API tools faq
paste
paladin316

RTF_86501d0eb001e0806687f557db7fceae_doc_2019-08-01_11_30.txt

paladin316
Aug 1st, 2019
2,284
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 180.41 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_86501d0eb001e0806687f557db7fceae.doc"
  7. * File Size: 223951
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "0952f04d55cc164efa44f4920f40283992ea02daf47768e2356534e7c682b9cd"
  10. * MD5: "86501d0eb001e0806687f557db7fceae"
  11. * SHA1: "132514ccd2325b66e52e65642e3dd90a46b5d87a"
  12. * SHA512: "747b3b045ee0b72b01b77ab608695be0bbda8f129b1ae25eae79671b5beb6ba5e7965eb4895078d1867acbf8456be1b3feb54cbf4c80ec182cdda6556a394477"
  13. * CRC32: "4D96C40A"
  14. * SSDEEP: "1536:mtgkBe1ehegeqfDYfpoG+g5ZcFRIxPILSQWns3R:mtgChmxgLSQWno"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "crydpr.exe",
  19. "RegSvcs.exe",
  20. "splwow64.exe"
  21.  
  22.  
  23. * Executed Commands:
  24. "C:\\Users\\user\\AppData\\Roaming\\crydpr.exe",
  25. "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE15\\FLTLDR.EXE\" C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT",
  26. "C:\\Windows\\splwow64.exe 12288"
  27.  
  28.  
  29. * Signatures Detected:
  30.  
  31. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  32. "Details":
  33.  
  34. "IP": "52.109.20.1:443"
  35.  
  36.  
  37. "IP": "23.63.59.41:443"
  38.  
  39.  
  40. "IP": "185.62.189.153:80"
  41.  
  42.  
  43. "IP": "104.18.24.243:80"
  44.  
  45.  
  46. "IP": "23.38.126.36:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "184.28.188.193:80"
  53.  
  54.  
  55. "IP": "72.21.91.29:80"
  56.  
  57.  
  58. "IP": "23.222.163.54:443"
  59.  
  60.  
  61. "IP": "185.217.1.156:5200"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  67. "Details":
  68.  
  69. "ioc": "quations.dotx"
  70.  
  71.  
  72. "ioc": "ontent.inf"
  73.  
  74.  
  75. "ioc": "chevronaccent.glox"
  76.  
  77.  
  78. "ioc": "ext.glox"
  79.  
  80.  
  81. "ioc": "ist.glox"
  82.  
  83.  
  84. "ioc": "rocess.glox"
  85.  
  86.  
  87. "ioc": "architecture.glox"
  88.  
  89.  
  90. "ioc": "gostname.xsl"
  91.  
  92.  
  93. "ioc": "mlaseventheditionofficeonline.xsl"
  94.  
  95.  
  96. "ioc": "sist02.xsl"
  97.  
  98.  
  99. "ioc": "harvardanglia2008officeonline.xsl"
  100.  
  101.  
  102. "ioc": "gosttitle.xsl"
  103.  
  104.  
  105. "ioc": "gb.xsl"
  106.  
  107.  
  108. "ioc": "anded.thmx"
  109.  
  110.  
  111. "ioc": "content.inf"
  112.  
  113.  
  114. "ioc": "rame.glox"
  115.  
  116.  
  117. "ioc": "ieee2006officeonline.xsl"
  118.  
  119.  
  120. "ioc": "e.gu"
  121.  
  122.  
  123. "ioc": "pictureorgchart.glox"
  124.  
  125.  
  126. "ioc": "ccent.glox"
  127.  
  128.  
  129. "ioc": "adial.glox"
  130.  
  131.  
  132. "ioc": "iso690.xsl"
  133.  
  134.  
  135. "ioc": "rings.glox"
  136.  
  137.  
  138. "ioc": "iew.thmx"
  139.  
  140.  
  141. "ioc": "rame.thmx"
  142.  
  143.  
  144. "ioc": "nline.xsl"
  145.  
  146.  
  147. "ioc": "iso690nmerical.xsl"
  148.  
  149.  
  150. "ioc": "set.dotx"
  151.  
  152.  
  153. "ioc": "rc.glox"
  154.  
  155.  
  156. "ioc": "etropolitan.thmx"
  157.  
  158.  
  159. "ioc": "uotable.thmx"
  160.  
  161.  
  162. "ioc": "ype.thmx"
  163.  
  164.  
  165. "ioc": "ividend.thmx"
  166.  
  167.  
  168. "ioc": "rid.glox"
  169.  
  170.  
  171. "ioc": "..3b"
  172.  
  173.  
  174. "ioc": "turabian.xsl"
  175.  
  176.  
  177. "ioc": "asis.thmx"
  178.  
  179.  
  180. "ioc": "eadlines.thmx"
  181.  
  182.  
  183. "ioc": "chicago.xsl"
  184.  
  185.  
  186. "ioc": "arallax.thmx"
  187.  
  188.  
  189. "ioc": "late.thmx"
  190.  
  191.  
  192. "ioc": "amask.thmx"
  193.  
  194.  
  195. "ioc": "rop.thmx"
  196.  
  197.  
  198. "ioc": "adge.thmx"
  199.  
  200.  
  201. "ioc": "erlin.thmx"
  202.  
  203.  
  204. "ioc": "roplet.thmx"
  205.  
  206.  
  207. "ioc": "eathered.thmx"
  208.  
  209.  
  210. "ioc": "avon.thmx"
  211.  
  212.  
  213. "ioc": "vent.thmx"
  214.  
  215.  
  216. "ioc": "ircuit.thmx"
  217.  
  218.  
  219. "ioc": "g.n9"
  220.  
  221.  
  222. "ioc": "esh.thmx"
  223.  
  224.  
  225. "ioc": "rail.thmx"
  226.  
  227.  
  228. "ioc": "v2.0.50727"
  229.  
  230.  
  231.  
  232.  
  233. "Description": "Expresses interest in specific running processes",
  234. "Details":
  235.  
  236. "process": "RegSvcs.exe"
  237.  
  238.  
  239. "process": "svchost.exe"
  240.  
  241.  
  242.  
  243.  
  244. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  245. "Details":
  246.  
  247. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  248.  
  249.  
  250. "suspicious_request": "http://185.62.189.153/crydpr.exe"
  251.  
  252.  
  253.  
  254.  
  255. "Description": "Performs some HTTP requests",
  256. "Details":
  257.  
  258. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  259.  
  260.  
  261. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  262.  
  263.  
  264. "url": "http://185.62.189.153/crydpr.exe"
  265.  
  266.  
  267.  
  268.  
  269. "Description": "Executed a process and injected code into it, probably while unpacking",
  270. "Details":
  271.  
  272. "Injection": "crydpr.exe(2180) -> RegSvcs.exe(584)"
  273.  
  274.  
  275.  
  276.  
  277. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  278. "Details":
  279.  
  280. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  281.  
  282.  
  283.  
  284.  
  285. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  286. "Details":
  287.  
  288. "Process": "RegSvcs.exe tried to sleep 1001 seconds, actually delayed analysis time by 0 seconds"
  289.  
  290.  
  291. "Process": "splwow64.exe tried to sleep 3240 seconds, actually delayed analysis time by 0 seconds"
  292.  
  293.  
  294. "Process": "WINWORD.EXE tried to sleep 292 seconds, actually delayed analysis time by 0 seconds"
  295.  
  296.  
  297.  
  298.  
  299. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  300. "Details":
  301.  
  302. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p0@2.~\\xac<\\x1a\\x90\\xa9\\x00\\xf09\\xc0\\xdfn\\xd9\\xa7p\"\\x83-\\x9f\\xb8fs\\x15l\\xe1x\\xc1\\xe0\\xd7 \\x80\\xfc\\xfa\\xc1\\xa3bh\\x1f\\xbac4q\\x85\\xca\\xac\\xa1\\xe8\\xe17\\xb4\\xe4\\xb8\\xd9_p\\x0b\\xa7z\\x00\\xb6\\x1f\\xa1\\xec\\x99\\xb3\\xc7\\x98+\\xa61m\\xde>~\\x12\\xc5*\\xb95\\xc8\\xa1\\xeah\\xe2\\xcc\\x14\\xd3\\xf3\\x0b/h\\xa1\\x89=\\x9f\\x99s\\x82\\xbf\\x18\\x08\\xc3%\\x1b+<yu\\x83li\t\\xf2\\xed\\x80\\xde\\x8f\\xeb\\xe8\\xc4\\xc4p\\x1f\\xa0\\x9a\\xcb\\x12\\x8b\\xfe&g\\xf7x\\xeaa`\\xe8q\\xd9\\xc5\\x94\\xdco\\xd4\n\\x8af\\xc9\\xec`\\x06?\\xa86\\xe9\\x13\\xd8n\\xf9,\\xf7\\xaap\\x951\\xbcwy\\xf8\\x9d\\xfd\\xd6d&\\x0e\\xcf\\x17\\x89\\xfc\\xad\\x7f.3\\xde\\x9f\\xbb\\xe7\\x97e\\x9d\\xda\\xba\\x97\\x98\\x14\\xd1\\x94\\xaf\\x0b\\xf1\\x15t\\xac\\xc4g\\xa6\\xfd\\xd5l\\xa4\\xd9\\xd5\\x93\\x11?\\x8dzc\\x0b\\xb6l\\xbdu\\xa9\\xd4\\x8d)\\xfd\\x93a\\xe5.k'\\xf8\\x1d\\xf0*yg=\\x82\\x96\\xbd\\xa6b"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xca\\x84\\x00\\xd9\\xd8\\xdff\\x84\\xb8\\x06\\xe1u(\\x838^$h\\xc3\\x07-dy\\x1b\\xd3\\x82:\\xcf\\xc9\\xff\\x1b\\xef\\xc1\\xfc\\x9a\\xf69\\\\xba2\\x86u:y\\xb6b\\x11\\x9b\\xa2\\xbe\\xb4.7e\\xd7\r\\x87p\\x02\\x1c\\xd49\\xdbk\\xe2\\x8f\\x98\\xd3t\\x19\\xbe\\x14c\\x18\\x16\\x8fh\\xb5f\\x99\\xcch'3\\xf7\\x86\\xf6\\x03\\xf1j\\xedp\\xaf\\xeb\\xd8t\\x1fr\\x96\\xa1\\xdb\\x85\\x81\\x96\\xd0\\xe5\\xc9\\x82yx\\x9e\\xc3\\xabf\\xba`\\\\x1fz\\x07\\x12\\xef\\x08\\xfe\\xf2g\\xdf\\xa4\\xac\\xc0_l\\x8c\r\\xf4\\xb9\\x1f\\x0exj\\x1f\\xb4f%\\xff\\x1c\\xfc\\xb7\\x96\\x96w\\xff\\xdf\\x17\n\\xad\\xd1v\\x87\\x14\\xdeyk(\\xd3d)\\xd5s8\\x89fc\\xe6\\xbb\\x1b\\xf8<\\xfd\\xe7\\xf0\\xf5\\xc9\\xb4\\xcac\\x93\\x83\\xd6\\xa4\\xb3\\x0f\\xa9\\x02\\xde\\xb9\\xae\\xf1f\\x8b,(\\xd1\\x8dx\\x83\\x02\\xef\\xa0\\xa0\\x9e\\xb6\\xb9h\\xd5\\x81\\x9b$\\x14v'\\x82@\\xfb\\x81\\xb8\\xd6\\xe4\\xfbp\\xd2\\xd8\\xc3\\xdd\\xee\\x1c\\x96okx\\xc5\\x99hx\\xa0n"
  312.  
  313.  
  314. "http_request": "winword.exe_InternetCrackUrlW_httP://185.62.189.153/crydpr.exe"
  315.  
  316.  
  317. "http_request_path": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  318.  
  319.  
  320. "http_request": "winword.exe_InternetCrackUrlA_http://185.62.189.153"
  321.  
  322.  
