclds.r\\xe2!$\\xdc\\xf0\\x1d\\xf6\\xd9\\x02r\\xf6\\x9c\\xf6\\xa6\\xf7\\xd9\\x8fk\\x96\\xb3y8\\xee\\x06<3\\xc8\\x8a\\xbd;\\xd0*d\\xbb\\xfc9@\\x9c\n\\x93v\\x1e\\x9d_@)c\\xadu8\\x14h\\x06\\xce\\x18\\xc5o\\x8d\\xbatn\\xc7\\xbdp\\xa4\\xaf\\xd7m%?6;\\xd2n\\x91\\x8b4\\xea\\x0fl\\x9c="
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x8bv5\n\\xc8o\\xf6\\xfd\\xec\r\\xd3\\xbb\\xdb\\x1c\\x10\\x0c\\x01\\x06\\xbe\\xb0:e\\x13wt\\xecf\\x9b\\x00$\\xaa\\xdd?h\\xdas?\\x93w\\xfbw\\xcb\\x16m\\xf1\\x11\\x1a=\\x0c\\xbd\\xe1\\x15\\x1f!_\\x17\\xd6\\xd8\\xde\\xca~50\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xdeo\\xb6\\x08\\xf4zif\\xc5\\x96rke\\xc8\\x8aui\\xa7o\\x8a\\x83\\x88u\\x98\\x9ci\\xcb\\x8c\\xbe\\x0e\\x14\\xccy\\x99fu\\x01\\xe9\\xc8\\xf2\\xfcg\\x0b\\xefy\\x1a"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfeb\\x0c\\xcaq~+\\xac\\x8e\\x82\\x98\\xfct\\xa4y\\xcazi\\xfdp3\\xf7c\\xa1\\xb0=0 \\xda\\xda\\xad%ck\\xa3r\\xc5\\xf5\\x86\\xbd\\xebg\\xa6|3\\x85\\x131\\xb8u\\xd3\\x0b.\\x91\\x13\\xd0c\\xf7\\x83\\x9d\\xb1//\\x11k\r/\\xa4b\\xdaf\\xc1\\xac\\x13\\x1d\\xc2r\\x82\\xd1p\\x0e\\x12k0\\xdf\\xf5*\\xe42\\x94\\x0e\\xdb\\xf6\\x12\\x93f\\xb3\\xeav\ne\\x80es\\xaa3\\x84\\xbc\\xb0?\\xcb\\xa5\\xf2sq2u\\x90\\x01\\x9a\\^\\xa8$w\\x10\\x98c\\x05y:\\x99\\x9a\\x98\\xccz\\x07\\xa8\\xe3@\\xb3\\xba\\x12\\x8d\"|\\x1d\\x9d\\xb4\\xa5\\xffo\\xc3\\xdd\\x14e\\x96\\xd0\\xaa\\x85\\xaa\\x1d\\xac\\xf6>\\xa9a\\x82\\xb3<a\\xc8(u\\xb2v\\xbf\\xadm!<d-\\xe67\\xac\\xa6%\\x8a\\x9e\\x01\\xd5\\xc7\\x8e\\xcb$\\xc9\\xad\\xc8|?\\xbb\\x05\\x1a3>s\\xd4yok\\xben\\xe4\\xad\\xe0e\\xf2\\x11\\x82<\\xea\\xd9\\xedn\\x7f\\xf8\\x0fr%\\xfa\\xf9\\x14h\\xce\\xeczh\\xfc\\x8f\\x0f\\xec\\xcc\\x8a\\x88"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xbe\\x05\\x18\"!\\xbcoje\\xc0e!\\xc2\\xbb\\x83\\x86%u4wg\\x85\\x1c/\\x8b\\xc6%\\xf98.\\x91\\x85s\\xad\\xc8uouj\\x0f\\xd2\\xe1\\xea^\\xe9\\x86dh\\xba\\xdd\\xb7a\\xb6\\xbd\\x1e\\xe4n\\x92tfv\r\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0f\\xc3\\xe5\\xff\\x91\\x1a\\xf1a\\x07\\xe1\\xbc\\xc4\\x8e)hvq\\x83p@\\xc8\"\\xc8w\\xe0=\\xb98s-cnb\\xa7t3\\xe6-e\\xac\\xd5$\\x02\\xe2\\xa8\\xc9\\xbf\\xac"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\x8e\\xb6\\xf8\\x85a\\x9b\\x10-`\\x96\\xc6gt\ni\\x1a\\xdf\\xe5l\\xb1c\\x85p\\xaev\\x05,\\x85\\xbc\\xd9\\xdc\\xf8\\x85\\xca\\xdb\\x11v\\xed\\x84\\xab\\x01oa\\xf1\\xf5\\xd28\\x16\\xd1\\x11\\xff\\xbc'\\xfd\\x05\\x80p\\x15\\x05\\xab\\xefo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\xac \\x0b4\\xd8%\\xa7uf\\x02n*g\\x0c\\xff\\x9b\\x95?lp\\x98\\x9ekl\\xbcw#s\\x8e\\xfey\\xc52\\x98\\x1e\\x06\\xd0'\\xabp\\xd5\\x86\\x01\\xe9\\xb8-"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\xef\\x01\\xe8\\xae\\xab\\xe9\\xc8y;`d\\x16\\xdbo\\xc6x\\x95\\xc5\\xab\\x12\\x0c\\xbb+\\x98tf\\x0c\\xc8\\x9c\\xfb\\x80\\xe8eu\\x9e\\x83\\xb68\\x08\\xb4pf?\\xa0\\xa6\\xd6\\x18or7\\x84*r\\xa6>\\xe6\\x16\\xfd\\x08\"\\x0e\\xb5\\x88\\xd5\\xfb\"\\x93\\x9f\\xfcm\\x06\\x81\\xcc\\x8fr|\\xe2g\\xac\\x11q\\x8c\\xff\\xb5\\x8d\\xa0\\xe0\\x10!r\\x03\\x82$u\\xa7\\xc9\\x98:\\xd2\\xdf\\x1cp\\xcb%$\\xff\\x10\\xc8\\xec\\xb7\\xc8\\x05h\\x89\r\\xa4\t\\x9d\\x1a\\x80\\xcf2bl=?\\x94qf\\x00!\\xbc\\xc9ur\\x0fg\\x88\\rm/\\xdf\\xfb\\x11\\xeb:\\x15\\x06xan\\xb9i\\xbf\\x17\\x9a\\x85zf\\xcdl\\x17\t\\xd8d\\xbe9\\xa5<\\xd1o\\xd7 \\x98\\xfa\\x06ce\\x99\\xb72\\xe0$\\xbf\\xc5\\xaab\\xd6|l\\xe2\\x81\\xc5m\\x0f@w\\x92\\xe5y\\x86\\xef\\xfe\\x91\\xee\\xb8\\xe5sl\\xb63\\x9c5\\x86ex\\x0b\\xb2\\x00\\xfa\\xa6\\xb7\\xfe\\x0f\\x96~\\xcb\\xdcq\\xbc7\\xac\\xdcug'\\xb3\\xd8\\xdf5s!u\\x95\\x87\\xd7\\x12"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2\\x1bo\\xf3\\xec\\x82!\\xbd\\xb1\\xe6\\xd5b0\\xf7\\x99\\xd9\\x80\\x9b\\x8fs\\xc96\\x1c\\xba~\t\\x17x~\\x13\\xb3fw\\xe6wp|\\x1at-\\xf6\\\\x15\\x0b#vb&\\x89\\x1e\\xf9:\\x00\\xe78uy%x\\xad\\x07\\xd2\rg\\x15kx\\xbd\\xfa~i\\xfa\\x13\\xce\\xfcj\\xd9\\x80\\xa3\\xfdzu;\\x13gq\\x82\\xa7!\\xf3\\x99\\xe7o\\x8a\\xd4\\x1b\\xb2\\x06\\x9d\\x1dfm\\x92\\xf9r\\xe2\\x85ys\\x7f\t\\xad\\xc4(_zk\\x8en\\xbfb\\xa2\\xb3v\\xe4d)\\xf5x\\x81\\x0e\\xae\\xfa\\xeb\\x01\\x12\\xaa\\x0f1\\x1e\\x1a\\xbf\\x08\\xc2\\xfe\\xe3$\\xd8\\xe3\t\\xcf\\xcar\\x9c\\xd0\\xd8\\xce\\xc6\\xd6k\\x85@\\x9a)p\\xe3\\xeec\\xff\\xcf\\xc3\\xe8\\xdf\\x96(\\xe5\\x9d;2\\xb3,\\xca\\x9fpm\\xd1\\xa3b\\x02\\x07\\xc8\\x0f\\xfb\\xbc\\x08~\\x98\\xa2\\x10\\x87\\xd9\\xe8o\\x1e\\x89\\x89\\x96\\xfb9\\x8a\\x1d<\\xd6\\xae\\x99\\xc3\\x06x\\x84<5\\x84'\\x1cn@q#\\x15y\\xd6\\xa5\\xeb\\x86\\xc5\\xbd\\x0f9\\xc5\\x9e,\\xd4e\\x9a\\xfex2q"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xd8n\\xe9!