API tools faq
paste
paladin316

Docs_920b8022cf38fb202b76f11fe9844e73_doc.json

paladin316
Jun 19th, 2019
2,324
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 278.79 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Shellcode"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Docs_920b8022cf38fb202b76f11fe9844e73.doc"
  7. [*] File Size: 8564
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "5387e2bd608c6817eb35e58b962c75e8c9ba2bc2351035428351f714eb1ff621"
  10. [*] MD5: "920b8022cf38fb202b76f11fe9844e73"
  11. [*] SHA1: "fdb47ea5bfc0bafb2cc80cf236b485cb1f866cec"
  12. [*] SHA512: "190798f4961f83112e9fdfdeb3489ec93eb1af45737b95ce7a43c5c03b5fb7fab4bdc13b23c3e8dc762e3204ff1828487341479ea14f5b94f7bc19e6d92bd5d5"
  13. [*] CRC32: "3187C24B"
  14. [*] SSDEEP: "96:M8B+vRmOluOtcH88jH7F0vmqXTys1O9x8mpAfjgK4rNys0+jJOoz:MseRZjyc8jbkTmmmiONys0GJH"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  23. "Details": [
  24. {
  25. "IP": "65.52.98.231:443"
  26. },
  27. {
  28. "IP": "104.93.33.19:443"
  29. },
  30. {
  31. "IP": "104.93.189.220:443"
  32. },
  33. {
  34. "IP": "52.109.92.24:443"
  35. },
  36. {
  37. "IP": "104.18.25.243:80"
  38. },
  39. {
  40. "IP": "184.84.243.209:80"
  41. },
  42. {
  43. "IP": "72.21.91.29:80"
  44. },
  45. {
  46. "IP": "52.109.16.4:443"
  47. }
  48. ]
  49. },
  50. {
  51. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  52. "Details": [
  53. {
  54. "ioc": "chevronaccent.glox"
  55. },
  56. {
  57. "ioc": "ontent.inf"
  58. },
  59. {
  60. "ioc": "chicago.xsl"
  61. },
  62. {
  63. "ioc": "quations.dotx"
  64. },
  65. {
  66. "ioc": "architecture.glox"
  67. },
  68. {
  69. "ioc": "iso690nmerical.xsl"
  70. },
  71. {
  72. "ioc": "gostname.xsl"
  73. },
  74. {
  75. "ioc": "ieee2006officeonline.xsl"
  76. },
  77. {
  78. "ioc": "e.gu"
  79. },
  80. {
  81. "ioc": "ist.glox"
  82. },
  83. {
  84. "ioc": "gosttitle.xsl"
  85. },
  86. {
  87. "ioc": "sist02.xsl"
  88. },
  89. {
  90. "ioc": "gb.xsl"
  91. },
  92. {
  93. "ioc": "turabian.xsl"
  94. },
  95. {
  96. "ioc": "set.dotx"
  97. },
  98. {
  99. "ioc": "harvardanglia2008officeonline.xsl"
  100. },
  101. {
  102. "ioc": "rc.glox"
  103. },
  104. {
  105. "ioc": "iso690.xsl"
  106. },
  107. {
  108. "ioc": "mlaseventheditionofficeonline.xsl"
  109. },
  110. {
  111. "ioc": "rocess.glox"
  112. },
  113. {
  114. "ioc": "adial.glox"
  115. },
  116. {
  117. "ioc": "asis.thmx"
  118. },
  119. {
  120. "ioc": "content.inf"
  121. },
  122. {
  123. "ioc": "rings.glox"
  124. },
  125. {
  126. "ioc": "ext.glox"
  127. },
  128. {
  129. "ioc": "rame.glox"
  130. },
  131. {
  132. "ioc": "nline.xsl"
  133. },
  134. {
  135. "ioc": "pictureorgchart.glox"
  136. },
  137. {
  138. "ioc": "etropolitan.thmx"
  139. },
  140. {
  141. "ioc": "ividend.thmx"
  142. },
  143. {
  144. "ioc": "rame.thmx"
  145. },
  146. {
  147. "ioc": "ccent.glox"
  148. },
  149. {
  150. "ioc": "eadlines.thmx"
  151. },
  152. {
  153. "ioc": "adge.thmx"
  154. },
  155. {
  156. "ioc": "ype.thmx"
  157. },
  158. {
  159. "ioc": "ircuit.thmx"
  160. },
  161. {
  162. "ioc": "g.n9"
  163. },
  164. {
  165. "ioc": "roplet.thmx"
  166. },
  167. {
  168. "ioc": "amask.thmx"
  169. },
  170. {
  171. "ioc": "esh.thmx"
  172. }
  173. ]
  174. },
  175. {
  176. "Description": "Performs some HTTP requests",
  177. "Details": [
  178. {
  179. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  180. },
  181. {
  182. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  183. },
  184. {
  185. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
  186. },
  187. {
  188. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  189. }
  190. ]
  191. },
  192. {
  193. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  194. "Details": [
  195. {
  196. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0k\\x9a\\x1e\\x0e\\x0f\\xa6i\\x94v \\xeb\\x82+\\x0f\"\\xe0>\\xb1op\\x8d\\xe5\\xee\\x97x\\x10\\x8b\\xdf~\\x92r\\xd7l\\xba\\x89egz \\xbfv\\xa2\\xf4l\\xf7f\\xcb< ;\\x8f\\xe1u\\xc0k\\x9at\\x9d\\xbc\\xe7\\xb1\\xaa\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\x1fr{h\\xef@\\x10*\\xdeg\\xc9}\\x16^\\xd2\\xac?o\\x8e\n|\\x07\\xfb\\xcbu\"f\\xc0\\x1f\\xc3\\xc3\\x92\\x97\\xb0\\x96s\\xa1\\xabv\\x06\\x92\\xdescr,\\x0c"
  197. },
  198. {
  199. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pu\\x18\\x95\\xbc\\xa8_\\x10k&\\x83,\\xda\\x8c\\x90\\xcd\\x13'0\\xb0\\xeb\\xc3\\xbf\\x9d\\xbe\\xfc\\x15\n\\xb4s\\xf7\\xcb\\x7fh\\xb5t\\xc1\\x0fp-k\\xc8s\\x16\\x19@\\xf6\\xa8\\xbd)\\x07\\xae\\xc3d\\xa7*u\\xee\\xbb+\t\\xe9\\xacb\\xb0'sdip\\xf5\\x88.\\x00\\x07\\x0f\\x11\\xa4j\\xc5{\\xe7\\x80\\xdb\\xd5p\\xf8\\xe5$iou$\\x9d6kzb\\xe2e\\x98\r\\xd2\\xb0\\xa7\\x10\\xaa1s\\xa5(\\x80\\xee\\xf5\\x137\\xd3\\xe1\\xc7\\x8d\\xe6\ta\\xfc\\xb7\\xacg\\xc2\\xf2l\\x90w)\\x13\\xc8\\xeex\\x05\\xf2\\x16\\xce\\x92k\\xd1#t@\"q8\\x9aeah^\\xc1\\x94uqv\\x8b\\xbe\\xdap\\xa3\\xcb\\x04:i\\x05\\x95o\\xd6\\xc9k\\x07\\xd0|\\xcf\\x8f\\x93v\\xf2\\xfe\\x1b\\xd0\\\\xca\\xaf)\\xce\\xb4\\x1f\\x10\\x0e \\xe3\\xa5\\x1e\"\\x81\\xfa\\xc71\t\\xf8>.\\xc2\\xbc\\x1bt\\xb1\\xde\\xdb\\xe0\\xd6-@\\xac\\xa7\\xe0\\xd2\\xee\\xcc\\xda\\x86\\xe3x\\xdba\\xf2s\\x84\\xda\\x85\\x10r\\x94\\xf3\\x14\\xde\t\\xcc\\xafg+\\xc0\\x10\\x14\\xcb<"
  200. },
  201. {
  202. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\t\\xf7\\xf3\\xad\\x89\\xc4(\\xa1@\\x11\\x0e\r@{\\x89\\xb6q\\xa4\\xb3\\xe9\\xb1<f\\xa8\\x19\\xaeq\\xe4\\xd3\\xcd\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  203. },
  204. {
  205. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\xa9w~\\xc5\\x11h\\xf9\\xf5v}\\xb9\\x8b7\\xe7\\x93\\xc9\\xa2\\x7f\\xa4^q\\xbf\\x0b\\x04\\x97\\xaa\\x1a\\xc3\\x86\\xb0\\xcbo?\\xab\\xbdf\\xe7\\xb3\\x8d\\xfcb\\xf9\\x89\\xe2 \\xaa\\x9f|k\\xfa\\x9a\\xf9tssbf\\xf0\\xa2\\x15*\\xbd\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d\\xbd>\\x1c\\xd3\\xa6\\x94=\\xa9\\xa04\\x1a\\xf8r\\xa7m\\xe2\\x08p\n\\xe7\\x04{\\xba\\xc7\\x14\ts\\x85\\x01r\\xd2fd\\xc1\\xf5\\xcc\\x98\\xd4jv\\xde\\x938oc/:"
  206. },
  207. {
  208. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  209. },
  210. {
  211. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  212. },
  213. {
  214. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8e]\\xa2\\x179'\\x99<\\xcd>\\xb5t\\x0cs\\xfe'z\\xa6i\\xbd\\xcc@8\\xac^>\\x94f\\xd9v[\\xa0q\\xf0\\xe6z\\x15t\\xa2i\\xbd\\xee\\xa4g\\x93\\xfan\\xfe%\\xa0\\x14\\x97\\x03\\x9f\\x9e\\xb7\\xef\\x1e\\xa2i\"t\\xf6o\\xb8]9\\x9d\\x07v\\xd4\\x91\\xa3\\x15\\xaa\\x16+\\xcc\\xb3\t\\xf1\\xaa\\x85\\xb7\\xa6!\r\\xd9\\x05)j\\xdd\\x12\\xbd\\xe4*\\x8a\\x99~\\x1fe\\x0f\\xf4+a\\xc2x \\xd7\\x81o\\\\xcd\\x9d1\\x88x\\xe6\\xf8\\xf9\\xdeh\\xa8ls\\xdd\\x9c\\x8c\\x89\\x17+y\\x97\\x89\\xb2\\x91\\xbc\\xcc-\\x9bx\\xb2\\xc1\\x08\\xae\\xa7 \\xc2\\xa2\ry\\xf9\\x8a\\x1c\\x94\\xb2g\\x90\\xed]\\x17\\x19c\\xa0#\\xc8\\xfc8\\xb7\\xf1\\xf7\\x84\\xcb\\xa7\\xb5\\xde\\xb8b<\\xf9\"\\xf3\\xab@x_@\\x1f\\x0b\\x00\\xa5\\x07\\x885\\x11@\\xf6\\x18\\xc8\\xef\\x19`\\x1f\\xf4\\xd0\\xaa\\xbe\\x8cd8\\x07\\x055\\x9f\\\\xd3r\\xa0\\xc9h\\xc8\\x90\\xe4\\xd2\\x15\\xd9{\\x1c\\xc9h\\xd3\\xc3\\xff\\xcdl\\xe2\\xd1\\xdb\\x9302\\xfae\\x14\\xb0`\\x89\\xd2\\xca(\\"
  215. },
  216. {
  217. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xb5\\xcf\\xf9\\xae=\\xb9\\x11\\xe1\\xdb\\xe88\\x0e\\x9f|g\\x11\\xe7\\xed\\xb2`&\\xd6zs\\xd7\\x9al\\xa5c\\x07\\xe0\\xd8\\x9b\\xe97\\x15\\x0fn\\xf0\\x8f\\x11m\\x9c\\xcc\\x14\\xf8\\xfei\\x9ea\\xad\\xeah43\\x13\\xe2*\\xf3\\x08\\xf6)\\xcb\\xa0\\xc1g[\\xc9\ty\\xbb\\x8b\\x85\\xaf3\\xf2w\\x14s\\xea\\x84\\x83u\\x07hnj\\x82$7\\xa1\\xd1\\xady\\x18\\xf2\\xf6\\x0b\nv\\x12\\x80\\xaf\\xd2x\\xa3t\\xea\\xb9\\xc2llwy\\xeel\\xe7\\xc4\"\\x06\\xb2\\xde\\x14\\xae\\xb3\\xee6\\xc2\\xc1^\\x03\\xc8`\\x0c\\x1e\\x95\\xa4b\\xb1\\xc6\\xb2\\x80\\x1br3\\xb0\\xd9\\xf6s\\x82f\\xa5g\\xea+\\xbe[,\\xf0s\\xb2w\\xb9\n\\xb8\\x90\\xa9g\\xc6\\x1b\\x95\\x0c\\xbe\\xb0\\xb9\\xfcj\\x87<\\xad\\x0eei\\x8dt\\xba(fc\\xe7l+r9e:\\xc3\\xc7\\xd6\\xd2\\xa4\\xa78!\\x15\\x96\\xc6\\xc4\\xef\\xee\\xaf\\xa0v\\xb0\"`\\xff\\xc4\\xdeg~\\x8b\\xebt#cz\\xed+i\\xb6hn\\x0b\\xe9\\x13\\xc5\\xd5u\\xcaq\\xbd\\x8d%\\xfd\\x8edx\\x14\\x8b\\xbb"
  218. },
  219. {
  220. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\t\\xf7\\xfb\\xbd\\xe68\\xf7\\xddp&f,\\xc2]\\xc5\\x94vz\\xabq\\xff\\xc4?o\\x1a\\xf6\\x83svo8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  221. },
  222. {
  223. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea=\\x10g\\xcb\\xae\\xf2y\\xc7;\\xf8\\x0b\\xc2a\\xdca\\xe1\\x8d\\xe0\\x82\\xda\\xcc+\\xf5\\x80\\xb9\\xc0&\\xcb\\xff\\x07\\xff\\x9em\\x12\\xae\\x8f\\x8c\\xe4.\\xa2^v\\xa6)\r5\\x9e\\x95n<\\xc0$\\x17\\xa7y\\xeba\\xa2\\x13\\xcc\\xe9\\x0c\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4 \\xb5\\x97\\xa9\\xb8\\x88\\xba\\x04\\xd2xw\\x8d\\xcen\\xa7\\xde\\x1bd\\x82\\x0bh\\xfe\\xba\\xf0\\xed\\xb0\\xcdld\\xb0\\xda\\xf4;\\x91\\xa4f\\xba\\x9f\\x137\\xbe\\xfa\\xc3\\xb0\\x03\\x1d\\x96"
  224. },
  225. {
  226. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1eh\\xa6\\x87\\xb7\\xb9)\\xe9\\xe8\\xd8kh\\xdc\\x88\\xd9\\x89\\xd96\\x04#\\xe7o\\xe2\\x13d\\x12\\xff\\x98\t\\xdf\\xd8(\\xa2\\x8bd\\xb0\\xa4a\\x07g\\xa1\\xf0\"a\\x92%\\x9f\\xa4r$\\x95\\xd8\\xac\\x8b\\xb9\\x93h\\xb8\\xb51$|\\xab\\xd0\\xb2j\\x00\\x9fee-\\xa2\\xea(x\\xfc:\\xea\\x18\\x8cgg\\xe6\\xe5rn\\xc9\\xdcyh\\xe0z\\x1f\\x9a%\\xba]>n_$\\xbf\\xdb\\xffp'\\xa1\\x8d\\xcc\\xf6'k\\xfd\\xf0\\xbc\\x99#\\xc9#\\xf4\\xabs=\\x18\\xc6\\x98\\x13\\xb7\\x00\\x7f\\xadl\\xa0\\x1e\\xe9s\\x17gm\\x1ef\nqk\\xc1\\xf9\\x85:4w?\\x0e+\\xe3{>\\x97\\xf4(\\x8f\\xa8\\x16\\x87\\x14\\x15\\x00\\x7fk\\x86\\xdb\\x08\\xc7\\x9a\\xfa\\x1bjc)\\xab\\xec~p\\xc8w[\\x18\\xdc\rly\\xc7\\x0c\\x95\\xe6\\x13\\xd9es\\xd6qg@\\xd3\\xe7\\x15\\xc7\\xc2qfs\\x83\\xbe\\xf8{\\xd2z\\xfd\\xde\\xf1\\xb2j6\\x1f^<f=\\xead\\xfdt\\xdd\\xba\\xd6\\xd7\\xa3\\x06\\xb0u\\xa6m-_\\x85`\\xdd\\xbfo\\xf1\\x99v"
  227. },
  228. {
  229. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\t\\xf7\\xfe^s#\\x9c\\x12f\\xdc\\x1b\\x8fa&x%hv%\\xf9\\xf7y\\x05t\\xdc\\\\xfc\\xb8\\xb0\\xd4\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  230. },
  231. {
  232. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb\\xde\\x12\\xe6\\xb8\\x14x\\x1e\\xfb\\xe4\\xcd*o4\\x1bm\\x03?s\\xc7\\xf7\\xee\\x7f\\xf9\\xb0\\x9a\\xf0\\x871*\\xd6}\\x0eg\\xa3\\xf74\\xa0\\xa9\\x8e\\xb9\\x95+\\xc8\\xe10a0^\\x90k\\xb3s\\xe2wl\\xf2*\\xae[\\xe0\\xdc\\xa1\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xb9\\x16 \\xe5q\\xcdf9\\xce+\\x9f\\xe1\\x90+-\\x00j\\xbfp\\xe3#\\xba\\xc5\\xef\\xd5\\xcb\\xf2\\xfee\\x13\\x94}\\xe1\\xe7\\xd7\\xe4\\xbf\\xba\\x13\\xb7\\xdf_\\xbe\\x8d\\xb4h\\xe7"
  233. },
  234. {
  235. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa2\\xb3w?\\xcc\\xd6\\xd7\\xa0\\x9c\\xdb(\\xfd\\x17a\t\\x13a\\xfe\\xc6}[\\x90\\xff\ncx\\xc7\\xcf\\xce\\xb3+zgb\\xb4\\x92\\xc3\\xdb\\x97\\xd0so\\x01.w^\\xaa-\"\\x929\\xd1\\xd5\\x06\\x9b\\xfcf\\xcb\\x1b\\xcf\\x92;\\x1b\\x1e\\x00\\x1a\\x8c1,\\xa3.\\xd6pvg*\\x9a\\x96\\x05\\xa6}\\xf77\\x93\\xd61\\xed\\x0el\\x817e\\xdatw' \\xec\\x9c;s\\xbferi;\\x98[\\xdb\\xfd\\x98b@n\\xf7\\x9f\\xce\\xc9a\\xd9n\\xe8\\xaf\\x08o\\xc5x\\xd4\\x7f\\xcf!z\\xd7f\\xe7\\xd0\\x90nof\\xce\\xd8f\\xaco\\xa8\\xc1r\\x149\\x8a\\x98c\\xd0\\xe3\\xdf\\xd3'qs}p;\\xa4>*\\xd0\\xa5\\x17c\\x9b\\x98\\xb4\n\\x06\\x93\\x83\\xe6\\xca\\xce\\x00\\x19\\xf75s\\xe6r\\x08dh]\\x1bl\\xb9\\xa7f\\xd8\\xa9\\x022#i\\x07n9\\x84_\\xa4lgh-\\x18\\&\\xb65g\\xab\\xf4r.\\x96\\xe3\\xb4b\\xd9\\xb0\\xa9\\xdd<\\xb3ip\\xec\\xdf\\xf60 x\\x85\\x9b\\xf1\\xe2\\x1f}d\\x8d\\xc0\\xe0\\xbb"
  236. },
  237. {
  238. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xb6\\x15\\x9d\\xa6]yd@!bq\\x0b\\x94\\xa6\t\\x97\\xb3\\xc8\\x8a%\\xe8\\xd1\\x13\\x13\\x1b\\x1b.^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  239. },
  240. {
  241. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x87j\\x91r\\x877k\\xfc$\\xe2\\x996\\xf9\\x18tj\\x99($q:\\xe6\\xf5y\\x86\\x82\\xbcn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  242. },
  243. {
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf3\\xec\\xf0=n\\x81\\xda^\\xc7\\x92\\x1a\\x0c\\xa5wh\\x04\\x9f\\xba2\\x11\\x93\\x81\\xe7\\xd7\\x85\\x957g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245. },
  246. {
  247. "http_request": "winword.exe_WSASend_*\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1fjo=\\x11\\xec\"b\\xe3\\x13ldy\\x9a\\xa1\\xbfo\\xf8\\x18l\\x9f\\x89\\x0fa;[v\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  248. },
  249. {
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8d\\x9c.\\x0f\\xdd\\x8a\\xde\\xf9\\xf8\\x13\\x10\\xccx\\xa6\\xef\\x89\\xd1d\\x9c\\xee\\xd7m$\\xc9\\xcd\\xe6\\xb1m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251. },
  252. {
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x19;\\xedyz\\xd6\\xdc9\\xa7+\\\\x93j\\xab0gv0t\n\\xa0/|`\\xbb\\xe0\\xcb\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  254. },
  255. {
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xca\\x08\\xa3\\xd3'b\\x03n+\\x06_\\x9c$\\xa3r\\xbdh\\xae\\x81\\x82\\x06^\\xfdv\\x03\\xbe\\xc5\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257. },
  258. {
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xab\\xa5\\x1f\\x9c\\x19\\xb7\\xbe@\\x83\\xd0\\x02\\x07\\xfd\\xd6\\x92qrv\\x01\\xcc\\x8b\\xcf\\xd9@\\x1c\\x9eda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260. },
  261. {
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa5c\\x12\\x16g\\xfcy\\x84\\x1c^\\xbf\\xb1p\\xdbz?s\\x8b\\x10\\x7f\\xc1\\xc71\\xbb\\x1c9xh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263. },
  264. {
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa7\\xe4\\xc2}\\xaek|0\\x9a\\x8e\\xec%?m\\x9f\\xae\\x1c8\\xa9\\xcb\\xa1\\x03e\\x0c2\\xac\\x18b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266. },
  267. {
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1cm\\x92\\xf2\\xb4\\x02\\xcb5\\xc6\\xe6>\\x12p$}\\x8f\\x0f\\xd2\\xd0\\x90\\xc6\\x0e\\xc8\\xc0\\x84\\xe4\\xb4\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269. },