  323. "http_request": "winword.exe_InternetCrackUrlA_http://185.62.189.153/crydpr.exe"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01b\\xc4\\x8d\\xca\\xd0\\xcd7\\xc4\\x05\\x17.r\\x1ay\\xfburb\\xcf\\xa2\\xf0y8\\xc3\\x95z\\xc3a\\xbam\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c%\\xd2\\9\\xd8\\xe8%\\xcb\\xf8k\\x916\\x01\\\\xac\\xba\\x0er\\x02\\xde\\xdb(z\\x12\\x98\\xa1a -pc\\xd4\\xda_\\x89^\\xa9\\x97\\xf7\\xbc\\x99jx\\x80\\x03\\xcb\\xfd\\x8dyg\\xf7n\\xca\\x8al\\xb4^k\\xa2q\\x07\\xad\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\p*1\\xf79\\xb9uw\\xfa\\xfd8\\xd5\\x9a\\xe36\\xc6#;\\xf2\\xdc\\xfb\\x84>\\x8a\\xe6&!\\xc6\\xd4\\xf6u#l\\x1aulf\\x9bh\\xcb\\x8d*\\xf5d\\xd2\\x12\\xd0"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8dd\\x0b\\xa1\\xc4\\xbc\\x1b\\x17\\x8c)\\x80\\x18d\\xe0\\xf6yp\\xcd\\xcd\\x0eu\\xcc\\x7f\\xc2\\xbd3\\x05\\xbf\\x80\\xe3'q\\xca\\x81j\\xf2 \\xee\\x84\\xb0\\xf0\\xe6\\xc8'\\x0e\\x8d\\xafh\\x05\\x9c.jt\\x93\\x98i\\xee\\x8b\\xc5\\x89#a\\xbb\\x02\\xe5\\xb9jhc*\\x99bfk\\x8aq>\\xb3e\\xd9bh\\xb6\\xf7(3\\\\x98\\x97lt\\xe5\\x80\\x80>\\x9b\\x05\\x07(\\xb4\\xcc\\xd4\\xd3\\xfb\\xd4\\x1f:u\\xe3_\\xadh`\\xfd\\xc5\\xe7vk\\x0c\\xaeq6\\x7f\\xd22\\xeada\\xb0\\x10\\xf5qw\\x1e\\xee\\xaf\\x1d0\\xbfnc\\x1c\\xe5n\\xb6g\\xfb\\xb7\\xcf\\x94vx\\xc2u\\x81h8\\x0ex\\xb0\\x81\\xc3%'\\xa9=\\xe9\\xeah\\xd5\\x95\\x80\\x93(\\xde\\xc3\\x1f\\x07\\xe5\\xf9\\x94(\\xe5u \\xdc\\x97dv\\xdf\\x99\\xc1\\xf6\\xc2)b_q\\x84\\xff\\x8c\\xbd\\x7f\\x9a\\x0e\\x14\\xebh\\x84w4\\xd3p\\xf1\\xf1\\xcd\\xad\\x8cb\\xe7\\xa9\\xc9/\\xba\\xb2\\xaa,\\x8f d\\x93e\\xc4x\\x08\\xdd\\x90\\xd9\\x11\\xebi\\xa0\\x9f"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01b\\xc4\\x93o4\\xff\\xe0\\xca2\\xdc\\xdb\\xbd\t\\x1e\\xd7\\xd7\\x16tmz\\xc0\\xfe\\xbc\\xe1o\\xf7\\xf7m\\\\xf8\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\xce\\xd9i\\xa5\\xa86\\x8d\\xd8|x\\x94\\x04\\xd4\\x86\\x8e\\xe5mz\\xa1u#q\\xff\\xda\\x8a\\x8c\\x1ak\\x06\\xe5g\\x8e\\xfe\\xc4-;\\xd7\\x1br\\x9c\\xe5\\x96\\xba/\\xda\\xb7\\x93rn\\xc8\\x84\\x05tk\\x8b\\xf8\\xd5\\x1dz\\xf9j\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x1b\\xa5\\xc1\\x92i\\x8b?\\xac\\x10\\xb6\\xa6\\xd5\\xe7\\xc4no\\xbb\\xf8\\x00u\\xf9cc\\x13\\xc4\\x10\\xfd\t\\xf1\\x8b\\xe2\\x0e\\xe5/\\x9a\\xc4\\xab\\xb2\\x01\\xf3\\x94\\xcc8bg\\x12"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p<\\xa3\\x86\\xa1\\x9d\\x94\\xcf\\\\xe7)\\xbc\\xce\\xee/(\\x8al\\xf9\\xff\\x81\\x1f\\x97/c\\x8d\\x98t\\x83=\\xd6\\x05ml$z\\xb9\\xc9\\xaeh\\xa1?\\x81\\x07\\xf2\\xa6\\xe4\\x98i\\x9fa^!?\"2nk\\x11\\xbfl%\\x0b\\x8b\\xbef\\x96op\\xe5\\x94\\x0b\\xa5\\xfd\\xd0my\\xf5/1\\xb2\\x86?\\xae\\x83\\x1c\\xb6\\xa9\\x19*q\\xf5\\xb2\\xf0\\x12\"\\x1b\\xde:\\x18\\xca\\x8eq\\x01\\xa3\\xac\\x86\\xaa4y1\\xc9\\xc0\\xcc\\x90\\xf5\\x81\\x84~am\"\\xa9\\x1f\\x05\\xb2\\xa5#\\x0emg\\x8a\\xf4h\\xa2\\xaf\\xc2\\xa7a\\x97\\xf5\\xed\\xce\\xaf\\x96\\o\\xdc\\x82\\xa0\t3\\xeaw\\xcc\\xb4^ni\\x84/\\xa3w\\x046+\\x17i\\xb9\\xc6?\\xba,\\xfc\\xe7\\x1c65h|\\x08\\x9c_.\\xa5'\\xc8\\xde\\xa5;d1j\n9\\\\x9c\\x90\\x02\\x0f\\x88s@\\xda\\xec\\xe7\\x0b^\\xba\\x0b\\x1c\\xb3\\xd5\"\\xbe\\x8a8\\x0e\\xe6s\\xf8z\\xc0^\\xf1e\\xef\\xb7(!ft\\x9cu\\xb1\\x90\\xe1\\x8c\\xb8\\xe72\nze\\x99\\xb7\\xa5"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x85h\\xf2~~n\\xcd\\x9c|\\xc5wvg*\\xda\\xdb>\\x11\\x06\\xf2\\xf3x\\xb3;\\xee\\x106\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xdc\\x8d\\xa3\\xee\\xd7h\\x0f\\xda\\xc7r\\xf7\\x95\\xbb\\x1c\\xfd\\x99\\xa3\\xd6\\xd8qx=\\xaa\\xc9\\xb0\\xd6)\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xda\\xacq\\x80\\xc1\\xae\\xbc\\xd2?\\x0f\\xfc\\xc6\natxa \\xaf>\\x88^\\xddl\\xc0\\xdc\\xc4<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xf2\\x10\\xe2\\x0f\\x81`\\x05\\x94\\xed9j\\xf1a\\xe2\\x7f\\xc6\\xb4\\x13#s\\xffjts@\\x0btg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xef\\xd4\\xc5p\\x04\\xd0\\x1e\\x07\\x07\\xa6\\x97\\x0f|v\\xc9\\x16\\xd9\\x89\\xfa\\v\\x9b\\xd0\\x8fk\\x89\\x83\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94n\\xfe\\xda\\x08\\x84\\xb9i,\\x9b;\\x8e\\x91\\xaf\\xc7i\\xb6%\\x025\\xf3\\x818\\xdd\\xa8\\x84\\xdej>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94ds\\xc5\\x18\\xb1\\xca\\x15\\x02\\x95$#\\xf8\\xce\\x08\\x9a \\x19\\xaf*\\xe8\\xcf\\x0fv\\x91\\xc99\\xfc\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x15\\xb9n\\x0bm.\\x99'\\xaf\\xe1\\xb4\\xda\\xbf@\\xed\\xdd\\x90d\\xb9\\xd6\\xf7\\xfb\\xdb\\xe0\\xd4\\x11\\x91n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x9d\\xb0\\xf0\\x99.w\\x93f /\\x8f\\xbe\\xf1\\xfa\\xc5\\xa3\\xda\\xb3i\\xd9\\x90\\xb7\\xa8\\xea\\xf8 l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xcb\\xc8\\xe47w\\x99hj\\xf2o\\x8dc\\x12\\xb1a\\x91o\\x11fh\\xcce\\x89\\xf6,/\\x9f\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xde\\x96@\\xf1\\x83\\xf2\\x84\\xe5z!\\xa4\\x9cl'p\\xa3\\xa3$cke\\x0bh-\\x08\\xca\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94:\\xc1\\xad?\\xf7\\xcd\\xb7\\xa7\\xb0\\x85\\x9ct\\xf6h\\xe9\\x05\\xd8\\xe6b2\\xe2\\x8ah\\xab\\xb7\\x1c\\xb4t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x7f\\xd9\\x90\\xab\\xff\\xae\\x03\\xd8\\x9eo*\\xbc\\xd1'\\xd9\\x10\\xe2\\xb6\\x8c\\x83\\xba\\x1bu\\x11\\x947\\x13\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94e\\x1ct\\xa0d\\xc9|\\x0b\\x9f\\x80#\\xf5l\\xa69\\xe0qu\\x878*\\x87\\xc8byn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x9d\\x8e\\x01r\\xeb\\xeb\\x95nj\\xc7\\xf1\\xc8*\\xadc\\x8du\\x87h,0\\xd1\\xd4<l\\x88\\x19\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\rt\\xb2\\xae_\\\\xf7\\xd6\\xf6i\\xfeyhh\\xb3\\x04\\xce\\xe0\t9\\xfa\\x08\\xe8\\xad\\x17\\xaa\\x14_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x0e\\xe47\\x8e\\xf3\\xce@b71\\xc2s=.7\\x93\\xa5\\xba\\xa6\\xbe\\xaa\nt\\xfd\\x98\\xbd\\xb3t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\x88ug\\xfa!$-\\xe3\\xb4\\x8fyyt\\xe5=*wccx\\xda\\xfc\\x1c\\x1c\\xc5\\xf4\\xb94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94\\xf11\\x08:\\x06\\x9c\\xf8e\\x99l\\xf9\\x1cg\\x18\\xe1\\x93\\xcd\\xd2\\x8d\\xea1i\\x93ti\\x1fc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x947i\\xec\\xb98\\xc7'i\\xeet\\xc3\\x15\\xd2\\xb3,kq$q\\x13|s\\xbd\\x9a0li\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\xc4\\x94%\\xe6\\x8a\\xe0r\\xc6\\xf0-`\\xa4#4\\xfe\\xb9\\x99s\\x9b\\xde\\x9d\\xd16\\xd1\\xee@\\x80\\xebl\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa3\\xd3\\xc4\\xe4l9f\\x9ci\\xc8k.\\xfbb\\xfc\\xa3s\\xd8\\x06\\xa1_\\xf9\\x9cn\\xd3\\x07ww\\x04\\xb4y\\x92wov\\xc8\\x9e\\\\xa6\\x1e\\xda\\x8e\\x03\\xc4\\x8a+\\xb2\\xa6\n\\xf4k2\\xbf\\xbb\\x83ux\\xf0\\xeee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91\\xdc\\x86\\xeba\\xdf\\x17\\xe3rs\\xa0\\xf2\\xd9x\\x8e\\xa89\\x0es\\xada\\x192j\\x06\\xbf\\xd5u\\xba\\xda\\xde)\\x96.\\x99\\xe6#(\\xfb=\\xd4\\xd5m\\x89.b\\xa2\\x11"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\x0fy\\xf6\\xdd\\xc1^r\\xfb\\x0b+-1\\xe1\\x08\\x02\\xbb\\xe8\\x03\\x97n\\x80s\\xb0'\\x8c`%\\xdfg\\xdd\\xa4\\xa8\\xd7\\xcf\r\\xf88\\x9d\\xa2\\xa7\\x18j\\xcbd\\xd6\\x19$\\xf7n\\x14\\xb5\\x0e\\xfb\\x0fin\\xb3\\x00\\x1er\\xf5\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ata\\xe2 zcy\\x84\\xee\\xd7\\xdc\\xe2\\xb8\\x1e\\xa9y,\\x93_\\x08\\x94\\x1c\\xa9\\xa1\\xac`\\x98\\xa2ngq\\x04\\x8d_i\\x1e\\xdd\\xc9\\xf8\\xdbt\\xaei)zeq"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\x91\\xc6pinmw\\xb0p\\xb7\\x024\\xc6q\\xbd\\x1f\\x07\\xa3\\xed.