\\xe91\\x8b:\\xe5\\xc3\\xe5\\x11\n^\\x97\\x8c\\xf7\\xde_\\xf6\\x14l@\\xe4_\\xb1\\x1b\\xf0l\\x11\\xbfgv\\xd7\\xde\\x1a\\xf0#3\\x11\\xcc\\xb8\\xd2\\xb6\\x04ktv\\xea\\x8f\\x11./\\xc4\\xb8\\xcdh;\\x8dg\\xe8\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006+\\xe2\\xef\\x9de\\xafic\\xc6\\xe1)\\xe0uv\\xc5\\xc3\\x81\\x8c\\x9a\\xa1\\xeb\\xcds\t\\xac1os\\xc1\\xe7\\xda\\x1c\\x83\\x93\\x01\\x8f\\xf6q\\x9c\\xf6<\\x95\\x9cs\\xbd\\xea*"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\x96\\x95v\\x0bna%\\x88\\xeeh`py\\x19\\x05\\x08\\x07\\x18\\xe9\\xe0&n\\xb5yc\\x92\\x82\\xe2\\x8c\\xb6a\\xfc\\x17\\xe9\\xf5\\x91=)\\x00owxl\\x19\\xc1a\\x80\\x937x3\\xf0\\x99ty\\x19$\\x14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n\\xef\\xd1\\x91\\xcc\\x0c0w\\xfb\\x11ps1\\xb7i\\x89k\\xc5\\xe5\\xaa\\xea$\\x98\\x88\\xee\\xee\\xf3\\xe0t\\xfb \\xa2\\xdd\\xa1\\xa1\\xcd\\xf1\\xe6h\\xe9or\\xe3\\x1b.!"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045m\\xc3\\x90g\\x8d\\xca\\x8c;\\x0e\\xe3oa\\xd4\\xa6\\x15b\\xea\\x9f\\x88i!\\xb2\\xd7\\x14q\\xcbp\\x18\\xfd2cr\\x1b\\x93m\\x88:\\x03\\xd4\\xae\\x8f\\xbb\\x7f\\xdf\\xd8\\x01\\xb5\\x8a\\x04\\x10\\xee\\x00\\\\xf6\\x02\\x18-s/\\xe6\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2\\xfa\\xf6\\xfa\\xb9\\xbc\\xd1n\\xc8\\xe2*\\xcd\\x7f<\\xb4xh\\xb0\\x84\\x91\\x1c\\x8c\\xa6d\\xcc\\xcbq\\xb6\\xa2\\xd4\\xcc\\xf9\\xaet\\xe8j#0\\x1c\\x91\\xd9+\\xa4\\x1aw"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~_\\xa5gd^\\xfe\\xe8\\xee\\xcf\\xef'\\xc5\\x18\\xaa\\xc2\\xd9\\xd0mr\\xf1\\x97g\\x02\\x85\\xa1\\xbf%\\x16rf\\x07wr\\xdd*z\\xdaqd\\x82\\xa7\\xc9!\\x0b\\xb5\\x80\\xcf|1&\\xe8\\x17\\x92\\x00 \\xf8\\xd2\\x06\tu\"h\\xad<\\xeer\\xd3\\x86\\xce\\x9f\\xd8\\xcb\\xcf\\xe6\\xe7k \\xa0\\x7f\\xc0qou\\x8d\\x16\\xa1\\xa2\\xd7\\xaf\\xd7\\x1c<\\x0e\\xf8!\\x861\\xecu\\xe6\\xa6\\x06h\\x9eql\\xa5\\xd0\\xe9`\\x9c\"\\x17\\xa4\\x12xi\\x84\\xfeq\\xc5p\\xa4\\x01gmp\\x93\\xca\\xbe\\xe3&\\xc6x\\xa7\\x07m\\xd3\\xab\\xe1\\xcc\\xf5\\x1b\\xca\\x89 \\\\x0f\\xb39\\x17\\xc3\\x13.\\x01\\xf4\\xac\\xa5\\xb21l\\xf0\\x88\\xd1\\xb8.\\xea\\xd8\\x84^\\x8d\\xe3\\x0f\\xd3\\x08\n\\xe0\\x07\\x91\\xa2\\x120\\x96\\xa4;\\xd8\\xectw\\x9d\\xc544='\\xd7\\xa2\\xf4\\x8cg\\xbb%\\x91u\\x1ac8\\xb1\\xed\\xed\\xbf\\x85nc\\x8a>p\\x1e\\xa1.\\xbcq\\xd0\\x03\\xda\\x1d\\x12\\xf8)`\\x964@\\xd0!\\x0b\\x1c\\x05\\x8ebe\\xa6\\xefb9\\x93`@\\x8e"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0be\\x0fz\\xf7\\xcc\\xcch\\xdf3\\xcf\\xfc187\\x99e\\xfb7\\x90*\\xcd\\xd5g\\xfa\\xc3a\\x9d1\\xf4\\xa7\\x1e5\\xa3ag#\\x00\\xb3p\\x8d\\\\xb6\\xc61\\xc9-\\xed\\x1a\\xc8\r\\xff\\x06\\xadne\\xf1\\x16a\\xb07`qp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3s\\x84\\xeac\\xa1\\xcaw|\\xd7a\\x19\\x82\\xd4\\x10\\x96x\\xe0\\x12\\xd4\\x0b\\xca\\xf85\\xf5\\x08\\x05\\xf7$\\xda\\x9f\\xd5\\xaf\\x9f\\x88i\\x08\\xb5\\xad\\xbb\\xc1l\\xee~b\\x862\\xb7"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xaep\\xf9\\xf0\\x7f\\xfc\t98\\x05\\x9f\\x06_\\\\x10\\xcau\\x90nh\\xe0\\xd6\\x80\\x9b\\xcf\\x8b\\x07c\\xf4v\\xa9m%\\-\\xc4\t\\xaczbl\\x06\\xaatw\\xb8\\x99\\xe6\\x1a\\x91\\xe3\\x9d\\xaa\\x03\\xa7\\x89\\xf4\\xa6\\xa3\\xc8\\xeai\\x87\\x91\\xbc\\xa0\\xef\\x85\n\\xf0\\xca\\xa3\\x95\\xce#\\xd8$vh\\x8a\\xed\\x04a\\xffi\no\\xce\\xa3\\xf7r\\xbe\\xf6\\xe4y\\x1c\\xc4\\xf5\\x99l\\x0e>\\xfe%\\x95\\x1b\\x96\\x0b\\xe2\\xc8\\\\xe5\\xc1\\x9d\\x84\\xc3\\xc6c\\xdd\\x96\\xd1u\\xfc<5<\\x9b\\x88\\x1ch\\xefjf\\x9el\\x03&\\x0c\\xaa\\xf11\\x10\\xf2gp0\\xfc\\x86\\xc3\\xde\\xacp\\x0b\\xdbj\\xbd\\xdc\\xd22j`l\\x97pab\\x109\\xa8\\x02#\\xfcy\\x86e\\xb7x\\x9e,y<\n\\x96p\\xe2\\x05\\xe7\\xb93\\xf7\\xfe\\xd0\\x8e\\xa1,\\\\xda-\\x88\\\\xf1\\x0c\\xee\\x02\\x86\\xd1\\xfeu\\x11\\xa7~^\\xa4\\x87\\x9e\\xa2\\x0fd\\xfb\\xe3w\\xd57fd\\xbf\\xff&fiuw\\xafm_\\xf7\\xa3\\xca3\\xfbc*\\xbc \\x13"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010oq\\xdc\\x85t\\xe9k\\x99\\x07\\x95>h?\\xac\\x17\\xae\\x9az\\xe0\"\\x82\\xfd\\xd8\\x014e\\xdf\\xd8@\\xaf\\x01g\\xe4\\xb6\\xd6n%\\xb5p\\x07\\xd9\\x19\\xbf_\\xbd\\xf5v\\x9f2\\xc1\\xdat\\xd6\\x85\\xc8uu\\xe0i\\xf6\\x8d~cxav=\\xf1\\xa1\\xcf\\xe0\\xe2\\x8d\\x1cl\\xf0a\\xd9y\\x91=\\x84\\x1ez\\xcbf\n\\xaa\\xd7k\\x19\\x07\\x08\n sdk\\xaa5c%\\x86\\xaf\\x9a\\xec\\xe2\\xcd\\xe9\\xacl\\xdc0!\\x95\\x8eo\\x04\\xad\\xbe\\x9a*\\xf5\\xf0\\x1eu\\xfb\\xb2\\x85`\nl\\xbe\\xf8\\xdc~\\x99k\\xd8\\xeecc\\xcb\\x82\\xaa\\xfd\\xb2\"\\x0f^\\xc2\\xb2\\xde\\x88-\\xb3\\xdd\\xb1\\\\xab0\\xe4\\x13jqx\\xdd\\x07\\x13\\xf5\\x93\\x15\\xb6\\x9d\\xeb\\x8a\\xa8\\xdc\\xa3\\x19\\xa0\\x0e\\xc0\\xde\\x93\\xf2-u\\xd4a\\xb4\\xd4\\xea\\x8a#\\xe1a\\xac\\x83\\x0f\\xeb,\\xc7b1\\xfb\\xca\\x94\\xad\\x8e\"%w\\xe3y7j&\\xe8j\t\\x7fo\\x08\\xa9\\x1bh\\x91\\xcb\\x9b9\\x12\\xa9kp\\xdaa\\xd6j\\x9d\\xc6(dp\\xa9\\xd3i\\xe3<"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xda\\xa5\\xce\\xe3d\\xbf\\xfex\\x1e\\x04\\xfd\\xbc\\xcd\\x08>q\\x12~\\xa3\\x13\\xb9wu\"\\xb2\\x15\\x9egq\\x04'\\xf9\\xb6.\\xe5g\\xd9\\x06\\x7f\\x14\\x01\\x9c\\x1d\\xbfhz\\xfeo4\\xce\\xd3\\xdd$\t\\x07.