  270. {
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xd7\\x91\\x13\\xf2\\xc6\\x8e\\xa1\"@sp\\xea\\xd8f\\xbf6\\xb1n1\\xf9l.\\x97\\xad\\xc9\\xb9\\xf7&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272. },
  273. {
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00d\\x02\\x84\\xae(\\xe6\\xb8j\\x0c\\x91:\\xe2\\x82\\x9e\\x8e9q5\\xc7\\x95\\x85e\\x03 \\4{\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275. },
  276. {
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x9e\\xa5\\xd0\\xd8ay\\xc6\\xbe\\xde~a\\x1d\\xcf\\xb8\\xe8\\x81\\xac\\xe0\\x06,6\\x00\\xcaa\\x8a\\x9a\\x04\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278. },
  279. {
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1bs\\x93\\xe3\\x14?\\xc1\\x93\\xd50\\x00\\x08\\xb6\\x02\\x0f\\xa3ix\txv\\xac\\xd2id8\\xbf}\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281. },
  282. {
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x84\\xef\\x1ddg=\\x8f\\x0c\\x91u-\\xbe\\xea\\x85\\x0f,\\xd4\\xc2\\x8e\\x85\\x1a\\xaf\\x02\\xb1\\xdf\\x9c{\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284. },
  285. {
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00)\\x9av\\xcdv=\\x8d#\\xe0'7\\x86x\\xb5]6\\xd5\\xb2&}\\x94\\x1a}\\xbfy<\\x85\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287. },
  288. {
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf1\t\\x9e\\xe7\\xc1\\xbc\\x91<\\x12m7\\x8f@?=#8\\x84\\xb5\\xf9\\x9e\\xdd*f\\xe4\\xeb\\xa1\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290. },
  291. {
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00wxe\\x03\\xaa\\x08emv>n\\xe3=d\\x0e\\xd8*\\x1a\\x17\\xc1\\xc9xwx\\x18\\xbf\\xf1o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293. },
  294. {
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00_w\\x97\\xd9\\xc3\\x13\\xcd\\x08z\\x19\\x9b\\xf1\\x9e\\xfb\\x82\\x9ed\\xda\\xf6w\\xf2\\xeab\\xcdy\\xe6m\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296. },
  297. {
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x89\\x16\\x0e,+\\xe6\\x86:\\xa349\\x95\\xde\\x9c\\x93\\x9f\\x04\\x99\\xc2\\x84\\xd8u\\x11sy\\xf53\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299. },
  300. {
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa8\\x9f\\xe8\\xec\\x15w\\x96e\\x10#:w\\xa6ne\\xf0!\\x8a\\xda{|\\x95\\x1b\\xfc\\xb5\\xab\\xb5\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302. },
  303. {
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1cdr\\xebe\\xcb%a;s7+:\\xc5}\\xbc462\\x10\\x1a\\xd5\\xa8\\xeb\\x8bo\\x94\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305. },
  306. {
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00`\\x86c}6\\xf5\\xde\\x11\\xa4g\\x17oua\\xcd\\x92\\x7f)q=6\\x07?\\xcdc\\x00\\x88?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308. },
  309. {
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa1u\\xeb\\xad\\xab}\\xfb=\".\\x90@\\x91\r\\x00-\\x07\\x8d\\x04 8\\xd9\\xce\\xe6m\\xa0j\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311. },
  312. {
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8f\\x95n\\xab\\xa0\\x05\\x01\\x0e+r\\xfb\\x16\\xa8\\xfb\\xf7\\xa6\\x06\\xca*\\xb8\\x8c\\xaagr\\x00\\xbey\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314. },
  315. {
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00d3,_\\xcd7\\xb0\\xf4\\xa1\\x1d3\\xbdir\\xe9\\xf1\\xcf\\xef!\\xc7\\x89\\xc2\\x9d.i\\x803h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317. },
  318. {
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00l\\xd4\\x0e'\\x08~\\xeb\\x9c\\xeb\\x18\\xe4z\\xe3\\x0e\\xe20%(\\x1fn4\\x05\\xae8\\xf9\\xfa\\x84\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320. },
  321. {
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xc8\\x8c\\x18\\xaf\\x00\\x96\\xa2\\x8d\\xb4lpj^sq\\x96\\x9b\\x0e\\xc3h{2\\xb4\\x81\\xd5\\xdeo\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323. },
  324. {
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf2.#s\\xdf\\xd6\\x07\\xe7b\\x9a\\xba\\x00\\xcb\\xe4\\xf8\\x1cz\\xca\\xec\\xb3\\x0b\\xc8\\x04\\xfcg\\xc5i\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326. },
  327. {
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00hsy\\xc4\\xca\\xe0\\xd1\\xfc\\x0ej\\x80\\xa1\\x9b:f\\x0cf\\x19_d\\x90j\\xd6\\x17xyv\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329. },
  330. {
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xca\\xc7\\x0f\\x9c\\xbeg\\xde3\\xf8\\x88\\xbe\\xcf\\x93\\xd0\\x7fn\\x16!d\\xe2\\x9d\\x04\\x0b \\xd1\\xc8\\xeb\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332. },
  333. {
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00s\\xa2\\xeex$\\x05\\x04\\x88\\xd1s\\x00o\\xc0\\xc54\\x15@\\xb2db\\xc6,\\x1b\\xd9oc\\xdd\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335. },
  336. {
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x00\\x95p\\x0f}p\\x12w\\x01t\\x08\\xeb\\xf3x\\xe5\\xbf\\x14\\xdc\\xe5\\xde\\x0f\\xd4o\\xab2 \\xb6\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338. },
  339. {
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa9h\\xc9\\xdd\\xde\\xb8\\xae8h\\xf8_\\xfdl\\x92~\\x05.\\xabi\\x08#\\xeb\\xe0\"\\x93\\x0e\\xed\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341. },
  342. {
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x12~\\x06k\\x91\\x17\\x9e\\xbb\\xbf\\xb5\\xc6a\\x85\\xf2\\xa1\\x85h\\xc6lmf\\xb0\\x8e\\xd1*\\xb8\\xee>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344. },
  345. {
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00(-\\x8d\\xb4\\x8a\\xc0e\\x899v\\xd2\\x00\\x11k\\xe8yq\\xbe\\x89\\xd54\\xb3\\x11.\\x0bhl\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347. },
  348. {
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8a\\x85\\xdb\\xd0zg\\xfa\\xae9\\xcb\\xc0\\xf8b'\\xc9\\xbc\\x94\\x03\\x8b$\\xf1\\xf2g\\x18_^m\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350. },
  351. {
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00>\\xe9\\xd9\\xce\\xccb\\xefc^\\x18\\x15\\xee\\xdda\\x1e\\xde\\xc9!\\xaa\\xb85\\x9f\\xe7\\xfe\\x18\\x9b\\x84\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353. },
  354. {
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00u\n\\xc9\\x1dg<\\xc5\\x92nv\\xfe\\x90xj\\x18\\xf3\\xce\\x00cuj\\xc9\\xad$(\\xe9r\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356. },
  357. {
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xc8\\x99\\x98\\xc8\\xf4\\x00\\x19\\x16<h\\x8f(q\\xdc\\x9d\\x8b\\xb4\\xc4}\\xf1hc\\xef@\\x9a\\x1a\r\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359. },
  360. {
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x94\\x8a\\\\xc6z*/\\\\xb4b2\\xde\\xed\\x85\\xec\\xf8x\\x13\\x0b\\xec\\x95c\\xe1\\xc3;jx\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362. },
  363. {
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x00.b\\xc1\\xa89l\\x97l\\xa5\\xd5<\\xa5h!\\x14y\\xafjw\\x9c\\xbannh\\x1ai\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365. },
  366. {
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00a\\x8c&\\xf05\\x92\r\\x9f\\xc8\\x88r\\x1f\\xb9,a|!\\x04\"\\xc2\t\\x03&\\xb5\\xa2\\x81\\xc9\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368. },
  369. {
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x7fz]\\x9c\\x84+v6\\xb6-\\xe5\\xdf\\xb1\\xdej\\x8f\\x11ow\\xee\\xb5<b\\x1f\\xfb/\\xf0\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371. },
  372. {
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2<\\xf3]\\xe0s-o\\x0e\\x1b\\x93\\xf6c\\\\xf9z\\x0c\\xacr\\xf2\\xc6$\\x88\\xa6\\x82lx4\\x1b\\x8a!t\\x86\\xc0\\x8f\\x07\\xe5\\xed\\xe3\\x15\\xde\\xa5u\\x05\\xe4\\xdek\\x0f\\x01r\\xfe\\xb5n\\xec\\xd6\\xd8d\\x027\\xcf\\xd7\\xec,9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\x1blx\\xcc\\xb2\\x91\\x00v~\\x19\\xeb\\xe5\\xb5\\xd6\\xb1\\x95\\x98\\x02\\xd6\\xcf\\xa9\\x15<\\x1a\\x0e\\x86?!{y\\xdc\\xf0\\xbb\\xfd#m\\x08\\x990ja\\x8c@o\\xa7\\xcag"
  374. },
  375. {
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb@\\xae\\xd53\\xb0\\xe2a\\xd4g\\xc7\\x8a\\xa3\t\\xf4i\\xf9\\xfa\\xa5\\xe1\\xe5\\x17\\xa2l\\xc8\\xc7\\x1a\\x1a\\xee\\xd4\\xe4q\\xa3\\xd4k\\xdfis\\x07\\xe3\\x8b\\xf5m\\x9a\\xacb -\\xf5\\xa7\\x91\\x0f\\xce\\xd0pn\\xa6\\x90\\xe6\\x1b\\xd4g\\xa7s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\x87\\xe19bj\\xaa\\x97\\x15\\x99.u\\x90\\xac\\xb9^\\xd4\\x17\\x8d\\xcc,\\x99z_\\xe5\\xbbp\\xc5\\x96+(\\xe2\\xe5e\\xb4\\xecv\\|\\x8agy\"\\xa2\\x8eh\\x1e "
  377. },
  378. {
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\x7fn\\xd2\\xcc\\x98,\\x0eb9\\x03+_\\xb3v\\x16f84w\\xa2`\\x13\\xd4\\xba\\x0c~\\xed\n\\x8a\\x9f\\\\xd0\\xf7%t\\xe4x\\x80\\xf8yu\\xcb\\x7f\\x8e\\xd6\\x8f\\x08\\xdb{`[o\\xf0\\xa1\\xbf\\xb7\\xc2\\xbco\\xdc\\xfb\\xb5\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x18o\\xfa\\xa3y\\xf3-\\xfd\\x9a\\x18\\xd3v\\x05\\x91\\xcbf\\x17yg\\xcagv\\xc3\\xfdo~\\xf8fz\\xcfa\\x8f\\xa3\\x85\\xfcn\\x04|\\x01w\\x0c\\x10\\x1ft\\x1fuo"
  380. },
  381. {
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\xeb\\x17~\\xfa\\x91y\\x80\\xdf\\x94\\xfdt\\xf6j\\x9f\\x03\\xbbcw\\xf2\\xc5z\\x95wf\\xb3\\x1a\\x8a\\xd0rdn\\xffm\\xd7m\\xeb\\xf8\\xd00h\\xa5\\x0e\\x0eq\\xed?\\xdf'\\xaa]\\xf4\\xad3u\\xe8\\xc6\\xa2g\\x18\\xd3\\xb2\\x97\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x92\\xd0\\xa9r\\x99\\x7fq\\xed\\xf5\\x18*k%\\xfe\\xfdn|\\x976\\xc2\\xc6\\xbf\\x7f\\xcb\\x84(\\xc0\\x0b,c\\xd5r\\x85n~(\\x92\\xb9\\xc1m\\x00\\xef\\xec57\\xd7>"
  383. },
  384. {
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa#\\xcf\\xb6\\xd2h/\\x03\\xacs\\xd1rd?\\xa8,\\x03**z\\xb4\\x01\\xb2q\\x89z2\\xbc\\x1f\\xb7\\xf8hc\\xd7\\xb5\\x0c,\\x84\\xfc\\xff;\\xb6\\xc9\\xfa\\xa1z\\xa8g\"1\\xf1n7\\x0b\\x04\\xdd\\x10}\\xe6v\\x16\\x14\\xef\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87t\\x92\\xe9\\x13j\\x83\\x92=\\x04vm\\xd2p\\xe0.|\\xff\\xaf\\xa2\\xd1\\xe4[\\xb2\\x15\\xb2\\x10\raw\\xae\\x02\\x02\\xe5o\\xe0\\xbc\\xcf\\xc6#e\\x8d\\xf7,/\\xf4\\x1fx"
  386. },
  387. {
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1*\\xee%\\xa12\\x84\\xe1\\xdduo\\x90\\xd3%\\xd6\\x97\\\\xc0\\\\xadh\\xd7h\\xc8h\n\\x80{\\xd0\\xff\\x1bw6\\xe2\\xa6\\x1b\\xa9\\xf1\\xab\\x81\\xe4\\x17\\xc5\\xe4w\\xafi\\xffc\\x05\\xcf\\x16\\xf8\\xa3;\\x0b]\\x16\\xa4j9\\x8a\\xee-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xaa\\xec\\xa75o\\xaa+\\xd4q\\x98\\xf0o\\xf4\\xf77\\xae\\x1c6\\xa1ka\\xb6\\xce\\xb26\\!\\x83 v\\xd4\\xec\\xb2\\x8fyxo\\xdf\\x10\\x8d\\xc1\"a\\x81\\xa3\\xbe\\xc0"
  389. },
  390. {
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xba\\xe3b\\x96t*\\x0b\\xd9f\\x7fa\\xd8\\xbfbu\\x08\\xf2\\x84\\xf3\\xdc#hq\\x06\\xa1\\xe3~1\\x96\\x8f'f'@\\xc5\\x03\\x1c;\\xf8]q%u\\xd7|?\\xce\\xdf\\x03\\xf3\\xb7\\x89\\xd9\\xba\\x88x/\\xd2\\xd7\\xa2\\xafbn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000cfi5\\xb2e:\\xda\\xe0<\\xd8\\x0c\\xacz0\\xa4\\xf8l\\xde\\xc7\\xa6\\xbf\\xf1$hgym7\t\\xe5`\\xb5wu+m\\xcb8\\xed~\\x9d\\xa6'j\\xef\\x83\\x9b"
  392. },
  393. {
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z?\\x13\\x12$\\xfb\\x0b\\xcb\\xa1\\xa7\\xdc\\xef\\xa4\\xf0\\x9c\\xdaa\\x87w\\x01t=\\xf5m<\\x97\\x94\\x89dl\\xbe\\xeb\\x04\\xe8f\\xdfo}\\xed\\xfd\r\\xcf\\xadb\\x0f$|\\xa2\\x17d8\\xdb\\x94\\xd3\\xc2\\x01\\x82r\\xda5\\xfb\\xa6\\xee\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 !\\xfa\\xdbh/$\\x9e\\xb9n\"a\\x19\\xbf\\x8f\\xa9d_\\xe4trv\\xf6k\\xce!\\xb2\\xcd%d\" o\\xb2imct!\\xca\\xd1\\xfck)\\xd2\\xb8\\xf2\\xb2"
  395. },
  396. {
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\xb9nb\\xb0\\x94\\xba\\xb6r\\xeea\\x1d\\xa6i\\xe3?y\\x98\\xa8\\xe9\\xdax}\\xd1%\r\\x9f\\x06b9@<k\\xb1\\xe1o3e\\xa8\\xd6|m\\xef\\xdf\\xbdne\\xb4we[\\xf3\\x15 \\xff\\xcd\\xd3*\\xb77\\x8c\\x88\\xae\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xffe\\xf3\\xa4\\x998\\xe0\\xb8g\\x84\\xb5\\xc1o\\x92\\xd6\\xcem(\\xee\\x10\\xcfi\\xb5^\\xbb\\xd6x\\xb7\\x1cg'\\x1d\\x16\\x85$\\xdb\\x98\\x935k`\\x80\\xf1\\x9c\\xea\\x15\\xe0"
  398. },
  399. {
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x16e\\x8d4\\xab\\xfa\\xb2\\x1c\\x98\\x17\\xe2\\x0e\\x10\\x87\\x14\\x81\\xcb\\xbf\\x10g\\xfd#,>\\xcf\\xb5\\xb69ky\\xe8w\\x06s\\xc7\\xc5\\xef\\xddy\\xc4\\xf60i\\xaau\\x92s\n\"\\xd2\\xaet\\xb7)]\\x02g*\\xe4$\\x0f\\xc2\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa2\\xd7\\xfb\\xc2g\\x83\\xea\\xb1\\xd2\\xf0\"c,zj\\x90\\x80e\\x15\\xe1\\x97\\xb5`6\\xab\\xabs+ \\x0f\\xdf\\x90d \\xf1\n(\\xa3a\\x82y\\x96o\\xd7\\xa0\\xb5n"
  401. },
  402. {
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\xbe\\xc5~l\\xbdo=\\xd9\\xedrp\\x90\\xac\\xd7?\\xb8\\xea%\\x1d\\x06[a66}\\xb6\\xda\\xca\\xdc\\x8c\\xb1\t^\\x0e\\xeb\\xf9\\x05\\xac\\xa6q#\\xc2\\x08\\xbd\\xa4\\x89\\x7f\\xcb\\xad\\x80z\\xf0o\\xac=?\rvnl\"\\xfb<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?a\\xb5\\xe4\\x1b\\x0f,\\x8a\\x9f\\x99\\xf9\\x04h\\xec\\x8f&\\x87'\\xd7\\xfe\\xb8\\xe6\\xb5\\x1c!ccj+\\xe8\\xb6\\xc3j\\x01\\xc4r(\\xdf0\\x0c#?-\\xfd\\xf3\\{{"
  404. },
  405. {
  406. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\x12\\x9b?n\\x8fw*\n\\x9d\\xa7\\x14e_^\\x9dj\\x93\\xb9\\xder=\\xf7\\x10\\x94\\x819\\xe3t\\xdd\\x97$\\xf6\\x97\\x85m\\xd9r)\\xa9\\xaa\\g\\xf1\\x06\\xa1\\x81\\xbab\\x07?\\xd8\\xe8\\x95\\xaee\\x1f\\x12z\\xd0q_u\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\x98xl\\xd9\\xf6\\xfbf\\x14\\xb0c\\x848t\\xd5\\xbd\\xbf\\xa5\\x9e\\x13\\x8b\\x97\\xc2\\x9f\\x8d\\xea\\x0f,z\\x1a\\x98\\xb9\\xff[\\x13\\xde7f\\xcbz\\xefi\\xccbi1\\xa7\\xf1"
  407. },
  408. {
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\x15\\xc2\\x04\\xb5\\x11\\xf5u\\x8e\\xab+5\\x9c\\xac]\\xef\\xc8\\xdf\\xba\\xcc\\xaed\\xf8\\xfe\\xfc\\x8d\\xba\\x07\\xf8\\xff\\x02\\xe8n\\xb1\\xa7\\x1e3\\xd0$^\\xda\\xc3;\\x832\\x1d\\xef\\xea\\x17m/\\x88\\x7f\\x9agj\\xc2\\q\\x00\\x13\\x98\\xe9\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o*\\xcdqhf\\x1d'4=\\xde\\xb5\\xba\\xf3\\xf1]\\x91\\xc1\\x81\\x98\\xe4hi3\\xeb\\xfe\\x99\\xb016g)\\xec\\xc3\\xc0b!-}<l\\x03\\x18/\\xb7z\\xc44"
  410. },
  411. {