\\x92\\xfa\\xc3\\x1a\\x945\\xd9xe\\xdf\\x1ew4\\x9fln\\x88\\xa9r\\x96z\\xe4\\xdf\\xf5\\x1d2\\x95&=\\x9aj\\x8f\\xccn\\x108j>\\x9d\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\\xf8\\x9e\\x10x\\xb9o;\\x81\\xca\\x98\\xb7k\\xb83(\\xe0\\x12l\\xcd\\xb7|p\\xfe\\xd9\\x1d#\\xdb\\xd5\\x02\\xdd\\xa4\\xc4\\xef\\xb8\\x92\\xba#\\xbd>\\xdd\\x84\\x0b\\xe6\\xbb\\x11h"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\x93wt\\x8bcz\\xba=#\\xe9_\\xbb\\xd1n\ty\\xca\\x9c\\xca\\xe0\\xa4\\x15>d,\\xca\\x90\\xabi\\xcd\\xb3\"\\xf4\\x8f1\\xdbw\\x14\\xe9\\x93\\xca_1t8u\\xdcm#\\xc7\\x93\\xe5\\xc7th\\xe7\\xe4\\xc5\\xc6\\xb1\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%e\\x1b\\xabn\\x04n\\xa4n\\xab-qgp\\xcc\\x87\\x17bh\\xdcp\\xf81 \\xb8s>\\x80\\x91sw3\\x12\\x1f\\x0b@\\xb3k\\xe7\\xdc\\x0c\\xb1\"\\xe6\\xdf\\x830"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x81m\\xaf\\xb6w\\x82k\\x1eu\\xae\\x9es\r\\xa3\"\\xdb\\xec~\\x1f\\xc5\\x12\\xf9.\\xc6z4\\xbdx\\xbf\\xb7\\xd7\\x1c\\x0b\\xd9\\xfe\\xea\\x14\\xe1\\xeckc\\xf4\\x1a\\x14\\xdey\\xad%*\\xb5\\x83\\x9c\\xbbix\\xc0\\x1a\\xeb\\xfa\\xe4\\x06\\x85\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\x95\\xc1\\xdb\\xb1w\\x87g\\xee^\\xa6n\\x7f\\x16\\x8f,\\xac\\x18\\xd4m\\x96@\\xa1\\xadb\\xb1&u\\x12\\xe5ioe\\x1d\\xd0\\x9cx\\xd7\\xac\\xe8o\\xe8\\xbfm\\x84\\xb9"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9(\\x08c7\\xc8\\xa9\\xbf\\x9c\\x9b\\xeb\\xf0\\x19\\xe7\\xe1j~\\xb1\\xf3\\xc3\\xaf\\xfc\\xe5b8\\xc5$<h\\xa4c\\xb8\\x1e\\x9fnfb\\x84i\\xf6\\xec< \\xf3\\xa0\\xab\\xe0\\x98)\\xee\\xc2\\xad\\xb2\\xa2\\x1c\\xe9\\xc3\\x96\\xe18\\xa8\\xd9\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2\\x87v\\xe8\\xed\\\\xd1\\xf9\\x17\\x05\\x06\\x95\\xad\\xe9\\xf8w\\x86\\xfa\\xbb\\x0c\\xd6\\xf1\\xec\\x9d\\x95\\xa2\\xde\\x82\\xcd\\xd9w\\xe8\\xe3\\xdc\\x17v^k\n\\xd2\\xe4<\"^\n\\xce\\xa2\\xe9"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3num\\xe8\\x8b\\x90b0\\x1a\\xb2\\x0fq\\x85!\\x1b\\xd4\\xb3`\\x85\\xff\\xf8\rw\"xi\\xff\\xb1\\xa6j\\x94w.\\xda\\x9f\\x81p\\xcb\\xfa\\xb6l\\xbfrk$p\\xd8-+s\\xdc?\\x84\\x9e3s\\x1dby\\x95\\xe0\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000tn,sx\\x1a\\x7fn\\xa8\\x00\\x11\\xacuxi\\xef\\\\x0b\\xce\\xb1\\x07aw>\\xd3@l\\x05\\x1fbiw\\xc2\\xd7\\x8b~\\xfc\\xe9\\xd3\\x1f\\xc7v`8\\xb1\\x7fhr"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9;/_\\xd01\\xe8q\\xf0\\x05\\x8b\\xc5\\x00c\\x81y\\x98).\\xee@\\xfe\\xe5\\xf8\\xf6\\x90\\xeaj\\xa4\\xd8<\\x00k;d%j\\xa7\\xbc\\xd6\\xea8h\\xb9i\\xd4o\\x886\\xf2\\x0bk/\\xd0r\\xb2\\x88\\x1b\\x1f\\x07p\\xb5\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000hr\\xa6x*\\xc5\\x02qe\\xd2\\x9fc\\xc0i1\\xdb\\x84\\x15\\x84\\xb5\\x9e\\x1bv\\x95\\x9c\\x9dc\\x89mk\\x1b\\xdc\\xa5\\x95\\x80\\xd6i\\xc2dm\\xee_\\x13\\x97\\xab\\x06\\xc3\\x7f"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb2\\xa5\\x8c>\\x7f\\xc6\\xea\\xc3\\x1b\\x91\\xd2r\\xd1<6\\xe6\\xd9_\\xee\\x8f1\\xeai\\xfe\\xdc\\xf6~>\\x8et7+m\\xc7~\\xe7\\xc8 \\xbb\\xb6\\x9b\\xca^\\xea\\x9a\\xcc\\x0b2\\x18\\xae#\\xf1\r\\xdf\\xb93\\xc9\\xf4\n\\xb6\\xad)\\xd1@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;\\x83\\xbc\\xa67\\xb0e#9@\\xdb\\xf6w\t\\x190\\xc3\\x83\\xd2i\\xb3\\xeet\\xa6\\xfd\\x0e\\x15\\xcb\\x90\\xb2&\\xad\\x1f\\xcb\\xe4\\x15_:\\x9f\\x0b\\x97\\xb7/\\xb5\\xab\\x02p\\x0b"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xb1\\x8d\\x9c\\x86\\x9b\\xec\\x1fw\\x9f^\\xcd\\xdb\\x99\\x87$'a\\xc1w\\x98z\\xaeh)b\\xda\\xb3\r\\xc3\\xd1t8\\xb5\\x0b\\xf5\\xa494\\xd6\\x14j6%\\xba\\xfe\\xe3\\x93\\x9a\\x87g\\x8a!\\xf8\\xb5\\x9c\\x92\\\\xf3ua\\x8bu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\x05\\x11\\x1f\\x89\\x1ah\\x95\\xad++\\x17\\x9b\\xb0;qm\\xe5\\x9b\\xcb\\xc6p\\xe6g\\x974b\\xa6l\\x95\\x84#\\x17\\xe8\\xe4kh\\xc0e<m-\\xc1\\x13\\x1c\\xea\\xcc\\x15"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\xeb\\xc55\\x14\\xd7fi\\xfakulx\\xf8\\x88\\x1e+q=mv\\xcc-h>\\x14\\xbb\\xe8\\x9cg,\\xf6\\x19\\x04\\xc4\\xc3\\x8bg\\x1e\\xcc\\xb2\\x1b\\xf8\\x88\\x1e\\xcenz\\xbf\\x9c\\xb3\\xe7y\\xcfw\\xa1\\x15\\xcb>\\x7fdix\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc6r\\x97\\x82\\x88g\\xa2\\x0bi\\xba\\xb0\\x81`\\xd4\\x9d\\xe6\\xc3\\xb1d\\x9dm\\xd1c9\\x10\\xa9\\x9fi\\x1f\\x0e\\xdb\\xa1&\\xea\\xc2\\xad\\xda\\x03\\xe5\\xf2\\xfci\\xcd\\x0f-\\xa3\\xcc\\"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\xa0\\x1f\t\\x9af\\x9e\\xeb_\\x95z\\x00\\xca\\xee\\xd6\\xbdw,<\\xf1f\\xa2\\x81phe\\x0c\\x17\\x05\\xfbe\\xa4\\xaev\\x8f\\xaa\\xcc\\xb5w\\xfd\\xdf7'*\\xf2vr\\x8a\\x1a\\x18u\\xdf|~\\xa4\\x82\\xdaxb\\xd0\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\xe2\\x99\\x17\\xd8\\xe1|\\xe4\\x0b\\x8b\\xa0er\\xd3z\\xcc\\xc2\\xcd\\xe2bo\\xdcp\\x82\\xb4?\\xed\\x1c\rb4\\xbe4\\x0eo\\x1b\\xf9\\xf4\\xf6\\x02\\xab\\xd88\\x88,1\\x00"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\x80\\xa9\\xc6\\xd9\\xd9\\x87\\xcc\\x97^\\x97\\x0e\\xfa\\x97o\\xfa\\xec\\xec0\\xa6\\x80\\x8fc\\xc4\\x0e\\x91wm\\x9b\\xe4dhw\\xc2\\xcd\\xe0\\xa2x\\x99o\\xf8\\x9c\\xe2\\x04+n\\xa2\\xaf-\\xb7l\\xeb\\x13\\xe8\\x04\\xe9^f\\xa8\\xbf\\xbf\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\n\\xfez\\x1a\\x95\\x00\\x9e\\xbd8\\xfa\\xde\\x03\\x91r\\x962\\xac\\xa9\\xb7\\xa6\\x06lj\\x05\\xc5\\x1a\\xb21\\x96bf\\xbad\\xf2li(\\x92\\xbd\\xa4|\\xcc\\xd4\\xae\\x9a\\x1a"
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf39^\\x86\\xb5\\x030)t|m\\xc0t\\x1f\\x11\\xf8\\xd7\\xf5\\xe3\t\\x0cb\\xf9\\xb3z\\x9b>\\xd2\\xbf\\x1c\\xeel\\xb8\\x80\\xd7\\xb6\\xebnr)0\\xe1\\xd9 \\x8a\\x15@\\xf8\\xad#\\x9b\\x9a\\xb4nj\\xf8\\xb1?aj\\xa8\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xc7a\\x9bx\\xecc\\x9b\\xe4g\\xcfy\\x18\nc\\xbf\\xdf\\x98l\\xa30\\x83hwn\\xc5s\\xe7\\\\xfe\\xcfta\\xc1^\\x9f\\x86\\x01\\xc4\\x87t?\\xb9\\xf4\\x1ft\\xd5"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x88o!#\\xc3\\xe1u\\x81\\xea|=\\x01\\xab\\xa4\\x8a\\x96\\xb6\\xf7\\xda\\x0e\\xa0\\xc0v\\xe3\\x94\\xacd\\x98\\x91\\xdc?\\xa3j\\x1f\\xc1\\x05\\xba\\x03\\xb2c\\xb6\\x1dp5;\\xc0\\xe1;\\x89\\x98\\xa2n\r\\xec\\xf6\\x8d\\x08u\\x16\\xb4\\xe5\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xc5n\\x9c\\xbf)t\\x9ao\\xe5\\x7f\\xa16\\x97\\xee\\xf6\\xd8\\x19t\\xa3\\x18\\xe7\\xf5\\xe2q<\\xf8\\xab\\x8c\\xe2\\xe9\\xca\\x95\\x0e\\xdd\\xf3\\xd3\\x99\\xc2n5\\xcc\\xceu\\x97\\xa1\\xe3"
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*l\\xe3=\\xcb\\x81\\xb6_\\x12u\\xda\\x0ej\\xefg\\xf1\\xac\\xf6\\xa6_\\xbc\\xb1\\x89\\xf8\\xa0\\x84yoz\\x8fi\\x9d\\x9a\\xac5\\xe2\\x9d\\x08\\xa9k\\xa08>\\x15\\xad\\xf0\\x19z\\x06\\xea\\xda\\x8b\\xee\\xbb\\x06\\x08\\xe8\\x00f\\xdd\\xce\\xb4\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\x9e\\x9b\\xd7q'~-\\xdd\\xa2.e/\\x81\\x88d\\x03&\\xe4\\xea\\x18\\x89\\x964vc\\xf7\\x8c\\x93\\xc9\\x95j\\xa0/\\xdc!pv\\xd0\\x89\\xa8\\xe5w\\x03\\x02\\x0e\\xf3h"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x04q\\x8b\\xb9\\x9d\\xa8guw\\xb1\\x9c&\\x8d6\\xf9j\\xfaxpr\\xbd\\xeby\\xaeym\\xab#;\\xaay\\xdf\\xb8\\x0b\\xdfa\\x9f\\xab\\xd6\\x0f+\\xaa\\x04<\\xb1l\\x95\\xdb\\xdd\\x8b\\xd8z_h\\x7f\\x17\\xc5h\\xcc.\\n\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa03y\\xcb\\xd9\\x97\\x00\\x83;\\xa5\\xf7w\\xa2\\x12\\x8465\\x8a\\x07\\xeb\\xaa\\x93\\x07pux\\xdaj\\xeb\\xbf\\x1eqc\\x0e\\x1dm\\x863\\xe9\\xb0\\x98\\xa3\\x97\\x8c\\x8cf\\x12"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'n\\xe4\\x03\\xd8^\\xb3\\x11\\xfd\\x0b\\xe0\\xeb\\x9b\\xaf\\xde\\xf84\\xbc\\x97n|nc\\xbd7-#\\xbd\\xbfk\\xad\\x01\\xfd;\\xddu\\xa5\\xf8\\xdb\\x8d\\xa0\\x0esc\\xe0h\\xf2c\\x9d\\x83\\xf8\\xc4\\x83\\x86\\xc7\\xfe\\x9b\\xcd\\x8d&\\x80v\\x01\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae,\\x83\\xed\\xcf\\xeb\\xdb\\xcc \\x1auw\\x02q\\xf2\\x90^\\xb6\\xcbl\\x97e\\xd5\\x06<\\x0b\n`\\x1c\\x840\\xf4\\xecd\\x1c\\xf8w\\x1e\\x97\\xda\\x88\\xbfj\\xf5\\xcexw\\x85"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04^\\xd1d\\xb8\\x89\\x07\\x18\\x83\\xa1f\\x94b\\\\xda~\\xb8\\x11i0\\xcb7)\\xe2\\x1a\\xa3\\xa2\\xdar\\x8d\\x013\\x8c\\x95\\x0f\\xady\\\\x89\\x19\\x85\\xb30\\x0f1\\x84\\xcf'\\x83\\x85\\xc0s>^!z\\xb3\\x96m\\x94\\x0e/\\xfc\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xdf\\x81\\xb0x\\x0f\\xe4.