\\xd0\\x0e\\xa8\\xcb\\x8a\\x8du\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\x19\\x11\\xa3\\x02\\x01\\xa6\\xceh\\x9f\\xef\\x7f\\x84\\x8e\\xcf\\xe4\\xdb4w\\x94\\x899\\x86\\x8d)\\x0ez\\x8b-\\x08\\xf7\\xcb\\xf7?,~8snjqw\\xcd\":\\x94\\xd9"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\xbb'bm\\xd3\\xceh\\xe2\t\\x06\\xc6\\xf7\\xe4uwe\\x07\\xbdiig\\xd6\\x97:\\xa2\\xc2\\xfb\\xc5\\xb1\\xef5q^v\\xed\\x14\\x8b\\xb8\\xbd`\\xa3g\\xb7\\xfc\\xf9p(0\\xd0\\xe0\\xf5\\x07\\x98\\xf9=\\xeb\\x02\\x0c\\x93\\x7f\\x914\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\x80\\xfd\\xf7^\\xdcm\\x84\\x9c\\xc9\\x83\\x98e\\xdex\\xd7\\xc3\\x040\\xcc\\xfc \\x07\rk\\x16\\xda\\xa1\\x15\\x91\\x8d\\xb5o\\xcc!\\x12\\xacb\\xa1`\\x92p\\x8f;\\x8e\\xc3\\x15"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xb82g3\t\\x05\\xf0\\xab1$^\\x8e\\xa5%\\xd8\\xd4#(\\x8d\n\\xfe\\xbcx\\xdc94ss\\xb9\\xfc!\\x8e\\xc5\\x06\\x06 @\\x8do\\xd0e\\xe3h\\x96\\xd5\\x98\\x86w\\x05\\xa6\\x9d\\xd4\\xfa@\\xe6\\x1d\\xec\\xfa\\xff\\x1b\\x1b\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;i\\x99\\x01\\x1b=\\xe0\\x02\\xcd\\xa6\\xad\\xe4\\xd4gt#\\xec\\xfcx\\x19\\xd7\\xe1\\xbeg\\x0c\\x1f\\x889\\xc6z\\xdf\\xec\\xe3|\\x96d@\\x7f\\x01d\\xfa\\x05+\\xccq"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xde\\xae\\xdcxu\\x8b\rt\\xec\\xf0\\xe3i\\x9d\\x92\\x074ku\\xa6zw\\x85h4f\\x9e\\xf7\\x14\\xa4\\xff\\x86l\\xefh-z\\xaf\\xc6\\xb7\\x08\\x8bx\\xf5\\xbc\\xf6\\xb6\\xc9\\xaa\\xe0\\xa8-\\x15\\x8b0j\\xa1s\\x97\\x867\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdc\\xe6\\xb2v\\xbf\\xad>q\\x05\\x83\\xa0?\\x1dsr?\\x87~hbe^\\x1cz\\x8f4\\x0b,bik\\xad\\x98\"\\xb2o.\\xc8\\xaa\\xe8de\t\\xdb\\x19\\x13\\xefs"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x7f\\xdczz\\&\\xc38\\x06\\xfe8\\xc3\\xa5\\xa2 \\x98\\x0f\\x0fr\\xbcn\\x0e\\x8b\\xdc,\\xbfx?\\x8f\\x12\\x8f\\x7f\\x9d\\xe8\\xc2r\\x8c1\\xacb\\xfdpe\\x11kr\\xcf\\x15\\x96\\xc3+\\xc6l(\\x92-~\\xc2a\\xc0\\xcb\\xd1\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\x96\"\\xe9\\xbdbbt\\xc6\\x9f\\x18\\xfc\\x92\\x99i\\x0c\\x18v\r\\xda1\\xeb\\xd5i\\xed\\xac\\x1f(\\xfd\n8\\xb7\\x13\\xae\\x01s)/l:\\xf7\\xf8\\xb5\\x1cd\\x80\\xc0\\x89"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0ec\\x8f'tp\\xb6-i\\x9c!\\xc8l\\x84i?.\\x05\\xfeho\\xdf\\xa2\\x8b\\xb5e@\\xd7\\xf7\\xe5jl\\x10\\xfb\\xaa\\xa8\\x04h\\xfevas\\x0ew\\xdbgg\\xfao\\xb6\\x196\\xeb\\x0f+x\\x85\\x95\\xa6y\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3\\x92u\\x8e\\xaau\\x10\\xf6\\x91\\x19\\xdd\\xb7\\xd7\\x05\\xedy\\xc7\\x84\\xed\\xd2\"\\x14\\x17tdp\\xe8;f\\xb9\\xf88b\\x8dp4\\xae\\xb2\\xd3\\xa2\\xaf\\x10\\x03@1\\x90\\xfd"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x1a\\xed\\xa7nz\\xa9\\xd9\\xd5\\x0fx-\\x80\\xc8\\xca\\xe8j\\x888\\xf6t\\x11p+ga*_\\x0f.\\xa6~\\xcf\\xbb\\xf8\\xe5\\xb0\\xde\\xaf\\xccq\\xa3\\x0b\\x98\\xa4\\xd7p\\xa3\\xf6\\x0fn\\x88\\x04\\xd2\\xe9\\xc1w\n\\xf9\\xb4f\\xeb\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\xb5t8\\xfa\\xbct\\xa06\\x12o\\x99\\xf4\\xe5\\xbbypt\\b\\x97\\xc8\\xc1x\\x9c\t88e\\xf5\\xf0\\xac\\xfe\\xa1z<\\xb79\\x98\\x8c\\x8f5\\xed\\x0f9h\\x9c\\x81"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xe26`q6\\xa6@ye\\xba\\x8b/w\\xf1\\x93fs-\\x8e\\xd7\\x08q\\xc8\\xdc<\\x89oh&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xe5\\xc3\\xd8f\\x1a\\x1f\\x7f\\xfd\\xeb\\xc9\\xff\\xf5\\x99\\xb5g\\xda\\xe4\\x12|,k?\\xe2\\x0ci\\x90\\xe4\\x9fv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xe4\\xb1\\x1b\\x88\\x7f\\xb5\\xe1\\xb5\t\\x02\\xfd>\\xab\\xf0\\x08\\xb9\\xd8c\\x07\\x95\\xf9f\\x7f\\xf2z1pb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\xd0o\\x1d\\x16\\xb0^h&\\xb1\\x12<&h\\xf4\\x1e&m7@\\xf0;\\xc0\\xf2k\\xd2\\xd0\\x9d\\x9dg\\xd5q\\xa8(rc\\xbd\\xcak\\x1c\\xe4c\\x1d\\xf4ks\r\\x95\\xa5\\xf4\\x06\\xc2\\xe3\\x18\\xecuee?\\x13\\x82\\xe5\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xb7;u\\xe7\\x9cx \\x7f\\xfb\\xafl\\xa9\\xc4j\\xd25\\xa4\n\\xbd#*/\\xbd\\xbbc\\xefezj\\xfd\\xa2_n!\\xael\\x99\\x1d\\xeb\\x80e\\x15\\xf2\\xf6/\\xedc"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04yfx\\xdd\\x84\\xea\\xe4\\xf1\\x01\\xdehs\\x95\\xf5\\xce\\xe6\\x00\\xfdy~\\x11\\xe6p\\xab\t\\x8b\\xb9\\xf4\\xfbt\\xf2\t\\x9eb\\xd9\\x99\\xd2f\\\\xafyg\\xc5p\\x9c\\xeeh\\x94\\x1a\\xe5g\\x01\\x1a\\xde\\x13\\xd5\\x94\\x8b\\xbe\\xc3\\x82g\\x8f\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\x06`\\xcb8\\xfa\\xd6\\x96\\xae\\xd7g\\xe4\\xc2a\\xf1\\xc0\\x85\\x18\\xd0hbz\\xb9\\x10\\xcdxx\\x8eh\\x17cf\\xbe7\\xa4\\xff v\\x0e\\x83\\xef\\x9b\\x9btm\\xf1sl"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xcc\\xe5\\x1b>\\x99.\\x8b\\xcc\\xcc\\x8be\\x998\\xc3\\x02\\xe4#\\x119ltd\\x0f\\x97\\x9b\\x1a<\\xd0\\x07\\xab\\x7fu\\x11q\\xcb\\xa6j\\x03\\x9aj\\xde\\x80\t\\xa7\\x8d`\\xf7\\xd5\\xd2\\x8b\\xab`8f/\\x9a\\xce\\xff\\x9f\\xdeqo\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\xd1\\x02\\x196r\\xda\\x16(\\x99\\xbc\tb\\xe5^!\\x9f\\x14\\xe9\\x111y\\x00\\xf5b,\\xa6l\\xb8\\xc2\\x7fm_\\xe8\\x97%\\xfbda\"\\xf0\\xea\\x8d\\x1a\\xa2\\x08 x"
  677.  
  678.  
  679. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00$j\\x0c\\xeb\\x83h\\xba+\\x05\\xf1q&\\xab7m\\xa8g\\x1a\\x10\\xc2nc\\xa3z\\xa5$\\xef\\xd9i^f\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  680.  
  681.  