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c28\\xa2\\x98n\\x8aui\\x98\\x96[\\xa6p\\xff\t\\xdf\\x05]d\\x87\\xff3?\\x8b\\x97\\x13\\x83\\xd8\\xc7\\xa5\\xbd\\\\xd6\\xc5\\x00\\xb3z\\x0b\\xf7e\\x95\\x94\\xb2\"\\x93\\xab\\xee-\"\\xc6\\x8c@\\x8c\\x9bpa8\\xa3|q\\x1d\\xa2<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16>_3\\xf18c\\x8e\\x8e\\xe2\\x9fck\\xb0\\xa3s@\\xc8\\xdail\n~p\\xfcbj\\x06ia\\xd3\\xcf>\\xaf' \\xd9\\xd9\\x91\\xbf\\x9a\\x8d\\xc1h\\xa0)=\\xd0"
  413. },
  414. {
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k#\\xaa\\x8c~\\x05\\xecy$\\xf3\\xb2\\xd2\\xff\\xf6g\\xf5?\\xbb\\xc7\\x16\\xe0\\x1a\\x95\\xac\\xb4\\x98\\xcb\\xf9\\xdc4\\x8b\\x0e9z\\xa2\\xdb\\x0ci\\xbf\\xcd\\xa1\\xd2k\\xefp\\xccjt\\xb8\\x88\\xa5kuo\\xe5\\xa3\\x02!\\x96u\\xeb\\x8d\\xe8z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000d\\xd5\\xe63\\x95\\xbbl\\xb1\rt\\xc9\\xb8]^\\x00\\xa8\\xa5\\xf0\\x01'\\x04k\\xc5y\\xaae\\x02\\x11\\xdb\\x9d\\x87\\xb7a\\x0c\\xe6\\x0b\\x88!\\xf9\\xc0\\x99i\\x8a\\xb2\\x80d\\xf8\\xf0"
  416. },
  417. {
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\t\\x04*#\\xcab\\xfay\\x18\\x95\\xe9m'\\xe4&\\x8d\\x02\\xf5\\xdd\\xd6\\x1a\\x03k\\x89\\xf6v\\x9abu\\xa3\\xc2\\xaa/\\x84\\xd0\\xc2\\xb5y\\xc0\\x94\\x93<z-m\\x93\\xb2\\x1c\\xca\\x8d\\x93fo\\x7f\\xf0\\xb7o\\x06u6o\\xe5\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\xf9<<\\xa9=\\xc7r`\\xc6\\xc3<\\xf7\\xfe\\xd2h\\x9c|\\x0biy\\xbak\\xb2\r#\\xb7\\xb8\\x16\\x85\\x8cw\\xb9\\x16\\x11i_\\xf0[\\x06\\x85&\\x1a\\xff\\xffce\\xef"
  419. },
  420. {
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5}\\x0f\\xca\\xcfg\\xe0w\\xb8\\xcdp\\x1f\\xcd1\\xfb\\xd5\\xce\\xeb\\xd1\\xdb\\x17\\xb7\\xe8a\\xb4\\x90s\\x94\\xcddvr(\\x18\\xe6\rlf5r\\x00\\x9d\\xbf\\xf6\\xe1zo\\xee\\xb8\\xe3'\\xff\\h\\xf0\\x8e\\x14\\xa5z\\xb77\\x89\\xb3\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x0b%\\xe9xz\\xed\\xc0\\x979\\x7f)\\x8f\\xe8g\\x83\\x01\\xb4\\xc2\\xf7\\x8b\\xe0\\x87\\xdb\\xc8o\\x87c\\xc5\\x13\\x8dy\\x844\\xb6\\xc0\\x0e\\x88\\xb7\\xea\\xbcw-\\xf1\\xb0\\x95\\xd3\\xda"
  422. },
  423. {
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6]\\x01\\x9c\\xab\\xf7/\\xfb\\x18m\\x85l\\xe3\\xf33\\x9b\\xa7|%l\\x13!\\xd1l\\x88\\x08\\x99m\\xa71\\x94\\x86\\xb4r\\x94\\xb3l\\x1c\\x97\\x1c\\xb76\\xf8\\xd1bf\\x10%\\xb2\\xcb\\x917n\\x9ch\\x8b\\xbc\\xc2u\\xb8lx\\xb0\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\xe1r\\xa1\\xd6\\x85c\\xf6\\xe84\\\\xe8:\\x14l\\wd=ez\\xc5\\x0e\\xe9\\x06\\x07y\\xbe\\xa5\\xbc\\x0f\\xcf\\xde\\x99\\x03\\x11\\xe1\\x1f\"\\xb7\\x12\\xfe\\xaf\\xbdx-\\x906"
  425. },
  426. {
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\x8b\\xd7\\xbb\\x9b(\\xbe\\xcb\\x0eryf\\xff\\xfe\\x14<\\x8a@\\xc2c\\x10$!\\xcc\\xc39\\x89@.\\xadd\\xb9j\\xf5\\xfaqgzo\\x85\\x1b\\xea\\xa37q1\\xb5\\x14@m\\xcc\\xa1\\x96\\x86\\xf6\\xd2\\xfd\\xa1\\x18|\\uo,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000gt {\\x10ci\\xa8l\\xd2\\xde\\x07\\x1a\\xf8j3\\x10\\x07&\\x15\\x1f\\xcd\\xaeo\\x8a67v\\xc2\\xa4\\xd8\r\\xd4\\x94+r\\xa0d\\xc3\\xaa\\xafk\\xc2m\\xa8\\x1a\\x9d\\xc4"
  428. },
  429. {
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xbd\\xae{\\x7f\t\\x87mq:\\xce\\x97\\x03w*\\xbb\\xac!p!\\xab\\x9c\\xf7q\\x0ew\\x0c\\x9dg-h_\\\\xe3e$\\xbb\\xc6\\xb29+oz\\x85\\xa4g\\x1c\\xee\\x9d\\\\x84k\\x14\\xcev\\x87w\\xa7\\x0e\\xc1\\x85\\xde\\xb6\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xc4f\\x9fp\\xa5\\xd0\\xc0>\\xae\\x0ek\\xef\\xa9\\x12n\\xcaoq\\xca\\x1d\\xbbr\\x18\\xd1\\xdbe6\\x9b\\xa9\\xeavy\\xabn*j\\x9d7\\x89au\\xd1\\xd9\\xad\\xde\\xbf'"
  431. },
  432. {
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1z\\xef5\\x82q\\xc2\\x01\\x83\\xc5\\xb8zn@\\xd2<\\xa3q\\xc0\\x1d \\x13\\xf4\\\\x15\\xdck\\x03?\\xdcj\\xea\\xf4t\\x07@@ \\xa7\\xde\\xeb4\\x86\\xd3\\xdd\\xf9\\x85\"\\xb4\\xa8\\xb9\\xce\\x00~m\\x08\\x13\\xf1\\xbe7;bfl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\xaaz\\xad\\x8b\\xbc\\xb2\\x86\\xaf\\xab>\\x82s^`0\\xf9\\xea\\x99d0\\x9d\\x81)\\xbcq(\\xb3\\xb7|\\xab\\xc4\\x10\\x05\\xab\\x80m\\x82\\xf6\\xbbb\\xd7\\x1a\\x8ew\\xe6\\xc2\\xe5"
  434. },
  435. {
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xa4\\xe3\\xf1\\xf2\\xae\\xaf\\x90\\x03\\xe9\\x16\\xdb\\xbe)\\x9e9\\xdc\\xcf\\x92[\\x90\\x8d\\x97j\\x12\\x16,@\\x00\\x1b\\xe1\\x8f \\x05\\xfb\\x10\\x182\\x95l\\xe4\\x0c'\\xf8!\\xf22190!\\xa4\\xaefu\\x8fk|\\xe6sn\\x1d\\x98\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\xaf\\x97\\xd9\\xd2'|\\xbd(\\x7f\\xb233 j\\xcc-\\xf3\r\\x81muivm\\x1f\\x03i\\x81\\xe3\\x0e\\xd5\\xff\\xab\\x87\\xbet\\x85\\xd4\\x82\\xfc)r\\x16%/\r\\xf1"
  437. },
  438. {
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xc3\\x1b\\x9f\\x848\\x0b\"=^\\x0fd<\\xd2\\xa3\\xc7`t\\x9e\\xe1\\xc3[\\xb6\\xbe\\xaf\\xf9\\xd2\\xdc\\xf6\\xe9\\xed=_z\\xb8\\xc1\\x93h7g\\xac\\xb3\\xa5\\xa5\\xf8\\x15\\x81\\x10\\xd0\\x90\\xa2\\xe0\\x10\\xf1\\x90z\\xfcx;s\\x87\\xfe`c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\xbe\\xb1d\\xe4\\xd4\\xa0\n\\x06\\xccw\\xa7\\x10\\xe1\\xd5\\x0f\\x7f:\\x8d\\x14\\x12\\xe5p\\x10\\xfe\\xc5y\\x94\\xd4g\\xdegw\\xc1\\xd6&\\x14x\\xe3\\xa4\\xd1a\\xd6\\x97\\x06h\\xf0\\x15"
  440. },
  441. {
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\nv\\xce]\\xfeba0q^\\xbd\\xdbk`x\\x14sfya\\xb6w\\xc7\\x10\\xb1o=k\\xb1g\\xa1\\xa6\\x19f\\x94\\xa6\\x9b\\x9e\\xfc\\xe7x\\x80g4{u\\xb8\\xc5-\\x89&\\xc4\\xd13\\x82\\xc6m\\xc8\\xecj\\x97\\xb5\\xf1q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8`o/\\x14)\\x124\\xd0jz\\xec\\xa6\\xb5j\\xc8vu\\xc0\\x11<\\x1c\\xb0y\\x93g\\xb6t\\x17\\xb6\\xa1\\xb4\\x136\\xfd2\\x1ckg\\xb3\\x81s\\x93b\\xac\\xafvz"
  443. },
  444. {
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xbc\\x10\\x9d\\xcf\\x99ek\\xa0j\\xbc\t\\x12?|o\\xefd\\x06\\xe6\\x1e\\xf3u\\xecw\\xbf6\\x9ek\\xce\\xb9,\\xdd\\x03t\\x81]\\x9f\\xbc\n\\x17\\xac\\xbe^\\xa1\\x9b0'\\xa0\\xcehl\\x0c\\x91\\xf3v\\x07\\x9c\\x03\\xfff!tr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb/n8\\xbe\\x07\\xa7xq\\x14\\x80\\x04\\xa2j\\xbf\\xf3db\\xd6q\\x11\\xc2e\\x0e\\xde\\x88\\xee\\xbe\\xc5s\\xabva\\x83\\xee\\xec\\x18\\xb7y\\x8d\\xe5\\x98\\x80\\xd2=\\x00x\r"
  446. },
  447. {
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13\\x85#\\xf1\\x93\\x1c\\xbd\\x82\\xdc\\xb6\\x99\\x97\\x99\\xe4\\xc8{:\\xe7\\x89\\xb1\\xe5\\xcc\\x8b4\\x8fg\\x9e\\xa2\\x96\\xa0\\x88l&\rr\\xdc\\x1c\\x89\\xb1\\xac\\xd4\\x80k\\xd8\\xda\\xbc\\x18=!?v\\x03.\\x1f\\xef\\xfc\\x85\\x17#\\xa4fk\\x17\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m^^=6\\xf9m\\x15\\xe4\\xd6\\xfb\\x00$\\x8f\\x98\\x16i\\xa0\\x952\\x0cp\\xd9\\x18\\xee\\x068\\xd5\\xaa\\xbagnh\\xd6\\xa3\\x975`\\xd27b>\\xe6\\xf5\\xee\\xd3\\x88d"
  449. },
  450. {
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w!\\xebo\\x0c\\xc5\\xb1\\x1d'\\x8en\\xb1\\x81\\xec\\x8b8a\\xc9\\xdfl\\x1c\\xc7\\x94u\\xa5\\x93\\xee\\xfe?\\xbbad \\xcd\\xea\\xe2z\\x9c;h\\xb62\\xf8\\xd7\\xc1\\x7f\\x0c\\xf7\\xcb\\xe1\\xe1e\\xfai\\xe5\\xc6m~\\xac\\xb2g\\xaa\\x8e\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x96\\^\\xe2h\\xc3\\x81\\xe1q\\xb7\\xfc\\xbcw\\x1b\\xd1\\xda\\xa4\\x19j\\xdbw`f\\xa2\\xe75\\xa2\\x1e\\xff\\xc1\\xfb\\xdc\\xca\\x1b\\xb3\\xdc\\x16\\xad\\x15\\xc4\\x04\\xf0\\x1a\\xe0o s\\x94"
  452. },
  453. {
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xae\\x06\\xbd\\x89\\xee\\x83do\\xfa|\\xd2s\\xc6\\x87#\\xac\\x9e\\xb3\\x06\\xc7\\x7fs\n=\\x10\\x11\\xff\\x90\\x80\\xbf\\x9e8\\xb8{5\\x8c\\xc4\\xc7\\xdcl\\x9d\\xca\\xb9\\xd1\\x1a\\xea\\xd0:\\xa7t\\xe1\\xb1\\x87\\xb4)\\xba\\xcb\\\\x13<\\x98dm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xc5\\x10\\xe61\\xd6\\xde\\x8e\\x19\\xc5\\xe7\\x891__h\\x9b\\xdcf\\x01q\\xd0g\\xb4\\xab\\x9a\\xe1\\x83\\xe8\\xb0\\xbfs\\xd5\\xcb\\xe8q\\xa7v\rr\\xfc/\\xab\\x92i\\xe2_\\xdf"
  455. },
  456. {
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xc3\\x06\\x0e\\xf4\\xd5\\x98\\xafd\\xb9\\xdb\\x97\\xb8\\xd3y\\xb7\\xfc\\x8a\\x0e\\x01\\xe1\\xc6\\xf5y/\\x82\\xc1\\xb7?\\xc5\\xe7\\x93_\\xd4n\\x084\\x8e\\x1cm\\x9bs\\xf7\\xa5^\\xff\\xee\\x17\\xb5lic\\xcb\\xb9\\x98\\xd4m\\xc6\\xa3\\xb3\\xa9\\x88\\xdd}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xd8\\x86^\t\\xf2\\xb1\\xe0<*\\xea0\\xe2\\x9c\\xd8\\xae,$r\\x0e\\xc7\\x96\\xcd\\xcc\\x05t\\xeb\\xd5\\x9e\\xd5\\x05\\x80\\xacq\\xda\\xe0j\\xec\\xb7\\x02&_\\xd9ev\\x14\\x93i"
  458. },
  459. {
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\x8a#\\xdd\\x11\\xc7\\xbf\\xa56\\x9e\\xd0j:\\xfc~82\\xd3\\x93\\x1d\\xc7\\x0b\\xb4d\\x08\\x0b/l\\xe1\\xd1\\xfb\\xbccq4\\x05\\xca1?;'\\xe6~}k\\xeb\\xd4wq\\xc7d\\xcd\\x1c\\xa8\\xd7\\xf5\\xe7\\xc7\\xb6\\x81\\xbc\\xe9q^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1\\x9c\\xff\\xb8?\\xc3\\x94\\x03\\xef\"c\\xc7e\\xc31\\x92^\\xf83>\\x9a\\xc6f\\xa0\\xa8\\xccp{\\xa9\\xaf\\x02\\xe2u\\xa0\\x13v\\xc1\\\\xacm\\xee\\x930\\xc38\\xb5\\x82\\xa5"
  461. },
  462. {
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7br\\xee\\xf2\\xab=$\\x8c\\xbc\\x06\\xcb$\\xa4\\xab{\\x12\\x95\\x97\\x0c\\x9f}s\\x899k\\xf6\t\\x12\\x88\\xc4\\x81\\xf5o\\xbf\\xdcu\\xafw\t\\x1d\\z\\xcd$:\\x06\\xe0_\\xa5}\\xd2\\x1b\\x8e\\x04\\x0b\\x9a\\xe8\\xb7\\xdc\\xbf\\xcf\\xb6\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\xe3\n\\xb2f*\\x8f>\\xc2\\xf6\\xf4\\x96eq\\xb9\\x9b\\x84\\xb0\\xb2\\xfa\\xff\\xe0<\\xbd\\x1d\\xcf\\xe4\\x994\\xd1l\\xe2\\xdf\\xde\\x8c\\x1b\\xea\\x0e\r\\xfc]c\\x12\\x82c\\xd6\\xb4\\x80"
  464. },
  465. {
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\x9b\\xca}}\\x18n\\xaagq\\x14x\\x9b6p~<\\xc8y\\x84\\x81\\x9b#e\\xdd\\xa7\\x83k\\xcc\\xd0t\\x94>}\\xeeg\\xb8g\\x13\\x05!k\\x90k\\x06p\\xfe\\xf3u5w\\x9bn\\xf3s<s\\xeb\\xecs\\x1b\\x8c\\x18\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x853\\xb9\\xf1\\xa0\\xfd\n\\x13\\x1c\\xc6\\x82\\xa7\\xaf\\xfde\\xf5\\xd6]:\\x1fj\\x81\\xf3&\\xeb^\\x0e^j\\xe8\\xe9\\xb8\\xd0\\xd1p\\x90\\xd8\\xd4\\x1f\\xf7h=\\xb7_\\xfe\\xd0g."
  467. },
  468. {
  469. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce{<z\\x19\\xa8h\\xfb\\x06h\\xe0y\\x9a\\x90=\\xd8\\xb9\\x98/\\x0e\\x1b\\x90\\xf2'q\\x90\\x8a\\xaa\\x1e\\xfb\\x8d\\x0c@\\xb7\\xabw9\\x91y\\x06\\xc1\\xd1\\xd3\\x1e\\xf0i&xdhv\\xb2\\xe3\\xbd\\xa4*k\\xf1\\xe60\\xb6g4\\x86\\x98\\xcea\\xb4\\xe4\\x06\\xa5\\xed\\x82\\x06\\xb5\\xca[\\x92\\xdf\\x93\\xf6\\xc7\\xc9\\x8d\\xa9\\xe6y\\x8d[\\xc3d\\xe5\\x9c\\xcf\\x81\\xe5\\x0b\\\\xb9\\xe8\\x91g\\x13\\x13y\\xe96\\x96\t;;=\"\\xfaoiy\\x12]\\xc2@\\x16\\x18\\xdez\\xdcf\\xad\\x90\\x1fm\\xd9\\xd7lyo~j\\xb4c\\xb4\\x85)\\xcb~)\\x06\\xe6\\x19;\\x88\\xe3\\xf0\\xe6\\xb4j\\x16 \\x95xmj\\xc4\\xcd\\x0b\\xc5\\xaaed\\x1e\\x96\\xecbs\\x98\\x19\\xec\\x0e\\x80\\xfa+\\x8d_g\\x94_\\xd5\\xa151\\xbe\\xf5\\xe8.\\xaa\\x81\\x1b\\xd97\\xb8\\xbe\\x86\\xbf\\xa4b\\xf2\\xd81i\\xc7\\xc9#\\xbc\\xe48qmnj:\\xd3y\\xca\\x02\\xd4\\xdan\\xe5fe\\xdf\\xf2\\x98\\xfc\\xfd\\xfd1\\xd1\\x12w\\xd7i\\x00\\x90+p+\\x8b\\xf5e\\xcd"
  470. },
  471. {
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\xa2\\xb7\\xe5\\xe0vq\\xda\\xb3\\xd1\\xb2\\x80\\xc7&\\xfasq6\\x85\\xc44~\\xb4&\\x0b\\x85\\x91h\\xbf\\xfd\\xe8v\\xd8\\xe7\\x80\\xb0\\x9e<\\x95\\xd4\\xb81p\\x93y\\xd8k\\xf6g\\xa3\\xf5dk\\xcdx{\\x802\\x8fp\\x17\\xf6\\x01er@\\xbb\\xdf\\xaa_\\xae\\xb5p2g\\x02\\xdf\\xf7\\xfc\\xa1>\\x99\\xfe\\xfb\\x06\\xa68\\x96\\xd9\\xaf\\xa3\\xfdv\\xed\\x16\\x00\\xb1)r\\xc9`;\\xf9\\xa4\\xc6\\xb4\t\\xae\\x8f\\x9a\\xe9 \\x1f\\xd1\\xbfz.x!\\xe9s\\x10|i\\xc7\\x89\\x9d#\\xf2\\xc7\\xf4\r\\x1b\\xc2\\xcb\\xbb:\\x9f\\x18\\xea\\x8f\\xb66+\\xa1\\xf1\\xb1\\x86\r\\xfcv\\xa6\\x96\\x8b\\xed\\xb6\\x96\\x11z\\x15\\xf9\\x18\\x18\\xa82<p};|\\xbc+\\x98\\xc1#\\xfc^e*\\xacd\t\\xffd\\x85\"\\xe7\\x9e]mu0j>\\x98\\xcf\\\\xcez4\\\\xad\\xdafo\\xdfy\\x88\\xe5\\xe4\\x16\\xa7`\\xe6\\x06g{\\xd7:)\\x7f\\xf9\\x9b\\x84b\\xfe\\xd2i\\x81#\\xfc`'\\x92\\x85\\xfe\\xf3n\\x8a\\xcd\\xc77\\x9c\\xd6w18\\x17k\\xc4|"
  473. },
  474. {
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\x0e\\xaf\\xf9\\x92}\\x9b\\x12-\\x81yjk:\\x97o\\x12\\xe2q2\\xf7\\xe7ni\\x7f\\x1f\\xa5\\xfe\\x99\\x97^3\\xf2x\\x08o8\\xe3\\xf2*\\xe6~\\xfd\\x14\\x155\\x89n\\x86d\\xd0\\x06\\xa3\\x9e\\x11qn\\x0e\\xd7\\xde5\\x0e\\xda\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6p\\xb8tj\\x8caez\\x81\\x8erf|\\x12\\xd7\\x98;i\\xbf6>\\xe8x{\\x18\\x80\\xf0l\\x8c\\xc7\\xe8\\xcb[\\x02\\x17\\xc6\\xc6/\\xff7eq\\x88\\xb3\\x16q\\xd3"
  476. },
  477. {
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\x1ek\\xc3\\x99!\\x9f$w\\xdd\\x02\\x1a*\\x18\\xe4\\xcb\\xde\\xff\\xf7<\\xfa3!\\x07\\x87&\\xff\\x7fp\\x92#\\xae\\xcbs\\x952\\x9dmwzc*jy)\\xac\\xc9\\xa0\\xc0]\\xdb(\\xa1\\xea\\xbb\\x9d\\xf7\\xedw\\x9bn\\xfe\\xcc\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\x00\\xd4j\\xf7\\xfd\\xbe\\xd7\\xdd\\xa6\\x06\\xd7\\x0b^u\\xcc\\x7f\\xf4\\xe46\\xcfj\\x83\\xd3\\xb4\\xcb\\x1ak\\x90$a\\\\xbf\\x07\\xde5-\\xa8>\\xcd\\xc7/\\xbc\\xd5\\xee\\xc0g\\x1c"
  479. },
  480. {
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\x827\\xa0\\x9e\ty?\\xa3\\x96\\xb2\\x94\\xedo\\x1a\\xb66\\x16\\xeb\\x88#z\\xdeo\\xff\\x85\\xad\\xbe\\xd7\\x08o\\x17c=\\x7f\\x1f\\xa0s\\x8a\\x1c\n\\xa3\\xfd\\x80}\\cj\\x13\\x92-\\xc2n\\xd0\\xa7\\x9c\\x8f\\x8d\\xea\\x8b\\x8a\\x01\\x1d\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\x88\\xc8\\xfa[{b\\xaa\\x87 \\xcd\\x80p\\xc4[_\\x16\\xc3/\\xd8\\x9e)\\xd2\\xea=\\x10\\xac\\x11\\xb9\\xc3\\x83\\xc8\\xcb?\\xf8o\\xf1\\xf8d\\xdd\\x18\\xc6\\x08\\xe7\\xa6\\xfa\\xb0\\x1c"
  482. },
  483. {
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd4\\xdd\\xeb\\xf59\\x19u\\xa2\\xde\\x84\\x9d\\xd7/\\xe0\\xaa\\x15\\xc0\\xa0\\xfe\n>h|n\\xe3\\x04\\xb9\\xcfg\\x08\\xadz7}-4\\xa2e\\xbay\\x8c\\xae\\x0c\\xdc\\xd2\\x88\\xa6#\\xb6t\\x1b3v4\\xe7\\xbcf`|\\xa1\\xbe\\xf5$\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xf1\\x92\\xce\\xbc\\xd3\\xb3\\xf9\\x02\\xe1e\\x89\\x14\\x88\\x991&\\xafv\\x98\\x86*\\x13\\xc3\\xe9\\xc3\\x82s\\xb1\\xcavj\\x94\\xa5q$]\\x89m\\xcbf\\xd5\\xb1g$\\xbf#\\xec"
  485. },
  486. {
  487. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\xa8%40\\xb9\\x92\\x11\\xd6\\xd07\\xe7@\\xefs%$^\\xa6i\\xa9\\xa6\\xf9\\xdc\\x08\\xa3\\x0b\\xdc\\x81\\x9c\\x98\\xd7\\x86fw\\x9c\\xbc\\xfd\\x08\\x00\\xe5\\xa7`\\xf5\\xbe\\xc5)\\x00_\\xb4\\xe3\\xe8\\x18\\xeb\\x18zp\\xa9<\\xf4\\xccf\\x03!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\x85\\xb4\tr\\xd5c\\x982a\\x18q\\xe5\\x07\\x9f\\x08\\xd8ck\\xed\\x94q\\xc6m\\xca\\x8d\\xc6\\x92\\x89\\xb6\\x15\\xa7d\\xdbox\\xc9k\\xbd\\x8e\\xbd\\xb5\\x92ag\\x81np"