\\x9d\\xd9\\\\x9a\\x8f2!uk\\xda\\x9f\\x91\\xd7k(r\\xf38\\xc8\"b\\x9f\\xa5d\\xa4\n6\\x9a\\x8b\\xfe\\x8e\\x811\\x11\\x15\\x9a\\xd5\\xc2\\xb7"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xddi*\\xc97\\xee\\xb7\\x0c\\x1a1\\x90\\x96\\x80\\x9f\\x1c\\xfd\\xc1z\\xe0\\x96\\x1cy\\xa7\\xd9a\\xdc\\xe5\\xb1\\xa7`m\\x19\\xc7sk\\x9ap\\xca\\xc0\\xde\\x84\\x82x\\xb4\\xe5kd\\xa1\n\\xbb\\x81\\xa2h\\xa0a\\xd6\\x01\\xa0\\xd7r\\x91\\xac-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"\\x86r\\x04y\\x9d.<=g\\x04(\\x93w\\x91\\xfd\\xb8\\xd83\\xb5\\x101\\x9ey\\xe9i\\xde\\xcb\\xc2.no\\xd9\\xf1\\xafg\\x87\\xe5>cc\\xbd\\x8c\\x95\\x82\\x8b\\x00\\xab"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1|p\\xfb\\xec\\xc3s\\x91ufz\\x05\\xbc1\\xab\\xdc5\\xbd\\x9bhu\\xe9\\x99\\xb5*\\x80\\xe7)\\xe3\\xa4\\x08\\xc9v\\c\\xea\\x90\\x03:u\\x1e\\x1d\\xe2wgb\\xbd\\x7f\\xb9\\x8aj\\x00\\x1dv\\x1e0w\\xbd\\xcbo\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\\xa0q\\xb5c\\xb2g\\xd4\\xadc\\x1f\\xb0\\xfa\\xb6\\xce\\xc6\\xef\\x88#c_j<h\\xfc\\x10\\x9an\\x19h\\xe9\\xb5\\x91\\x8d\\x10h\\x9a\\x08\\xe0\\xd5%\\xa7qa\\x9a\\xc9\\xf9"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xc7\\x9e\\xf8\\x80=\\x1cn\\x1b\\xff/\\xa9\\xea_o\\x86'\\xcd\\xe6\\xb2\\xe2+\\x90\\xb5\\xa9@\\xf9\\x12\\xacq\\xba*oi\\xd8\\xb7+i\\xb93\\xe6\\xa3\\xd7|\\xf6\\x86\\xe5\\xdf\\xac\\x13\\xc2c$\\xdch\\xf2o\\xbb\\xdd\\xf4pcp\\\\xda\\x80\\xf8\\xb8k\\x13u\\xd8!\\x82\\xe0\\x06j\\xa8\\xa7x\\xd1\\x0f\\x96\\xa5e\\x1d\\xc1\\xf1\\xbd\\x077+`\\xadf.w\\xd0o:\\xba\\xbd\\x9dh\\xe7u\t=\\xd7\\xb9_\\xab\\xcen\\xce\\xa8 /\\xc4\\xb3\\x87\\x7f\\x1f%\\x7f\\xe2\\xe2h\\xd0c2\\xe3\\xa1\\x8ab\"\\xce\\xaf\\xc5pf\\x1c\\x90%t\\x17\\xa4u/b\\x9ao\\x16\\xbd\\x85s\\x95q+\\xc1\\x822\\xd2\\xec \\x02\\x88\\xackkr\\xe9\\xd5\\x9d\\xb9p\\x82\\x1a\\x87\\xb5\\xab\\x8di\\xa4\\x17/\\x82\\x1d\\x00~\\xd4\\x01\\x8f\\xf3\\x7f\\xb9(k4\\x85\\xc3\\x9a\\xeb\\xde\\x7f?\\xb7\\x93\\x8d\\x85\tfh\\xc0\\xbb\\xbf\\xd4\\xfa\\x8a\\x9e\\xbe\\x15v\\x93\\x90oe|\\xdf\\xda\\xa1\\xce\\xbe_@z\\x8a2\\xa4\\xbe\\xe4u\\xf7\\xfd\\xc4\\xd0"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\xe7\\x02xy\\x823 \\x8b\\xab\\xee~\n(\\x8d\\x07\\xbf\\x9b\\x0c\\xcb\\xdf)\\xbfx\\x9e\\x1a\\x16\\x84g\\xd7\\x1c\\xddw\\x8e\\xc4z@\\x16\\x7f\\xf8xib\\xe9#\\x06\\xfa(\\x95\\xeb\\x89\\xbd\\xb4\\xb1\\xcel\\xdf\\xb342\\xe4\\xd2iph\\xf1#d\\x9d\\x99\\x1e\\xf9\\xe2\\xb7\\\\xdatqc\\xbf\\xf9\\a\\x0c\\xf1\\xab\\x84\\xeb\\xff\\x89*\\xba\\xfb#c\\xc0\\xc45$\\xd01\\xf9\\x9b\\xb1@ p\\xc6\\xb0(\\xae)du\\xda9\\x89r3\\xdc\\xee\\x02\\x05\\xa2\\x08x\\x11\\xc3\\xad.sx\\xfa\\xfb\\x1e\\xe61h^\\x979\\xba\\xc3\\x8a\\x16\\x81\\xac\\xdd\\xe5\\xee\\xd4u\\x1a\\x98_.\\x11\\x0f-\\xa4z\\x1e\\x15\\xf8x^\\xafl\\xc5\\x81\\xd6\\xfa\r\\x16\\x17\\xa9\\x03a\\x91\\x8e\\xba\\xae\\xa7\\xe5\\x84k\\xcc\\xdd\\xe9\\xaeo\\x8b\\xf5\r\\x81)n\\x9bw\\xc0\\xb8md*%\\xc8\\xcf\\xb8\\xf49\\x81\\x05\\xdct\\xdb\\xd6z\\xcc\\xa2\\x8b\\x06\\xed\\x89\\xdd\rqhc\\x1ca\\x8d\\xd4\\xcd\\xc2\n\\xe2u<\\xfd\\xa4~1_g\\xba\\xef\\xc7"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\xb8r:t\\x859\\x9b\\xb3\ts\\xda9\\xf2,3`\\xb5\\xb3\\xdb\\xb2\\x84s\\xdb\\xb9\\x9dw\\x10+wlm`w!\\x94\\xa8^\\xb4\\xd2\\xa7\\xb4\\xdb\\xab&\\xf4\\xd8n\\x8a\\x87f\\xa6\\xf60\\x83\\x1b\\xed\\x17\\xa3\\xbb\\xd6\\xb3\\xf7y+\\xc0\\xa2\\xcc\\xc0\\xa5\\xc7\\xb4\\xcc\\xca\\xbada!q\\xe1j\\xc7w\\xf3\\xfc%\\xe7\\xb3\\x83 \\x1c\\xeb\\xe2\\xf3\\xee\\xbc\\xee\\xe3\t\\xfa\\x94p\\xc1\\x06\\x17g\\x1d\\x8b\\xf8)g\\x872\\xa3\\xfa7>\\x10%\\x9b\t\\xed\\x01\\xeetx\\xb8%hd+\\xbd\\x9dq\\x92x\\x10\\xd7\\xf2\\xb5/\\xa6x\r\\xe4\\xd9\\xda\\x90\\x1c\\xbb\\x9f\\x92\\xadb\\x01\\xbem\\xb8\\x11\\x81vu\\xcb\\x04\\x15`67\\x95^\\x05e\\x91n\\xe2\\x9af\\xa9\\xcb\\x19\\x93\\x91\\xa94\\x07`\\x0f\\xb1\\x1d\\x84x/\\x05\\xd8\\xef\\xba\\xc1\\x84\\x93\\xba7lz`c\\x1d\\x81\\xbb37/\\xf5\\xea\\xf1\\x9a\\x17l\\xda\\x1b\\x12#\\xba\\xb4>6\\x94\\xd9)\\xa9w\\xc04\\xb4ocu!\\xb3\\xaf$\\xab\\xd9l\\xaf\\x05d"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc\\xb3\\x9f\\x91.f_\\xb5\\x97`5\\x8a\\x97\\xec\\xfc\\xde\\x8b\\xc7\\xca8?\\x92\\xb4y\t\\xa9\\xcdl\\x13$;\\xda>\\xfc\\xe7c\\xeef\\xe9\\x97^j\\x05ma\\xfc\\x1a\\xaa\\x9e!\\xe7\\x00\\xee\\x1d\\xf2\t\\xb5\\x8a\\x98o\\xfcp\\xfd!\\x0c\\xb2r(\\x9b\\xcc(\\xb5\\x16\\xb6~\\xb7\\xb9<q\\xc7\\xe5\\xe1w\\xfd\\xdf9\\x94\\x07\\xce\\xfeurn\\x1f\\xa5\\x04\\xcf\\xd0\\xc4\\x96e\\x98\\xca?\\xa19(\\x93\\xa5h\\xcc-\\x0bl5\\xd0\\xa0+\\x01\\x00\\xddu&\\xe7\\xffjt\\xa1\\xeb\\x1fh\\x84\\xe6\\xd8\\xc0y\\xfav5\\xeda\\x94v\\xc1\\xc7\\xef\\xd08\\xac\\xb3x\\xfe\\xe5\\xb9uy@\\x1ccy\\xb0\\xefc\\r\\xbb\\x15\\x8cf\rx\\xbes\\xdc\\xbb\\xb3|\\x06\\xd21\\xcf\\xe12\"\n\\xf9\\x91i\r\\xb5ds\\xa5\\x99\\xcev\\x7f\t\\\\x92c\\xf7u\\xfd_+\\xea\\xe4\\x87\\x06\\xa4/\\x81\\x02\\xb4\\xb7c\\xa1\\xc3rl\\x82\\x8a\\xb8\\xdbl\\xf8\\x7f!\\xfc\\xdd|\\xab\\xd1\\xea\\xb9\\xae\\x0eod\\x9f\\xc1\\x7f\\x8fh\\xee\\xc3"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\\xb2\\xa1p+\\x9a\\x83\\xae\\xf0\\xcf|\\xb5\\xef\\xa2m\\xf5\\x17\\xb1y\\xaf\\x97v\\x00i\\xdf\\xc2\"\\xfbb\\x90,\\xf5 *h\\x05\\xf9\\x8f\\xa4\\x10\\xcff\\xca\\xe8n\\xaa\\xe2(x!\\xcd-o;z\\xf2\\x03\\xf9\\xa6\\xbd\\xe3\\xb5\\x1a\\xfc7z\\xfe\\x88e,q\\x9b\\xd3\\xe2\\xef&>\\xbe\\xe2\\x86\\x1b\\xd6mj\\xd6&9x\\xf0\\xc3+mc.k\\xc1\\xd9g\r\\xcaj$)c\\x03\\x04\\x89\\xdc\\x05\\xa4\\xdc6|\\x05\\x0cma\\xd3\\xe99\\xf1yj\\x0e\\xd4\\xe6\\x1e\\xa3\\xd0t\\xe1\\xe4\\xd4&\\x05\\xdd\\xb2v\\x9b\\xba\\xf5h\\xd1\\xa3\\xaa\\x8d\\x82\\xe7\\xdc\t\\x1c\\xaa\\xa3\\xd52 gf\\x89\\xff\\x95\\x16\\xfc\\xa3\\xc0\\xaeek\\xbao\\xa3<\\xe4\\xa4\\x0f\\xc4\t\\xb4\\xb5daig\\xdd\\x10\\xdek\\x04\\xfc\\x17a\\xb1\\xe0\\xfbrt\\xabiwfn\\xcd`\\xd7y\\x94\\x94\\x81&\\xc6f\\xba\t\\xf3\\xc6\\xe1\\xf1\\xe5\\xac\\x1b\\xdd\\x99t\\xbe\\xa7\\x14\\x04y\\xc0q\\xf9b2k\\x95\\x075y\\xd8\\xd0\\xbb+\\xda\\xb2\\xea\\x0e"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\xbc\\xdf\\xf4\\xb64*\\xb3\\x1f\\xe3z\\x07\\xda.&r\\xdc\\x0c\\xb0\\xb2\\xd7\\x08\\xc5y1k\\x1b/%\\x85\\x0e\\x02\\x86r\\xd5\\xc19\\x14.\\xe5\\x13\\x01prj\\x86\\x7f\\xc4\n@\\x08\\xc9j\\x1b\\xe6\\x90se <ev\\xf3\\x89x\\x90\\x17\\xb7\\x95\\x9ai\\xbc8\\xb1\\xb0\\x9c\\xdd\\xa1\\x0f\\x80t\\xbf\\xd7k\\xda\n\\xc2s\"\\x93sl\\xb2sgwt\\xd0nx\\xb4\\xd8x\\xd0d\\x9e9p\\xe9kv\\xec\\x10\\x87\\x9df\\x06\\x0c,v6\\x1ba\\xabr\\x01\\xf1\\xba\\x9f\\x86wn|c\\xa6n\\x15m\\xc2g>\\x84\\x1f*\\x91\\xccn\\x0b\\xc8\\x9dj\\xf1\\xe8\\xcb`\\xc04\\xdc\\xe2q&\\x16\\x18#\\x18`\\x8c'\\xde\\x01\\x94\\xc5\\x02\\xd4s\\x18e\\xde\\xd6\\xe2\\xbb\\x00\\x12\\xf5\\x8a\\wm\\xc00&\\xd6&\\xbd\\x8d\\x8b\\xb8u\\x9e\\xcf1\\xc7\\xa6\\x01j\\x1d\\x9b\\xe0\\xca\\x0e\\xe4b\\x9f\\x8b\\xf9\\xde\\xfb\\xb91w\\xc4m\\xd0\\xb3\\x1a>\\x16ob\n<\\x0b\\xee\\xc2\\xbe\\xe1\\x1fmt\\x92\\xf2*\\xa4\\x9d\\xb1\\xd9~\\xb3"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102v\\xaa|z|\t\\x02cr\\xb9\\x16\\xb7\\x861hc\\xc9j\\xc0@\\x13z\\x13-\\xee\\xcd\\xb2\r\\x10\\x96\\x1a$3av\\x17>\\x92\\x135\\xa0g\\x1f\\x9fg|\\xec\\xa7\\xad:\\xc1\\\\x8d\\xc7\\xc8\\xee\\xa8e\\xeebh\\xc5\\xa23\\x13\\xea\\xc5h\\xef\\xdd\\x01\\xc8\\xd8\\xa9\\x03j\\xa1\\xcd\\xfa\\xff<\\xec\\x8a\\x05;d+\\xe3\\xe6s$t\\xb7\\xbc\\xdd\\x9b\\x8a\\x8eb\\x8e@\\xcf\\xa3\\xb1l\\x9f\\x1c\\xc8j\\xd4\\x9bf.