  682. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xf1!`t\\xd4\\x1e<g&\\x8b\\xa5\\xa2^\\xe0\\x14\\xbd\\xd4\\xe4\r\\x95\\xd4\\xcex\\xfa\\x8a\\xb2l\\xa5b\\xbc\\x94=\\xfdx\\xc0f\\xc1\\x9a\\x93\\x9f\\xaa!\\xb8m$\\xdb\\xe2\\x9c\\xfa\\xdct\\xfd4\\xa5j\t\\x08\\x0e\\xf6\\xad^kb=\\xb6\\xdfl\\x180l\\x85\\x96\\xfa\\x9a\\xe6~\\x9a~\\xde\r\\x9f\\x8c\\xd1\\xf6\\xd12\\xbc\\xe2\n\\xda\\x87\\x13\\xfaa\\xacn|q\\x9d\\xe2o\\x0b\\xe1v^l\\xa8\\xa5q\\x14\\xe1\\x06\\xfdu\\x8e\\xf4v\\x95e3\\xe68\n\\xb2\\x90\\xd4\\xca\\xc3\\f\\x9cx\\x08\\xc8\\xe1\\xceq\\x96|^\\x19hums|\\x80\\xec\\x8f.\\x86\\xac,5\\x94f\\xf05ci\\xb7\\x052\\x88\\x16\"t\\xc0uh\\xd5\\xdd4\\xbdd9`\\x0c\\xech\\x01j\\xd7g\\x8d+\\x13c\\x88\\xff/t\\xeb\\xcc\\xc9'2\\x0b\\xa0\\xa8\\x87\\x13cz\\xde7\\xcc9a\\xac\\x08\\xa4\\xd3\\xab>\\xb5\\x81j\\xb2\\xae\\x85o\\xb0\\xc0\\x00\\x95\\x0f\\xd7\\x08k\\xd91\t\\xf4?\\x0e\\xbd\\xff\\xe4o\\x17\\xa5="
  683.  
  684.  
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)\\xc0\\xbaw=t\\xdbz\\xf41u)\\xf5z\\xf9q\\xb6/\\xae/vw_\\xac\\x8e\\x81=n\\x03p\\xb9\\xea\\xf4\\xf0\\x12\\x0c\\xec\\xf5ja\\xb6\\x9f\\xb0a\\x7f\\xc7i\\x86\\xdf/g\\xc6\\xa0*@\\xabn\\x17\\xe9)bt?\\xae\\xb8\\xb5\\xb3\\xf0\\xd0\\xd7\\x8coxp\\x85\\xfb\\xb5#\\x88x\\xbd7>\\xec\\xb6\\x03\\x9d\\xd1\\xa2\\xb9\\x949v\\x982\\x17\\xa9\\xf4\\x16n\\x0c`_\\x93g2\\xbd9\\x8f\\xf8\\x8c\\x1eps\\xd9'<\\x9e\\of\\xa7\\x95\\xcf\\xe9&.n\\xe03z\\x9ag\\xab\\x96\\xc1\\xee\\xd8n\\x89\\xe9\\x062\\xd3\\x8ai\\xff\\xc4\t\\xbb\\x9d\\x1ck\\xd6q\\xdc\\xe2\\x03\\xb9\\x02\\xf6\\x9a\\xcd1\\xd8\\x99\\x14\\x0c\\x05\\xd0\\x8f\\xe0\\x957\\xa2<\\x10\\x99\\x80f\\x7f\\xf70\\xfa;j;\\x07\\x10\\x13\\x05\\xbe\\xd2^\\xaff'\\xc9\\xa7\n\\x1d\\xaa7\\xdd\\x0c\\xf3\\x98\\x9c\\x1d\\x87\\x89p\\xc0\\xae\\x85\\xd4&\\x84;is\\xdd\\x8f\\x90\\x83\\xce\\x91\\xa9%,gk\"\\xb37=0\\xad\\xb5$2vo7\\xd5\\xae"
  686.  
  687.  
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b/\\xcbzk\\xbb\\xed\\x13\\x94f9@\\x95\\xae\\x13\\x86\\xddq\\xd1n\\x1e\\xb9\\xa7d\\x02\n\\x8a,\n\\xd2'hp -\\xc4z\\xd0\\xda\\xb9iq\\x9d\\x97\\xf3x*c\\0\\xb4$\\x96(\\x82\\xe0rn\\x96\\x97\\x08\\xcco\\x81\\xfe\\xed\\x10f\\x9e\\xb1\\xb0z\\xbfb=\\x15>\\x97\\x9c\\xec\\xf3\\x1f\\x85\\xbe\\xc0`\\xa4h\\x9d\\x02.\\xbe23t*,\\xa9\\xb8\\xd4\\x83t\\xfd\\xf1t\\xa7k\\xea\\xd1\\x06=\\x91\\xfb\\xdf\\xcb\\xf4u\\xbfm\\xb4\\xdb\\x1e\\x03\\xba\\x06\\x19\\xb7\\xf1?\\xa5\\xac\\xcd\\x8e=\\xba\\xa41\\x17s&w6\\xd2-/\\xde|t\\xfb\\xfb\\xe6\\x97\\xaf\\xd52z\\x90\\xa9o\\xce@\\xd0\\xd6\\xdcn\\x99\\xdb\\xd2\\xea,\\xe0^x\\xa8\\x13\\x91\\xd4\\x82\\x1e\\x81\\xe2\"$\\xd2\\x1e\\x82v\\x9f1\\x7f?\\x91\\x99\\xa6\\xd3\\xd2m_)|\\xc0i\\xfe(\\xba\\xaf= k#\\xdb`fg\n\\x93\\x1a\\x90#\\xfff/\\x97\\xc1#sz\\xd5\\xf8~\\xd7\\xfc\\x11j+\\xa9\\xb1\\xa2k\\x89s\\xc1\\xf8\\xd03w\\xa4"
  689.  
  690.  
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ur\\xa1\\x00c\\x15\\xe3\\xfcc\\x98\\x84\\xe6\\xee=\\xc2nm\\xe7x\\x17\\xb7\\x06\\x9b\\xcfox\\xc8\\xbf\\x06\\x10\\x0c\\xc3\\x95d5\\x9a\\x84|\\xed\\xb1p\\xc5\\xadm\\x7f\\xf4\\xde\\xdaz\\x05n<xm\\x94\\xcf\\x8e\\xcbl&_b\\xa0\\xbb\\xa0\\xbc\\x13\\xa0\\x17a\\x85\\xf5\\xc7\\xd4\\x96e\\xf3\\xfbw\\xbagx\\x10\\x8a8\\xdc\\x13z\\xa9#>\\x86j_\\x03g=\\xd8+\\x93 \\xb4c\\xd35\\xa4\\xd44>\\xaa-\\x02\\xcei\\xdc\\xe8\\xae\"\\xcd\\x14z\\x88\\xd1\\x12\\x10\\xac\\xde\tw\\x1cs\\xa0\\xd9\\xe6\\xd3\\xa9l\\xbe\\xe9b|\\xc9&\\xa3\rnm\\x98\\x9awjg`m?\\xe9\\xde:\\xee\\xd8\\xde\\xc8\\xb2\\x05\\x19\\xc3bt\\xc7\\xf4\\xaf\\x0e\\x7fn\\x97w\\x01ak\\x19\\x82\\xb8e\\xa4\\x06\\x00\\xe9\\xa3\\xb5@\\x7f\\x16\\x97\\xa0\\xe7-w\\xc4\\xec\\x9aa \\xb0\\x97\\x1dgd\\xcbr'\\xa1 \\x9c\\xf4e\\x04x\\xf8\\xee\\x12\"\\xf5\\xef\\x81y\\xe8\\xed\\x17\\x1d5\\xa1u\\x01\\x16\\x11\\x81\\xf8y\\xba\\x8fea\\xa0\\x1a\\xb9<"
  692.  
  693.  
  694. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\xb2\\xf1\\xca)9\\xb7?\\xa2\\xd1?q\\\r\\x81\\xc9/\\x9d(\\xab:\\x85\\xe3zh\\xecn\\xad\\x1a\\xe2q\\x10\\x01\\x0c$#\\x1d~k\\x91\\\\xe6:\r\\xc5\\xfbd\\xe3\\xa2\\x87\\x82j\\xfd\\xf1\\x0f\\xde\\xdd\\xfc\\xf16a\\x14\\xab\\xf5`\\xc7\\xbc&y%\\xf0w\\xe7\\x07k\\x8a\\xdb\\x99\\xe3\\x05\\xa3\\x1e\\xf6c\\x01\\x9c\r\\xf8!\\xf9\\xb6\\xdb\\x959v\\xfb\\xf9j\\x08\\x8ct\\xf4\\x93q\\xdeav\\x99\\xe6,zb\\xe8\\xea\\x9c\\x91?\\xc9i\\xe70\\x84\\xc6\\xca\\xdf\\xa6\\x8d\\xfa%;\\x13e\\x12n\\xb0\\xa3\\x9f\\x1a\\x8e\rd\\x14,\\x1b\\x9c\\xa6\\xf7~\t\\xa9\\x1ae\\xf7z\\xa6z`\\xf2\\x8f\\xbe\\x1a:\\x87\tc\\x12rc\\xc3\\xfa\\xaa\\xccx\\xc1\\xa6\\xba&\\xa727\\xde\\xdb5\\xfb6=\\x0cd\\x1fy\\x05\\xd3\\xf3i\\xd0\\xb30\\x98\\xa4\\xe8\\x00\\xfb\\x00\\xa5\\xeb^u\\xdbu\\xb1t\\xec\\xb3\\x05\\xd0\\xbc\t/\\x9d\\xc7\\xb3o\\xb1c\\xc5\\xfe\\x82z\\x97\\x98;\rb\\xc0\\xde\\xe0x\\xcf\\xc8\\xa7\\x9am/\\xd3r*\\xbdas\\xc0"
  695.  
  696.  