  488. },
  489. {
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\x16\\x85x\\xea\\x14\\xfc\\&/\\xde\\xdf\\x04~m\\xf5\"*\\xc6\\x0b\\xdc\\xbe\\x91e\\xbd\\xd1\\x92\\xc5\\xf3\\x95\\x1c\\xce\\x8f*\\xfc\\xa1}3\\xc1q\\xb19%\\xdb)z\\x85/\\x88\\xd30\\xe2\\x10\\xedau`j\\x0b=#\\xc2\\xd6\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j@\\x1a!(\t\\xc9\\x8cy\\xfa\\x1a7\\xf6\\x14\\x12\\xdd\\xb1p|\\xa8c \\xfe\\xfe\\xdb\\xbd\\x83m\\xd4\\x11\\xb1\\x17c7(\\xd5\\xf5\"si\\xc5wa\\xec\\xeb\\xb5\\xdf\\x0e"
  491. },
  492. {
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde$&\\x16_\\xe0\\xc5\\xeb\\xc6\\xdf\\x048\\xbd\\xc75\\x08g\\xb22\\x90io\\xa7\\xb2\t\\x80\\x17t\\xda\\xedk\\xa4m\\xcff\\xcamau\\xbd\\xa0i\\x87\\x08\\xa4-`\\x83\\x0co,s\\x06\\xe2\\x86i\\xf8bz\\xcbpm\\xa5\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\x10qh\\x15\\xec]j{\\xd5\\xdb`)n\r)\\x11\\xf7#\\xbf\\x1e8myp\\xfa\\xc7\\xdc\\xf7n8\\x1c\\x92\\xb2\\x91+?];f\\x8b\\x84\\xdam\\xa4\\xd1\\x8f\\xdd"
  494. },
  495. {
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\xf8*\\xb5=>\\xc3\\xd7l\\x19d\\xd7s8\\x82\\xd9\\xb1\\x99\\x85\\xa0m]\\xf1\\xcbg\\xe4\\x15dw\\x88\\xa5\\xff\r\\x88\\xe0e\\xbcj]\\xd7\\xde\\xdf\\xcc\\x16\\x16\"7b\\x1e\\x07~)yep\\x14\\xa5v\\xe0o\\xfd.g\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03w\\xd1\\xbc\\xe7$\\x88\\xd6\\xa0\\x8e#\\x07\\xab\\x1e\\x88\\xb1\\xf4\\xf3\\xa6\\xeak\\xe0\\xf1z\\xaew^\\x16q\\xe3\\xa5\\x99\\xb9jieu\\xb9\\x0b\\x01\\x15\\x83\\xa2q+\\x07w\\x93"
  497. },
  498. {
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\x85\\xaa]hs\\xeffz\\xb5\\xbe\\xd1\\xa57ql$,\\xc7qi\\x92x\\xa4\t\\x86jwv\\xfae\\x0br\\xc8\\x8e(n\\xc9p\\x0f\\xee\\x95\\x98\\xb6p\\x85\\xecp\\xc2\\xec>\\xe8\\x11\\xf0\\xa5^\\x1ep\\xe2y77!\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaex\\x0f\\xc2\\xb8]\\xd1y\\xfb\\xb7\\xd2\\xc1*b\\x9c\\xa4\\x0fk<j/`5\\x9c\\x16\\xa8\\xef^p\\xe8\\xc1\\xe6k\\x04\\xe21\\x11\\xc69\\xdc\\xbe\nk\\xd0\\x1aoh\\xa4"
  500. },
  501. {
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a?\\x18\\x979\\x8fjin:(2\\xfc>+\\xbb\\x0b\\x14\\x12\\x8d\\xb3+\\xb9j!\\x13l\\xcc\\xe7\\x14\\x13.@\\xa4\\xe0\\x88\\xbf}\\xa3\\x9d\\xa28\\x94\\xe1g\\xb0~3l0g\\xfe`\\x16hf+h(\\xc0\\xea\\x96\\x810\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%i\\xab\\x8f\\xd4\\x8et\\x97\\xb0l\\xc2\\xc1\\x1a\\xf1$\\xe60\\xda\\x86\\xc0\\xefx\\xe4\\xfd\\xce.\\x8bl6\\xdfg\\xd7~|d\\x98\\x02\\xe7>9y\\xd8x\\xf8\\xf4\\x05\\x8ej"
  503. },
  504. {
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\xc7\\xa6\\xdc/\\x0c\\xa7\\xae8\\xc0\\xc5\\x82\\x0e\\x81\\xba\\x91\\xdf\\x9a\\x92\\x1a\\xe0b\\xda\\x8d1\\x15\\xb8ja1\\x1a$q\\x8a\\xa0\\xd0\\xff;>@\"\\x88\\xfdzf\\xd4\\x12\\x15\\x14|\\xff\\xd84\\xa9\\xcd\\x0c\\xbd\\x95\\x0f\\xdc\\x0chn\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000kr/\\xa6:i\\x9c\\x18\\xb4kc4\\xee\\xf2\\xccyj\\xef\\x18b\\x8c]&\\xe6\\xf5\\x9c=s\\x9c\\xed\\x1c\\x01\\xe0\\x9d\\xc6\\xb1\\xeaz=`h\\xef\\x95\\xc5\\x07\\x87\\xf0\\x1c"
  506. },
  507. {
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042l\\x81\\xb9\\xd0\\xd5-\\xca\\xaa\\xa7\\x84\\xc4\\xaa\\x84\\x88\\xd5\\x12l[\\x8e\\xa1`\\x1a\\x84\\x9f\\xd0\\x8b\\xd8\\xa83\\xdf3\\x07ilsku1b-\\x18\\x0c\\xe9d\\xa7o\\xaa\\xc6\\x9bs\t|u=f\\xee]&\\xafo\\xf7\\x17\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1cy\\xf9\\x0c\\xf1\nu\\xe5*\\xe3\\x84y\t\r\\xe6\\x10>-z\\xdcg\\xf7\\xc6\\xd6>tzx9\\x0b\\x1a0\\xb57\\xc5(j7;\\x1a\\x966\\xf1\\xfc\\xa4\\xc1\\xc6\\xee"
  509. },
  510. {
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\xc8xu\\x8f\\xb8y\\xb5\\xfe\\x84b\\xb5\\xb3\\xae\\xfa\\xa4;g<\\xb2q\\xd7\\xc9\\xfb\\x8b\\xc9\\x9c\\xcbe\\xd9\\x1bhu\\xe7fgp\\x1f6\\xf7\\x04\\\\xd4\"a\\xe8h\\xb0wo\\xee\\xc62\\x9bo\\x04q\\x82\\x078\\x98\\x935\\x13b b,ib\\xd4_;jk\\xe0\\xd1\\xa0\\xad\\xd1\\x0f+\\x11\\x10\\x1e\\xb7\\x1b\\x92\\xbd\\xca\\xa8\\x0b^}\\x13\\xeb`\\xc3h\\xda\\xa1\\xc8\\xabpkw\\x04\\x1e\\x9d\\x8b\\x9d4zl\\xac\\x84\\xc4\\xa4\\x80(a6h2\\x9c`\\x9c-\\x91\\x85\\xc8%\\x0c~^8\\xed\\x9c\\xbco\\xee\\xac\\x16\\x93^i\\xce\\xf37\\x9e|\\xb8\\xa4\t\\xd9\\xee\\x1f\\xb7\\x04\\x98\\x16\\x95\\xf3g\\xfc\\x89\n?\\xd3*\\xb3\\x11(\\xd0\\x99\\xd9\\xec\\xd8\\xa2vp\\x7fl\\x9d \\xb9\\x16!\\x18\\xac\\xe3\\xcdw\\x89>|\\x83\\xe9\\xff\\x96\\xe5v\\x0c\\xd2o\\xdd\\xa36\\x8f\\xd7\\x05\\x80\\xe4of\\x0b\\xac\\xf0\\xa1\\x8bo\\xb9\\x7f(d\\xd2a\\xc6tp\\x83d\\\\xb0\\x832x6\\xae\t\\x90\\x98i\\x0e\\x17\\xbf\\x93\\xc9\\xd2\\x95o"
  512. },
  513. {
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\x88\\xa2\\xf9\\x9b.m\rcjk\\x12g\\xf5\\xe47\\x92c;\\x01i\\x06\\x02\\xd2uh\\xb7\\x9d*\\x9cz\\x99\\xa2/@xj\\xb1\\x8b\\x9b\\xea#\\x06\\x91=\\xdd\\xa2\\x167\\x9a\\xef\\xbb\\xed\\x0c\\x91v\\xfe\\xbd\\xcb\\xb2\\x8d\\xfc\\x84\\xcd?j>\\xd3\\x95\\xe2t\\x13\\x00\\xecz_$d\\x105p\\xb5\\xcf&q\\xbf\\xbd\\x1c\\xebl#t\\xf90\\xa3\\xad<<\\xd6\\xc7\\x91\n\\xd64\\xa9k& \\xb6\\x128~\\xf2\\x91\\x81\\xa3\\xbe\\xe7\\x1e+\\xc9\n\\xf9+\\x07c,d\\x0b\\x16p\\xfexi\\x95-\\xfes\\x8cd\\x07'\\x18\\x1a\\x82n\\xb3\\x17\\xec\n_\\xa9\\xee\\xf9e\\xb9\\xc2\\xcdo,\\x08!\\x07\\x07q\\x85\\xe2\\xb4\\x00u\\xae\\xd3yw\\x94\\x14!|h\\x9b\\x03\r\\x06\\x1a\\x193\\xa2\n\\xbf\\xe1\\xab\\xe9\\xb8\\x02vk@\\xe1&\\xd6f\\x82w`\\x8c\\xdf.i\\xed%\\xd6d\\xb8\\x11&)\\x12\\xaf\\xe4\\xa0\\x85\\xa46\\x9c\\xe0w\\x18\"\\x9d\\xf9\\xd8\\x93\"\\x01\\xbf\\xf8_\\x8d_\\x98\\x10h\\xee\\xf1\\x86nl\\x05\\xd2\\x01s"
  515. },
  516. {
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xa7\\xd7>}\\xcaq\\xc2o \\xdf\\x1acx\\xbd\\xd2y\\x8b\\xb5\\x00\\x03`\\xf5\\x97\\xc3\\x14\\xb6\\xee\\xd4\\xea\\xa2\\xc5'<#\\xf5\\xaf\\x00\\xea\\x80\\xdf/1\\x0c\\x12yf\\xae\\x1bp\\xf1\\xfb\\x81\\x05\\xbf\\x00f\\xed\\xaa}\\xc9w}\"/\\xd5z\\x02\\x05\\xe1\\x00\\xb5\\x8c\\xbc\\xc4v\\xae\\xb5\\xf8\\x98rz\\xcf\\xaf<\\xc1\\xe9|xcy~\\xf8+\\x91\\xd7\\xde\\xfa\\x00\\xcf\\xc4\\x02\\xd4@i\\x07n7\\x03\\x05\\xb3t\\xd12m\\xabj\\x88p7\\xa0\\x18&\\x91\\x10\\x95\\x94\\xf3,\\xbd-}!\\x8c\\xdc\\x9c4i\\xbfh\\xc7\\x0b\\xa9\\xad\\xf4$\\x95\\xf0\\xcf\\xf3s\\xf80\\xa0\"s\\x1a\\xa4\\xfe\\x86\\xf5j>\\xd8\\xa1\\xd5\\x96j\\x998j&\\xa8\\x16\\xd8i\\xa1\\x0b\\xcb\\xd7 \\xe9&\\x87\\xe5eb\\xbc\\xe0\\xa9\\x1ce[\\xa8\\x95\\xda\\x9a\\x0b\\x95c4\\x9e\\x83p~\\x0b*\\xe6xq[\\x00\"d\\xc6\\x16an\\xa5\\xd6\\x12\\xa4y\\xfa#n\\xac\\xf5l\\x9c\\x1c\\x91\\x08\\xe9\\x8d`\\x1f\\xdf\\xff)\\xc3\"\\xb0qp\\xbanwkg\\x88"
  518. },
  519. {
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?r7\\xa3!\\xbd\\xcce\\xf9'&ku\\x08\\xf0t\\x94\\xb9\\x9a\\xd6\\x88\\xd8\\xfb\\xe9)\\x91\\x96\\xa43\\x13\t\\xdd\\xcf|b\\xd9\\x9e\\xbco\\x83\\xb9t\\x10\\x97\\xad\\xff\\xf1\\x92&\\x11\\xc9\\x0c\\x02\\xb8\\xf1a)%\\xadn\\x93\\x94\\x83\\xee_\\x8d\\x8b\\xbd\r~2rx\\xe9bf\\xda\\xca~\\x15d'\\xe0\\xa0\\xb7t\\xc8\\xfe(d\\xc9\\xc3\\x15\\x81o\\xa1\\x9f\\xb4\\x99%\\x02\\x08o!1xvu[:\\x99u\\xa0\\xd9\\xf2l\\xf45n\\xef\\xb0+p|\\xb3w\\xe4\\xf1\\xb5\\xaa^\\xabzt@\\xff\\xdc\\x9c\\x8fn\\xb8\\x0b0\\xbf\\xf2\\x14\\xc9a\\x9f\\xc9>\\xf1\\x8apk\\x02\\xfb\\xed!k\\xb6\\xe7\\xf1\\xac|(\\xff\\xcc:u\\x17\\xbe\\xcck\\x0f\\xf8\\x8b\\xbc\r\\x0c\\xce\\x03%1\\xae\\xbd\\xc5}[b\\xb0\\x1c&jg\\xc3\\x14\\x18\\xbe\\x15\\xc5\\x93\\xaf\\xf1\\xcb\\x0e\\xd5\\x9b\t\\x1c\\xc8\\xf4\\xcev\\xab\\xa9\\xd6\\xfc6un\\xa9]4\"9j\\xe3\\xdflg\\xc9\\x01\\xda*\\xcc\\x8a\\x96\\xba\\xd1\\xa1\\x7fs\\xa0\\x13@\\xe7ym\\xec\\x95"
  521. },
  522. {
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\x8e\\x83\\xd1\\xd2\\xdd\"rd\\xda\\xaa\\xed\\x05\\x08nbh\\xfc\\xa5\\x81\t6\\xd5)\\xda\\xfc ef\\x1b}\\xca\\xf8\\xab\\x1b\\xd6\\x89\\xf6y\\xe2p_\\xfc\\x13q\\x88\\xce\\x99\\xd4\\xec\\xa2\\xec\\x00\\xf1@\\x8c\\xbe\\xdd\\xcd\\x96\\x03\\xda\\xf1\"\\xe0`\\x88\\xb3?\\xa1\\xdf\\xa0w\\xc8\\xf0n*j6\\xaelnv\\x05\\xe6\\x8e\\x82\\xce[\\xaft\\x14\\x83\\x87h\\xcd\"\\xcfv\\xaa\\xf8t\\xc3\\xd2\\xe0\\xd0\\x9da\\xf6\\x11\\xbb\\xd3\\xc8\\xcd\\xb4jh:or\\x87\\xcd\\xbf\\xaan\\x7f\\xfd\\xe3\\xda\\xee\\x0f\\xe0=\\xa2bip9w\\xa7\n\\xd6\\xaf)\\xbe\\xb0p\\x8c\\xf7\\xc2\\xcatz\\xc7`l\\xf4:\\xbc\\x88)\\xc6v\\xd5\\xc6\\\\xa1\\xbcd;0\\x04\\xa2@\\xe9\\xe9\\xdc\\xb0\\x15\\xe3\\x8f\\x8a\\x01r\\xf4h\\xe6\\xa9\\xca?\\xa5o\\xd7\\xd2|\\x1f\\x17\\x97\\xd3\\xa5\\xa6\\xd2\\x97\\x00\\xcc\\x85v\\xaf\\x8c\\xb6\\x96{\\xc7>\\x90\\xe3]\\x97\\xb8m1\\x07\\xec\\xbb\\x05\\x83\\x01t\\xd5\\xd7_\\xe1\\x1a\\xea\\xaat1\\xd6=\\xa4\\x01\\x92t\\xaf\\x9e$m\\xaf\\x92w/"
  524. },
  525. {
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xffb\"+\\x16\\xa8mm5r\\xf81&`n\\x9d\\xa8\\x83\\xef\"r6j\\xe5\\x80\\x9e\\x9e=c\\xfe\\xd6\\x9e\\xac\\xeb\\xc1^4t\\xa7\\xd1\"<4\\xe8\\xca\\xb9|\\xaf\\x85\\xb7-\\xc8 \\xa2\\xd8\\xdc\\x9e\\x15\\xeb\\xe8\\xf6\\xae\\xb6{\\xcd\\x1e\\xd7w\\xcc\\xf5t\\xcb\\xc3\\xc3@\\x16\\xc8-\\x8ax\\x1a\\xb2\\xd9\\x0e\\x9b\\xc7\\xc7\\xba\\x97\\xa9\\xda\\xe9\\x07\\xe5\\xd6\\xa8\\xaf\\xe2\\x12\\x94r\\xf8\\xae0\\x8fas\\xf5x\\xf2\n$\\xca7/\\xc8#f\\xfa\\x12\\x1d\\xa6tl/q\\x0b\\x93q\\xbc5<2g\\x9ae\\x0b+\\x11\\x1flh\\x7fv\\x82\\xecs\\xd8\\xd1i\\xe9\\xb5;\\xde/l\\x14\\xe8\\x01\\x9e\\x1c\\xfc\\xed?\\xe6\\xab\\xd0z\\xbe(d\\xd5\\x1bvel\\xeeoq4(56\\xac-\\xa0@\\x86\\xc1^\\x8ag\\xb6\\xb8g-\\xfa\\xe8\\xbat\\xbb\\xb8\\x1e\\x8c\\xc5\\xb9\\x17tx\\x07\\xe4\\xc9\\\\x11\\x10\\x83\\xb6\\xc5]\\xa4p\\xc4\\xb7\\x9e\\xeav-\\x1c!\\xe0\\x8f\\x13r\\xad~~\\xb6]n\\xb1\\x0f\\xa3\\xd1\\xb7\\xb1\\xa6w\\xfbj\\x0c\\x0c"
  527. },
  528. {
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\x04*\\xbd\\xb3\\x13\\x8a\\x1b\\xb4\\x18nw\\xb8\\x9b\\xf83\\xbf\\xa1\\xdct\\xf2q\\xec8\\x99nyx\\x0b\\x90\\xaf\\x11\\x15\\xf9ewo\\x82\\xa7\\x85\tbcp\\xb1)\\xa0i\\x03\\xec\\xc0i\\xc3\\xdde\\x15\\x84of\\xcatb\\x98dwa\\x97\\xffj7\\xda\\xb5\\x02vt\\xbb\\xf5\\xd9{\\x03\\xab@\\xea\\x8f\\x0c\\xe8\\x1ak.\\xaf\\xbb\\xcb\\xea\\xf7\\x82 \\xbe\\xc1\\xa1\\xbc\\x8c\\xf0l\\x84zb3\\x1d\\x8a\\x8c\\xe7\\xb8\\x86\\xdd\\xb4&\\x7f\\x8c\\x9eqv\\xd1\\xe2\\x82\\xed(/dv\\xc8a\\xa4\\x1d}\\xfd\\x97\\xa0\"?x\\xb7\\xf5\\xa7\\xf7u \\xb0\\x9c\\x90<\\xea=}j-\\xee\\xe3\\xfe\\xdb\\xae\\xbce\\xd49\\xfe\\xd0$\\x0f\\xd8\\x16\\xce\\xdd\\x1d\\x7f\\x7f\\xa8\\x98\\x0c\\xfc'6\\xb0j\\xa1b\n2\\xff\\xea\\xed\\x82%\\xa1k\\xdc\\xfa\\x1c\\xa8\\x9f\\xf3\\xa1-\\xed\\xd1\\xfe\\x91:u\\xe5\\xa7\\xc5\t`\\xf3\\xaaw{\\x81\\xf3\\xab;!<\\xf9t\\x03i\\xb9\\xcb\\x07fu\\`\\xd5\\xa7\\xa0\\xda\\xdb4l\\x93d7\\x052\\x17\\xcdc\\x9f\\x10"
  530. },
  531. {
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\x14\\x125\\xa5\\xe3&\\xf28*\\xb7\\x8b\\xec\\x03\\xfa\\x81\\x98h\\xc5\\xc6\\x00j?c\\x8b|'\\x05\\xd0\\xcfl\\x02\\xc9\\x85\\xf7\\x9e5\\xec\\x06\\@\\xa6x\\xc9r\\xfa\\xd0\\x89\\xa8\\xd1\\x07\\x01p#\\xb1\\x13\\xa2\\x83\\xc7\\xd0\\x80\\xd2\\x0b\\xdb\\x134[\\xe7b\\x99f\\x99\\x0ci\\xa16\\xaf;i\\xa0c\\xb2g\\xf8\\x1c\\x8d\\x9c\\x0e\\xfd\\x13u\\xf5\\xe1\\xa9\\x9b\\xbb?\\xfc\\x0cs^]\\xf0\\x01\\x1c\\x97\\x88/\\x7f\\xf4n\\xa3\\x8f\\xdc\\xa0\\x95\\xb5\\xd3\rf\\x95\\xa4\\xe9\\xb5\\x98\\xdb\\xebn\\xef\\xd2\\xf9o\\xbc\\xf7\\x9f\\x07o\\xc1\\x916td|\\xc2sc\n\\x98\\xc6k%x\\xd8\"\\x8ar\\x00\\x03\t\\x00br\\xd4pv\\x8d\\xf6\\xe4\\xf6\\xdc\\x9b\\xe5\\xdcxy\\xe0\\x13\\xeb\\x85i0\\xcf\\xf0h1\\xe4d\\x10\\xaa\\x85sji2\\xd8v\\x7f\\xc8\\xdek\\xac\\x01\\x1d\\x83\\x8e\\xa7\\x94\\x83\\x9f\\xd4\\x03\\x8d\\xe9\\xfd\\xaf\\xfc\\xd3\\xee\\xe1\\xa2\\x84\\x8bk,z\\xda\\xdb\\x92<\\x8b\\xe64\\xddv\\xc3~\\xaf\\xf7\\xd9m2^i\\xda\\xbc\\xc3\\xb6\\xf6\\x10\\x16>"
  533. },
  534. {
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2p\\x9be\\x97\\xacg\"\\x1b^\\xb8\\x99p\\xc6\\xc8\\xce\\x0e\\xa6v\\x93\\xfb\\xd9b\\xd53\\x10\\xcd\\xeb\r\\x17m\\x12%\\x19\\xf1\\xf4\\xa0\\xb3\\xa6\\x91h\\x9c\\xc2\\xe0\\xce\\xd85d\\x07\\xca\\x9e*\\x04@./\\xdd>\\xb1}umh\\xa5\\xfe\\xbco\\x17-a;h\\xcc\\x1e\\x97\\xa12\\xa7m\\x98!\\xff\\x94\\xcb\\x94@\\x06h\\x8d\\x08z\\x07\\x1aq\\x1e\\x1b\\xcfw\\xb6<\\xa2=\\xe1x\\x05x\\xf4\\xf5g\\x145\\x1d\t\\xf9w{4\\xa6\\x91\\x0e\\x11r\\xa3\\x0e\\x01\\x8d\\x12#\\x134{\\xe1\\x15l\\x12\\xa2q\\x00\\xd5\\xee\\xbacje\\x07\\xfdb\\xb0\\xed\\x92\\x1c\\xd5 x\\xb0 $\t\\x8e\\xc1h\\xb1o\\x9c\n\\x8dptcxq\\xb8\\x97\\xc2\\x0b\\x88\\x7f\\xc70r\\x01\\x0f\\xe5\\xfbd\\xe9\\x07{\\xb1c\\x18\\xe7\\xd24\\x15\\x80e\\xb2}\\x04\\x96\\x05f\\xa2\\xa4\\xf1\\x1d\\x16\\xdc>\\xa7y\\xb3\\xce\\x00\\xca0\\xb2\\xd8\\xe3!\\xf1[\\xce9\\x8e`\\xd5\\xda#\\xd9\\x06\\x7f\\xf6q\\x9c\\xef\\x1a\\x01\\xecz\\x7f\"?q=m\\xa6\\xae\\xf5o"
  536. },
  537. {
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1<\\x86\\xaf\\xaf\\x80\\xfd\\xff\\xc0\\x84\\x1e:sb\\xf7\\xf246\\xdda\\x8cx\\x92\\xaa\\xb0$\\xd5\\xd4\\x9bza\\xc3i,\\xc66`8\\xc9m\\xa9i \\xaf\\x94{1b\\xb0u\\x04\\x81\t\\xfc\\x16\\x0c\\xbc\\xe7z\\xb3\\xf7\\x17\\x06v\\x16\\xc8\\x17n\\x8cm\\xe6l~\\x8bz\\x95'=\\x02\\x1a\\xa7\\xa7|\\x16\\xb7k\\x01i\\xbc\\xc2,?\\xb3\\xf0\\xd4\\xbd\\xb3\\xbfz\\xfe\\xc9\\xfc\\xef\\xb5l/\\x1d\\x1c\\xd0q\\x12\\x91\\xf4o\\x19\\xaa`\\xc0\\x06o\t\\x9c\\xa4\\x94\\x9d\\xe7\\x85\\xbdd\\xceur\\x80,.\\xb5r\\xeb!k\\xfc\\xce\\xe1\\xe8\\xfb\\x92\\x06sx\\xaa\\xf1t\\xfb\\xde8i\\xc2l\\x99\\xde\\xcf\\xa4\\x82\\xb2p\\xa2[2;\\\\x00\\xb7\\xe7\\x8f\\xb7f\\xa2}\\x13\\xa7\\xa4e\\xda\\xf3r\\xe6\\x8d\\xb1\\xb7v\\xea\\xa7ua\\x0f`\\xf7\\xdap\\x97\\x86q\\x11h\\xc4-\\xcf\\xab\\xf1\\xfe\\xfb\\x12\\xbb \\x04=^0u)\\xdd\\xf8\\xc2\\xa8cs^\\x8f\\x00\\x8cd\\x87!|]\\xb3+0\\x0f\\xa2\\x05\\xe3\\xe6\\xa7m\\x8b\\xb9;\\xf7\\xbd\\x9c"
  539. },
  540. {
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdbc\\x14\\xdey,\\xf8t\\x08\\xb4\\xd6\\x80\\x9b\\x84\\xa8\\x8d\\xda\\xbea\\xc9\\x9a\\x88`\\x84\\xae\\xd4\\xe8\\xca\\xab\\xb0\\xef(\\xb0\\xfb\\x10]>\\xf5v\\xff\\x9bf1[w\\xf7\\xe5\\xeb>\\xb8vlnk\\xd2{1 +\\xf3\\x9b\\x89?\\x83j\"\\xc7g\\xc5u!z9\\x9de\\x16\\xc9y2\\xc32+\\xef\\x92\\xb4\\xfa\\x0e\\x1a4\\xa7\\x90\\xc2[\\xef\\xeaf\\x04w\\x19\\xd2\\x9e\\xe9ni\\xa5p\\xf5\\x8d,\\x0c\\xa6\\x08\\xc9pl\ng6&k'\\x1ck\\x12\\xa8\\xaag?\\xfa\\xfbh\\xa7\\xe0h\\x14db\\xe0\\xf1\\x16\\x97au\\xb2\\xe1r\\xb6\\x0bp\\x93\\x0fy#\\x96\\xdc\\x97\\xb6 \\xb5\\x1d'l\\xff\\x98f(\\x19\\x05\\xd6g\nu\\xb9\\xe9u\\x97\\xe9\\x07\\x1d\\xd4\\x7f\\x8bi\\xb3s\\xf2e\\xd8c\\xaf<\\xa5\\x1b\\xe0\\x84{i\\xee\\xb9\\x88\\xef&p\\xb0.\\xbc\\xf4%g\\x9f\\x05y\\xa2u87\\x9fq,+\\x11\\x80\\x0c\\x8d\r'\\xaaju&\\x9e\\x98l\\x03\\x7f\\xf3\\x1bv-e+\\xaa\\xe6,\\xe3\\x180\\x15\\xecu["