(y\\x1b\\x06\\x02\\x84;\\xf9\\xfe?)\\xd2(\\x88o6\\xd2^\\x8a\\xb7\ru\\x8cw|=\\x8e\\x87h\rj\\xab\\xed\\xa3\\xef\\xccc\\xe7w\\xc5xd7d\\xa5\\xa6j\\xab\\xc1\\xdbu\\xbc=\\x05\\x138\\xe6\\x0e\\xb2\\\\xdc\\xd5\\x08\\x0e~\\x92h\\xc9\\xfc\\xd0\\xc1\\xf5\\xb8\\x91\\x07\\xc0%-7\\xd0%|$\\x80\\x95\\xd0\\x91\\xfc\\xe1\\xb0\\xda:y\\xaf\\xd5t\\xc0w\\x8f\\x0by@\\xfcyner~/\\xbf\\x82q\\x87\\x9b\\xfc\t-i\\xaavq;\\x95'\r3y\\xba\\x8a:q\\x98\n"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1b\\x82\\xa5\\xce\\x9d\\xb61\"\\xb7\\x18\\\\xeb\\xf9\\x8c\\xcc\\x89\\xd9\\xbft\\x95r(\\xac\\xe1\"~\\xe3e\\xbc\\xdcl\\xc2w\\xf7\\xec\\xad\\xb7\\xa1\\x91\\xec7_\rr\\x846\\xd9z y\\xff\\x1e2|\\xc9\\x06c\\xcb\\xe4\\xc7s\\xff6<p\n'9\\xec\\xc4\\xb0\\x80\\x8b)\\x8a\\xb2\\xcb4\\x0fz\\xe1\\xa7\\xe0\\x90oecq\\xb1j\\xd2\\xda\\x01\\x14\\xf3\na\\xc5\\xd88s)\\xd4\\xe73sc\\xb7;\\xbd=,\\xdc\\x06\\xcb\\xfe\\x19\\xd4\\xd4\\xfc \\xb7\\xc1\\x8c\\xbf\\xaf\\x1f\\x98\\xd8\\x14\\xff_\\x05\\xe1h\\x15\\x18\\xde\\xf0`\\xfb\\xc1l\\xadu\\x1db\\xb0\\xe0\\xb6h\\x8bf\\x96xqy\\xfe\\x1b\\xb2\\x81j\\x02t\\xeb\\x03/*0q\\xfb\\x11\\x9b\\x00\\xbb\\x1d\\x0b\\xa6p|\\xb0\\xbcq@8\\x85\\x8d\\xdd.\\x993\\x8cc\\x1b\\x17.\\x0b\\xd8i\\xa9\\xcbpc'j\\xe4nsg\\xfe\\xdbx\\xd7\\xd9\\xd9_\\xb4\\xf3#\\xc2\\x94\\xf0\\xd8\\xf2\\xd7\t\\xb4\\x1b\t\\xc1bb\\xd8<\\xbc\\x97\\xdf x\\xe8\\xd4\\x08a\\xd8\\xe7\\x9f"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x15:g\\xc70\\xfevle\\xce4i\\xb8~!\\xa1\\xc8\\xc3\\xcd\\xc6\\x0b\\x01c\\xcb\\x9e=vi5\\x1ar\\xc5(\\x99x\\x08\\xfcs\\x08f\\xbec\\x98\\xf8<exq\\x08\\xdc\\xdf\\xa8\\x02\\xa1\\xd8\\xa8\\x92\\x1es\\xdc\\xb8'\\x97z\\x90a\\xee\\xe09\\xb1\\xfc\\xc7\\x1d\\x92\\x12\\x83\\xbc%6,\\xb3xtt\\xc4?sd\\x08y\\x1b\\xb9\\x90/\\xf9\\xdd\\xfe \\xc5\\xf1\\xb1q\\x1b\\x03*k\"\\xb6y\\xd8\\x11\\xb3l\\xb7c\\x07\\x1f\\xab\\x88\\xd2t\\x08\\xc7\\xb4\\xc2\\x86\\xdbk\\xe4u\\xc06h\\x81c~\\xaa\\x82x\\xf2v\\x06\\x84\\xad\\xde\\xf2\\xaco\\x87\\xfb\\x0ej\\xf2\\xeb\\xaar5\\x8add$\\x92\\x1e\\x9d\t\\xb1\\x14j\\x82kev\\xa1\\xdc\\xac\\xff\\xca\\xe9\\xa2\\xf8\\xc7\\xf5p\\xa0bg\\xc0\\xa3\\xa5\\xfa\\xdc\\xe5\\xe9\tm\\xb8\\xa2\\xc8\\xee\\xba\\xe7\\x8e\\xbanl\\xed\\xeb=\\x\\xf5\\xe7\\x91\\x9e\\x91\\xa4\\xdf\\xcd\\x0e\\x81\\xf1\\xfb\\xde\\xd9\\xaem\\x0f\t\\xdc\\x1e\\xab\\xc2d\\x10\\xa9g\\xcf\",o\\xc4\\xd0\\x8e\\xdd\\xa2"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\ng\\x99\n\\x99gi\\x00\\x12\\xb5\\xd9\\xb6s\\x9a\\xb3h\\x1fe\\xe6\\x92\\x96\\x0f\\x87\\x89\r\\xdd\\xe1\\xa4w\\x83c\\x8eo4\\xd98\\x03c\\x95a\\xf5\\xa3dx\\xc87\\x88@*\\xc8\\xbb\\x8e\\xb3\\xe8i\\xe1x\\x94\r~\\xb70\\xb2i.\\xbe\\x0cu\\xf9\\xdbr\\xca\\xcf\\x88l\\x96sw\\xae\\xdf\\xc7\\xa0/\\x03\\xc4p\\xf3\\x1f\\xe3*\\x8c\\xbbv\\xc4h\\xa5\\xd8\\xeb\\xc3\\xf4\\xa4\\xbe\t\\xe8a\\xdam\\xa3\\xa0\\xda\\xce\\x83t,\\xf3\\xe9\\x06)\\xfc\\xf6w\\xbf\\x1dn\\xaef')u*\\x9a\\xa3q\\xe2\\xffp\\xee/\\x99zfq\\xd9@\\xff\\x93\\xd5xd\\x93b\\x930h\\xc2h\\xc8n\\xdd\\xb9\\x0b\\x11\\xed6*\\x8b\\xbd\\xe8\\xa7aj\\x97\\xff\\x01b6e\\x87\\xf0\\xe8\\x14y\\xbb\\xf8\\xbdu\\xc6\\x8d\\xa4\\xacz\rp/\\xc6tj\\xc5\\xe8\\x8bd\\xc7\\xd3r\\xad\\x8d\\xdd\\xa7j\\x85jm,a\\x06\\x1b_\\x16*\\xc1<qk\\xe5\\xf7\\xbbv\"\\xf9\\xff2\\x9a\\x8cy2\\xc9\\x90\\xc5\\xa47\\xa1\\xf5\\xc6\\xb9\\x90"
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010/p\\x1bm\\xcb\\x87\\xf7\\xfed\\xcei\\xf9\\xef\\x16v\\xc7\\xc14\\x14\\x97v\\x99ksvhh\\xa2\\xf3b'\\xc5\\xe3|\\xf9\\xf2\\x83\\x9a\\xdd\\xf0\\x88_za\\x1d3\\xbbi!\\x9d\\x1e\\xb3\\x05\\x8a\t\\xe1\\xe4-\\xde\\xc0j\\xb5\\x91\\xf2b`p\\xdd\\x0e%\\x88_\\xe2w\\xa6)\\xd9l\\xf0\\xdf\\x05m%\\xd7v\\x9f5\\x11\\xbf3'\\xab\\xc37\\xf1\\xdfv\\x81\\xbb\\x1c\\x0cu\\x1a\\xf5\\xe5h\\x8c-n\\xeb\\x8cz\\x85\\x87<d,\\x13\\xbd\\xfev*\\xb0\\xf0\\xf0\\x96\\x85#*f\\x10\\xbc+dl\r\\x1f\\xeb\\xa7r\\xf2\\xb4\\xec\\xac\t\\xa2\\xe4\\x9ff\\x9d-\\xd4\\xb6\\xc94\\x88\\x03\\xb1^~\\x00\\x8a\\xcc\\xa7_\\x8f\\x15\\x1d\\x0bp0\\xd5\\x92\\x87\\xfb\\xde\\x07\\xc9q\\xfey\\xef1i\\g\\xce\\xe8*\\xe0`\\xbd\\xfa\\xbc5\\xb6\\xce\\xfa\\xd97!\\x1b_\\xd4qx,\\x82\\xf5\\xd7\\xca*\\xe7 e\\xce\\x06\\xa6\\xabr\\xc0rp\\xbcr\\xdc\\xaf\\xb9\\xcc\\x03\\x0cz\\x95\\x0eqg+k_\\xfcpb\\xbb\\xcb\\x81\\x968"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xec\\xa45\\xee\\xd2\\xaf\\xb3\\xd5\\xff\\x1f\\xed\\xef\\x028\\xa8l\\xcdp\\xbam#\\x81\\x86+i \\x92\\xeaa\\xbde7jl\\xbe\\x825)\\x15\\xd5\\xf2\\xd2wz\\x7f\\x89g\\xc1t\\xf9\\xdfz\\xabe\\xde\\x05<w\\xd0\\xb6\\xfe\\xc5\r\\xf8d>\\xb6$\\x98l\\x02\\xdcsf\\x1a_\\x89_\\xe5\\xb8\\x90\\xf3hbu(\\x15\\xb5\\xd0e\\xd9g\\xb2c\\xc1\\xd6\\x17)!\\xab\\xc9\\x8f\\xefk\\xb71\\x02h\\xdbwngg7f\\x8dt\\xfc\\x0fv\\xdf\\xada\\xed\\xc4\\x84r\\x1d\\x96%\\x80u3\\xad\\xa3\\xc1$\\x12 #e\\xb2\\xcb\\x83rv\\xf1\\xaa\\xd9\\xf0)\\xfc4>\\xb3\\x1c\\x96>\\xcc\\xd23|\\x0e$\\xc8\\xa6\\xfe\\xaeh\\x92s\\x9f\\xc2d\\xfao\\x1b\\x11*5\\x11\\xa1\\xb2.\\xff^7\\xa6\\x81\\xea\\xcb\\xdbs\\xf8\\x02\\x07\\x85\\x96\\xcf'\\xa6\\x91w\\x9f\n\\x87\\x86>\\xb5\\xf0\\xc2\\x99\\xb6<\\x1e\\xb1\\x14\\xdbv\\xdb\\xcb,,\\xd1\\xf2yrg\\x90\t\\xacm\\xa7\\xbc\\xf1\\x0374(=\\xd2\\xf3\\xd60\\xc1u\\xea\\xbbq\\xa9"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcbh%\\x9a\\x07,x|:ix\\x90.p\\xcb\\xc0\\xf5f\\x02\\xe2\\xffl\\x1d+\\xc0p\\x15\t\\xe7\\xd9\\x92k\\xd6\\xbd\\x19a\\x96\\x9c%\\xe4\\xf1\\x1a3\\xdby\\xb1\\xc0\\x1f\\xed\\xf5w~r\\xcay\\xf8\\xc8`\\x07b\\x05\\xff\\xb4\\xac'-y\\xa3\\x97\\xec\\x98d;py\\xdbp\\xd2b\\xa9\\xd1\\xf2\\x068d\\x17\\x03\\xb8*\\x8a\\x18\\x94g\r\\xb6\\x13\\x85\\xc6_\\xe7\\x94\\xbau\\xf6\\x12\tr\\x9b\\x9c\\x00\\x08\\xe1\\xae\\xd3\\xc0\\xf0\\xb2\\x9e\\xa9>\\xc2o\\x91\\x00\\x86\\x07\\xf3\\xa6s\\xbe\\xc0\\xc6\\xadq\\xd4\\xf2\\xdd\\xd7\\x15\\xa6\\xfce\\x02t\\xa4\\xddf\\xe6\\x02\\x93\\x9d\\x06\\xba\\x90\\xadzisp8\\xbes\\xdau<\\x9d\\xf3\\xf6\\xd3\\x9c\\xednf\\x92@\\x99\\xd76\\xf5qyj\\xb0n\\x18\\xb4\\xf4\\xfd.\\xcc\\xe5\\xf5\\xbc/\\xcc\\x19\\xf3/z`\\x84>&\\xed\\xeb7z_%xt(\\xad\\x11\\x1a\\xa5\\x97\\x8dbu\\x81\\x9ep\\xe1k.\\xb8\\\\xb1f\\xc1%\\x15\\xc7\\xb7\\xc2\\x9d\\xcf\\xc9(\\x07\\x84k\\xbdc"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0w\\xe5q\\xa8<y\\xfd\\x1cv\r\\x9d\\xf6\\x96\\x987s;\\xbb\\xaas\\x05\\x1b\\xb7\\x10c\\xdc\\xa0\\x95\\xfc\\xa1\\xf6\\xee1#\\xe8v\\x81\\x12\\xa8\\x08y\\xcd\\x9f&\\x91\\xe4\\xe1k/1\\xd10$\\xbet#\\xa5-w~\\xd3\\x8d)\\xd4\\x97%\\xc9\\x96\\xba\\xc3\\x98\\xf3\\x95cp4\\x99\\xdc\\xc9c\\xc01\\xdb\\x0bsri\\x1f4\\x9e\\xbf\\x92\\x84-\\xfb\\xc5\\xb8d\n\\x8bky\\xb7\\xfc1\\xd5$\\xfc\\x80\\x7f0p,\\xa5\\x08\\xbe\\x0f\\xe8\\xa8\\xd2\\x07(\\xaevg\\x04\"o?\\x9f\\xf8\\x16\\xc8f\\x05\\x92)\\xfa\\xc4fr\\xe3+v\\xd2\\xd0\\xc9\\xa0\\x8f\\xaf\\xa1d\\xa1\\x84\\x8c\\xf4.\\x1cp\\xa5\\xb5\\x11\\x13\\xb9c\\x9bm2y<\\xdc\\xf5h9\\x8f\\xb0\\x07\\xf6`\\x83\\x95\\\\xd8\\xb3\\x95_\\xc8\\x7f\\x00kbm\\xd34\\xc4-\\xe2`\\x89\\x05e\\xc2\\xfc\\x19\\x06l\\xf1j\\xbb\\xa3\\xc8\\x86\\x03^\\xc7\\x7f\\xfd\\x04n\\xf9,ps\\x87\\xfc\\xc13\\xd8\\x88\\xc3*ya\\xfd:\\xc6\\x80\\x91\\x8e\\x02t\\xdf\\xc2\\x9d\\x1f\\x04\\xd6"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\xfc\\xff\\xd8\\x83\\xc8x\\xf7\\xa4\\x8d\\x01\\xe3y\\x95z\\xd5\\xaa:\\xd51\\x00(c\\xee\\xf4e\\xeb\\x16z\\x19\\xd8\\xa0**\\xb46\\xfa\\x93\\xdf\\xb7\\x1c\\x82\\xc75\\xc3\\xa4\\xb8\\x9ctu\\x7fr\\x0b\\xcc\\xa6+\\xab\\xc3\\x04\\x91\\xa1\\xee\\xc3\\x0f\\x05\tm\\xe1^\\xd2\\xec^\\xfc\\xf8\".