  697. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:`\n\\x00\\xe8\\x1d\\x99\\xac\\x01\\x11\\xddb\\xcf\\xf3\\xeb\\x04\\xf2\\xaf\\xc1i\n\\xadn\\xf4\\xed\\xae\\x83\\x9b\\xe3\\xdd\\xa9\\xfe\\xb6\\xf5\\x19:\\xa1\\xaabb\\xf1\\xa29d\\xe5\\xd3us\\x84\\x13\\x94p*\\xf4n\\x07\\x93_`_h)\\xc5\\x8c\\x01%\\xe3\\xfb\\xb3\\x85\\xec\\xfeu\\xa0f\\xbcn\\x96s\\xec%k\\xc7\\xabas\\x8a\\xa9\\xfa_<\\x04w\\xc7@vw,\\x8f\\xb9:\\xd0\\xe9\\xeb\\xe5\\xbf\\x9d\\xe9\\xcbw\\xe7\\x8e\\x94\\xfb\\xf4\n\\xc8;\\xd8\\x06\\x80\\x19e\\xc1q\\x82n\\x1a2.\\xcf\\xbc\\x9a\\xb7\\\\xfc!\\x01\\xeb\\xd8\\x94\\xdcc\\xdc# @\\xdd\\x88\\xc1d%\\x94\\x94\\xcf\\xb02\\x93\\xf5aj8\\x1f\\xcc\\x91\\xddk;4\\x96\\x12\\xa8m\\x90d\\xdd#`\\x9d\\xbc\\x83\\xce\\xc4\\xebk\\xe65\\xb2\\x96?l\\x1a\\x80\\x06fg\\x8d\\xd2\\xa1\\xfa\"e\\x14\\xb2\\xea\n\\x01\\x97e\\xe8\\xc5\\xeb@>\\xb2k_ceo\\xe2,\\x0b\\xf2\\x87\\x97\\xdf3h\\xcd\\x87\\xea\\xb3\\xb3\\xcc~\\xc8p\\xa7\\xcd\\xd0\\xa9n\\x13|\\xa0\\xf5\\x0c\\xbc"
  698.  
  699.  
  700. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa5-&\\x19'\\xe7>\\x19\\xf5|\\x9a\\xfa\\x96\\xed\\x90\\x87xs\\xed\\x0e\\xef\\xfa\\xfe\\xdbf$w\\xb3dzq\\xf2\\xc1|\\xf3\\xcc\\xa0o\\xfb\\xb6\\xde\\xdc.%\\xfe*4\\xd4\\xae5\\xaf\\x85w\\x91\\xc8\\xdb\\\\x06\\xf3mw/\\xdf\\xbat\\x86j\\x82\\x85b 'l\\x94\\x8d\\xf1g\\xe9\\xd8\\xbav\\x88\\xac\\x0e\\xa6\\x1a\\xadmf\\xc5\\xe1 \\xba>\\x05\\x8d!\\x14\\xed\\x9f\"$|\\x1aj\\x86\\xb4\\xcc\\xd0\\x01?\\x16\\xd63\\xf0\\x92\\xb2\\xb1pkl\\x98\\x89j,\\xd9wn\\xcd\\xa0\\xa5%\\xdb\\x8cu\\x93*\\xc2\\xa9\\x88~%\\x0c!\\xc0gwd\\xa1\\xbb*\\x8c;f+\\x06\\xf0\\xd8\\x0f\\x02\\xd1\\x95\\x9c%\\xc6\\x97\\xeb\\xe7\\x03\\x8f\\x11\\x00\\x92\\xbc+g\\x97\\xaf\\xa7%\\xda\\xcc?\\xb6\\x88\\xc0\\x04w\\xb8\\xb4/6p\\xf6\\x85\\xbe\\x8e\\xb0\\xc4\\xea\\xc4\\x10\\x92\\x1b\\xa9v/\\xc2\\x98\\x81\\x90z\r,9\\x92\\x1b\\xda\\xbb^r\\xc0vu\\x9c\\xebi\\xe3r\\x10\\x8d\\x9a\\xd2\\xac\\x1dqt\\x0e\\x9e\\x16%6\\xc3\\xbc\\xfc\\xa5"
  701.  
  702.  
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xe3\\xfb\\x12>6\\xbc\\xf9\\xae\\xe4\\xdd\\xadc\\xb6\\xfc\\x88\\xadyy\\x99;\\xc3/g&\\xef\\xcf\\xaa\\xf6\\xbb\\xcc\\x17z\\xc8\\x8f,\\x00\\xce\\x8c\\xdfs\\xd6\\xeank\\xabb\\xbd\\xf5\\x8e\\xeab\\xbah<\rk\\x15\\x8f2b\\xc0\\x14\\x1c\\xeb\\xebk\\x8c\\xe5\\xed>\\x88gy\\x17\\xbfj\\xf4\\x11=2\\xbd\\xd8\\xb6\\xcf\\xfbu\\x9f\\xd2\\xb3f\\xc4\\xd1\\xc7\\x9ab\\xfe\\x80\\x92a)\\xcdn\\x10*\\xfc\\xe4\\xf4\\xe4\\x80\n\\x8b$\\\\xc2\\xef\\xae\\xd1\\x93\\x01\\xf4\\xce\\xca\\xe2=\\x14\\xa2\\xef|^\\x1a\\xda\\x8f\\xc4\\xd0\\x0bvk\\xdc\\xe4\\xf7qr \\xe8\\x0e\\xd8i\\xdb\\x01\\xc06\\x1f\\xf2\\xb7\\x84\\xd3\\xcdk\\x93\\xa3\\xa6\\xf9\\xb6\\x12\\xaa\\x9b\\xf7\\xce\\xb7gk\\x14\\xeb4\\xf2\\x08\\x05\\xd1\\x1f\\xf0\\xa7y\\xbec\\xea\\x1b4\\xeaztzx6\\x89\\x16\\xc7\\x95\\xd5\\xe3\\xb7g\\x97n\\x15\\xb2\\x1b\"lyw\\xee\\x1avow\\xcb@!\\xfd\\xe3\\x999\\xc0<#2u~\\xdbj\\xeb\\x05x \\x94\\xeffjyy\\xad!\\x87\\xf6\\xac"
  704.  
  705.  
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xe6(\\x1f\\x16v\\xa9\r\\x1b\\x9a)\\x95a\\x16\\x85\\x13\\xde\\xc1\\xd3\\xa2b\\xef\\x90z\\xb8\r\r\\xb2p\\xa5i\\xa4c\\xf5\\xf7\\xb2\\xefe\\x12\\xb4\\xa2\\x94p\\xbb\\xab!~\\x91h\\xb3t\\x88\\x03\\xb7\\xb9\\xe8 i\\xba\\xc2\\x08t\\x02l\\xae\\xb6\\xae\\xef\\x19\\xf8\\x0f\\x87\\xc9\\x14q\\x0e\\xf2\\xc0u\\xcd\\xfd\\xf5\\xfd\\xb28\\xf7o\\x97\\x96\\xfa^\\x1cg;\\xaax>\\xbe`\\x1f\\x0f/\\xe2\\xb7\\x17c\\xb1<\\x03w\\xfd\\x9et\\xa8\\x8e\\x9e:\\xf3\\xcd\\xa3\\x1b&\\x9ba\\x1br\\xbd\\xee\\xa1\\xa1c\\xb7\\xb4\\x01\\x1fpv\\x95\\xab\\x1be`5\\xeei\r\\x90t7\\x1a\\x82w\\x1c\\xa3\\x87\\xb1\\x9ay\\x92\\x82\\x00t\\xb4\\x10\\xfe\\x9es\\xa1l\\xb8\\xbcy\\x81\\x88\\xd7\\xf8\"\\x15m\\x80n\\x03zl4\\x00\\x12\\xe4n\\xb6*h$\\xce\\xb1mwxf\\x8ck\\xe46\\xa1\\xe5v\\xa6\\xf8\\xbd\\xc6\\x01\\xd87\n\\xe9+6%\\x0f9\\xcf\\xd7\\x81\\xf7\\xac\\xc5\\xd2\\xd2\\xa8^hr\\x1d4:\\xb5\\xe1<\\xdd\\xff\\xa4\\xc0x\\xe2\\x86\\xfb"
  707.  
  708.  
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x1d\\xa2\\x87\\xce\\xc1\\x85>\\xef\\xeae*\\xdam\\xc9\\xab\\xbd?\\x1f\\xd2a\\xeb_\\xf6\\xbb&\\x84\\x92lh\\xed!\\x01jo1\\xba\\xa92\\xf4'\\x80\\x10\\x11\\x8b\\xd5\\x0ea\\xac\\xf6b\\xc8\n\\x9bu\\x02\\x12\\x8d\\x84\\x9a2\\x9b\\xb5g\\xc8~\\xc6x\\x92\n\\xd9z\\xb5\\x85\\x12|\\xf8>j\"\\xdfy\\xcb\\xaf7\\xb1\\xa3\\xe4v-\\xc5\\xa1\\xb0\\xad\\xc5\\x07\\x8c\\xebn\\xe8:\\x0c\\xb0\\xdf/s7\\xeb\\xbf\\xa9s\\xfeb#6\\x1c`!+%\\x0f\\x1dk\\xd5y\\x89^\\x1f\\xe42#?\\xc7b\\x8d\\x00\\x8d\\xab\\xc4we\\xf3\\xd02\\x88^\\xd9\\xeb8l\\x14\\xf6 \\x1f\\xcf/\\xfb\\xc1\\x85\\xd8r\\x8a\\x8d\\xc8;a=w@\\xd4\\xbd\\xb1\\xeb\\xbca\\\\x0f\\xdd\\x88:\\xd3\\xf2eg^\\x97&\\x15\\xb3\n\\xd6\r:\\xa99\\xaf\\xf5\\x1f\\x00\\x1b\\xb7\\xa8l\\xf74\\x04k\\xd9\\xf0\\xcal\\xbe\\xa9\\x99\\x04hc\\xc0$&\\xee\\xb4-\\x87\\xa1\\xb6\\x00\\xff\\x84p3\\xed\\xe1\r\\xe7tk-\\xba\\x0c\\x03!@\\xf0\\x06#a\\x00\\xec"
  710.  