  542. },
  543. {
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\x90b\\x8a\\xf0\\xd6!\\x9f\\x05\\xb3m\\xbf\\xe1j\\xf2\\xf7\\xda\\xb9\\xdf\\xf4\\xf139>\\x9a\\x8f\\xa0\\xd3\\xdc\\xac\\xd9\\xcf\\xe2\\x9a\\xfd\\xa0\\xffi\\xee#\\x1b!\\x8f\\x0f\\xc4\\x94\\xaf\\x7f\\xd0\\xa8(\\xd1\\x12\\x14\\xa5pc\\xf5,*r\\xa2\\xa5\\xe4\\xd5\\xc8|pr\\x17(\\xe9\\xdf\\x90\\xa7a^\\xd7\\xd6\\x98\\x9ew\\xa8;6\\x11\\xfcx\\xe1v~\\x05.\\x1b\\xbc\\xa7n\\x1f\\xc7\\x07w\\xb0\\x15(\\xf6\\xdc\\xc6z5\\x92\\xd3\\xb5-\\xbf\\x12}\\xf1\\x0c\\x8f\\x1c\\\n\\x80\\xf4w\n\\xb60\\xae\\xb4b\\xca\\xa3\\x84\\xa4@\\x96\\x13j\\xd7\\xb3\\xbb\\xf5\\xba\\x8cvn\\xb3q\\xf1\\x17\\xec\\xe7se\\xdd\\x9b\\xfd(\\xb1\\x98\\xf6\\xe5br\\x96\\xd3\\xcf\\xfc>\\xefj\\xc3\\x8az\\x87\\x8f\\xc7@\\x84\\x93\\xcd\\x9b/c9n\\xdc\\xdb\\xb83\\xf2)\"&\\x95\\xdc\\xbbb>\\xb9g\\x04y\\x86\\x0c\\x00\\x05\\x1b:\\x95\\x07w\\x84\\x83l!\\xd2\\x10\\x07\\xfb\\x92\\x923\\x93\\xb0\\xd0&-\\xac\\x82\ni\\xb2\\xc2\\xb3\\x83\\xe4\\x92\\xf3_\\xb3<\\xfc\\x84:8\\xb8\\x94\\x8c\\x9d"
  545. },
  546. {
  547. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xe6\\x84o\\xf4\\x80\\x1d\\x9c\\xe8\\xbe\\xce\\xcb\\x8b4if\\xd6\\x10\\xab\\x96\\x17#@\\x9c\\xcf\\xc6\\x86\\xe0d\tt\\x04\\xe4\\x06\\x9ah\\xff\\xf1\\xab\\x83\\xd2\\xe3y'\\xc1<\\xbc\\x98\\x9eq\\x14\\xd7w\\x87n\\x12)\\xc2(\\xae\\x05\\x96w\\xc3\\xaa\\xc2\\xacp\\x0e!w0^\\xaf\\x97\\x04\\xc2\\xbev\\x94u\\xa2k\\x1a\\xd6/i|\\xd5\\xa1\\xcd\\xfc\\xbe\n\\x86m\\xa0\\xbe=\\xe4\\xea\\xb9\\xc0\\xb6\\xc3h\\x89\\xa2r`\\xcao\\x07x\\xc9\\xad\\x9c\\xa1|\\x17[\\xea\\xfd?\\xa3\\xcf*\\xd7\\xc1[\\xbc\\xc9\\xe1\\xae\\xe6\\x95:,\\xd7'\\xd4pbxc\\xcdn:g\\x95\\x83\\x8a\\xa1\\xe1e:ugs#\\xa2\\x12\\xc1,\\xd8v\\x1c\\x08i\\xd2\\x98f\\x94o\\x0f\\xd0#\\xb7\\xaa!\\x9b\\xbb\\xee&0\\x9doe\\xe8\\xfds\\x82\\xd9<\\xe8k\\x07\n\\xdbsq\r\\xc1\\x07\\xb3\\xf3c\\x88\\xc7\\xbf\\x13)\\xc6\\xb9\\xfdz\\x81\\xb8\\x18\\x87d\\x99 s\\x8ef\\xa7v\\xc2\\x8d\\xd5\\xfe4e\ng\\xd9\\x82\\x8e6\\xd7\\xbe\\x9a\\x97g\\xccl\\xdd\\x17\\xf40"
  548. },
  549. {
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6s\\xc1\\x98\\x1f\\x14\\xa8n\\xde\\xea\\x1d\\xc29\\x00\\x01u\\x88\\x83\\x1e\\x94\\xc2\\xd6 \r\\xcb'u\\xcbx\\x8bv\\x04~\\x0b\\x00\\x9ex\\xf0\\x8a\\xf7\\xdbt\\x8f\\xcd\\xbd\\xa9\t\\xec<<;\\xb0:`\\xeb\\x96\\xad\\xa1\\x9e\\xc7\\x99\\xf0\\x80\\x99'&7\\x83x$\\xfa/\\xcd&4s\\x18\\x91\\x8d\\x9b\\xbe\\x8d\\x16\\xbb\\xd3\\xae\\x0725\\xb9\\x00@\\xf4}[\\xee0\\xf3y\\xa2\\xe5\\xf9\\xa9\\xdbh}\\xef\\x00\\xd2\\xfe\\x19\\x85\\x9emo\\x01\\x98\\x8e4?\\x02<\\x03\\x9c6\\xc0\\x0c\\x15\\xfc\\xe7\\x8b\\xcbw\\x08\\x9b<\\xaa\\xab\\x96\n\\xbb\\xea\\xd0b\\xe1\\x10k%p\\xaag\\x91]\\x9cr\\x12}\\x02;\\xb7m7m8ir\\xdf\\xb8\\xe6\\x8c/\\xc3\\xf4\\x03q@01#\\x95\\x91\\xb7\\x0e9q%\\x19\"\\xe8\\xa5t\\xe2\\x0f\\xe3\\xf8\\x05\\x9e#\\xf3\\x82\\xc7r\\xbdgjt+*$f\\xaf\\x86a\\x17\\xb96\\xf1\\xb2\\x82{}\\xf8\"\\xe8\\xcd\\xf3\\xf9h\\x82\\x1f\\xd9pq`\\xa7w\\x81\\xe9\\xb80\\x1a\\x8c\\xe7mh==\n?r\\xf4"
  551. },
  552. {
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:q\\xc85\\x17\\x8a\\xe9\\x0f2\\x84n\\x02\\x05\\x08\\xbd\\x96\\x91\\x89:'`akrxq\\xba-*\\x805\\x0f\\x91\\x0b\\xdb=]\\xa4\\xc6\\x1b\\xcc\\x06\\x9b\\x08hs\\xee\\x03\\xd3\\xc5\\x8b\\x00\\x1f[\\xf3/\\xb01\\xe9k\\xf1\\x07t\\xf1r\\x10&\\dj\\xf4{\\xfb\\xb4p1\\xdc{\\xf2v4\\xf1p\\xf7\\xe7ny\\xf8\\xb8nw}\\x03v3\\xbc\\xd0\\xc8\\xa1\\x9f~\\xe6\\xcb\\xaegaz^\\xf3\t\\x16\\xe5q\\xa7\\x9eb\\xd2\\x07\\x91\"\\\\xbck\\xab\\xe6i\\xfe\\xcc\\xf3\\xda\\xbar\\xf6\\xac\\xe1\\xda\\x05a\\xd4\\xfd\\x98>\\xe8n\\xe9lt\\x85\\xe2\\xa6>\\x1c\\xb7\\xaa\\xads,\\xf8\\xb4\\x06'r\\xdbw\\xf8\\x05\\x89<y>f\\xf9h\\x18\\xbb\\xa4>9\\xf3\\\\xb8iz\\xe3\\xe3\\xcd\\xcc\\x0b\\x93\\x01x*\\xaashs]\\x89\\x05\\xf98\\x8d\\x92v\\x98\\x14)\\xbe\\x7f\\xef\\xe5\\xf2m\rly\\xf9.1hv\\u\n:\\x0ey4{\\xde\\x06k\\xf0t7\\x7f\\x06\\xf2+\\xc3\\xb1nv\\xc5\\x16\\xe8m\\xca\\x9db\\x91"
  554. },
  555. {
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\x15k\r\\x06(\\xd2\\xed\\xb0\\x8e\\x02\\x9fff\\x82~w\\x89\\x9a\\x03?\n%\\x87j\\xefgxp\\x19\\xe8\\xe9\\xbb\\xba\\xd7\\xf1p\\xde\\xce\\xbf\\x07s\\xee\\x81\\xc2\\x959\\x08\\x9a\\xdb\\xc9\\xdc\t\\xddj{\\xf8\\xa8\\xd0i\\xa9\\xeb\\xa8\\xafi;\\xb1+t!.f\\xbb\\x189r\\xb23i.\\x9b\\x83\\x98\\xbb\\xc9\\x1c\\x97v\\xe2\\x99\\x88l\\xb9\\x05l\\x1f\\x13\\x0f\\xf75\\xd9\\x05>.f\\xf7\\x94\\x88@\\xd6%\\x90\\x07\\xff}\\xeb(c\\xf1s%brm!.d2\\xe4s`\\xf8b\\xe7\\xbe\\x07\\xb0\\x9f\\x1c\\x19j\n\\xdf\\x08n\\xcal\\x90\\x9f\\xcf\\x02f\\xffj\\xd5c\\x7f~\\x0b\\xb5\\xdd\\x9f\\xaf\\xf4\\x86\\xf2\\x10m\\xc66\\xefj\\xff\\xfdk\\xe5u\\xa81\\x03'rrqt\\xd2\\xa6\rc\\xde5-\\xbd\\x03\\xff\\x92\\xbb\\x05\\xd4-\\x12\\x05$v\\xfc\\xf6we\\x9fm%\\xa9y\\xee(s$\\x12\\x0e\\xc6\\x04\\x9a:\\xc7\\x1c\\xda7u\\xe6\\xa0\\xf9\\xf5kz\\xad<\\xdd~4\\xb2\\xb3\\x96\\xb3\\xedgc\\xb5\\x88lc\\xfe"
  557. },
  558. {
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\xd7\\xca\\x89\\x16z\\xa4}\\xca\\x10\\xa7\\xc2\\xd9\\x15\\x88\\xe9\r\\x16\\xd3\\x87\\x9d\\x0f\\xe6o\\xc1\\x8cv\\xda\\xd7p\\xe9ab\\xe3\\xd7\\x8a\\x97@#\\x1f\\xf7^\\xb3\\x8d\\x8e\\xf2\\xfelh\\xf4\\x95\\x9a\\x84\\xa6\\xf6\\xa9p\\xb5\\xb2\\x192?\\x94\\xfb\\x82*r\\xd1\\xae\\xaa \\xa6\\xf4\\xb0\\x8b\\xc2\\xae\\x07|\\x8b\\xd6\\x06\\xa7\\xce\\xfaq\\x8f\\xf3\\x1b\\xbb\\xc7\\xbf\\x8f\\x1b@5\\xd6\\xb9\\xc6\\xfa\\x86\\xb3\\x03\\x89\\xc7\\x9f\\xe4\\xcf@:\\x81v\\x932]\\x1e\\xf8\\xdfl\\x13\\xedi\\x1fu\\x966\\xfb\\x85(\\x18\\x84\\xabn\\x85\\x91:\\xd0\\x1e\\xf5\\x89\\x9c\\x7f\\xe2\\x03l\\xf5r\\xae\\x18<,\\xce[\\xda\\xe6\\xbb\\x9b\\x19\\x9e\\x0c\\x1f[\\xe7\\x94y 7\tlhoy\\xf8x]2%\\xebj\\x9b\\x98\\x818q\\xed\\xbb&14bx\\x1f}e\\x8cf\\x7ff\\xcc\\x9b@b\\xea7-+\\x1b\\xd0\\xf1\ta\\xae\\x82\\xe7\\x7f\\xa6d\\xba\\x80\\xa6{),\\x1c\\xdd2\\x12\\xda\\xca \\x1c\\xa7\\x96e\\xc0h\\xf5\\xad\\xfes\\xf0*\\x84u\\x1b\\xfc \\xc4\\f\\xce"
  560. },
  561. {
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f#jol\\xbf\\x16\\xa78\\x059\n\\xee\\x08\\xcd|\\xf3\\xc0\\xb2\\xb5\\x8d\\x9e\\xce\\xaa\\xf1t>\\xdfl\\xa8h\r*eg\\x919\\x00\\x06\\x90\\xd6ws\\x17\\<\\xda_\\xf9\\xec[\\xd9\\x94mz\\xd0\\xb7o\\x94o\\xb9\\x814t\\x8f\\xe7\\xf3\\x19\\x1b\\xfew\\xa6/\\x1ci\\xfd+\\xbb\\x9b\\xe6\\xd6/c\\x00\\xe5&\\xc3k\\xfc\\xe8\\xaes\\x17\\xe1\\xf6h'\\xa4\\xf3|\\x11\\x8an1\\xef\\xd3\\xd1\tl\\xa5\\xe8\\x10\\x9a\\x8e#\\xf3fp\\x1d\\x8c\\x15}\\xe2l\\x1ar6/\\xf04h=r\\xc9\\x11\\xb7\\xf3\"\\xf1\\x89\\xaf3h\\x8au-\\x1c\\x99\\x10\\xb5p\\xd4\\x1dq=\\xcd\\xf7-\\xd8\\xcc6s\\xad@4\\x98'+x@o\\xbb\\xc8ved]\\xb3\\xafew\\xfc;k\\x80l\\x1b\\xba\\x8a\\xadg\\x83\\xc8\\xfd\\xc8]\\x90\\x182\\x07d\\x82bc\\x1a\\xf7w=\\xe2\\xb9\\xe6\\xa4\tc\\xe4\\x07\\xc9\\xbb\\x93\\xd9\\xde\\xc9ue\\x0b\\xd1y\\x08\\x00\\xf1\\x89d\\x86\\x19\tb\\xd9\\x82\\xe8\\x1f\\xde\\x17[\\xdcs\\x8b\\xd3o\\xf4\\x8a\\"
  563. },
  564. {
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\x9b,e\\xed\\xc3\\x0c\\xa0\\x8e\\xff\\xfb\\xa5w\\x86\\xc5\n\"\\xcb\\x1bf\\xe3\\xff\\xfd^\\x82\\xc1\\x92\\xd6\\xee\\xf9\\xe0ueb\\x0f\\x90o#\\x90e.\\x8c3-\\xc1\\x89 r\\xf9\\x95r\\xa0]q\\x03\\x16\\x8c\\x9d3\\x82df*\\x9d\\xcc\\xa6\\x1f\\xb8\\x0f\\xfcg\\x93\\xfd\\xba\\x8f\\xf8n\\x1e\\xf5\\xa5\\xcdcy\\xbc>\\xf8\\xda5\\x13\\x16\\x00\\x1eo\\xed0\\xc7\\x89\\xf2x\\xf5\\xa0j_\\x86\\xb9\\x06\\x19\\xfb\\xcdcl\\xfd\\xdd\\xad\\xc8\\xa5\\xd9\\x1f\\xae\\xe3c\\x90\\xc0\\xa6\\xd9i\\xcb\\xee/\\x14\\xbcc\\x91\\xf7\\x90\\xec-1n\\xde\\xd1q\\xae\r\\\\xb0n\\xab\\xc0\\xd5l\\x1e\\xb1\\xc8\\xe6f\\xa3'q\\x00\\xbfp\\xb5\\x92\\x9e\\xdb.?\\xff\\x1b\\xcd\\x93\\x9c9=\\x13\\xa4/\\x9c%\\x8ad\"=\\xc4m\\x8f[\\xf9\\x02i:m\t\\xff\\xb2\\xf3\\xe5\\xdf{rq\\x9c\\x93\\xad\\x02\\x9e\\xd3z\\xdd\\xf7[6\\x01\\xa1t\\xbd>\t\\x0e\\xb7~\\xe1\\xc5\\xf8\\xd1*\\xa1h\\x9b\\xad\\x1e\\x84\\xb2\\x97^eu\\x03\\xe6\\xf4\\x9e\\xf4\\x85\\x85\\xdfh\\xe3\\x8ea\\xfd"
  566. },
  567. {
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x13=\\x1da\\xba\\xca\\xfd\\x88*\\xc9\\xd6\\x0f\\x91\\xe5\\xe4\\x17t\\xb9\\xd0\\xcf\\xa5\\x835\\xc0\\x98\\xf0\\xb6\\xdf\\xc4!\\xfbi\\xc3_db\\xd0\\xa6\\xba\\x10\\xf7\\x05b\\x9e\\x1e\\xf4\\xcb1\\xee\r\\x1f3\\x02\\x8ey\\xf0\\xbd\\xe9<\\x17z<x\\xdd\\x9d\\xaf\\x81\\xdb\\x9fn\\x07\\xef\\x06^\\xc3:\\xd7\\xe4b\\xe0j\\xe1c\\xc7z\\xd3\\x15\\x8b\\x97\\xe1\\xdcw\\x01\\xdb\\x00\\xba\\x98\\xfam1xgu\\x08\\x11\\xef^ $\\xba:\\x01\\xbag\\x04v\\xc1l\\x8f\\x05?\\xe5>\\xb6\\x06\\xf1|\\xa8\\xa9\\\\xb6\\xa2v\\x8cf#\\xb8\\xf5y\\x84\\x1e\\xa3v\\xff fd\\x0e\\xf6i\\xff\\xd1\\xb8&%\\x01\\xa4@|'\\x88m\\xedk\\x9c;|\\x1a\\x82w\\xef\\x07\\xffw\\xc7\\x19\\xe3\\x18\\xa1\\xed\\xd5\\xc8\\xf5o\\xd4|j\\x8d1\\x1dj\\xc0\\xc2m\\x1bk\\x00\\x10\\xb6\\xd3\\xf8\\x89\tt\\xde\\xa7\\xe4\\x9e\\x99jx\\x94b\\xb3\\xc8\\xd1u\\xff\\xb3\\xad\\xdc\\x18|\\x1b\\xd3\\x0e\\xa0}\\x05\\x97\\x0e\\xe5\\x9c\\xf6\\xeb\\x10\\xbfz:\\xe2\\xfd\\x9e\\xde\\x03\\xee\\x80\\xb5\\xdd6\\x87"
  569. },
  570. {
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010dy\\x11\\xff)16\\xf6\\x81s\\xce\\x9ex\\xb2\\xcbo\\xa5\\x92\\x90:\\xa7\\xb4\\xa3\\xf5\\xee\\x816i\\x06\\xdd\\x1e8\\x80p\\xaa\\x07\\xac\\x81*!~\\x0bx\\xcc\\x93\\x05\\x99*\\x0bhci\\xfa\\x8f\"\\xf3\\xc7\\xe9b\\xad7\\x9a \\xc2\\xaa\\x8d\\xe7yo\\x14}\\xc9ggw1\\xc1\\x13\\xa3\\x8d;\\x8e\\x8afk\\xec*\\xd3\\x10\\xd1\\x8a&\\xbc+%l4an\\x827i\\x88\\xdbq\\xf4\\xc3\\xe1\\x81\\x91\\x14e;\\x95\\xb52\\x94m\\xea\\xaef5x\\x14\\x8c\\x85\\x98$\\xc3\"%\\x96\\xce\\x16\\xfb\\xe1he\\xe7\\x9e\\x0e\t\\x9c\\xc8\\xd9>}\\xe1\\xef\\xf3\\xd9@\\x0f\\xbf\\x90\\xd3\\xb1\\x16)\\xe7\\xd2r\\xbc\"\\xf5\\xe1o\\xd4\\xfd\\xf5r\\xd2\\xcb+\\xce\\xc5\\x9f\\xe0\\x0e\\xb2\\xb7\\xf4\\xa0g.d\\x88\\x82\\x9c7\\xb2\\xa1\\xf0\\xcf\\x80 \\xf3)\\xec\\xac\\x9f\\x9d\\xf3\\x96\\x96a\\xad\\xc04\\x876\\xa0\\xddg\\x08\\xe8\\x1fu\\x0e\\x87o\\x98nnz1\\xfe\\x9f)\\xb8\\xe7\\x97\\xcb\\\\xf3n\\xc1\\xccm\\xecss\\xac\\x02\\x89\\xb4\\xe9qv\\x19\\xf3"
  572. },
  573. {
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd'\\x18\\x9a\t\\x92\\x90&\\xc6\\xa0\\xc8\\xe0\\xe8\\xa6\\xa1e\\xae\\xa1\\xdft\\xbd,\\xc7-#f3\\xac\\xfa\\xe3\\x12\\xe4\\x08\\xb1\\xeb\\x17\\xcc\\xe4.\\xe8i\\x15x\\xb0\\x80\\x9b\\xba$\\xb5\\xde)\\x0b\\xc5>\\x85\\xec\\xf3o#>n\\x95y<9\\xac\\xebe\\x8bt\\xd4\\xf0\t<s\\xfb\\xbe\\x10z\\xb6p\\x077l\\x9b\\x8a+\\xf3\\x06\\x92\\xb2\\xfai\\x11#3\\xb9[\\xb5\\xf0\\xaa\\xd9\\x01|\\xea\\x08\\xd6\\xa9\\xa5\\x9b\\xa7\\x99\\xf8>\\xab\\x9d\\x05z\\xac)\tu\\xe1\\xd3\\x1c\\xa1\\x8c\\x9b;\\xf8\\xb8\\x0f\\x0c\\x80k/c#\\xa6\\x8aq\\xf3\\xba\\xdfd\\xf8\\xeb\\xaa?\\x17\\x07\\xdd\\xd7qmt\\x95\\x99\\xea\\x80xp\\xa7i\\xc2\\xa6\\x14kdw\\xd0mis\\xfcg}\\x83\\x08'\\xe6\\x16\\x88u%\\x00\\xeb5u\\x1e\\xf9\\xe4jhwk\\x05\\xffp\\x9e'\\xffj\\\\xb5\\xa2\\xa8\\x17\\xee\\xff\\xd5\\xdf\\x89\\xf5m\nl\\x7f5\\xe7\\xc3\\x85\\xfa`.^\\x7fe\\x13\\xa4x\\x8f\\x17a\\xe99\\xbeo5\\x9c\\xd9\\xfcvi\\xcb=kp\\x8c\\xf2o"
  575. },
  576. {
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\x95\\x8ard\\x084x\\xef\\x7f\\xe5\\xf1\\xf0\\x0f\\x03\nc\\xa9\\xf5')-\\x84\\xcc\\xfa\\x0b\\xa28y\\xec%\\xc2\\x82y\\x14\\x12\\x05\\xb8\\xb3t\\xbae\\xf7\\x14\\xc2w\\x17\\xd1r\\x945\\x05\\xee\\x85\\x95v\\xe3\\xa4l=o\\x9a\\xba\\xfe\\xda0\\xb8\\xb2\\xf0\\xfc)\\x9c\\xbaj\\x9ae\\xcf\\xac\\xdfnr\\x0f\\xbd\\xd6h\\x93\\xeb\\xe76\\xe3\\xfd\\xaauv\\x8aa\\x1f\\x85\\xcd6\\xd7\\xd2^q\\xa8,\\x8cl\\x80y\\xbae\\x9f\\xbc\\xc4\\xef\\xa0*.\\x95\\xf9\\xb4\\xcb\\x99\\xaa\\xcc\\xfd\\xe7\\x84\\\\xb3\\xb44>o\\xe0i\\xba\\x88\\x19`\\xc2\\xfbbc0\\xe8\\xab3\\xcd\\x06#a\\x0c\\xa8\\xce\\x80v\\x1c,\\x02m\\x19\\xd2d\\x9bn\\xd9v\\xba\\x8f\\xff^\\xac\\xeel\\xe6\\x00\\xc8\\xf0\\x93e\\xfe\\x03\\xf2/!v\\x8dgmzl\\xbem\\xc2ua\\x92]\\xf1v\\xddp\\x0e\\xe64\\xc7o?0s\\x0ca\\x08\\xd8x\\x08\\x81\\xa7\\x8ao\\x1bu\\xefn\\x1bg\\x18\\x8ad\\xa0{\\x9f)\\x11h\\x8d!\\x0c\\xf4\\x88\\x9d\\x01f\\xa6^f\\xc5gg"
  578. },
  579. {
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x88\\x94\\xaf\\x9d8\\xcb\\xba\\x0b\\x04,\\xd5>\\xac'\\x91-y\\x9d\\xe7^ad\\x05\\x91p#\\x8a\\xb7\\x8a\\xca\\xb3\\xcf\\xe1\\x8a\\x8a\\x1f\\xf7&{\\xe4v\\x01u\\x93}\\x85\\xfb\\xee\\x8d(n\\xea~w\\x1fp\\x17h:'x\\xd8\\x8c\\xee2auc\\xef\\xe8\\xb5\\xa1,\\x05w<:j\\x9b\\xb8\\xbe\\xa6iu\\xc0$cn\\xa8\\xe2\\xe7,:u\\xdfyy\\xca\t\\x973'en?\\x89\\xd2\\xa9\\xc5\\xc6cs\\xbf\\xda\\x94\\xf1\\xa5\n{w)/\\x16\\x85vp\\xb5r\\xb7\\xfb\\xdc\\x1b>w\\xb9\\xcd\\xe1,\\xce\\xb4\\xe3?\\x93\\x80u\\xad\\xfb\\x85\\xfax\\x00\\xe5\\x1a\\xe7y\\x05\\x1a\\x8d\\x89'*\\x07\\x92d\\xeay\\xd5 ]\\xcd\\xd1\\xab\\xe4\\x8f]k\\xb4\"\\x95\\xaf\\xe6\\xc4\\x16\\xcc\\xd8f\\x08\\xe3&\r+zn\\x08s>\\xa8i\\xeci{r\\x85\\xb8\\x81[b&\\xdc\\xd7\\xfa\\xd9wv\\xc7\\xb6yt\\xb8\\xcb,\\x8cl<\\x0et\\xad\\xd4\\x8e\\xb4v\\xb6\\x1a\\xe98\\x9eu\\x90\\xb8rw\\xdey\\xe1\\xb6'\\xedmh3"
  581. },
  582. {
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3/\\xfch\\xe9ak\\xb0\\xcef\\xe5\\xd0\\xdf\\xdf6\\x96\\xcb\\xe5\\xeb\r\\xd4\\x1bf\\x96\\x1c\\xdbgr\\xbd\\xc4\\xea\\x07t\\x8b\\xe9\\xf4\\xa5\\xda\\x11\\xc8\\xfbj\\xdba\\x1a\\xdc\\x912u\\x84}\\x90w\\x9f\\xbd\\xdc7g@\\x00\\xfe\\xe1\\x051\\xdb\\xcf5\\xe9\\xec\\xea\tni\\xf6d\\xc8\\x12)bz\\xd9\\xd8\\x9c\\xb7}k\\xef^\\x8a\\xb8!\\xf3?{\\xc6\\xbam\\xd8\\xe0\\xf7\\x1c\\x80\\xa9\\x0c\\xd1d`\\x85\\xd7\n\\x7fg\\xc2\\x96\t\\xf3\\xb9\\x14i\\x90j\\x00b\\x1b\\x91\\xf0\\x88\\xc7gz\\xa6#}x\\xf7\\xdf\\x08\\xb07 \\xb0\\x8a\\xd1;\\x9e\"\\xe2\\x99\\xe7\\xb2\\xb5e.\\xbc\\x8a~\\x16'\\x18]\\x9an\\xe9;h\\xdd\\xb4\\xcem\"-\\xa0-j\\x9f\\xca\\x1e<i\\xa5bd7\\xf0=\\xc8\\x92\\x06\\xe8\\x92l\\xcdwp\\xde\\xa6\\x1c\\xd9\\x8a\\x83\\xa6*\\xfb\\xbadv&urf\\x8e\\xf2\\x15\\x96\\xb7\\x14\\xaf\\x15\\x96\\xc7\\xd59ox\\xd4\\xfa\\xf8/`5\\xd7\\xdfa\\xa4^\\xa2\\x9c\\x9f\\x08\\x86\\x15gx8^i\\xc9*d\\xc34"
  584. },
  585. {
  586. "http_request": "winword.exe_WSASend_\\xc4\\x00\\x88\\x00\\x88\\x00\\xaf\\x12\\xb0\\x96\\xc1h\\xd9\\x83\\x06\t\\x8e {s\\xf9\\xc3\\x1a\\xd8e\\\\x0cm\\xb7\\x91\\x93\\xab\\x050\\xaep\\xa2\\xe1\\xbeg\\xdd\\x81~}\\xa9\\x1c\\xdb\\xd2w\\xc8\\x8b\\x8b\\xa4\\xc3|\\x89r\\xe61\\xadg\\xa2\\xd8n\\xd7b\\xc9\\xea\\x15j9\\xf9\\x1f4y<\\xfd\\x8b\\x94\\xccr\\xb9ee\\x90dm\\x9f\\x10qq<^\\xf2\\xcf\\xe7\\xf0\\x9a\\xabq%\\xce\\xa4.\\xebe\\x97\\xc8\\x86\\x8f\\x86\\xbc\\x03\\x95 x\\xdb\\x9f\\xf2\\xdd^s3\\x9a^f\\xbd\\x1b\\xd4g4b\\xecd|\\xd6\\xec\ttx.#h_\\x83r\\xb2\\xf10\\x9d\\xa0\\xa0\\xc7\\x93\\x98\\x12r5s\\x1d\"o\\x05ao\\x80\\xb8\\xf3\\xc9\\xe5g((|~\\xca\\x95\\x97\\xaa0\\xc3u\\x85\\xbd\\xdc\\x96n#l\\xd6\\x89\\xaf\\x86\\x1ff\\xf3\\xd1\\xfc/\\xb2v}a\\xaf\n\\xd8\\x85\\xdf\\xc8l83\\xf3\\xef\\xa5\\xf40;\\xe9bx\\xf1=\\xb2\\xe5\\x91\\x03<vn\\x14nf\\xe3p\\xc1\\xc1\\xdd\\xf1\\x93\\xf3\\x94l\\x02b\\xb2\\xcb\\xb5\\xb0x\\x86ab\\xde+\\x1f"