\\x19\\x8e\\xd3\\x0b\\xd6n$\\x0b4g\\xcbx\\x14~'\\x15\\xff`\\xa8\"\\xcc\\xc9\\xc8\n\t>\\xc2\\xbd^`\\x03@\\x92m\\x9e\\x13\\x97\\x03\\x1f\\xeav\\x8e\\x83>n\\x17e\\x9ak\\xc1v8\"\\x12\\xfanj8\\xe8:y\\x19\\x90xs+\\xe5r*\\xcd \\xd6\\xdb\\x1bu\\xf6\\x92zf\\x7fm~\\xa5o\\x0f9e\\xdd\\x1d\\x8dl^\\xcb\\x97b\\x17\\x7fw\\x83z1c,\\xd2\\xfa'\\xf7\\xd9\\xa3\\x02b\\x91\\xe6\\xa8pvn\\xf2hmp2\\xdf\\xa3u\\xfd\\x94y\\xbfl\\xbc\\x866>\\x84<\\x94\\xa2e\\xd2\\x0e\\x9e\\x01x\\xd9h\\xaf\\x1f+\\xdf\\xae\\xb8\\xf1o\\x8e\\xb8\\x94v0w\\xca\\xf5,\\xa32\\xb8\\x02\\xb9n\\xef+\\x87"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\x8b\\xa1\\xff\\x83\\xcd\\x11\\xa0\\xc6 \\xb3(\\xbf\\xa4\\xceedx\\xfb\\xae\\x0b\\xf5*\\xb1>\\xcf\\xc6`\\xa6\\xd8l\\xcf\\xee\\x03\\xb0%ija\\xacg\\xfe\\x8b\\x85\\xc1\\xbc\\xa3\\x1a\\xf9\\xf9b\\x9f\\xa0\\x81\\xb3|\\x11\\xce\\xf9\\xb0\\xbc\ry\\xb0\\x974\\xbd\\xcb\\xa6\\xb5\\x81\\xe7#\\xb6\\xbd\\x901\\x1b\\x8b\\xd8\\x8eh_\\x01%c~+fn\\x19\neb\\xa7\\x84\\xe6ch\\xf9\\xa9\\x13\\xdbq\\x95y\\xa0\\x82%\\xb3\\xe9;\\x12\\xc5\\xfe.\\xf2\\x85\\x8d\\xa9\\x80\\xf9\\x9a\\xe0\\x9e\\x88\\xf2*9\\x85\\xd9\\xdbk\\xd8\\xe8\\xbf\\x1f\\xb8\\xe5\\xf7\\xa2\\xe9\\xf3\\xbb\\xc98\\x88g\\xe9\\x8a\\x94\\xe2\\xd1\\xff\\xc6m\\x12q\\x06u4\\x13\\x12\\xb5\\x1e$\\x10/\\xefg\\x84\\xa6+\\xae\\xe1\\xb3\\x1fv^\\xeb\\x12\\xf8\\x9ca\\xbbe\\xf5^\\xc8\\xc7\n\\xbb\\xa9j1\\x9c\\xc6'\\xe7\\xe6\\xc9\r\\x14c\\xfc\\x84\\x89\\x0cc\\xa5\\xe9\\x80\\xf4\\xcb:\\xcb\\xb2\\x13s\\xc1\\xb5e\\x07\\x0c\\xe6\\xfeb\\x88y\ndp\\x17\\xc9\\xbf\\xe3\\xf4\\xe82\\x81v\\xc8\\x87\\xe9\\xb7\\x81\\xb5\\x0e\\x99\\x84\\x92"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\xae\\x96\\xcao\\xfe\\xb6\\xd3$\\x116\nf\\x0c\\xebei\n\\x0b9\\x8e\\xff\\xa0\\xe3\\x8c3\\x17\\x1cx2\\x91\\x19\\xf0|6\\xbd\\xceg\\x8b\\xff\\xe0\\x9a\\x89y\"\\xbd\\xaa\\xfd\\xd7p=\\x0e\\xecbf\\xb3\\xa5\\x8f.\\xd7i\\x1c\\x0e\\x89\\xb8\\x8c\\x98@\\xf0\\xa7\\xba\\x08\\xe2\\x83j\\x1b\\xa8\\xb9\\x15\\xd0\\xd9\\xc0q,\\xe5\\x08f\\xcd\\x99\\xde\\xc1\\xaa\\xb3\\x05\\x02\\xec\\x9ej\\xfew\\x90!\\x96\"\t\\xc4(\\xdf\\xbe\\x9cek`\\xad\\x81\\xc71_\t\\x1c(pqrih\\xb2\\xa2\\xa1\\x85\\x97\\xd7\\xefih\\xbf\\xccp\\xb1?u!0.\\xd47\\xa7t9\\x11/\\xdf\\\\xa9\\xb4\\xb2\\xb4\\x15\\xc9h\\xc9hq\\xa0\\xc0\\x86\\x10\\x8a\\xd1\\x96k\\x06\\xee\\x14\\xba\\xb6\\xd3\\xe2\\xfb\\xb9\\x16\\x91\\x1f\\xf7\\x10h\\xb1\\xb9\\x02q\\xb6\\xaa\\xffk\\xe1\\xeatr&dytr\\x99pg\\xcd\\xb0q\\x19\\xcc\\xb1b\\x8a\\xe5\\xbb\\xe6=4\\xc8;\\xc9jk\\x93\\x8fd\\\\xed\\x96\\xa7g\\xb6\\xaa\\xe3q;\\xa8\\xe3\\x87\\x83\\x05xlm\\x07r"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x14\"\\xd8\\xac\\xf5\\xcf\\xafdh\\xaa\\xbb\\xaa\\x0ex\\x9a\\x16/\\xc9\\x1bb\\2\\xf5\\x98j\\x88\\xb5\\x146q\\xdf\\x9f\\x07\\xebr\\xcc\\xfc*\\xb9\\x11\\xe8\\x17fl\\x13@\\xad\\xb4\t\\xe8\\xb1\\x02\\x1f\\x14\\x0c\\xb1o\\xee\\x7fl$n\\x82\\xc5\\xd9j\\xac\\xce\\x85l0\\xed\\xe9\\xdfg\\xcb\\x06s\\xca\\xb2a:\\xe4(0u\\xf4\\xd9o\\xe4\\xcf\\xfa\\xf88\\xc7\\x1a\\xe2\\xea\\x99\\xbc\\xaf\\x03\\x8a\\xefbhz\\x1d8\\xfe)\\xe7\\xc6\\x88nw\\x10\\xe6\\xad~~_\\xbe\\xe0\\x07u\\x81\\xd4\\x10\\x916\\x80\\x9d\\x07\\xbaqfm\\x00\\xe9y#\\x13w\\x1e\\xbe\\xb3\\x03\\xf4w&\\xbb\\x97\r\\x84\\x02i\\xe0\\xfe\\x14\\xe1\\xad\\xba\\x9c\\x89b\\xde5\\xad\\xb74\\xe3\\x90f\\x1b\\xe7\\x18s\\xb6e\\xa4\\xd6\\xbeu\\x8d\\xb5\\x16\\xf1d\\x99\\xa2\\xa8\nn\\x90\\xd7\\xe0\\xcf\\x07\\x99\\xa9\\x98b\\x13\\xf9\\xbf\\#!\\x95\\xb9\\xd8-\\xfe\\x1b\\xef\\xabjw\\x1c\\xd86\\xf1v5s\\xb6\\xf6\\x80\\xafn\\xa3\\xe3:\\x9d\\x0c\\x9b\\x02n$\\xf9u\\x83\\x03:\\xca\\x8a\\x81"
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\x9fh\\x13\\x7f\\xf4\\xd6\\xe13\\xa8d%\\x02\\x84\rs\\x10\\xfbzk*\\xc3\\xb9)\\xfb\\xcb\\xef\\x1a8\\x07\\x1b\\xa8\\xd1\\x81@\\xf4\\x8f\\x13x\\x9e\\xbeu\\x9dq\\x87\\xb4r\\xd7\\xdc\n\\xf8>os\\x13h\\xa1@\\xd7\\x85\\x8e\\x195\\x9a2in\\x8b\\xf0\\xfchw(l! \r\\x7f\\xef\\xf1\\xe8\\xbc\\x96\\xb1\\x0c\\x94\\x94e6\\xd0\\xdb\\x1fj\\x9d\\x8f\\x89\\xca\\xaf\\xfa\\xa8\\xe9\\x84\\xdc)q\\x87$\\x82k\\x81p\\x13sn\\x13\\xc6\\xd7\\xbe\\x06o\\xc3j<\\xfa\\xb5\\xcae\\xdb\\xbc\\xabr\\x8a\\xfd;\\xc1\\xa2\\xb1\\x8af.\\x1a3\\x81\\x92\\x1f\\xaa\\xd0\\x90jp\\xb4!\\x18\\xfdhy\\xa2\\x9f\\xaa\\xb9r6\\x12\\xc1\\x8a\\xc3y\\x0b\\xf7\\x10\\xa0\\xfa\\xb8\\x83\\x05s\\xbc\\xfd\\x9e;\\x05\\xf0\\x06\\xad \\xa9\\xfe%\\xef\\x91\\xa7\\xf9\\xc7\rr!\\xb5\\xc0\\xde\\xd1!.md\\xe7#a\\xcf@\\x89\\x80z\"p~$\\x1a6\\xf8\\xbf\\xbc=\\x94g\\xb8\\x01w\\x17\\x95q\\xee\\x00\\xf4\\x93u\\xdb\\x04\\xe1h\\x02dl\\x9b\\xeetc\\x04\\x92\\xf1"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b\\xd5j\n\\x1c\\x1b\\xaf\\x85\\xcd\npj\\x81j\\xb6\\x15\\x8f\\x14q5\\xd1\\xa1asq\\x05\\xb2\\xece\\xfa>z\\xf3v:f,\\xd3\\xd7\\xddl\\xcea\\xee\\x8c\\xb6t\\xc9\\xc4\\xb1\\xea5\\xe4\\x0e4\\x11\\xbeq1\\xfd\\xb0w\\xa0\\xf9\\x0e\\x97\\x92\\x196x\\x08r\\xe9ds<\\xcb\\x99\\xc1\\xb6k\\x18\\xd3\\x05\\xa4\\xf5\\x00\\x01\\xa6\\xb3|\\x15\\x07\\x99\\x8c\\xf89w\\xaac88\\x00\\xd3\\x06lp\\xa35\\xd8,\\xa7ye\\x921\\xf4\\x13\\xa6v\\xb5n\\xbc\\xd2\\x99m\\xd6\\xc5=\\xf7z\\xfbu>m\\xa4=\\x1a=\\x05^\\x06\\x11u\\x85\\x00\\x91\\xed\\x84c\\xc2c\\xe0\\xb2\\xbcp\\xdd%\\xc2\\xae\\x10xe2\\xdd\\xf3 \\x9d\\x13@\\xbd\\xc2\\x9d\\xa6\\x91*r:\\xecia\\xcef _\\x81\r\\xd1\\x1ad\\xaa\\xab\\gl\\x85\\x1b\\x8b00\\x0b\\xd1\\xb8\"\\xab\\xc3\\x0f\\x14\\xe0a\\x06\\xda\\xac\\xc8\\x96\\xd7\\xf4\\xd7\\x87\\xd3\\x82\\x9c\\x88\\x80\\xc3n\\xb1\\x1bjk8\\x97\\x07\\x03\\x177\\xde\\x91\\xd6k\\x81\\xeea\\xe6\\xb4\\x0e\\x1a"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb\\xf8\\xbbsd\\xd0\\x17\\xe7\\xd7q&\\x85'\\xaf>\\xb6\\xc1\\xbf\\x08\\x00\\xae?\\x95\\x9c\\x90\\x1e\\xb2_\\x02\\xb3\\xeb\\x99>p\\x1cs\\xc9\\xe32vi\\xd9\\xfe\\x07\\xc7ug\\x13\\xae.\\x88?\\xce\\x1b\\x1f\\x17\\x83\\xc3\\xe8i`\\xc6\\x13 \\x1a\\x1b\\xde\\xc5\\x92\\xb6/\\xee\\x01\\xfb\\x97\\x0c&qr\\x84\\xfbq\\xbb\\xfca\\xc8\\x81\\xe6\\xbc\\xb2\\x8b\\x15\\xdf\\xb2 \\x0f\\xef\\xdc\\x8d\\xe1\\xd9\\xabr\\xf3\\xc4)s\\x93\\xad\\xa2\\xbf\\xd3rr\\x0c\\xefy<k\\x87\\xc4v@la\\x86\\x9e3d\\xc8\\x0ch\\x9a\\xb5q9\\x1c\\xd5\\xdd\\xfd\\xd8\\xf1\\xa7\\xd4\\x0c\\x1f\\xaa/\\xbb\\xc4\\xf5\\x97 \\xf2iw,eg\\x9a\\x9d\\xee\\x0e\\x86\\xf3\\x18m\\xb1@j\\x01\\xba\\xcd\\xa2\\x13j|\\\\xc2ib\\xcd!$\\x19\\x85\\xdca'\\xca)k\\x05\\xdeyx\\xd4u1\\xdch\\xa0)o\\x8d\\x02\\xa8w\\xe2\\xc5\\xe6y\\x99:\\xb0\\xa0\\x9dwgh\\x9df\\xd7\\xabnb\\xf1\\xaboy\\xb7l\\xbb\\xee4m\\xc6o\\xf4\\x84\\xf2\\xa2\\x06\\xe5<\\xa4\\xd4"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01b\\xc4\\xa0y\\x0c\\xbb,r\\xb22\\x82\\xed\\x84s\\xd1\\xa0\\xf4\\x85d: \\xca\\xc3+\\xef\\xb0\\xdek\\xf0\\x97\\xe5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00/om\\xef2\\x10\\xbd\\xac\\x9d\\x88\\xe9\\xd0\\x87\\x02\\x10\\x0btr\\xa1j)\\xee4\\x0e|\\xa9\\xd9\\x9d\\x9ax\\x1f\"\\xecp\\x05+g\\xd6|\\x04\\xa2\\xaf\\x9b=|2\\xb0\\xedo\\xccm.\\x9c7\\xeb\\xdd0\\x07\\x83m\\xfc\rq^\\xddl\\xb7\\x94k)u\\xc9%\\xdc\\xff\\x11\\x99*\\xb8)\\x9c\\xea\\xc4\\x03\\xfc\\xc4\\xd6\\xa7f\\xac\\x07t\\xaf\\x8a\\xe5\\x83\\x03\\x15u\t\\x81\\xc5\\x89\\x1b\\x96\\xccc\\xfa\\xee\\x13\\x80\\xc7~<\\x19\\xf8a;\\xecz\\x10%\\x98\\x92y\\xd9\\xa2'u_\\xfb\\x90\\x9b\\x89\\x81e\\x17\\xf29\\x8c\\x8bpqr\\xb1\\xea\\xd6izk\\xe3\\x0c\\xac<\\xa1\\xd8k\\xbb'\\xbe\\x916u\\xe9\\x94\\xc0\\xa6`\\xc6b\\xe3o\\xa9\\xba\\xb0\\x83\\xac\\xa2\\x16\\x16<\\xf9\\xa5\\xf6\\xe3\\x84~\r\\xbc\\xe85\\xa6\\xaa\\xefv\\xbe\\x07\\xce\\x0c\\x04f~\\xb3\\xe8\\x06n\\xbbb\\\\xab\\x85\\xbd\\xcdn((\\xa7\\x12\\xa0\\xe8\\x1a\\x8as4\\xe4\\xba\tb~\\x18&\\xb9\\xf7\\x97a\\xe8\\xb6\\x9d\\x1fm\\xf4|"