  711.  
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xd4\\x82\\x04\\xe5\\xc7\typ\\x06\\xb6\\x1c@\\x85\\x83&\\xb8$ft\\xeb\\xc0\\x96d\\xa6\\x03j\\xb7\\xfa\\xe2*\\x90;\\xebk \\xd4\\x82\\xce\\x8e\\x7f\\xa2g&\\xe6l\\xf7\\xae\\xce\\xb7\\x96\\xeew*|t9\\x8c\\xdc\\x95\\xbd\\xa2\\xbf\\x7f0\\x9e+/\\xc9\\x050\\xe3\\x1f\\xfc0\\x1eeo7\\xd2\\xbd=\\xbdv\\x02\\x8ds\\xb0\\xec\\x89\\xbd\\xec\\xae\\xa1\\xfc\\x9a\\xf4\\xb2\\xb1\\x84\\xcb\\x84g\\x9a\\xbb\\xd2\\xb0t\\x0c'x\\x95\\x8f\\xb1\\x05y\\x8f\\xdew\\x91\\x06b\\xe8\\x98\\xed\\xd3l\\xc5i|m\\xa0r3\\x9e\\x07~\\xd3@\\xa0z\\x8e\\xc4bl\\xf6\\x8bh\\xb8\\xc5\\xa2\\x81\\xd5\\xdd+\\xa5\\x03\\xe0\\x9dg(\\x0f\\xe3\\xee\\x05\\xac\\xb2c\\xc2\\xf9a\\xfb\\x81\\x15\\xfc\\x88\\xec\\x0b\\x9a\\x9b\\xd7.k\\x9ar\\xd0\\x8b\\xda\\x8eu\\xfa9'c\\x02\\xe7\\x98\\xe5\\xcawx\\xcf\\x97\\x9c\\xc4l\\xb1\\xc5\\xd2\\xbe\\x17\\xa8\\x9b\\xbb\\xfb\\xe2\\xc5\\xb3\\x05\\xe9\\x03x\\x92\\xdb\t\\x05\\xa0lx\\x83-o)\\x00\\x92\nj\\x07\\xdc\"\\xd0*\\xef\\xe1\\xb8\\x84x"
  713.  
  714.  
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\xf8\\xe1n\\xbf|\\xebjg\\x86\\xde3\\x8b;\n\\xf2\\xdcw\\xc4?\\xdbk\\xdb-\\xafs\\x96\\xab\\xd9s=\\x81\\x93\\x0eo\\x9e\\xa6\"\\xbe\\x85\\xc5\\xbc=\\xbd\\x19\\xc6\\x01\\xa4\\x89y\\x8b\\xc7\\xbe\\x98\\xf9\\x01\\x08\\xc1\\x82\\x101\\xb4\\xa4\\xd3 .\\xc5n\\x86\\xdfppcd\\x9e\\xec\\x1a\\x92$\\x06\\xc9t\\x11\\xa6\\x08\\xfd\\xd3\\xd0\\xb7*\\xf6ii\\x9b;mbh\\xff\\x11\\xa5\\xf4\\xbf\\xc9ft`\\x8db\\xee\\xfe\\xf3\\xf0k\\x9e.\\x15\\x8e#j\\xc5\\xcc\\xfa\\x923\\x87&\\xd2\\xe4\\xc9\\xe1\\xa0\\xb8l\\xfe\\x98e\\xf9\\xaboc\\xc5\\xb5ojf\\x0b\\xb6\\xe6\r'`ej\\x83\\x1c\\x89\\xf26=2\\x8c\rl\\x8f\\xdb\\xf4\r\\x12\\x8c\\x0c%\\x16\\x1do?\\xa8\\xb2z\\xb1c\\x8e\\xa3\\x02\\xf39l\\xb80q\\x10\\xb5i\\x12k1\\x1a\\xaf\\xf2\\xa0m\\xa1\\xe3\\x15\\xbfd\\x88\\xa2\r`(1m\\x8f\\xb3\\xcc\\xc4\\x90m\\xae\\xfb\\xc0\\xec6=\\x8df\\x84\\x0fy\\x96\\xc9\\xd3vaf?\\x00i3\\xc0\\xad\\"
  716.  
  717.  
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b\\xfe\\x17\\x80|qf\\x99*~\\x08cz\\xb4s\\xe3e\\x89\\x10\\xe3\\x00\\x17u\\xde\\x8a\\xc1\\xa7oi\\x0b\\x08\\xee\\xde\\xc0\\x1f\\x86\\xcd\\x0b\\xdc\\xe2%z:`z\\xc2#\\x00\\xba\\xe4e\\xda\\xa2\\xc9\\xd5n\\xe6(\\xe7\\x00'\\xfe\\xb0o0\\x13\\xf8\\xce\\x00\\x9e\\x14r\\xf1\\xd6\\xfc\\x88\\xcc\\x86__z\\x0e\\xbd\\xbf\\xff x\\x082-\\xce\\x9d\\xec\\xfd\\xbb\\xf3\\xb5q\\xd5\\x0ep\\xbd\\xed\\x95q\\xd90\\xa9h.\\xf9 \\x03dl\\x91\\xcc\\xe2\\xfce\\xda\\xa2\\x9a\\xccu\\x08\\x1b\\xde\\xdb\\x8b\\x9f\\xbc\\xb4\\x88\"jv\\xa30\\x0f\\x9b\\xb9\\xf2\\xde\\xd6\\xf1\\xe1\\\\x02\\xea\\x93\\x80>\\x88\\x86\\x03\\x11m\\xbb \\xb6\\xd1g\\xb7\\xd6\\xbaw\na\\xc2\\xe3\\xe4\\xd97k\r\\x00\\x1f\\xea\\x0e\\x9ea\\x83\\xda\\\\xd1\\x12,\\x0cd-xr\\xb4:\\xebg\\x0b\\xf4\\x1c\\xe8\\xad\\x800s\\x95\\xcb=\\x0c\\xae\\xcf\\xb4=\\xf7\\xb4\\xb5\\xe4\nr\\x1c\\x13&\\xcd\\xd7r\\z\\xb5\\xbf93m\\xfc\\xfd\\xb6tm\\x9f\\xbe2b\\xd9\\xfahd"
  719.  
  720.  
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xba\\x17d\\x8bf\\x8f\\xf0\\xd4\\xfc bx3=\\xfcq\\x04p=?,\\xf5m\\xdd\\x0ek'\\xcb\\x16\\xcac\\xe1\\xd0\\x86\\xd9\\xb8b\\xccf&>!k\\xbc\\xb4\t\\x05/\\xe3n\\xba\\xc3\\x9b\\x95k\\xb2\\xdf\\x89\\x044\\xc2\\xf2\\x9f&s\\xf6\\xddr\\xbd\\x8c\t\\xe0\\x95\\x13\\xce(\\xbb\\x15t\r\\x01\\xb0\\xbebq;\\xfa\\xf3+\\x1e\\xaeb\\d9&\\xc2g\\xa7\\x96\\x1d\\xb3\\xb3z\\xec\\xbeafz\\xa72\n\\xa7\\xf3j\\x9e\\x9d\\x06\\xee\\xec\\x93eca,\\xdb\\xc3\\xbc\\x8d\\x91y\\xc2x\\xb3\\xfb\\xa5\\x0c\\x18\\x8f\\x81oq\\x9d/y-\\x10\\xa3$!\n\\xb0\\xc8.u\\xe8\\xadvi^\\x8ev\\xec\\xf3\\xefj\\xd9w\\xac\\x9e\\xf4c\\xcd\\xd0_\\x94\\x91\\xe6\\xdc\\x88y\\xbc*\\x87\\xdd\\x7fso\\x8f\\x9f\\x7f\t\\xe3ef\\xe1v\\xa9w?\\x81?\\xa1\\x8a\\x15\\x17<\\xa7\\xdb\\xd9\\xd2k\\xd1\\\\xc4\\xad\\xc6(8\\xb7^\"\\xc2a\\x11=\\xc5;6o\\xc9c\\x05l0\\x90uz\\x84n\\xb5\\x906\\x90g\\x16y\\xdap"
  722.  
  723.  
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\x15\\x17hph\\x19b\\xce\\xfc_\\xe0#\\x113\\xf9\\x1bb\\xfb\\xfe\\xfd\\x8e\\xbcs\\\\xf6\\xc8\\xa2?j\\x11\\xa6c\\xab\\xc0\\xc1zb@\\xd40\\xd4\\xe9\\x0f\\xdab\\xaa\\x05\t\\x1b\\x1c|)\\xb5\\x84\\xf0\\xf6\\xb8zg$\\xfd\\x15\\xab\\x84\\x9aa^e\\xf5\\x83\\x0c\"\\x06\\xdf\\xbd#\\xa4\\xcfkp\\x17\\x82\\xeczu%a\\x1fcvgp\\xa5p\\xb1\\xda\\xed\"\\xc5\\x0cgzn\\xf9?\\x88\\xb62+\\xb1\\x12x\\xee\\x8et\\x9a\\xfdq\\xaf\\x8d\\x9b\\xbe\\xcb\\xcd\\x10\\x14\\xfe\\xaauf\\xae\\x87\\xbc\\x11v\\xaf!u|\\x86\\xd0sx\\x8f\\xd1hz\\x13\\xf9\\xd8w\\x90\\xc5\\xc4j\\x89\\xc3\\xa3\\xdc\\x964\\xda\\xca\\x1c\\x9c\\xc2\\xc6\\xe83#\\xe6zu\\x0b*j#\\xe9\\xb6\\xaf\\x8b+5^\\xb4\\x93\\xb6r\\xef\\xdf\\xeb\\xe8\\x8c8ye\\xe1pm\\x06\\xf3\\xcbk\\x19\\r\\x9c\\x0f\\xcb\\x9b\\x0eg\\xe2y\\x98w5.w\\x7f*\\xad\\x08wp\\xabp47m\\x1a\\x93\\x8dn\\xe9k\\xe3d\\x97\\xe4xc\\\\x18\\xc8\\x8a"
  725.  