  587. },
  588. {
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x8e7g8\\x18\\xec\\x93\\xcc\\xa3\\x84\\x8ep7\\x93\\x0e\\xb3\\x8f\\x05\\xd7\\xc1\\x16,\\xbac\\x88\\xe1\\xd2\\xf3\\xc838\\xecv\\x937\\xce\\xfa\\x08\\xd5\\x14\\x9cz\\x1c\\xd5\\x1f\\x10\\xb7\\xcd\\x90f-\\xfb\\xad\\x8d\\xa6\n\\xdcv\\x98\\xc6\\xd5b\\x15\\xe4\\x08\\xc8\\xf3\\x8f\\xb3\\x85\\x80\\xdf\\x8e\\xae\\xe8v\t21\tl\\xb1x\n\\xb8\\xe4>d\\xd7\\x9b\\x88\\xd1\\x86\\xd8\\xf1\\xf3tcr<\\x97\\xdap\t:ojth\\xed\\x95cq\\xef\\xc9*\\xad\\x80[\\xd7}\\x18\\xc7\\x03;x'\\xd3\\x9b>\\xf1\\x80a\\x15\\xe8\\x81\\xe6j\\xba\\xa517\\xe1\\x93\\xe2\\x87\\x16\\x8c\\xb3-th\\x14\\xa2\\xec\\xec\\xac\\x17\\xac\\x8d\\x9e\\x01\\xdf2m\\xaf\\x07\\xd1\\x98y'\\xf9i\\xde\\x06\\x01m7\\xf2v\\x00\\x90\\xe55\\x82v\\xb7]\\xc7m\\x1a\\xa4\\xaa\\\\xf6\\xbf\\xc6\\xc9\\x1d}\\xda\ny\\xec\\xcb\"\\xa7)\\xc0\\x10\\x9af\\x1a\\xdal\\xbc\\xc1\\xcf_hnm\\xd1\\x80e\\xf2\\x06\\x00\\xfa\\xf1\\xdc\\x1a\n]*2\\x8f\\x96]\\xa7\\xf2&z\\xef\\xf1\\xe6\\xa1{\\x99\\xe8"
  590. },
  591. {
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6g\\xa7}\\xc1\\xe3p\\xe1\\xfe<\\xe43%xd\\x1a\\xc3\\x8a\\xa61<m\\x9c\\x1a,p\\xdf\\xb1ch&pt\\xeb\\x98z\\x1d\\x8fb\\xb1\\xca\\xf5\\xf6\\xe6\\x19q^\\x99\\x8e\\xe6\\xdbatv\\x9a9\\x8e\\x94\\xe64/%\\xd4z\\xf6\\x04\\xd4\\x1498\\xffu\\xf3\\xf9\\xa1_\\xa9\\x1e\\xa4\\xcb6\\xd1el\\x10=\\x95\\xdaq\\xff\\x9e\\xd4\\x88x-ok\\xe7-\\x94by\\xf8\\x96\\xff\\xdf\\xb9\\xd3ip\\x9eczks\\xfb3\\x88\\xbdv\\xf4\\xad\\x87y\\x80\\xa2\\xac\\xb7\\x0e+\"z\\xfdx\\xe2n\\xa5\\xe3\\xde\\xdc$\\xd3f\\xad\\xea\\xd36>.\\x18\\xa5\\x9e\nd\\x83'\\x9a\\xcf\\xa1>\\xb8\\xd90\\x96\\xec@\\xec\\xa4\\x9ah\\x91\\xe4\\xe69\\x84\\xa3\\x18\\x15c\\xbfk\\xa7\\x96}\\xae+\\xe4\\x9az\\x16\\x98\\x18\\x1d\\x82\\xbc\\x82\\xba\\x8ew\\xd0#\\xc1p\\xfb<g\\xa0\\xb0\\x1c\\x14\\xd7\\xf0\\xf0\\x94\\xe8\\xb6\\xd1ot\\xe6\\xed\\xa9\\x12|\\x9d\\xadm\\x97\\xd7\\xcf\\x87\\xc0@c\\xaf\\xc3\\xe9\\xf6a##\\x8bx6\\xd5f\r>f\\xaf\\x05"
  593. },
  594. {
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r'\\xf3\\x93\\x88&\\xf9\\xc7[;et\\x02\\x9b\\xc1\\xc3\\x1a\\x82\\x02\\xd4\\xddcs(\\x89'*\\x04\\xb3\\xc28. \\x04\\x97\\xfc\\xea\\xd8z@\\xc6+\\xfe\\xbb\\xd0n\\xd4uc]\\xd6<\\xeb\\xc2\\xc5od\\xcb\\xc3\\x7f\\x93\t\\xc4\\x16\\x03\\xe1\\x9e\\xd1\\xbf\\xd3\\x13.\\xa1\\x84\\xdc\\x0f\\xb6\\x92\\x91\\xdd\\xc3\\x1e\\xc27\\xf6\\x8d\\x8c\\x92e\\xf3\\xdb\\xddd\\xc6+fh\\x9b\\x86\\x9e\\x98(\\xdc\\xf0\\xc4\\x06!\\xd7v\\x9b\\x9e\r\\xd1\\x89{\\x18{\\x1cq*rc\\xc2h\\xe3\\x05\\xd5!)3k\\x15\\x16\\xdf\\xda\\x80u\\x843\\xff\\x91xq\\x02\\x1a\\xc1m\\x1a\\xd8+\\x90\\x9d\\xdc{\\xce\\x84xij\\x0byp\\xe2\\xf4\"\\xec/\\x037=\\xf5\\xf7\\xc3\\xa6s\\x10\\xaf2\\xee\\xe0\\xb7\\xccx\\xc2u\\xae\\xef\\xb3\\xdc\\x15\\x0c\\xc6\\x02j\\xaek\\x8cr\\xa9\\xa5s%i\\x85\\xe8\\xef5\\x14\\x19\\x89aw\\x9ca\\x02\\x03\\x90\\xbc\\xa7\\x1fd5\\xdfv\\xc2\\xa4\\x0b\\xab\\xc0~\\xd9\\xae\\x90\\x81\\x03\\xb7\\xc1\\xf4#\\x03\\x9d_\\xfb\\x8f`\\x9cii\\xd6\\x11\\x95"
  596. },
  597. {
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xbe\\xac\\xe0\\xa2\\x94\\x85\\xfd\\x03\\xed\\xe0\\x7f\\x87\\xe9\\xfb\\xd0\\xf4)\\x0b\\x16z\\xea\\xf0\\xf4\\x8c\\x0e\\xe8l\\x18\\x82\n \\xd8v\\x85\\xbe+\\xd5=\t\\x1ce\\xbcr\\xdeb\\x86\\xea\\x0b\\x86\\x05jz\\xb1c\\xect\\x8c\n|\\x0b\\xd1\r\\x93u\\xb5\\x11\\xcbl\\xd1\\x8d\\x8a\\x90@v\\x11<\\x0b\\x0b%\\xa6\\xfc\\xec\\xede&\\xa6\\u\\xc0vm0\\xda\\xf7[g\\x02\\xd9\\x84\\x9fz\\x85\\xa8\\xac\\xde\\x90-z\\xcblg\\xa8\\x8b\\xdf\\x7f\\x94\\xd4\\x98x*\\xfe\\xbc\\x94]\\x08i#\\xc4\\xf2\\x06\\xf2\\x11\\xd4\\xe6r\\x8d\\x95\\x81\\xc7\\xd9\\x97+\\x92x)t\\xe4{d\\xb8\\xbf\\xcd\\x9f\\xcc\\xc0-\\xc8ek\\xd5\\xac[3\\xf0\\x8d\\x7f\\xb9\\xbdw\\xd0\\xf6\\xb91f\\xde\\xa3#s\\xe0%\\xf2\\x94\\x8d\\x1a\\xf8[\\xc1i\\x98\\x1f\\xbd\\xc5-w\\xc21w\\xef}s\\xea\t;\\xc5\\xa5s\\xc4(\\xcc\\x89dk\\xc8f\\xb0\\xc2\\xe3\\x00;0^\t\\x01\\xb8b\\xd3\\xde\\xb6\\xe5\\xb9\\x1fn\\x1d\\xca\\xe7w\\x8a\\xfb\\xe5-\\xb4\\xaf\\xdcnef\\x83g\\\\xa8"
  599. },
  600. {
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\t\\xee\\xb8\\xf1\\xe5[s\\xda\\xe9\\xff\\xe5\\x96\\x06\\xe8\\x00\\xd8ni\\xe8@&\\xc3s\\x0f\\x81\\xbd\\xa5\\x9e\\x15\\x91\\xaf\\xebg\\x98\\xbe{\\x07\\xa3\n\\x99\\xd7o\\xbe\\xa4\\xae\\xc0\\x11zjj\\x92\\xed\\xb6\\x9a&\\x8a\\xaa\\x92\\x150\\x85\\x85z\\xae\\x93b\\xbd\\x87\\xc44'\\x9d\\xe1\\xach\\xae\\x06\t\\x10\\x9d\\xb0\\xb5\\x06\\xff\\xd9\\xdd\\x8d\\x1f\\xc3\\x12\\xed\\xf7j14\\x9ap\\x1d\\xba\\xfd\\x15\\x05\\xc3\\x0b\\xf4jyt\\x8f\\xf2\\xf8./\\xbe]\\x9f2v\\xf5\\x9a\\xce\\x13\\xd8\\xdd\\xae\\xc7\\xcb\\xfe\\xee\\xcb\\xf8\\x08\\x9f\\xe5\\x89\\xdf/i\\xdd*\\x17\\xa6e\\xa2e\\xf5f~e\\xdej$vq\\xac\t\\x8f\\xcca\\x12\\x94\\xae\\xe7\\xd8\\x89\\xf8\\x0bkw\\x08\\x1f2\\xe9m\\xf0\\xe7\\x8c^\\xb8)\\xfd%6`\\xe1\\xb6\t\\xf5\\x0f=\\xc8\\xacoz\\x85\\xfa\\x84\\x92/\\x11\\xa3o\\xe3\\x1e\\xe8\\xf2\\xbbaz\\xeac\\xf7\\xd8^o\\xd0\\x08qa\\x93\\x8b\\x80@\\x9a\\xedt\\x13\\x19\\x14a)\\xc3\\xb7r\\xd4\\x1a\\x8d8\\x18>\\xc1\\xb43\\xe2q\\x14z\\x97u\\xbd"
  602. },
  603. {
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xf4\\x94q%~\\xb3y\\xc0o\\x05\\xf87\\x91p\\x0c\\xee\\xa7\\xc8\\xcf\\xac%%\\x1f\\xc8xx8\\x1d\\x90a5*\\xc6\\xb1\\x8e\\x9fjjn\\xcb\\xc7\\x9a\\xfak\\xc0\\x1ad\\xd5\\xae\\xf9\\xb1\"\\xdaa\\xc2\\xffo[.\\x8bwn\\xc3\\x00c\\x18-\\xaf^\\xb6\\xcb\\xfc%\\xaa#\\xb0\\xa6\\xee\\xc1\\x94-\\xab\\x8c\\x87\\xa8\\x88\\xe3\\xb08\\xb1b\\xae\\x8a@et\\x85dz1w\\x02\\x82\\xcc\\x81%\\xeb\\xed\\xd8n\\xc7\\xedb\\xca\\xf4$\\xb4\\x9f\\x05\\xa07\\x9f\\xdcm:\\x9f\\xea\\x7fp\\xd5\\xd8\\xca<spc?\\x1d\\x16\\xeb\\xe2\\xac\\xa2e\\xb8\\x8ah~\\x9e\\xbfm\\xfd\\xa8\\x0c\\xb2\\xec\\x97x\\x19\\x08nq\\x81\\x92`gomc=\\xc8\\xae\\xd4:l\\xd7r`\\xd7+\\xe7z3\\xb9tr\\xe5\\x18\\x13z\\xf6/5:\\xe9\\x9b\\xdd\\x0fc\\x0f!\\xc5\\xc8p!\\xd2\\x93\\x94`dl\\xe0\\xe1\\x8a\\xf7\\xba\\x912k\\xb1\\xc1\\xfa\\x87\\xbf\\x81\\xaa\\xba\\xd3_\\x9a\\xd5\\xd5\\x88y\"\\x9bm\\x7fao\\x94y8\\xd5\\xe7\\x97hg\\xca\\xae"
  605. },
  606. {
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xf5!\\x91o\\xab\\l\rp\\x02p\\x06\\xe4v\\x94g/8\\xec\\xc4\\xc5\\xd5\\xee=b`h&\\xb8\\xdax\\xc4yc\\xd5\\x11\\x7f\\x9a\\x0bp~\\x12t\\xa0\\xe5\\x83 \\xd2\\x0c]f79\\xd0\\xd80\\x06<\\x14]\\x85\\xd9c\\x97\\xbbb\\x1e\\x01\\xbe\\x85\\x00\\xd3\\xb9\\x12`t%\\xe5\\xad\\xe9\\x85e\\xd0cj\\x07\\x06\\xfc,jh^\\xbd\\xa4\\x13\\xd4\\x1e\\xea\\x8b\\x80\\x10-\\x0c.\\xa8bq\\xe6[\\x19\\xee\\xb1\\xa2\\xc8\\x8e\\x1b\\xbb\t,\\xd1s\\x84,\\xe9\\xf6f\\xed\\xf7\\xe2\\x90\\xcc\\xe3\\xf2y\\x7f\\x1a0m\\x81v\\xda\\xd8:m\\x89\\x1a\\x05lh(\\xc20;\\x1c\\xc7-r!\\xf4+\\xc3\\xfa\\xd4}\\xe7\\xa5\\xa5w\\x10\\xa3\\xab\\xcb\\x96\r}\\xac$b\\x88\\xf9\\xbd\\xb5\\xf4np\\xd1ph\t-\\x86\\xda\\xb6\\xaf\\xb3\\x00\\xab\\x96sm\\xa3\\xa6\\x9a[$\\x92\\xfek\\xd0}\\x84v/\\x10\\x08t\\x0b\\xfc\\xf1\\xa9\\xcc\\x137}\\x80y\\y\\x98\\x19\\xc3i\\xa0:\\xd3\\x95\\x1c\\xf6\\xb0\\xde\\xbb\\xb6\\x0ca\\xb0-\\xba\\x05\\x80\\xf8"
  608. },
  609. {
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\xd2\\xd8\\xf6\\xd0f\\x1e.z\\xa0\\x02\\xff\\x9f\\x89\\xb4\\xd9\\x1f\\x94\\xdcs1]\\xf8/\\x14\\xcb\\xf9)\\xe4\\xbef]w\\x0c\\x13\\xb8\\xe8\\x0e~t\\xf9%h\\xd8\\xa0\\x80\\xc8'_\\xfa\\x92\\xee\\x94]\\x83\\xebl\\xa0\\xf2*(;\\xac\\xf8qi\\xba\\xe7\\xf0>\\xb5\\x19\\xd6\\xad0\\xea\\xf7r3\\x03\\xcc\\x90i\\xdd\\x10d\\xdd\\xb0\\x7f\\xbb\\x0b\\xad'o[\\xbe!\\xeb\\xd3\\xb7\\xbf\\xdc~\\x82#!\\x9e{\\xb8eg\\xfd\\xdd\\xaa\\x8cw\\xbczy;r\\xac\\xd0\\xb6\\x12\\xd9\\xf6h\\x9f\\x81\\xec\\x9d}\\x8c;\\xec\\xf87\r,\\xb5\\xbe\\xd6t\\x9c\\xad\\x0c_t\\xe2\\xab\\xeb\\xa3\\xb5\\xec\\xac>.\\xec\\x93\\x8bj\\xc98\\xdb;\\x8a\\x05\\xa7\\xa0\\xfc\\x86=]pv\\xd9ak\\xd8q\\x85\\x95s\\xb9\\x8eb\\xe7\\xb3o\\xc5\\x1c\\xa7e\\x9efy\\xc2\\xd9\\xf2u\\xf0\\x94\\xf9okr\\x02!n;f\\xb0\\xa2\\x04\\xed\\x8e$t\\x0b\\x16\\x9d\\xa9:t\\x0f\\xe9n\\x025\\xa8\\xd3\\xb8\\x1a\\x9e\\xff7\\xa1\\xb8+k\\xd2p\\xd7m\\xfdl[\\x01\\xad\\x9e"
  611. },
  612. {
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>@\\x10w\\xe0\n\\x88-b\\xa4\\xa4g\\x92\\x13\\x80j\\x14q\\xf5<5\\xb2<\\x18\\xa0\\x1a6fm\\x19\\xd3\\xde1\\xa7\\xcb\\xb2\\xe6\\x0f\\x07\\x92\\xd7\\x06\\xe9\\xf5_\\x9f)qv\\xec\ti\\x91\\x05c\\x8f\\xcdf\\xf2\\xfbzo\\xd8\\xa1\n\\x87\\xc52\\xb2t\\x9a\\xfa\\x96\\xe2s\\xbeqa\\x03c\\x82\\xd6\\x1a/\\xd3\\xcd\\xa3\\x1c;\\xb8p\\xfb(,#\\xb6\\x9e\\x06{~\\xf9\\x17\\x07a\\xe9\\x1ct\\x1c,@\\xc1\\xf5\\xa5\rq\\x0e\\xb6k\\x93h\\xde3\\x1c\n\\x0e\\xa2\\xac\\x1d\\xe3\\xb0\\x0b\\x10`]\\xb9\\xa74\\x91\\xb4n!\\x85d\\xbc\\xa0a\\xd6>\\xc9\\x9enu{\\x98'\\xa3\\x0fj_;q\\x91`/z\\xdc\\xde\\xba\\x1c]b`\\xe5\\x8b1\\xf9\\xd8\\xa6\\xa9\\xf72\\xf9\\x03\\x9c\\xa2\\xcc\\xde\\xdazc\\xf7(\\xf7~\\xbf\\x8d\\x94\\xab\\x80\\xfc\\x0c;\\x8b.\\xd3\\x80/\\x06x\\xdf\\xb1\\xdd7\\x98\\xfb\\x0c\\x90{\\x02\\xe4\\xebf\\xbe\\\\xde\\xc5vf\\xea\\x00.\\x97\\xf7\\x9ad\\x90\\x8fz\\x04*\\x86`;\\x9a'p%\\xf4\\x991\\xc6"
  614. },
  615. {
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103y\\x0b|\\xeb}\\xbe\\xd7\\xa9|\\x11t6\\x08\\x81\\xc5\\xcf\\xce\\x0c\\xae\\x1b\\xa4\\x8ez\\xa9\\x84<\\xf3ap!\\xfdp\\xf5\\xed\\xbe\\x8c\n\\x83\\x93k\\xc3w\\xe0\\xc4\\xe2&\\xf0\\x1fh9\\xe0\\x89\\xb1{\\xa9\\x06]'`\\xfbb\\xff\\xb00\\x98b\\xf2@\\xac\\xad\\x05o\\xc3\\xf7t\\x82\\xb4m\\x17i\\x9e\\x99\\x0bz.\\xa8x\\x19\\xc5\\xb4\\x97\\x832s\\x07in\\xdbj\\xb7w\\xbf@\\x8e:\\x96\\xc1i~s\\x8c\\xb3i\"\\xb9\\x13-\\xa9\\xca\\xff\\x04\\x18\\x05\\x06q\\x15*\\xc8d\\xe4t~\\xfe\\xa4\\xed&h\\xc61\\xa8\\x8c\\xa0w$\\xfb<\\xcbj\\x13\\xa6\\x9b'\\xe5z\\x81\\xf3r\\x05%\"-z{\\xd3'\\xf27[5\\xd6\\xc5c\\xcb\\xc2\\xcf\\x7ft\\xb1\\x9f.\\x84\\xe7\\x9c\\x86\"\\x071\\xde\\x88\\xa7\\xee\\x8a\\xa3f\\xe9\\x8e\\xf7\\xc3\\xa9\\x10\\x02\\xad\\x16\\xcd\\xc4\\xb0\\xcb\\xee\\xf6\\x10\\x186\\xd7`\\x7f\\x1f{\\x9f\\xd6\\xce\\xb1e\\x9a\n\\xd9\\xc2\\x80\\xd3\\xed\\x10q\\xf1f\\xbd\\x1a\\x9c\\xa2\\xb8p\\xceb=\\x9b\\xb3\\xbf:y\\xdd\\xb2\\xa0"
  617. },
  618. {
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xac\\x84\\xd9nb\\xf7\\x11w\\xc3\\x900\\xdc\\x8e\\xccu5uvm\\x08\\xc7\\x17\\x02\\xa58\\xaf \\xcbdp\\xf7\\xfb\\xb2\\x8dxa\\xd17>\\x83\\xf6`5^`\\x8b8w\\xea\\xd8\\x16\\x89\\x85\\xc0`\\x92\\xf8\\xb65f\\xbc\\xe8l\\x99\\x0b\\xc4\t>\\xeaer\\x02\\x8f\\x85\r\\xf0\\x18mr}\\xa0\\xf2\\a2\\xd2e\\xb5r\\x84\\xedy\\xe3in8\\xc6\\xe0\\xf4s\\xddcm\t\\xb2\\xe2\\x8b\"\\i\\xbcv>\\xdco\\x17\\xa7\\xcb>\\x9c\\xce\\xb4\\x1ds\\xef\\x8b\\x97xr\\xc7z\\x88\\xc0\\xec\\x80\\x18nmx\\xfc\\x83\\x9f\\x83\\x88b\\xa5c\\xa7v\\x10\\xf2\\x87\\xbd\\xcd-\\x12\\xc0u\\x92\\x92\\x84\\x87l\\xf7\\xe0\\x92\\xab\\xff1e\\xb9j[\\x02l}\\x87\\xd4\\xb5`q\\xeaec\\x85d\\x9e\\xb8p\\x82\\xe1\\x07\\x1d\\xd90\\xe3\\xbc\\x00\\xa9\\xd0,el\r\\xca\\xb1\\x99\\xd1(\\xc8*s\\x18\\xf3|\\xc2`w4/\\xa3s'lbom\\x0cqa\\xfe\\xd9eq\\xd6\\x80a\\x9a7f\\xd7>p\\x1e\\xadr{(\\x8b\\xde"
  620. },
  621. {
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2\\x9d\\xb3\\xa8\\x08\\xeb-}\\xc20\\xb3\\xc9y\\x98\\x9aw\\x9cy\\xe8\\x7fs\\x8c\\x0c\\xe0.\\x9d\\xcb\\xecs\\xa8\\\\xaa\\x89\\x1d%\\xcc\\x03t;\\xc9\\xdb\\xd9,_\\xe8\\xe2-rw\\x98\\xb0\\xc9\\xaea%\\x01\\x01\\x86\\xb4\\xb4\\xd4\\x8e\\xfb\t\\xfb,~zb\\xe2y\\xbf\\xf60\\\\x97\\xec}&\\x84\\xf2<\\xd9\\xce\\xb8c\\x8e\\x1a\\xca\\xa5\\xa7&\\xe0\\xf1\\xce\\xd7\\x9cqo\\xb5\\xde\\xa0\\x9b\\xba^\\xad\\x9b\\xa9wq\\xf3\\x1e?\\xd0&\\x95\\xccu\\xa2$\\xf2\\xcb\\x98w\\xd6\t\\x98\\x92\\xa2*\\x93\\xcf\\xaf\\xbcz`\\x80\\x8fu\\x98\\xf2\\x82\\xf9\\x10\\xfa>\\x96\\xe4!\\xd7w\\xf0\\xde\\x88\\xec\\x99v\\x99t\\xc0:\\xd4\\xa4\\xac`\\xc3\\x84t\\xd8\\x18f5\\x8e\t\\xda\\x89\\xce&>\\xb9\\x84nb\\xfc\\xe2\\xc3\\xb4\\xcb\\xbd<k\\xfd;i\\x96a\\x90u\\x88\\xb2\\x9d\\x1a\\xc7\\xda\\x07r\\x96\\x0e\\xf8\\x9d\\xdep&#\\xe4@f\\xda\\xec\\x16\\x8a\\xdb\\xab\\xd1\t\\xb0\\xcb\\xb3\\xa0\\xaac=\\x1a\\x0e sia\\x83_z\\x16\\xba\\x89\\xed\\xde\\xeb\\x02t)\\xf5"
  623. },
  624. {
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\\xff\\x9ef\\x006\\x1c\\x99\\x0b\\xaaj\\x8bl\\xc6\\xe9.\\x0et'y\\xb3\\xdb\\x98re\\xc3\\x13\\xab\\x15w\\x9a\\x17\\xac\\x90c\\x06)\\xeb\\xef&\\xe2f\\x0e\\xd9\\x82\\x0eb\\x19\\xe1)\\x07\\xf2b\\x14\\x10jq7\\x1e\\x11\\xf3\\x14\\xbe@\\xd5*\\x06\\xed\\xe6\\xa3nw\\x06\\xd1\\xafl\\x15\\x7fmf\\x05\\x1e\\xe5\\x15\\x0f\\x13\\xd8\\x07\\xe7\\xbd\\x86\\x9e\"\\xdb\\x96\\x9d\\x81\\xd2{ \\xe6\\xc7\\xce\\xe9_\\xf6\\xd0\\xc7\r\\x1b7\\xc1\\xf0\\x05\n\\x01*{\\xd1\\xf1&}r@\\x8blr\\xba1^\\xa2n\\xf2\\xc8k]\\xce`\\xb7\\xd1\n]l\\xaa\\xd6\\xe1\\xa2\\x1c\n\\xe0\\x10\\xb9\\x0fiw\\xe88\\xe8\\x13\\xa72\\x88\\x15\\xa5\\x9e\\xb7\\xce\\x0f,\\xb9\\xb9\\xd5&\\x15\\xf1\\x87\\x9b\\xc5f9b\\x86s-\\x1f\\x84\\x98p\n \\x08~uz\\xe7\t\\x86i&\\xe8|\\x9a\\x1b\\x97\\x8d\\xac\\xd7\\x92\\xe1>9fj\\xb7fp\\x8c\\x04\\xf3f\\xd5\\x857\\xa5/\\x86\\x1d\\xae\\xb9'\\xec\\xaa%\\xc5\\x8fmpqf\\x05l\\xdb\\xc3oo\\x89\\xf7wif2"
  626. },
  627. {
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#r\\xbf\\x80v\\xfe\\x91b$5\\xa2w\\xea\\x9e\\xca\\x0b\\x12\\xf4\\x00a\\x9b]\\x84u\\xb4bq\\xb1+\\x80\\xc6.\\x0c\\xe1<\\xaf\\xa0\\xc8\\xa5\\x845)\\xdf\\x81\\xf3\\xdejly&?\\xcc\\xf6\\xc3\\xb6e\\x99\\x0f#\\x9cc\\x82mo\\xf3y\\xf8ml\\x03\\xcb\\x01\\xca\\x0c\\x13cn\\xa4n\\xfa\\xcfo~+\\xa7\\x8d\\xdb\\xd7\\xd2\\xe5\\xad\\xd0\\xd7\\xd0\\xbc*s,=q1\\xca\\x11\\x91u\\x91\\xcb\\xf5\rr\\xc7d\\x01\\xab\\xd7\\xd5t\\xcf\"2\\xe0\\x82\\xdd.\\xe6\\x90)\\xafk\\xf0\\xba\\x16`\\xda\\x0c\\xf4\\xf4\\x1br\\xa1\\xe3oj\\xbce\\x18t6\\xd2w\\xb9\\xaa\\xa3]\\xabk\\xfb\\xe3\\x165.~\\x99\\x99\\xeewjf\\x92\\x8d\\xd2+a\\xa1\\x8d&\\xae\\x91\\xf1`\\xb7m\\xd0+\\x01i\\x02\\xaa\\xab\\x94\\xf7&\\x0fv\\xacwm\\x82\r\\xcc\\x04\\xff\\xf4zi\\xd7\\x90\\x9ctc\\xfcj\\\\xf7\\x98\\x81\\xdc\\xc9\\x06\\xe3\\xf0\\xb8sv\\xbe%\\xba\\x1e\\x85\\xf4\\xe1\\xcf&\"]\\xa7\\xe1q\\xc0p\\x8a\\xd9\\x8f\\x84\\xady\\xcb\\x82\\xbbd\\xd7"
  629. },
  630. {