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xa8\\xae\\xe1\\x1dl.\\xc7+\\x8as\\xe5\\xac \\xaaa\\xbf\\xe1',\\xcdj\\xe7f\\xa0\\xcap\\xcd!8\\xc4\\xa3v\\x00\\xd8\\x9f\\x9bmednh\\xf6\\xa6\\xd1nis\\xa9\\x0f\\x89\\x03\\xd5\\xa2\\x86\\xcb\\xe2i\\x83\\xf7\\xb5>g1\\xce7\\xa8\\xa7'kk\\xdf\\x08\\xf7|u\\x05\\xcf_.\\x90\\xb6g\\x17m\\xcd\\xc9z\\xbd\\xf5\r\\x0b\\x82\\x05\t2\\x11\\xd6)\\xd3\\xa8\\x81&\\x07\\xc2\\x01\\xcci\\x02\\x983w\\x13lx\\xfe7o\\xf0m\\x98q\\xef-\\xc0\\xe8\\xa0i&\\x1a\\xe1\\x9f\\xe8\\x05\\xf0\\xa9'\\x04\\xe3\\xa4\\x8c\\xfe\\x81\\xc8\\xfc\\xb1\\xc6k\\xc1\\xae\\\\x99\"\\xff\\x8e\\xe3\\xd5\\xbc\\xce\\x07\\xee3\\xe4\\xe9\\xa5\\xb52\\xf1=,\\x9ao \\xcf1\\xae\\ig\\xbei\\x1dk\\xcb\\xc5\\x8a\\x1b\\xcd\\xac\\x85)\\xb3f\\xa5\\xbd>\\xbe\\x1f\\xc1\\x8c\\xba\\xe6\\x07\\xc6\\xef\\xabbe\\xaf\\xd9\\x0c\\x9fa\\xad\\xeeq\\xf5v\\xf1?\\xf2\\xc6\\xd1`\\x1e\\xff\\xddt`\\xefq\r\\xba\\x7fn\\x18&\\xc9\\xc0\\xeb\\xb3\\xdd\\xbc\\x0exhz\n\\xec"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xec\\xe1\\x8e#\\xa7\\x83\\xad\\xe2\\xa5\\xdc\\x10\\x0e\\xf8\\xf3\"\\xcda^\\xdc\\xa4\\xe5\\xaa\\xcb\\xc8f\\xeb\\x9f\\xf3\\xbc\\x8c>\\xe3\\x96ll\\xa4x\\xaf`3,\\xd2\\xd9\\xb0y\\x9e\\xfe\\x87\\x8d\\xb5\\xba\\xf0_>a\\xdc\\xc0\\x0b\\xa7\\xd1\\xd0x\\xbf\\xff9\\xc1\\xfe\\x8d\\xd7\t\\xfdq\\xdf\r\\x8d\\xfc\\x93\\xd41\\xf63e\\xf2\\xc1w\\x11\\x86l@\\x80\\xcd/\\x91\\x08bwp\\x89\\xc3\\x1d\\x18\\xd0\\xa3\\x90x\\x87h\\xfe,$\\xb0\\xa4\\xe3j\\xe9\\xf5\\xa5\\\\xf2\\xa7\\xd4\\xb04\\xb5\\x07\\xd0\\x87\\xd5\\xca\\x01b(p\\xd8\\x8bd\\x8c\n`\\x91%\\x14zg\\x14\\xd3\\x94f\\xc2\\xf4\\xdfk\\xa2\\x9ef+\\xa5\\xeam\\xd1\\xf7.\\xff\\xfe\\xe8\\xa1\\x15ui\\xfd\\xc2u\\xf3\\xc3\\xee\\xeag\\x1b\\xe6\\x00\\x8f\\xe0\\x90s\\xa9\\xd0\\xfc\\x00\\x89\\x87d\\x1ak\\xb4\\x00\\xda^\\xcevp\\x88\\xd4\\xa0<\\x98|\\x8e0\\x9bo\\xa7\\xe1\\xd1\\xac\\x07f-\\xa6\\x17\\xa3k#\\x1c\\xaa\\xc4=\\xbep\\x83\\x98'\\xdd\\xfe\\x8f\\xc2w\\x87\\xd0h\\xa9\\xc3\\xcb$9\\x05b"
  549.  
  550.  
  551.  
  552.  
  553. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  554. "Details":
  555.  
  556. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  557.  
  558.  
  559. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  560.  
  561.  
  562. "office_dl_write_exe": "winword.exe_InternetReadFile"
  563.  
  564.  
  565. "office_dl_write_exe": "winword.exe_NtWriteFile_C:\\Users\\user\\AppData\\Roaming\\crydpr.exe"
  566.  
  567.  
  568. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  569.  
  570.  
  571. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  572.  
  573.  
  574. "office_dl_write_exe": "winword.exe_InternetReadFile"
  575.  
  576.  
  577. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  578.  
  579.  
  580. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  581.  
  582.  
  583. "office_dl_write_exe": "winword.exe_InternetReadFile"
  584.  
  585.  
  586. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  587.  
  588.  
  589. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  590.  
  591.  
  592. "office_dl_write_exe": "winword.exe_InternetReadFile"
  593.  
  594.  
  595. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  596.  
  597.  
  598. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  599.  
  600.  
  601. "office_dl_write_exe": "winword.exe_InternetReadFile"
  602.  
  603.  
  604. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://185.62.189.153/crydpr.exe"
  605.  
  606.  
  607. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/crydpr.exe"
  608.  
  609.  
  610. "office_dl_write_exe": "winword.exe_InternetReadFile"
  611.  
  612.  
  613.  
  614.  
  615. "Description": "Installs itself for autorun at Windows startup",
  616. "Details":
  617.  
  618. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UWOhusOTiK"
  619.  
  620.  
  621. "data": "C:\\Users\\Public\\UWOhusOTiK.vbs"
  622.  
  623.  
  624.  
  625.  
  626. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  627. "Details":
  628.  
  629.  
  630. "Description": "Creates a hidden or system file",
  631. "Details":
  632.  
  633. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  634.  
  635.  
  636. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  637.  
  638.  
  639.  
  640.  
  641. "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
  642. "Details":
  643.  
  644. "MicroWorld-eScan": "Trojan.GenericKDZ.57214"
  645.  
  646.  
  647. "FireEye": "Trojan.GenericKDZ.57214"
  648.  
  649.  
  650. "CAT-QuickHeal": "Exp.RTF.CVE-2017-8570.A"
  651.  
  652.  
  653. "McAfee": "Exploit-CVE2017-8570.d"
  654.  
  655.  
  656. "Arcabit": "Trojan.Generic.DDF7E"
  657.  
  658.  
  659. "NANO-Antivirus": "Trojan.Script.Vbs-heuristic.druvzi"
  660.  
  661.  
  662. "Symantec": "ISB.Downloader!gen60"
  663.  
  664.  
  665. "ESET-NOD32": "VBS/TrojanDownloader.Agent.RRM"
  666.  
  667.  
  668. "Kaspersky": "HEUR:Exploit.MSOffice.CVE-2017-8570.a"
  669.  
  670.  
  671. "BitDefender": "Trojan.GenericKDZ.57214"
  672.  
  673.  
  674. "Ad-Aware": "Trojan.GenericKDZ.57214"
  675.  
  676.  
  677. "Emsisoft": "Trojan.GenericKDZ.57214 (B)"
  678.  
  679.  
  680. "TrendMicro": "HEUR_RTFMALFORM"
  681.  
  682.  
  683. "McAfee-GW-Edition": "Exploit-CVE2017-8570.d"
  684.  
  685.  
  686. "Ikarus": "Trojan-Downloader.VBA.Agent"
  687.  
  688.  
  689. "Cyren": "JS/Downldr.QN2!Eldorado"
  690.  
  691.  
  692. "Microsoft": "Trojan:Win32/Sonbokli.A!cl"
  693.  
  694.  
  695. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  696.  
  697.  
  698. "GData": "Trojan.GenericKDZ.57214"
  699.  
  700.  
  701. "ALYac": "Trojan.GenericKDZ.57214"
  702.  
  703.  
  704. "TACHYON": "Suspicious/RTF.Script.Gen"
  705.  
  706.  
  707. "Zoner": "Probably RTFObfuscationD"
  708.  
  709.  
  710. "Rising": "Exploit.CVE-2017-8570!1.AFC6 (CLASSIC)"
  711.  
  712.  
  713. "MAX": "malware (ai score=81)"
  714.  
  715.  
  716. "Fortinet": "VBS/Agent.JURO!tr.dldr"
  717.  
  718.  
  719. "Qihoo-360": "susp.rtf.objupdate.gen"
  720.  
  721.  
  722.  
  723.  
  724. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  725. "Details":
  726.  
  727. "dropped": "clamav:Rtf.Exploit.CVE_2017_0199-6231737-0, sha256:eaf16dfbf27106330fd8860ddcf181e08e0bdd9a276e575345eb8efa946c6374 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RTF_86501d0eb001e0806687f557db7fceae.doc, type:Rich Text Format data, version 1, unknown character set"
  728.  
  729.  
  730.  
  731.  
  732. "Description": "Drops a binary and executes it",
  733. "Details":
  734.  
  735. "binary": "C:\\Users\\user\\AppData\\Roaming\\crydpr.exe"
  736.  
  737.  
  738.  
  739.  
  740. "Description": "Martian Subprocess Started By Office Process",
  741. "Details":
  742.  
  743. "office_martian": "c:\\users\\user\\appdata\\roaming\\crydpr.exe"
  744.  
  745.  
  746. "office_martian": "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regsvcs.exe"
  747.  
  748.  
  749.  
  750.  
  751. "Description": "Collects information to fingerprint the system",
  752. "Details":
  753.  
  754.  
  755.  
  756. * Started Service:
  757. "osppsvc"
  758.  
  759.  
  760. * Mutexes:
  761. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  762. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  763. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  764. "CicLoadWinStaWinSta0",
  765. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  766. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  767. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  768. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  769. "Local\\WinSpl64To32Mutex_1cec0_0_3000",
  770. "Global\\CLR_CASOFF_MUTEX",
  771. "Global\\7140dd53-8224-4a4c-a761-095bf953a286",
  772. "Global\\.net clr networking"
  773.  
  774.  