  726.  
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xa8\\xd3\\xde)\\x1ep\\x95\\x92\\x90\\xb1t-\\xe8s\\x0f\\x85p\\xe8\\xe2\\xf0c\t7&\\x0b\\\\x9a\\xd4)q\\xf6\\x86\\xdc\\x04\\x0c\\xf1k\\x90\\x95\\xe7\\xb4~s\\xb3\\xa8\\xa8\\x82`v\\x19\\xe5\\xd6\\xd2b\\xc0\\xeb3\ns.\\xf4\\xf4(`\\x91\\x1fa\\xf3;i\\xd3\\xc1\\x12\\x83o\\xec\\xc5\r\\x8c\\x93\\x9f\\xf3\\xb3\\xb3r\\xb4\\x17\\x0b\\x19x\\x0c\\xad\\xa2-\\x9d\\x7f\\xddq\t\\xe0\\x11\\x02\\xee\\xd6\\x04\\xd9i\\xfa\\x11,.\\xa1\\xa7i\\x1e\\x14\\x90o\\xc9%\\xd5\\xa5\\xf3\\xf9\\xb6\\x0bi\\xd7\\x89\\xdd\\x96\\x0e\\xfd\\xe7\\x15\\x0fp\\xa8\\xd5:xhg\\xbd\\xec8\\xb3\\xbb\\xf7b:\\x01\\x81\\x9cn&\\xf2\\x9ffr\\xefi2y\\xdf\\x1bn\\xad\\xa98\\xb8\\xb7\\xb8?\\xf0\\xfe|\"^\\x0c\\xe3\\x04\\xe1,gc\\x92\\xa1\\xed\\xcb\\xdc\\xcb\"#\\xc6\\x83m\\xe8\\x08\\xe7i\\xef\\xae6\\xcbg\\xc4m\\x7f\\xfe\\xda\\x14t2\\xa8x\\xa7\\x01\\xads\\x9f\\x96d\\xcf\\x15\\xf5@k\\xbb\\x05.3\\xfd\\xce5\\xce\\xe8d8\\x01\\xdd+\\x8f<v\\xf9"
  728.  
  729.  
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\x06\\xd1\\xfe\\xb4\\xca\"\\xce\n\\xc0 \\x08\\xfb\\x15\\x9al\\xb6\\xea\\xc2vlm\\xa7g\\x80\\xb7\\x97mu\\\\xe1ibyr\\x90>\\xe5\\x98\\xf7\\xce\\xf0q\\xaf2&\\xb9th;\\xa0\\xae\\xb6pbk\\xd4\\xb0\\xd3t\\x0b\\x85\\xe7\\x90ev\\xa1p\\xa8\\xd7\\xb2\\xd7j\\x86\\xee\\xa84t\\xaebu\\xddjh>:\\xf0,\\xef\\xb7@\\xf9^^\\xbe\\x81\\xca\\xe0\\xe4\\xf9\\xa7\\xe3\\x8e\\xe6\\xbe\\x0c\\x0el\\xa6\\xd2lt,|-ft\\xa1\\x9d\\xe4v\\xc5g\\x17\\xbc\r\\x1c\\x17\\xf5x\\x84\\xf3\\xf4\\x13$1\\x01\\x9e\\x83\\xb3>\\xb0\\xf0e\\x84;\\xd4h.t\\x90)\\x93\\xf288c\\xdd\\xd0se\\xddy\\xc2\\x8e\\xbe\\x88&\\xa7\\xdb@\\x91`\\xa6\\xb5\\xf7\\x0c\\xed\\xcf\\x064\\xa6\\xed\\xefd\\xc5\\xa2\\xa9\\x8c\\xe2\\xa3\\xad\\xd8+*\\x88c\\xc8m\\xbf\\xf8\\x87\\xc3\\x89\\x830\\xf6\\x94d\\xee\\xf4au\\xc1\\x9b\r\\xb5cah\\x99\\xe2\\x8f$\\xac\r'\\x81\\x8c\\\\xac\\xd0\\xa0ln+\\x99`\\xc0q\\x82\\x89\\x9c\\x04^\\xb4\\x8c\\xf8"
  731.  
  732.  
  733. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  734.  
  735.  
  736.  
  737.  
  738. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  739. "Details":
  740.  
  741. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  742.  
  743.  
  744. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  745.  
  746.  
  747. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  748.  
  749.  
  750. "McAfee": "Exploit-CVE2017-11882.ah"
  751.  
  752.  
  753. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  754.  
  755.  
  756. "Cyren": "CVE-2017-11882!Camelot"
  757.  
  758.  
  759. "Symantec": "Bloodhound.RTF.12"
  760.  
  761.  
  762. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  763.  
  764.  
  765. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  766.  
  767.  
  768. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  769.  
  770.  
  771. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  772.  
  773.  
  774. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  775.  
  776.  
  777. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  778.  
  779.  
  780. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  781.  
  782.  
  783. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  784.  
  785.  
  786. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  787.  
  788.  
  789. "TrendMicro": "Possible_SMBCVE20170199"
  790.  
  791.  
  792. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  793.  
  794.  
  795. "Sophos": "Exp/201711882-P"
  796.  
  797.  
  798. "Avira": "HEUR/Rtf.Malformed"
  799.  
  800.  
  801. "MAX": "malware (ai score=84)"
  802.  
  803.  
  804. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  805.  
  806.  
  807. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  808.  
  809.  
  810. "AhnLab-V3": "RTF/Malform-C.Gen"
  811.  
  812.  
  813. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  814.  
  815.  
  816. "GData": "Exploit.RTF-ObfsStrm.Gen"
  817.  
  818.  
  819. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  820.  
  821.  
  822. "Zoner": "Probably RTFObfuscation"
  823.  
  824.  
  825. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  826.  
  827.  
  828. "Ikarus": "Exploit.CVE-2017-11882"
  829.  
  830.  
  831. "Qihoo-360": "susp.rtf.objupdate.gen"
  832.  
  833.  
  834.  
  835.  
  836. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  837. "Details":
  838.  
  839. "target": "clamav:Rtf.Dropper.Agent-7010788-0, sha256:009feed74713bb688fa34d8c35300de11a149898e3d2194059167c97bce743ce, type:Rich Text Format data, version 1, unknown character set"
  840.  
  841.  
  842. "dropped": "clamav:Rtf.Dropper.Agent-7010788-0, sha256:009feed74713bb688fa34d8c35300de11a149898e3d2194059167c97bce743ce , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_cd99e32dfd8ea9a3caaeaf988d971c18.doc, type:Rich Text Format data, version 1, unknown character set"
  843.  
  844.  
  845.  
  846.  
  847. "Description": "Attempts to create or modify system certificates",
  848. "Details":
  849.  
  850.  
  851.  
  852. * Started Service:
  853. "osppsvc"
  854.  
  855.  
  856. * Mutexes:
  857. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  858. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  859. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  860. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  861. "CicLoadWinStaWinSta0",
  862. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  863. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  864. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  865. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  866.  
  867.  
  868. * Modified Files:
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_cd99e32dfd8ea9a3caaeaf988d971c18.doc",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_cd99e32dfd8ea9a3caaeaf988d971c18.doc",
  871. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF5625DB46-1B40-4654-A30A-4A14020C399F.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A789934-E077-4212-9BAF-1055F170043D.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS91D174AA-2B53-4E93-B9D8-1B9C25F3B1D9.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  875. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  876. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  877. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  878. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab55B4.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar55B5.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD640.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD651.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD86.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD87.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1DF.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F0.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F2.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F3.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1BE.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F1.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B3.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B5.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab757C.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1CF.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7773.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7784.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7772.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7796.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7771.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B4.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7785.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7816.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab77A6.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7817.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab77A7.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7828.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7827.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C03.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C13.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C02.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E76.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA6CA.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA91D.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAC0C.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab456E.tmp",
  916. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  917. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  918. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  919. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  920. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD715.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4E1.tmp\\iso690nmerical.xsl",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D1.tmp\\HexagonRadial.glox",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE790.tmp\\content.inf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F0.tmp\\iso690.xsl",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D0.tmp\\RadialPictureList.glox",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4CF.tmp\\PictureFrame.glox",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4E1.tmp\\Content.inf",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD715.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D1.tmp\\Content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA54.tmp\\ThemePictureAccent.glox",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE83F.tmp\\BracketList.glox",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F0.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB71.tmp\\ConvergingText.glox",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D0.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5F.tmp\\content.inf",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE790.tmp\\Frame.thmx",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4CF.tmp\\Content.inf",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA54.tmp\\Content.inf",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB71.tmp\\Content.inf",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAB2.tmp\\APASixthEditionOfficeOnline.xsl",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5F.tmp\\Dividend.thmx",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB70.tmp\\ThemePictureGrid.glox",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAB2.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE83F.tmp\\Content.inf",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE14.tmp\\TabbedArc.glox",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE03.tmp\\gosttitle.xsl",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB70.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED66.tmp\\chevronaccent.glox",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E0.tmp\\gb.xsl",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE14.tmp\\Content.inf",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE44.tmp\\VaryingWidthList.glox",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF422.tmp\\mlaseventheditionofficeonline.xsl",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED66.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE44.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF327.tmp\\ieee2006officeonline.xsl",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE03.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF79E.tmp\\pictureorgchart.glox",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF6B3.tmp\\architecture.glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFD2D.tmp\\TabList.glox",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E0.tmp\\Content.inf",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF422.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF79E.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDF9.tmp\\CircleProcess.glox",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF327.tmp\\Content.inf",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE58.tmp\\gostname.xsl",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFD2D.tmp\\Content.inf",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  979. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A677-DC18A9A3B170.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF6B3.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDF9.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7FE.tmp\\content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE58.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7FE.tmp\\Wood_Type.thmx",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1965.tmp\\Equations.dotx",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18E7.tmp\\ThemePictureAlternatingAccent.glox",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18E7.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1965.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AAF.tmp\\turabian.xsl",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AC0.tmp\\Banded.thmx",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A31.tmp\\sist02.xsl",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AE0.tmp\\chicago.xsl",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B00.tmp\\harvardanglia2008officeonline.xsl",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C0C.tmp\\InterconnectedBlockProcess.glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B6E.tmp\\rings.glox",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AAF.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C0C.tmp\\Content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B00.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AE0.tmp\\Content.inf",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AC0.tmp\\content.inf",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx"
  1026.  