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010uz\\x07\\x11i\\xa2\\xc7\np\n\\x1a\\x07\\xfc\\xfa\\x96$8\\xc8\\x03d\\xa7\\xc8\\xe6\\xa7\\xfb!5t\\xef\\xab\\x8a\\xc0\\xdbb\\x16;\\xb0h\\x81s\\x029\\x12\\x0b\\xc0\\x14m/\\x7f\\xd4\\x07=\\xb5\\x99\\xd6\\x80+\\xb11\\x01(\\xe0\\xa7\\x07\\xb7m&\\x12\\xf6\\xf6u\\xf1\\x07\\xb9\\xbe(\\xd3\\x10\\x00\\xeeou\\x14b\\xc7\\xd2\\xdf\\x9bu\\xae\\xc9\\xd1\\xdb\\x015*\\xbe\\xa0$ym\\xcc\\xaf\\x90,\\x95\\xb2*\\x02\\xb3\\xfb\\xe9\\x81\\xe8;\\xdf\\xb6\\xa1\\xeb\\xec\\x13lj\\xd7\\xa8\\x7fbp\\xa3\\x08o[{x\\x85\\xf2\n\\x85=\\xd7:\\x05\r=\\xb9\\xb0\\x02\\xa3\\x94\\xdf\\xc7c\\xecw;\\x04\\x0c\\xfbl\\xb4\\xcd~bf$\\xedxe\\xf2k\\xcb<\\xb2\\x7fg+?\\x0fv\\xb2uz\ra\\xbe!\\xb0h\\x06\\xcf\\xf6\\xdd\\x7f\\xed\\xd7\\x92@\\xf1:\\x82\\xfb\\xe3\\xb9<\\x83\\x1b\\x18sig\\xf3^x\\xde\\xd3\\xa8\\xfe|z\\xcf\\x05\\xfb\\xb8l\\xd4,\\xc9\\x1f\\xe1s\\xc2{\\xbe;\\xd9\\xd9\\x8f\\x9an\\xf7\\xaf\\x0bh\\xef\\x95\\xdcef\\xbc\\xd4\\xd3"
  632. },
  633. {
  634. "http_request": "winword.exe_WSASend_\\xc4\\x00\\x88\\x00\\x80x\\xbb\\x12\\xa1|\\xf1\\x15\\xe8h\\x9c)\\xb6c\\xa2\\x01\\xc1,]t\\x0ct\\x9a\\x13?y\\x98\\xb9\\xad=2/c \\x96\\xba*\\xc2mi\\xef\\xf1el\\xf12\\xee\\x82\\xb9\\xfc\\x8d\\x8b\\xc9c`sy|\\xf2\\x14\\x99ny\\xbf8\\x92\\xbc\\xec[\\x01h9\\xa0\\xb3\\xf6?\\xc1\\x95\\x8f1\\xb1\\xab\\xc9t\\xba\\x95\\xa8\\x1b\\xa15nv}\\xcd\\xab\\xb3\\x1a\\x06\\xcd\\x17\\x83\\xdc\\xae\\x9c\\xf4\\xe3\\xc2\\xe9a\\xb1h\\xb1\\x1a\\x93e\\xf0\\xcc\\xc6\\xa5nx2\\xc3\\xa7\\xa2\\xe4ps\\xcc\\xcc\\xd6t\\x9e\\xe0b\\x11\\x88\\xe3\\xba\\x8b\\\\x95\\xe6\\x1b~\\xb6\\x05r\\x94\\xc5\\x1eo>h\\xd5\\xfa\\x13\rx\\x82\\xd2\\x0e\\x819\\x1f\\xdc)\\x11\\xef\\x97\\xc8\\x8f\\xa8\\xe0\\xd0\\xe9\\xa5\\x00\\x16iz\\xbanb\\xcb\\xa0\\xae\\xefga.\\x02\\xba=\\x81\\xc7\\xf4\nj\\x99 k\\x905\\x8a\\xce\\xfc\\x94b\\x0f*aei\\xebn\\x83q{g\\x8f\\xc6\\x89\\xa0\\\\x14g)\\xd4\\xaf\\x7f\"\\xac\\xfa\\x1a\\x87\\x04m9 =\\x08\\xe7t\\xc0\\x00\\x9b\\xf2\\x0f\\xf0\\x10n"
  635. },
  636. {
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01o\\x96 \\xbd\\xf5\\x01\\xca%\\xcd\\xa2u\\xe1\\xb0o\\x1d\\x00{\\x8b\\x0c\\x8d\\xd5%\\x12\\x9f\\x1d\\xe2\\xdbr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  638. },
  639. {
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x0c\\xb8\\xc1?\\xef\\xd6k\\x11\\xce\\xfd*\\xa2\\xc3$\\x8d+\\xec\\\\xd0\\xac+\\xb2x\\x0e-kb\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  641. },
  642. {
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x1ell\\xac\\x1d\\x8c\\x82>\\x0e\\x9b\\xb8@\\xb6\\xf4%\\x9ex\\xd9\\xad\\x1d\\xf5\\x87\\x92\\xdcj@\\x08\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  644. },
  645. {
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01$s\\xfc\\x0c\\xb6;&\\x95g6\\xd2d\\x97,\ta\\xb5\\xc5\\xf2k\\xcf\\x1a\\x17y\\xce\\xde\\x96[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  647. },
  648. {
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01:\\x98\\xe8_\\xe3}\\xb1k*}\\x83sq\\xaf\\xe6t(\\x93$\\xc2\\xe4\\xd7y\\x0f\\xa4\\x04\\x04\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  650. },
  651. {
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x86\\xa8\\xe8\\xa10\\x08lus.\\xf2s\\x18\\xaf\\xe3\\x8f\\xf1\\xe4$\\x02\\x12\\xda\\xa3\\x07n\r\\x86\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  653. },
  654. {
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\xd9\\xe9q\\xb1r*\\xc2 \\x90\\x1d$\"rn\\xcb\\x17\\x86\\x83\\xc2\\x97\\xc6\\x85\\x8d\"g\\xf0m+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  656. },
  657. {
  658. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01mia\\x9d\\x8b|\\xe1p\\x9c|\\x8f\\xc2\\x9cz1\\xe7\\xe1y\\xa4\\x89v|i(\\xc4\\xcdj\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  659. },
  660. {
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\xf85\"m\\v\\x1a\\xcb\\xe6u\\xffr\\x1b\t\\xae\\xa0\\x0c\\xd6l\\xb8al\\x89j\\xaa}\\xcbk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  662. },
  663. {
  664. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01uf\\xee\\x93\\x9e\\x8b\\x18\\xf0\\x17w\\xb3\\xc5dp\\xf5\\xa5\\xcb\\xb0^\\xc9g\\xd0\\x9a\\x81\\xa7i\\x92\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  665. },
  666. {
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x1alwn\\xd5g\\xeen\\xc6\\x91z\\xbc\\x90m\\x88\\x03r\\x18c 0\\x86\\xf4\\x05\\xd1\\xce\\bv\\xfe\\xd4tl\\xd0p\\xd0f\\xea\\x98\\xa7\\xc8\\xe3!\\xc3\\x98\\xa7r\\xcf\\x1c\\xea\\xb1c\\x84\\x02;\\xfc\\xa9\\x0beu\\xa0\\xc3@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\"\\xcc$\\x98\\x87\\x8b\\xdedy\\xfa\\xd6ht\\x104\\xff\\xd1\\xbd((\\xd3\\x11\\x9fg\\xa4\\x99\\xe8\\x10\\xf4\\x040\\xd3\\x84\\xb8\\x88\\x92\\xb8\\xd1\\xbb\\xf8rh\\xfc\\xbd\\xdd\\x910"
  668. },
  669. {
  670. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xe6\\xb5\\x9ca\\xda}x\\x91\\xfc\\xec\\xc0xknrj\\xb05\\xa65\\xd0\\xb8\\x84_g\\xa7s\\xee\\x8c:\\xa7l\\xc1\\x8e\\xb6c+\\xc9\\xcaq\\x85\\x835\\xa6<\\x9ep\\xb9(w\\xd4\\x8d\\xf3\\xaa\\x7f\\x90\\x15-\\x02\\xee\\xf0j\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xac\\xc8\\x90\\xa7k\\x04h,\\x039\\x9d\\xc3\\xa9\\xd9skz_\\xa9\\xdd\\xd5,\\x84_\\xb2\\xeb\\xcd\\x9f\\xa0u\\xea\\xefx \\xebhr.\\xa4\\xd1\\x94\r\\x81\\xde\\xc6z\\x84"
  671. },
  672. {
  673. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\xa3\\x8c\\xbc\\x0e6s\\xcf\\xe41\\xb0\\x1f\\xba\\xeeb\\xa82lt\\xc9p\\x94\\x9c\\x13\\x80t?\\xf8n\\x10\\x1f\\xdfeo\\x84\\xd2\\xb4)\\x17\\xb3\\x81\\x05\\x86za.\\xd3\"iv\\xb1\\x13\\xcc\\xa5su\\xf9'w7\\xf9j\\xfaq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccy\\xd6\\x91\\x8d\\xd9\\x17ui\\xd23\\xca\\xe7{ \\\\xfb\\x98\\xe2\\xfd~?.\\xc6\\xfb\\x0cq\\xac^i\\xb3}\\xf5\\xb1~v\\xf5\\xa5'\\x8d\\x9a\\x84\\xa6%\\x84\\x11\\xef@"
  674. },
  675. {
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xd2'#\\xe6\\xb3p\\xf42\\xa4i\\xe7\\x87\\xde\\xe0\\xd7\\x86\\x98qed\\xd4\\xb9i\\xc3,\\xfbl\\xeb\\xff\\xb8\\xb7@\\x08k\\x15\\xafp\\x81\\x11]\\xfc\\x1bv\\xb1\\xf7\\x06\\xf8u\\xf3\\x9d\\xc49\\xb4\\xc7\\x9b@x\\xa5g\\xc9\"t\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98\\xecw\\x0ep\\xec}\\xd06\\xccx\\x83i\\x93\\x89\\xf7\\x02\\xf8\\xe8\\x10\\x8e\\xbb\\xdac\\x17\\xe6\\x91\\xf3\\xd7\\xbe\\xca\\xfe\\x972.\\x81\\x91\\xf4\\xbe\\x1a\\xe1\\x1a\\x12\\x05\\xff\t\\xe8\\xeb"
  677. },
  678. {
  679. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xbdj\\x1f\\x9e\\x9d>\\x13\\xcc\\xed\\x17y8/l>x{o\\xd6um\\x87\\x0c\\xdfq\\x8b\\x10\\x16\\x993<b%\\xf9&\\xe5\\x8d\\xe5\\xdc\\xfd^\\xb0;\\xe4w\\xb0\\x9cv\\xc8\\xcf\\xed\\xb5.\r\\x11\\xc3xg^\\xfe\\xd7\\x14y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y x\\xe6\\xee\\xf1\\xa1k\\xf5\\xb3\\xcd\\xc4\\xb7i\\xb7\\xb1\tn\\x1f\\xd2%\\xa6\\xd6\\xbf\\xf4\\xf1'\\x97u\\xac\\x8d4%\\x01!\\x8f\r\\xe1\\x8a\\xdc\\x15\\xd0\\x199\\xe88\\xf6w"
  680. },
  681. {
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qq\\xc6\\xedy\\x9b\\xa1\\x94`\\xe1{b\\xe9\\x88\\x86\\xabe\\x11\\xa1\\x1bz\\x86\\x04q\\xad^\\x87et\\xa2$p\\x08p\\x94\\x139\\x0ex\\xde\\x1ejo\\x1ak\\xd6\\x08\\xe3\t\\xabj%{8\\xa0\\xd5\\x96\\x05\\xbbw\\x83\\xa6\\xfe\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xa3i\\x8b\\xb1\\xf8\\x01'\\xf9\\\\xa1z\\x12\\x86\\xec\\xdadq\\xb2l|\\xa8\\xfa=-\\xed)\\xd8\\xec\\xb5=\\x8d\\xd9g\\xf2g|\\xde\\x9ds\\xd4\\x02\\xc7.\\x95bd\\x02"
  683. },
  684. {
  685. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xec\\x1cf%\\xb2\\xba\\x95\\xa5\\xa0_\\xceng1\\x17\\x8bw\\x90\\x975\\x18>@s\\x14\n\\xea\\xd1\\x85>\\x82\\x10,\\x84\\xa7\\xbbd\\xc5\\xc4v\\xc4\\x99\\xcb\\xaf\\xedf\\x15\\xc6\\xf61\\xb8\\xc6\\\\xc4\\xf4&\\xb9\\xc4\\xf7q\\xf1\\xa1\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\x8e\\xc1\\x92\\xd00o\\xc9\\x9d\\xabz\\xce\\x93qz{\\x08\\xdf\\xe4\\x1bx\\x99\\xb5e\\xc7\\x15\\xb0\\x86j\\x0ct\\x08\\xc3nn\\xc6\\x80\\xad\\xc3\\x9b\\x8a\\xf9g\\x01y66\\xcb"
  686. },
  687. {
  688. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8ev\\xb9b\\xe4\\xc5:+;s\\x1f\\xac\\x91\tr\\x85\\xe7\\xe1\\x9e\\x00\\x92\\xb9l_\\xa46\\xfc3\\x82jns\\x93\\x0ee\\x1e\\x11\\xc5y\\xe9`l\\x88\\xe4\\xa3npq\\xb4\\xa4\\x19\\xf6\\x83zc\\x141\\xed\\x8dpo\\xba\\xc2\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xae\\xc1\\xd5ud\\xd7\\x95?\\x8e\\xdf\\xba+rb\\xa2\\xc4\\xb1;`cht\\x17\\xef\\x97 <\\xae\\x110af\\x80\\xc5hn0\\xa8\\xfc(\\x1fn9\\x0e\\xc3jx"
  689. },
  690. {
  691. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90ni+3t\\xa9m\\x01\\x90\\x15ft\\xc4\\xb5:\\x13\\xb0\\xbd\\x85\\xdfrgm9\\xf4\\x9e\\xd1+;\\xde\\x02f\\x88\\xa9\\xa7:\\x94@\\xbf\\xecn\\xe8\\xbfs\\x18\\xb3\\x1e*\\x0e>\\x12\\xf6'e\\xe7\\x118av;\\x08\\\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\xf6\\xa2d\\x16@o;\\x97^rl\\xcc\\xeea\\x89\\x85\\xedg*\\xaf\\xa0\\x86*~^\\xda\\xab\\q\\xc4]\\x8blya\\xd2\\xdb\\xf7\\xffg\\xacyy\\x0f\\x97$\\x13"
  692. },
  693. {
  694. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04sv\\xef/a\\x1c\\xf7z\\x17\\x07,\\xfb0\\x85n}+crn\\xdf\\xdf\\m\\x82\\x9al9\\xff\\xd6\\xf1\\xba\\x8f\\x8az<p5\\x831\\x80\\xee\\xd1\\xee:\\x85q\\x10eu@\\x94\\xd6 \\x90h#\\xd4\\xb3\\xa4\\x8ff\\xc3\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\x16\\xb36,e\\x8az\\xbeb\\xe6=o\\xb5\\x1c\\xba\"\\x18jy\\x0b|\\xf8g\\xf2\\xef|\\x07\\x0bl\\xa6o(\\xa2\\x1fze\\x15\\x95l\\xc8\\xda\\xf5\\x88\\x969(v"
  695. },
  696. {
  697. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\t\\xf8\\x02,$\\x915\\x89\\xf1\\x85\\xec\\xf0\\\\x1a\\x1f\\xef\\xcfi\\x1d\\x0b\\x1d\\x1d.(\\x0e\\x1d\\x1ax1\\xa7\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  698. },
  699. {
  700. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?\\xd9b\\x7f\\xc7\\x9c\\xc5\\xcaz:\\x95)d\\x01t\\xb1oo6!\\xc7#\\xf4\\xc11\\xbaqe\\xa2\\xe5;d\\\\xe3\\xc4y\\xa0'\\xd4\\xc57\\xcf\\x80\\xd9\\xef\\xdf\\xfe\\x00\\xdf\\xac\\x01\\xd0jm\\xcf\\xc8\\xcem\\xa9wxiv\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xb2\\xb3\\xed%0b*\\xcf\\x9ar\\xb3?f\\xd0ay\\xa6qm\\x1e\\xea\\xfb\\x95$\\x8b\\xa0}\"$\\xa3\\x9d\\x0e\\xcc\\x11l\\x17\\xe8\\xdf\\xded\\x84ta`\\x81\\x90l"
  701. },
  702. {
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:z|\\xd9\\x81\\xb5\\xa5a\\xb8\\x87\\x1b\\xd1^\\xac9\\x139\\x0f\\x9a\\x0b\\x84\\x93\\xcbq0\\xa6n\r\\xe9\\xa6o\\xc7\\xb4\\x1f\\x959\\xd0\\xf7\\xb0\\x02q\\x10\\x01\\xdf\\x11\\x10ip\\xd88\\xf5\t8\\x99\\xc6y\\x0f{\\x1d\\x92\"\\xeb /\\xc1k\\xa8\\xf1a\\xa2\\xa9\\xe5\\x84b\\xfe\\xcb\\x95h'\\x933\\xcd\\x13\\xc5\\x9cb\\xde\\x92q1\\xfa\\xabdn\\x9e\\xd8\\xf4\\xc5?i\\xda\\x0f\\x08m2\\xa8&\\xf36_m\\xd9\\x8bo\\x8d~\\xa0z&\\x84'\\x8c\\x13\\xf9\\xfd\"\\xba\\xfao(\\x82k*~r\\xc3i\\x8b\\x91\\xe7\\xdb\\x05@s\\x13\\xeco\\xd1\\xaf8\\xd2.l\\xdc\\xe4\\xa8r\\xb7hz\\x1eb\\xd8`\\x17ei #\\xe0\\xa2\\xe6<\\x1cm\\xd8\\xf4\\xa3\\xdb\\xd3\\xa3\\xdc\\xa1\\xf0\\xba\\xd8\\x0f\\x9f<\\x99_\tg]\\xad\\xb93\\xa48\\xe6:\\x13\\x94l\\xddj\\x8a\\x97\\x7f\\xbf\\xe4'i\\xb5l\\x92\"d\\xf6.t\\xce\\xec\\xdcx\\xf8\\xb1\\x9ewe[\\x8c\\xd9\\x1e\\x0e\\x804\\x1a\\x99\\xb0\\x1e\\xed\\xac\\x9cpc\\x19\\xc8\\xba\\xbc\\xc2"
  704. },
  705. {
  706. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  707. },
  708. {
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaaj\\xd6\\x00\\x8e\\xdd\\xa1\\xfan\\xab\\xdf\\x14\\xd3\\xcd\\x97o\\xc28\\x89\\x02o\\x9e\\xe1\\xbd\\x1c:\\xa2\\x95c\\xcc7ygz\\xad\\x819\\xb43\\x0f\\xe8xy\\x06\n\\xbd\\x8c\\x19m\\xb23\\x96=\\xc5\\xc0\\xac\\xad\\xc8=\\x8e\\xcfuo\\xbf`\t\\xc2/\\x95b!\\xe7\\xcb\r\\x87d\\xe1\\xb8\\xf6\\x08\\xc3{\\xd0\\xa6\\xf6y}>\\xb9\\x03\\xb0\\x8b\\xce\\xe9\\x85\n\\x1f\\x13h\\xc2\\xdf\\xe8(@d<\\xcd\\x1f\\xfcy.h\\xb7\\x0e\"\\x83\\xb29\\xa9=\\xc0!\\xb6;0\\x06\\x8ba9\\xe9\\xac\\x93\\x91\\xe8\\xb0v\\x82\\xb1\\xdc\\x88\\xe9\\x88\\xf1\\xc4\\xad\\xcd\\x07r\\xac\\xa0\\xb5\\x98\\xae\\xbd\\x93\\xa0ez\\xd3\\x82m\\xed\\xcc_\\x90\\xd8\\xe01\\xee\\xe5\\xd9\"\\x8a\\x83\\x9d\\x9as\\xe6`\\xe5\\xee7\\xf8\\xf8u\\xa4y\\x92ms\\xc6\\x95ak\\xa9\\xed\\x9c\\xec\\x13\\xc1\\x0c\\x06g/y\\xd3\\xfe\\xaf{\\xd2\\xc9\\xb3n\\x18\\x8a\\xd8\\xb5\\xbbm\\xb7\\x1c\\x9ab\\x01\\xbc\\x9b\\xf9\\x9f\"\\xae,\\xbe\\xaa\\x15ui\\xacz\\x13\\xfdk\\\\x86-\\x1a\\x05s@a\\xc5p"
  710. },
  711. {
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\x81\\xa7\\xe4~z]8\\x04\\xf8\\xca\\xf5\\x0e\t\\x1ab\\xfa-^\\x94a\\x06\\x98\\xa7\\x80\\x19\\xe3#\\xb6ax\\x00\\x18\\xde\\x8c\\xe5i\\xc9\\x93\\xe4\\xa2kq\\xcf\\x872\\x8f\\xf5\\x14<\\x96*a\\x8d3\\xc6\\xa2\t\\x89\\x8c\\xb5\\xc6b\\xc9\"\\xb5b\\xd6\\xfb9h\\xdf\\x00\\xe2\\xa2l\\x85frq$\\x1b\\xf0<4m`m\\x11\\xa6\\xaf\\xb3\\xff\\x1b\\x8f\\x80v\\x1b2aj\\x1d\\xc2\\x86\\xc1\\x9b8\\xef\\x948\\x17\\x17\\xbc\\x8d\\xc56\\xfb\\xf7\\xd5\\xbd\\x93\\xee\\x9d\\x7fu\\x98\\xe9~b\\xf7c\\x07\\xcc\\x83\\xec\\xee%\\x0e\\xbbp-e\\xc8\\x02\\xf4\\xda\\x1a#\\x05e\\x8a\\xfds\\xacr\\xba\\xdd\\x07\\x9e\\x14@&q\\x7f\t/\\x97\\xac\\x85p\\xdf\\xf1\\x16*\\xf0\\xf9b\\xa1p\\x8fd\\xfbl\\x88\\x83\\x86\\xd9\\x86|k\\xe1`\\xdf1r\\x9c%\\xe4m\\x97\\xa3\\xb7\\xfc\\x1dk\\xe0q%\\x87p%`\\x9a\\xf66\\xcfssr\\xcbs\\x8e5\t\\xe3\\x8at\\xc7\\xca\\x08\\x8b\\xdei\\xc0\\x86p\\xa4\\x08\\xf4\\xa4\\x19\\xe9\\xaa'1qo\\x89\\x8c\\xd1\\xb8"
  713. },
  714. {
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\x90q\\x9f(4\\x90i\\x9c\\xe0\\x1f\\xca6\\xd7\\x1f\\xf0\\xe6\\x88\\xd6\\xa0\\xda\\xd8&\\x86\\xe9\\xe4}\\xfa\\xb2$\\x06\\xd3c\\xf8\\xdc\\x02\\xf1\\x18nz\\x07jma\\x1b\\x7f\\xfaxs\\xc1n\\xdbky\\xf1>\\xe8oy@c\\xdfn,\\xe6\\xc3\\xb6\\xdc\\xd4\\xdb-\\xddh}$g \\xadk\\x01)\\xdf\\xccg@.\\x00h\\xebk\\xf3th\\xf5\\xe0\\xdc\\xd2(\\xc0x\\xd0\\x80\\x021\\x99\\x1d\\x84w\\xf6(\\x193\\x12a\\x15\\xf1\\x95v\\xcer\\xde\\xb2*\\xd2vni)\\xb8<\\xd1\\xf9\\xa6\\xdc\\x854\\xea\\xcb\\xb1h)\\xee\\xe7\\x81\\xc0zr\\xbd\\xcb\\xb2\\xdd_\\xa52\\xadk\\xda\\x1ae\\x1aq\\xf3\\xe5n7\\xbb\\xd99m\\x08\\x95`\\xe2\\x08\n\\xe0\\x06\\x82adn\\x0c77\\x8a\\x16\\x087\\xa0\\xd3\\xf4\r\\x9c\\xba\\xa3\\x8bx<\\xe2dp\\x91iet'\\x12\\x8bw\\x8b=r\\x99\\xdb;e\\xe6\\x19<7\\xec\\xf3\\xb6\\xb4\\xeb\\xb2@\\xce\\xa7\\xbe%\\x02\\xb6e\\x9a7\\xd6\\x80\\xb6\\x7f\\x14s\\xcf`\\xb2/pf\\x1d`\r"
  716. },
  717. {