  775. * Modified Files:
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_86501d0eb001e0806687f557db7fceae.doc",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_86501d0eb001e0806687f557db7fceae.doc",
  778. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  779. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  780. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFBA7F49D8-75EA-47C1-8152-0540DEF27AD2.tmp",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.scT",
  782. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  783. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6A1A.tmp",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6A1B.tmp",
  786. "\\??\\PIPE\\srvsvc",
  787. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\crydpr1.exe",
  788. "C:\\Users\\user\\AppData\\Roaming\\crydpr.exe",
  789. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS73591845-3A46-41EF-8581-8997CD801F96.tmp",
  790. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0CA3236-9C80-44BE-9405-5C3BF46537C5.tmp",
  791. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\E807B894.png",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_86501d0eb001e0806687f557db7fceae.asd",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DC.tmp",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DD.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93EE.tmp",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93ED.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93FF.tmp",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9401.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9413.tmp",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9400.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9414.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9412.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9434.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9435.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9474.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9485.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9486.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A7.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A6.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94E7.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9517.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9518.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9528.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cab953B.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cab954C.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9539.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cab953A.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab955D.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cab957D.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cab958E.tmp",
  821. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  822. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\cab955C.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95DD.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95EE.tmp",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95FE.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cab964E.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96EB.tmp",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96FB.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cab972C.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\cab971C.tmp",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97F8.tmp",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9819.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9962.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DD7.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F40.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F51.tmp",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F81.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F82.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FA3.tmp",
  841. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  842. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC3.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F41.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA031.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1C8.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2E3.tmp",
  848. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  849. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA380.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Crop.thmx",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA576.tmp\\content.inf",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C6.tmp\\gb.xsl",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA65A.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA576.tmp\\Droplet.thmx",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B5.tmp\\HexagonRadial.glox",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA619.tmp\\Feathered.thmx",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA649.tmp\\content.inf",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\RadialPictureList.glox",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA619.tmp\\Content.inf",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Content.inf",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA608.tmp\\Insight design set.dotx",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D8.tmp\\iso690nmerical.xsl",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D7.tmp\\ieee2006officeonline.xsl",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C6.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67B.tmp\\content.inf",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA649.tmp\\Quotable.thmx",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B5.tmp\\Content.inf",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\Content.inf",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\Element design set.dotx",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D8.tmp\\Content.inf",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67C.tmp\\Berlin.thmx",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA94E.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA99D.tmp",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA842.tmp\\Banded.thmx",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67B.tmp\\Parallax.thmx",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9AD.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\Content.inf",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A1.tmp\\content.inf",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA842.tmp\\content.inf",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67C.tmp\\content.inf",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA99.tmp\\pictureorgchart.glox",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D7.tmp\\Content.inf",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA99.tmp\\Content.inf",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A1.tmp\\Wood_Type.thmx",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cabADE6.tmp",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  896. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  897. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  898. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  900. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA608.tmp\\Content.inf",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5F.tmp\\gosttitle.xsl",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF00.tmp\\Equations.dotx",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\content.inf",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF8F.tmp\\content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB07C.tmp\\Circuit.thmx",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB01D.tmp\\Basis.thmx",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF00.tmp\\Content.inf",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5F.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF8F.tmp\\Frame.thmx",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\Damask.thmx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB168.tmp\\mlaseventheditionofficeonline.xsl",
  915. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB07C.tmp\\content.inf",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17C.tmp\\content.inf",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB169.tmp\\sist02.xsl",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB167.tmp\\content.inf",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17D.tmp\\content.inf",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17A.tmp\\architecture.glox",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB01D.tmp\\content.inf",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB268.tmp\\content.inf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB168.tmp\\Content.inf",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17C.tmp\\Mesh.thmx",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17A.tmp\\Content.inf",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17B.tmp\\gostname.xsl",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB169.tmp\\Content.inf",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17D.tmp\\Main_Event.thmx",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB167.tmp\\Savon.thmx",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB268.tmp\\Vapor_Trail.thmx",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17B.tmp\\Content.inf",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB632.tmp\\chevronaccent.glox",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\TabbedArc.glox",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB632.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\Content.inf",
  951. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\ThemePictureAccent.glox",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC5E.tmp\\CircleProcess.glox",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC90.tmp\\APASixthEditionOfficeOnline.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8F.tmp\\harvardanglia2008officeonline.xsl",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC91.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\Content.inf",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC5E.tmp\\Content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC90.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8F.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC91.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  964. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  966. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE48.tmp\\rings.glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE49.tmp\\ThemePictureGrid.glox",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE38.tmp\\content.inf",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE48.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE49.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE38.tmp\\Metropolitan.thmx",
  974. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF64.tmp\\turabian.xsl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF65.tmp\\content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF76.tmp\\content.inf",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF75.tmp\\chicago.xsl",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF78.tmp\\InterconnectedBlockProcess.glox",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF79.tmp\\Badge.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF77.tmp\\Headlines.thmx",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF8A.tmp\\PictureFrame.glox",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAA.tmp\\iso690.xsl",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAB.tmp\\content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFBD.tmp\\VaryingWidthList.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAC.tmp\\TabList.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF64.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF65.tmp\\View.thmx",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF76.tmp\\Slate.thmx",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\ThemePictureAlternatingAccent.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF78.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF75.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF8A.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAB.tmp\\Dividend.thmx",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF79.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFBD.tmp\\Content.inf",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAC.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAA.tmp\\Content.inf",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF77.tmp\\Content.inf",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9C52B1FBFE174D2F.TMP",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAEA.tmp\\BracketList.glox",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAEA.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC33.tmp\\ConvergingText.glox",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC33.tmp\\Content.inf",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1028. "C:\\Users\\user\\AppData\\Roaming\\cdpusersvc\\UpdateNotificationMgr.bat",
  1029. "C:\\Users\\Public\\UWOhusOTiK.vbs",
  1030. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
  1031. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\Logs\\user\\KB_20165171.dat"
  1032.  
  1033.  
  1034. * Deleted Files:
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6A1A.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6A1B.tmp",
  1037. "C:\\Users\\user\\AppData\\Roaming\\crydpr.exe",
  1038. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\E807B894.png",
  1039. "C:\\Users\\user\\AppData\\OICE_15_974FA576_32C1D314_AA6\\",
  1040. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.scT",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F40.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F41.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA576.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C6.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D7.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B5.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA619.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA649.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D8.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA608.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67C.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67B.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA576.tmp\\Droplet.thmx",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA619.tmp\\Feathered.thmx",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Crop.thmx",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA842.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A1.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1C8.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA380.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA031.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA649.tmp\\Quotable.thmx",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA99.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67B.tmp\\Parallax.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\RadialPictureList.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F51.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9819.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94E7.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B5.tmp\\HexagonRadial.glox",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA99.tmp\\pictureorgchart.glox",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D8.tmp\\iso690nmerical.xsl",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\Element design set.dotx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C6.tmp\\gb.xsl",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A1.tmp\\Wood_Type.thmx",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5D7.tmp\\ieee2006officeonline.xsl",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA67C.tmp\\Berlin.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab957D.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9518.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5F.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF00.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9435.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF8F.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB07C.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB01D.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA842.tmp\\Banded.thmx",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA608.tmp\\Insight design set.dotx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96FB.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB168.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB169.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB167.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17D.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17A.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17C.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9434.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17B.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95FE.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9486.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB268.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FA3.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB07C.tmp\\Circuit.thmx",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF00.tmp\\Equations.dotx",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\Damask.thmx",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF8F.tmp\\Frame.thmx",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5F.tmp\\gosttitle.xsl",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB01D.tmp\\Basis.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2E3.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9528.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB168.tmp\\mlaseventheditionofficeonline.xsl",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB632.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17A.tmp\\architecture.glox",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17D.tmp\\Main_Event.thmx",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB268.tmp\\Vapor_Trail.thmx",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB167.tmp\\Savon.thmx",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB169.tmp\\sist02.xsl",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17C.tmp\\Mesh.thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA94E.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB17B.tmp\\gostname.xsl",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F82.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\cab972C.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97F8.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9412.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9414.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9413.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9400.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA65A.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB632.tmp\\chevronaccent.glox",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA99D.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\TabbedArc.glox",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9AD.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9401.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\cabADE6.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93FF.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC5E.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC90.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8F.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC91.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DD.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9517.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC90.tmp\\APASixthEditionOfficeOnline.xsl",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\ThemePictureAccent.glox",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC91.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8F.tmp\\harvardanglia2008officeonline.xsl",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC5E.tmp\\CircleProcess.glox",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\cab964E.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE48.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE49.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE38.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\cab954C.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cab955C.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93EE.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9474.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE48.tmp\\rings.glox",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cab958E.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE38.tmp\\Metropolitan.thmx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE49.tmp\\ThemePictureGrid.glox",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF64.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF65.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF76.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF75.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF78.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF77.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF79.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF8A.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cab971C.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAA.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAB.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAC.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFBD.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab953A.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF64.tmp\\turabian.xsl",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF79.tmp\\Badge.thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF75.tmp\\chicago.xsl",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9485.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF8A.tmp\\PictureFrame.glox",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAB.tmp\\Dividend.thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF65.tmp\\View.thmx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF78.tmp\\InterconnectedBlockProcess.glox",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC3.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9962.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A6.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF76.tmp\\Slate.thmx",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF77.tmp\\Headlines.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFBD.tmp\\VaryingWidthList.glox",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab953B.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96EB.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab955D.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\ThemePictureAlternatingAccent.glox",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F81.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAC.tmp\\TabList.glox",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFAA.tmp\\iso690.xsl",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DD7.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95EE.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95DD.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A7.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9539.tmp",
  1204. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_86501d0eb001e0806687f557db7fceae.asd",
  1205. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAEA.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAEA.tmp\\BracketList.glox",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DC.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC33.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC33.tmp\\ConvergingText.glox",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93ED.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0CA3236-9C80-44BE-9405-5C3BF46537C5.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_86501d0eb001e0806687f557db7fceae.doc",
  1216. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  1217.  
  1218.  
  1219. * Modified Registry Keys:
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\c.9",
  1221. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1222. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\packager.dll,-2000",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1226. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\GraphicsFiltersPNGFilesIntl_1033",
  1227. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1232. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1233. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\13431F6",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\13431F6\\13431F6",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\13431F6\\148B442",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1545. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1546. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1547. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UWOhusOTiK"
  1848.  
  1849.  
  1850. * Deleted Registry Keys:
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\c.9",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\'b7",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\13431F6\\148B442",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\13431F6\\13431F6",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1860.  
  1861.  
  1862. * DNS Communications:
  1863.  
  1864. "type": "A",
  1865. "request": "warzoneburky.ddns.net",
  1866. "answers":
  1867.  
  1868. "data": "185.217.1.156",
  1869. "type": "A"
  1870.  
  1871.  
  1872.  
  1873.  
  1874.  
  1875. * Domains:
  1876.  
  1877. "ip": "185.217.1.156",
  1878. "domain": "warzoneburky.ddns.net"
  1879.  
  1880.  
  1881.  
  1882. * Network Communication - ICMP:
  1883.  
  1884. * Network Communication - HTTP:
  1885.  
  1886. "count": 1,
  1887. "body": "",
  1888. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1889. "user-agent": "Microsoft-CryptoAPI/6.1",
  1890. "method": "GET",
  1891. "host": "ocsp.digicert.com",
  1892. "version": "1.1",
  1893. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1894. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1895. "port": 80
  1896.  
  1897.  
  1898. "count": 1,
  1899. "body": "",
  1900. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1901. "user-agent": "Microsoft-CryptoAPI/6.1",
  1902. "method": "GET",
  1903. "host": "ocsp.msocsp.com",
  1904. "version": "1.1",
  1905. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1906. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1907. "port": 80
  1908.  
  1909.  
  1910. "count": 1,
  1911. "body": "",
  1912. "uri": "http://185.62.189.153/crydpr.exe",
  1913. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1914. "method": "GET",
  1915. "host": "185.62.189.153",
  1916. "version": "1.1",
  1917. "path": "/crydpr.exe",
  1918. "data": "GET /crydpr.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 185.62.189.153\r\nConnection: Keep-Alive\r\n\r\n",
  1919. "port": 80
  1920.  
  1921.  
  1922. "count": 4,
  1923. "body": "",
  1924. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1925. "user-agent": "Microsoft-CryptoAPI/6.1",
  1926. "method": "GET",
  1927. "host": "crl.microsoft.com",
  1928. "version": "1.1",
  1929. "path": "/pki/crl/products/microsoftrootcert.crl",
  1930. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1931. "port": 80
  1932.  
  1933.  
  1934. "count": 1,
  1935. "body": "",
  1936. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1937. "user-agent": "Microsoft-CryptoAPI/6.1",
  1938. "method": "GET",
  1939. "host": "crl.microsoft.com",
  1940. "version": "1.1",
  1941. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1942. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1943. "port": 80
  1944.  
  1945.  
  1946. "count": 3,
  1947. "body": "",
  1948. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1949. "user-agent": "Microsoft-CryptoAPI/6.1",
  1950. "method": "GET",
  1951. "host": "crl.microsoft.com",
  1952. "version": "1.1",
  1953. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1954. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1955. "port": 80
  1956.  
  1957.  
  1958. "count": 1,
  1959. "body": "",
  1960. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1961. "user-agent": "Microsoft-CryptoAPI/6.1",
  1962. "method": "GET",
  1963. "host": "crl.microsoft.com",
  1964. "version": "1.1",
  1965. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1966. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 16 Jul 2019 05:01:15 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1967. "port": 80
  1968.  
  1969.  
  1970. "count": 1,
  1971. "body": "",
  1972. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1973. "user-agent": "Microsoft-CryptoAPI/6.1",
  1974. "method": "GET",
  1975. "host": "crl.microsoft.com",
  1976. "version": "1.1",
  1977. "path": "/pki/crl/products/microsoftrootcert.crl",
  1978. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1979. "port": 80
  1980.  
  1981.  
  1982. "count": 1,
  1983. "body": "",
  1984. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1985. "user-agent": "Microsoft-CryptoAPI/6.1",
  1986. "method": "GET",
  1987. "host": "crl.microsoft.com",
  1988. "version": "1.1",
  1989. "path": "/pki/crl/products/microsoftrootcert.crl",
  1990. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1991. "port": 80
  1992.  
  1993.  
  1994. "count": 1,
  1995. "body": "",
  1996. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1997. "user-agent": "Microsoft-CryptoAPI/6.1",
  1998. "method": "GET",
  1999. "host": "crl.microsoft.com",
  2000. "version": "1.1",
  2001. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2002. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 18 Jul 2019 05:00:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2003. "port": 80
  2004.  
  2005.  
  2006.  
  2007. * Network Communication - SMTP:
  2008.  
  2009. * Network Communication - Hosts:
  2010.  
  2011. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!