  1027.  
  1028. * Deleted Files:
  1029. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab55B4.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar55B5.tmp",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444fn=Basis.eftx",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496fn=Parallax.eftx",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444fn=Basis.xml",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496fn=Parallax.xml",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444fn=Basis.xml",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496fn=Parallax.xml",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_cd99e32dfd8ea9a3caaeaf988d971c18.doc",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D1.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4CF.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE790.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D0.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD715.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4E1.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E0.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F0.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA54.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE83F.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB71.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAB2.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5F.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB70.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D0.tmp\\RadialPictureList.glox",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD715.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4D1.tmp\\HexagonRadial.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE14.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4CF.tmp\\PictureFrame.glox",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA54.tmp\\ThemePictureAccent.glox",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED66.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE44.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE03.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB71.tmp\\ConvergingText.glox",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE83F.tmp\\BracketList.glox",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F0.tmp\\iso690.xsl",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B4.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1CF.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF327.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F0.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C03.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1BE.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4E1.tmp\\iso690nmerical.xsl",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF422.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7827.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF6B3.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF79E.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C02.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B5.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFD2D.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F3.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDF9.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE58.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE14.tmp\\TabbedArc.glox",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7773.tmp",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7FE.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A677-DC18A9A3B170.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A789934-E077-4212-9BAF-1055F170043D.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAB2.tmp\\APASixthEditionOfficeOnline.xsl",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7771.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS91D174AA-2B53-4E93-B9D8-1B9C25F3B1D9.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18E7.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED66.tmp\\chevronaccent.glox",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cab757C.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1965.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB70.tmp\\ThemePictureGrid.glox",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5F.tmp\\Dividend.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A31.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7796.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA6CA.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AAF.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AC0.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF79E.tmp\\pictureorgchart.glox",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE790.tmp\\Frame.thmx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AE0.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA91D.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE03.tmp\\gosttitle.xsl",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B6E.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7817.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD651.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C0C.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFD2D.tmp\\TabList.glox",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1F1.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E0.tmp\\gb.xsl",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7784.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF422.tmp\\mlaseventheditionofficeonline.xsl",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEE44.tmp\\VaryingWidthList.glox",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7828.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDF9.tmp\\CircleProcess.glox",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4B3.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7816.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF6B3.tmp\\architecture.glox",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1DF.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF327.tmp\\ieee2006officeonline.xsl",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD86.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE58.tmp\\gostname.xsl",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD640.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18E7.tmp\\ThemePictureAlternatingAccent.glox",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C0C.tmp\\InterconnectedBlockProcess.glox",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7785.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1965.tmp\\Equations.dotx",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AC0.tmp\\Banded.thmx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B00.tmp\\harvardanglia2008officeonline.xsl",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD87.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AAF.tmp\\turabian.xsl",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B6E.tmp\\rings.glox",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAC0C.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab77A6.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AE0.tmp\\chicago.xsl",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A31.tmp\\sist02.xsl",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7FE.tmp\\Wood_Type.thmx",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E76.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab456E.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1E67.tmp.cvr"
  1189.  
  1190.  
  1191. * Modified Registry Keys:
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\x)0",
  1193. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\124D354",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\124D354\\124D354",
  1213. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1214. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\\Blob",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1528. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1532.  
  1533.  
  1534. * Deleted Registry Keys:
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\x)0",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\wn.",
  1537. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\124D354\\124D354",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1563.  
  1564.  
  1565. * DNS Communications:
  1566.  
  1567. "type": "A",
  1568. "request": "koirado.com",
  1569. "answers":
  1570.  
  1571. "data": "46.105.57.169",
  1572. "type": "A"
  1573.  
  1574.  
  1575.  
  1576.  
  1577. "type": "A",
  1578. "request": "apps.identrust.com",
  1579. "answers":
  1580.  
  1581. "data": "192.35.177.64",
  1582. "type": "A"
  1583.  
  1584.  
  1585. "data": "apps.digsigtrust.com",
  1586. "type": "CNAME"
  1587.  
  1588.  
  1589.  
  1590.  
  1591. "type": "A",
  1592. "request": "vemvemserver.duckdns.org",
  1593. "answers":
  1594.  
  1595. "data": "205.185.125.42",
  1596. "type": "A"
  1597.  
  1598.  
  1599.  
  1600.  
  1601.  
  1602. * Domains:
  1603.  
  1604. "ip": "192.35.177.64",
  1605. "domain": "apps.identrust.com"
  1606.  
  1607.  
  1608. "ip": "46.105.57.169",
  1609. "domain": "koirado.com"
  1610.  
  1611.  
  1612. "ip": "205.185.125.42",
  1613. "domain": "vemvemserver.duckdns.org"
  1614.  
  1615.  
  1616.  
  1617. * Network Communication - ICMP:
  1618.  
  1619. * Network Communication - HTTP:
  1620.  
  1621. "count": 1,
  1622. "body": "",
  1623. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1624. "user-agent": "Microsoft-CryptoAPI/6.1",
  1625. "method": "GET",
  1626. "host": "ocsp.digicert.com",
  1627. "version": "1.1",
  1628. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1629. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1630. "port": 80
  1631.  
  1632.  
  1633. "count": 1,
  1634. "body": "",
  1635. "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
  1636. "user-agent": "Microsoft-CryptoAPI/6.1",
  1637. "method": "GET",
  1638. "host": "apps.identrust.com",
  1639. "version": "1.1",
  1640. "path": "/roots/dstrootcax3.p7c",
  1641. "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
  1642. "port": 80
  1643.  
  1644.  
  1645. "count": 1,
  1646. "body": "",
  1647. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1648. "user-agent": "Microsoft-CryptoAPI/6.1",
  1649. "method": "GET",
  1650. "host": "www.download.windowsupdate.com",
  1651. "version": "1.1",
  1652. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1653. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  1654. "port": 80
  1655.  
  1656.  
  1657. "count": 1,
  1658. "body": "",
  1659. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1660. "user-agent": "Microsoft-CryptoAPI/6.1",
  1661. "method": "GET",
  1662. "host": "ocsp.msocsp.com",
  1663. "version": "1.1",
  1664. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1665. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1666. "port": 80
  1667.  
  1668.  
  1669. "count": 6,
  1670. "body": "",
  1671. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1672. "user-agent": "Microsoft-CryptoAPI/6.1",
  1673. "method": "GET",
  1674. "host": "crl.microsoft.com",
  1675. "version": "1.1",
  1676. "path": "/pki/crl/products/microsoftrootcert.crl",
  1677. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1678. "port": 80
  1679.  
  1680.  
  1681. "count": 2,
  1682. "body": "",
  1683. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1684. "user-agent": "Microsoft-CryptoAPI/6.1",
  1685. "method": "GET",
  1686. "host": "crl.microsoft.com",
  1687. "version": "1.1",
  1688. "path": "/pki/crl/products/microsoftrootcert.crl",
  1689. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1690. "port": 80
  1691.  
  1692.  
  1693. "count": 1,
  1694. "body": "",
  1695. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1696. "user-agent": "Microsoft-CryptoAPI/6.1",
  1697. "method": "GET",
  1698. "host": "crl.microsoft.com",
  1699. "version": "1.1",
  1700. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1701. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1702. "port": 80
  1703.  
  1704.  
  1705. "count": 2,
  1706. "body": "",
  1707. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1708. "user-agent": "Microsoft-CryptoAPI/6.1",
  1709. "method": "GET",
  1710. "host": "crl.microsoft.com",
  1711. "version": "1.1",
  1712. "path": "/pki/crl/products/microsoftrootcert.crl",
  1713. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1714. "port": 80
  1715.  
  1716.  
  1717. "count": 1,
  1718. "body": "",
  1719. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  1720. "user-agent": "Microsoft-CryptoAPI/6.1",
  1721. "method": "GET",
  1722. "host": "ocsp.pki.goog",
  1723. "version": "1.1",
  1724. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  1725. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1726. "port": 80
  1727.  
  1728.  
  1729.  
  1730. * Network Communication - SMTP:
  1731.  
  1732. * Network Communication - Hosts:
  1733.  
  1734. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!