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xf9\\xce\\x93@]uq\\xcf@\\xfct\r\\xecn\\xcf}(!\\xd897=\n\\xfe\\xf5^\\x9ai1a-\\xc8\\x89v\\x13\\x18\\xe0ea\\x9c\\xdc\\xbf\\x84&f\\xfcu\\xe6\\xa7\\x9b\\xbf\\x9c]\\x9d\\xc9\\xa5\\x8c/-\\xd7\\x99\\xce=\\xd4\\xda\\xeb\\xd8\\x8a\\xc1mbw\\xf0u\\x8a\\xfb(3\\x1d\\xdb\\x02\\xd1\\xe6\\xb2~\t\\x82\\x9bl\\x001l\\x1b\\xdf\\xd1l\\xae\\xb6\\xd7_\\xfa\\xc4\\\\xe1\\xd0\\xd4m\\xc9\\xe6\\xf6\\xa7>\\x05j\\x9b\\x08\\xa4c\\xaf\\xb2y\\x1aeq(\\xd5\n\\xd0\\x05\\x1fu\\xf0\\x9d\\xb1\\xe2[\\x1b\\xd8\\xac\\x8d\\x85\\xb5\\x8f4\\\\xe6l\\xe2=v\\x1c~\\xf5!b\\x1b\\x8f\\xab\\x12\\x1fh\\xc5:\\xfay\\xe6c\\xaf\\xae\\xca\\x0f\\x87*l\\xab\\x13\\xd6\\xbd\\xf4vi\\xa9\\x9b\\x97\\x9e\\x8d\\xe5\\xeb\\xcb\\x94m l\\xfb\\xdc\\xe2\\x14\\xe1\\xe4\\x83\\x86\\x9c\\x99\\xcd\\x0e@\\x8a\\xd6\\x04|\\xed\\xcb\\x13\\xf1ez?`\\xd9\\x92\\x071v\\xf2\\x9b\\x1a\\x84+\\x14\\x8a\\x04\\x8b\\x15\\xed\\x82\\xc4y\\x82\\xe80\\x80\\x91{\\x9a\\xc5\\x8f\\xe5\\x05\\xc9w"
  719. },
  720. {
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\x8c\\x92\\xd0k\\x10\\xfe\t\\xdf\\xaby\\xf0\\x0b\\xa9\\x19!\\xf4%\\xd9\\x1d\\xb6w\\xb0\"\\x02\\x9a\\x92\\xfa\\xa3\\x8f\\xe4\\x8b\\x11w\\xaa\\xda\\xac\\xf3c[\\x97\\x18\r\\x19)\\xa6[c\\x0c\\xbe6cps\\xc6\\x0c\\xd7\"\\xea\\xa2\\x14@;\\xf7\\x00\\xd1\\xde\\x82(3q\\xfc\\xaf\\xd6_`h\\xc27\\xff&>\\x83\\x83<\\x91\\x1au \\xc6\\x0b\\xd0i\\x17\\xf9\\xb7v\\xd8h\\xd14\\xd0\\xf4\\x968\\x1c<\\xe8j\\xc9\\xcf\\xf8$\\x81\\xc0\\x84/e\\x83\\x98:\\xe9\\xa3\\xf1\\x0e7\\x9b\\x1a\\x8e7\\x8c\\xa2\\xe6\\xd4\\xb3\\xac.\\xf1\\x0fq\\x82\\xe2\\xde\\x1a\\xe5\\xcazn\\x1f\\x10\\x97\\xb5$c\\x93%\\x8b\\xd3\\xbc\\xa9\\xf6\\xd0\\xbf\\xcc\\xff\\xc3\\xc5\\xd7=\\xa1oz\\xb3\\xc1q\\xaa<in\\xec\\xfa\\x93.o\\xe4\nj\\xce\\x01d7\\xaco\\xe9\\xeeh\\xba\\xdf]\\xdc\\x94\\x07\t\\xe6^i`\\xc3h\\xde\\xd4b\\xc8\\x02\nh\\xd2\\xc3\\x0faet\\x83@\\xe6\\x9e\\xb1\\x9c\\xcf\\xbd\\xf0\\x8de0\\xcd\\xed\\xd1\\xf9;\\xc2\\xfaw\\x1a\\x0cc1tu_\\xc1\\xfe"
  722. },
  723. {
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe97l\t&}\\x03\\xa8u)\\x95\\x16\\x06h\\xbd\\x81\\x9eq\\xd0\\x11\\xd3q\\xe0o\\x1fv\\xe6\\xa2\\x15\\x02f\\xce\\xfcfy\\xf8^l\\x8f4\\xd1e\\xefc7\\x0c\\xe1\\x99\\x98$\\x0e\\x94g\\x9a'\\x97\\x1c\\xfa\\xbe\\x18\\xcb\\x8b\\xc43\\xd6\\xf1~\\x7f\\xe0x\\xf2\\x89\\xb7z\\xd0~\\x98a\\x9bs\\xd00-t\\xcd\\xdb\\xce\\xd9\\xa1\\x0c\\x9am\\xd8\\xbf\\x9c\\x97\\x92y\\xe9\\x1acg\\x05\\x0cr\\xc0\\xae-\\xf2\\xe2\\xd4./\\xbe\\xe0]\\x92jw\\x07gme\\xeb/e\\x1c\\xd96\\x95\\xb3\\xc9\\x18\\x87\\xe7\\xbe\\xa4\\xc3\\x8en\\xca\\xfdk\\xdf\\xfc\\xee/vm\\xca\\x0bg\\xb8\\x94\\xe0\\xbb\\x82n\\xe8\\xb3@\\xc0\\x1c\\xef\\x8e\n&\\x01yn\\xd0_\\x0c\\xc5e\\xea\\x8f\\x97f^v\\xd2\\x18\\xff\\xf9\\xeb\\xd5p\\x0c\\x13\\xbe\\x9e9\\xc6\\x98;\\xfe\\xb6k\\x1c,\\x18q\\x96p\\xcc\\xb9\\x05\\xaa\\xbcoj\\x9at\\x0cf\\x8f\\x03\\x17\\x14v\\xed\\x94\\x04\\xc5f\\xcfo\\xd0\\x07v\\xbd![q\\xf1q\\x99\\x1b\\xb6\\xac\\xeaw>\\x83s^\\xfb\\xbf\\xd3y"
  725. },
  726. {
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\.^\\xce\\x8e\\xa3\\xa0\\xbb\\xf5\\x84\\xcal`s\\xc5a\\x16\\x16\\x12\"\\xc2\\x02/g\\x02'\\x9d\\x14\\xc79\\xb8}p\\xc12w\\x87\\xd8\\xf5\\x7f\\xbc\\x82\\xe2,}\\xed\\x90\\xfe`\\xb0i\\xbd\\xce\\x98\\x9c\\xa1y@l\\xaf)[\\x9b,\\xa9}\\x86fq\n\\x0f\\x9e&q%>\\xa0+\\xc6\\xb0\\xf1\\xdah\\x16\\x0ef\\xb1\\x18>(k\\xb4\\x04h\\xae\\xdb\\xa1c\\xeb\\xe5p j\\xaa,2\\xcf\\xbam\\xb5b\\xa5n\\xb9\\x90\\xb0\\xa5\\x01\\x92]\\xe7\\xcb\\xe79z[\\x84ax\\x92v\\x9b\\xc8z\\xa7\\x0b\\x16t\\x05^\\x8b?\\x13b\\x84ts\\xfb)\\x87\\x96\n\\xedu\\xe1\\xf2\\xd9\\xb6\\xb0\\x80\\x94\\xd3\\xfd[\"\\xa9\\xa1d\n\\xe0\\x04\\xd5^\\xba\\x84en4:j\\xf03\\xc5\\xed\\xe6iq \\x90\\xf2\\x03 (>~\\x13\\xae\\x84cuj\\x9e\\xa4\\xf5@\\x1a\\x02\\x1e\\x16\\x06\\xf9>\\x1cy\\xbd--\\x11]u\\x80#\\xbe\\xe1\\xce\\x9f\\xdb\\x99\\x9d\\x8a0\\xc80\\x9f\\x89\\xd4tyw\\xf3\\x16\\xd1<\\x0eh\\xc2\\xdb*fy"
  728. },
  729. {
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x90\\xe2&\\x06+l$\\xdb\\x87-\"qg\\x93\\x83\\xb1\\x13ca\\x1a\\xda\\xfbv\\x0b\\x0f\\xe7%\\xcdx\\xe1w\\x1d)\\xef\\xd8\\xf8\\x02u\\xe1\\x8c\\x7f\\xc7b\\x12\\xa8\\x83\\x94\n\\x08:\\x8a\\x86\\xd4zu\\x05\\xefxq\\xef\\xea\\xd2^\\xa1\\xa1#\\xb6\\xdb\\xa0\\xa4\\xb7h\\x02\\x0f{\\xe0\"\\xc4\\xfd\\x95h>t\\xc3\\x0c\\xf4\\\\x96\\xf5\\x8ce\\x07*\\xbb\\xf0b`hb\\xa8m\\xe2\\x1b\\x03f@\\xa6o\\x84\\xf4<\\xca4\\x8a\\xc7^ik\\\\x98\\x88+\\xfe\\x16\\xd4\\x08\\xf6\\xb9\\x065>\\x92~b\\x1c\\xa6\\x96\\xe8\\xa0\\xbe\\xf5}\\x84\\xa3\\xb1\\xd9\\xbe\\xb1\\x88\\xf1\\x1fs;\\xa8u\\xb7\t\\x81g\\x19\\xd6\\x022\\xc1x\\xafd\\xf5\\x81\\xad\\xa2\\xc3:\\xc0\\x1f\\xd6\\xf8\\x0b\\x93\\x11h\\xb0l\\xce>\\x87\\xe2`\\x1e\\x97y\\xde\\xee\\x13)ft\\x03\\xf2\\xfb2\\x95\\xcc:\\xf0\\xdco\\xbd:\\xe4f=\\x82spc\\x82\\x16o+{\\xfd\\xcf\\xc9\\xd0\\xe5c\\xb2\\x0e\\x87,x\\xba\\xe7\\xae&\\xe8\\x18\\x02d\\xe7v\\xdd/w\\x99i\\x16\\xf7k"
  731. },
  732. {
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8q\\xc1\\xd0\\x86\\xfb\"\\xa3\\x80!2\\xdd;rf\\x89xr$\\x88\\xa9\\xa9\\x81\\x0c{>\\xc8\\xdb\\x89\\x0e\\xe5\\x05\\xcf\\xa4\\xf2e\\x06\\xb8\\x86\\xf59.\\x19\\xc1\\x94\\x9c\"\\xb5\\xc4\\x85uo};\\x0c\\xf5\\x158\\xae\\xb7\\x8f\\xb3\\x1d\\x13\\x17%v\\x89\\xf6\\xf5\\xb3\\xa5\\xd3vi\t~\\xea:t\\xf5\\xc3qgz\\x98\\xaa\\x1e8\\xa3b!_\ts\\xeew\\x0c6<\\xcd\\x05 \\xd6\\f=\\xac\\xb7\\xf5w\r\\x0b\\xb1\\x01e\\x91\\xd6\\xf8%\\xac\\xaf\\xdc\\xbf\\x86\\x03\\x94\\x93\\x9b-\\x96\\x9c\\x03\\xa1b\\x7f\\xdb\\x9a\\x9f\\x9f\\xe7z\\x0c\\xa7&\\x80\\x9cl\\x97n\\xa77)\\xfb\\x19\\x00u;{\\xcdx\\xa5g\\xfa\\xc8b7\\x17\\xb3\\x1d\\xd1\\x10\\x1c28\\xc1d|e\\xfb\\x19\\xde\\x12\\xe7\\xe2\\xfda\\x9cq\\x92\\xef/\\xeb|c\\xa2p\\xa0\\xbdc+\\xf8\\xde\\xcc\\xa3\\xdf11\\xc0\\xd1\\xa2;u<\\xf0\\x13\\xb5\\xa0h\\xca\\x04\\x03[x\\xfe\\x80\\xbe\\xcf\\xd9 \nb\\xf7g\\xdb\\xa8\\x93\\x07\\x95b\\xae)\\x9d\\x115\\x9fm\\xa3}h\\x93"
  734. },
  735. {
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd-\\xc5\\x96\\xa9\\x7fb\\x0c\\xff\\xca\\xf1\\xab\\xfayc\\x92\\xde^~\\x1c\\x18\\x01\\xe9\t\\x17\\x81\\xf4\\xa1\\xfd\\x94\\xb3\\x974\\xe2#\\x16dt\\f\\xbb\\xd9\"\\x974\\xe5/\\xe1\\x11r\\xa3\\x91\\x124/\\x08\\x00\\xf0\\xfb\\xf0\\x9e\\xa7\\xb0\\xc8\\xc1\\xd0+\\xed:)\\xfa1\\xb4\\xa6\\xa9\\xbb\\xfc<\\xbf:\\xf4\\x0b#\\xdco\\xd7w\\xfc)o'p<\\x1cf\\xe3\\x18\\x12\r\\xbf\\xb6 \\x95\\x943m1\\xdck\\x1b1\\xba-\\xcf\\x16\\xe8\\xffy$\\x85\\x8a\\xd5\\x04\\xc6p\\x15\\xf7\\xe4\\xeaw,\\xf2\\xd6\\x9df\\x8c\\xf7tx\\x11iix\\xbf\\xcez\\x9a\\x1f\\xf9/^\\x13c\\xe2o\\xba't^\\xde#~\\xe3\\x96!\\xe796\\x88\\xf2x\\xa7\\xf1\\xec\\xd8 \\x8b=,\\xf5\\xcc\\xb1?\\xa1\\xff\\xf8\\x85\\xb3w|arov\\xfflp\\xd4\\x9b\\x0b|\\x18\\xbd\\x9c\\x00\\xe1#yi\\xe4\\xa6\\xa0\\x80\\x83\\x96\\xd0+\\xdb\\x05 ~d\\xcc\\xd5\\xab\\x17\\x83pm\r\\x97\\x058\\x04)p\\x87\\xc6\\xe8\\xe9\\x1e\\x81\\x92\\xbai\\x80\\xa9\\x84\\xee\\x90~"
  737. },
  738. {
  739. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 16 feb 2019 02:02:49 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  740. },
  741. {
  742. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x0e)j\\xf8\\xc7e\\x9e\\xf5\\xfe8\\xe8.\\xbb\\x82d\\x0eru\\x99\\xdb\\xb0:\\xb24c\\xde\\x1b\\x0c\\xbf\\xc2k\\xce\\xc6\\xac\\xb9%o\\xa3j\\x93&\\xb6y\\x01\\xa9\\x8f\\xd3p\\xbb\\xccbr\\x1c\\xc9\\xdblu\\xd7\\x89\\xf4\\xa0\\x1f\\xe712\\x83\\x1c\\xb6[\\xdcy\\xeeb\\xa4?\\xa3\\xa3\\xa8\\xae\\x80\\x1b\\x7f\\xf9\\xfa\\x9c\\x9c\\xf0\\xda\\xe8\\xc6\\xae\\xb3/yk\\xae3\\xb4[\\xb9\\x0c\\x1cx\\xaa\\x81\\xd5\\xe9\\x88)\\xd4\\xe9\\xbf\\xe0\\xb7\\xda?i^\\xc2\\xbd4\\xcdf\\xecl>\\xc8:\\x8f\\x17\\x86\\x1f\\xea\\xa6|>\\xc5o\\x16l.\\x98#\r\\x0f\\x97\\x8d\\xc9\\x91\"j\t\\xa1\\xb5\\xc8a\\xedvm`\tv\\xabo\\xa3\\x1d\n\\xbap\\x14\\x1eb\\x0c\\x0f\\xac\\xe2(\\x12e\\x15\\xefh\\x0fb\\x1e2\\xa0\\x05p\rdd-?\\x8e\\x95\\xfe\\xf9*\\xf7@\n\\x01\\x05\\x84\\x8e\\x08/\\x97\\xf0\\xd0ww\\x8e\\xc6\\xadf\\xbb\\xf2\\x07f\\xccl\\xd8\\x91!h\\x9b\\xc1\\xd0d\\x9d\\xb6i\\x12\\xd9t\\xbd\\xfc^\\xde\\xf3o\\xe0\\xe6"
  743. },
  744. {
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`}lb\\xdd\\x1bt\\x04\\xeb\\xea\\x9eab\\xf1ih\\x1d\\xf5\\x8d\\x9a\\xc1c\\x18\\x80\\xe1\\xccm#\\xd6\\xad\\xe6\\xa0\\xfd]\\xe9a\\xf9\\x8ft\\xf0\\xb7\\x14z\\xcf*~\\x8a\\x00\\xd4&\n\\xcen\\xdf\\xf6\\xb8e\\x9a\\xcf:\\x9dl\\x11j\\x0bej\\xe1=\\x16\n\\x88\\x01\\x02\\x8d\\xc4\\xe6\\xed\\xadev\\x94\\x83c\\x1d\\xfa\\x06m\\xe0\\xcc\\x8d\\xc8\\xc8<\\xd0\\xadxi\\x00'y\\x8a\\xc6\\x82e\\xae\\x91\\x87z\\xa5\\xb9\\xd2\\x9du\\x98\\xa4\\x1a*(\\xd4y\\xcc,\\xb4\\xf41{\\x1d+\\x0e\\x88\\x9ap2\\xbd\\x08\\x80\\xb9\\x93^{\n\n\\xa8~\\x12\\xcf,-\\x89*\\xf5\\xa6\ty\\xdek\\x03\nw\\xf8\\xdd!z\\x8c\\xf6h\\x9a\\x04e\\xc3\\x92\\xbbm\\xf6*\\xee_\\x87\\xf9gv\\xa1\\x939\\xd0e\\x08e\\xabr\\xe73@!{\\xb3\\x13g\\xcf\\xc4\\x84\n\\x84\\xcf\\xc7vs\\x8c\\x8d\\xfbg\\x95\\xe0g\\xe9\\xcdy\\x1c.\\xdc\\x8e\\x85\\xf7\\x03l1j\\x99s\\xdb\\x14q\\xa9\\xab y\\xf1w}\\x8cm\\x08g\\xc5si1\\x9a\\x10[x"
  746. },
  747. {
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xbb\\xebk\\xfdxy\\xcce\\xc3\\xbb\\x93\\xab\\x8f\\xc2\\xdbm\\xbf\\x8djq.%\\\\xabb)`\\xf4[fq&\\xf6\\x1f\\x84\\x0brl\\xeb\\x9f7.\\x955\\x8e\\xedm\\xe51as\\xa6mm{\\xee\\x19x\\x95\\xb0\\xaa\\xfd|\\xbb8\\xb5#w/\\xf7\\\\x03o\\xed)\\x9d(\\xad\\x12\\xe9\\xfb\\x97\\xd8\\xe1\\xc31\\xf8\\xe1}\\xdc\\xc9g\\x14\\xb6nn\\x8e\\xc2:\\x06\\\\xadh\\xc0\\x93g`\rq\\xd1o\\xee\\xfa\\xf2ym\\xd5\\xa2u\\xf4c\\x13\\x0f:\\x11\\x06/\\xed\\xcep\\xeb\\xe3\\xd9\\xa9#;\\xeeo9\\x85\\xe3{\\xc9\\x90\\x12\\xb4\\xed\\x01or>\\x92\\xd0\\xf7\\xec\\x11\\xa0\\xd0\\xd3\\x1fo]\\xe2\\xd0\\x0bi\\xf1q\\xfb\\x9f\\x0b~p\\xf0\\xa8fa\\x0b,\\xca\\x7f\\xc2a\\xbfii\\xdab\\x98\\xfc\\xf1yj\\xda\\xe4u\\xff}\\xe7\\xcb\\x10a\\xc7\\xdf\\x91\\x92j\\xb8\\xffw\\xa9r\\xb3\\xb43\\x9c\\xd6\\x80.\\x8a\\x9a\\x10>2\\xb2\\xa8\\x95id\\xe0z+\\xe5w\\x84\\x85}\\x90h\\xa7\\x85\\xbc\\x12\\xaau\\xa3]\\xe5zq\\x91"
  749. },
  750. {
  751. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 03 may 2019 05:00:32 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  752. }
  753. ]
  754. },
  755. {
  756. "Description": "Creates a hidden or system file",
  757. "Details": [
  758. {
  759. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  760. },
  761. {
  762. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  763. }
  764. ]
  765. },
  766. {
  767. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  768. "Details": [
  769. {
  770. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  771. },
  772. {
  773. "FireEye": "Exploit.CVE-2017-11882.Gen"
  774. },
  775. {
  776. "ALYac": "Exploit.CVE-2017-11882.Gen"
  777. },
  778. {
  779. "Cyren": "CVE-2017-11882.E.gen!Camelot"
  780. },
  781. {
  782. "Symantec": "Exp.CVE-2017-11882!g3"
  783. },
  784. {
  785. "ESET-NOD32": "Win32/Exploit.CVE-2017-11882.BQ"
  786. },
  787. {
  788. "Avast": "Win32:ShellCode [Expl]"
  789. },
  790. {
  791. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  792. },
  793. {
  794. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  795. },
  796. {
  797. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  798. },
  799. {
  800. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  801. },
  802. {
  803. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  804. },
  805. {
  806. "DrWeb": "Exploit.ShellCode.69"
  807. },
  808. {
  809. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  810. },
  811. {
  812. "Sophos": "Troj/RtfExp-EQ"
  813. },
  814. {
  815. "Ikarus": "Exploit.CVE-2017-11882"
  816. },
  817. {
  818. "Avira": "EXP/CVE-2017-11882.Gen"
  819. },
  820. {
  821. "Microsoft": "Exploit:O97M/CVE-2017-11882.L"
  822. },
  823. {
  824. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  825. },
  826. {
  827. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  828. },
  829. {
  830. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  831. },
  832. {
  833. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  834. },
  835. {
  836. "McAfee": "Exploit-CVE2017-11882.yx"
  837. },
  838. {
  839. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  840. },
  841. {
  842. "Zoner": "Probably W97NativeOnly"
  843. },
  844. {
  845. "MAX": "malware (ai score=94)"
  846. },
  847. {
  848. "Fortinet": "MSOffice/CVE_2017_11882.BB!exploit"
  849. },
  850. {
  851. "AVG": "Win32:ShellCode [Expl]"
  852. },
  853. {
  854. "Qihoo-360": "virus.exp.21711882.d"
  855. }
  856. ]
  857. }
  858. ]
  859.  
  860. [*] Started Service: [
  861. "osppsvc"
  862. ]
  863.  
  864. [*] Executed Commands: []
  865.  
  866. [*] Mutexes: [
  867. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  868. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  869. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  870. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  871. "CicLoadWinStaWinSta0",
  872. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  873. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  874. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  875. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  876. ]
  877.  
  878. [*] Modified Files: [
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_920b8022cf38fb202b76f11fe9844e73.doc",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_920b8022cf38fb202b76f11fe9844e73.doc",
  881. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{3AAFB77E-89AE-4E15-8BFB-9EA61136E7FA}.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  883. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  884. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  885. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  886. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21B8.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21B9.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{066AE2AC-E5B5-430A-9E2D-37A439D50B48}.tmp",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_920b8022cf38fb202b76f11fe9844e73.asd",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  892. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA05348923C55AD00.TMP",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab525F.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52EC.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52ED.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5446.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B9.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56CA.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B8.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5832.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5843.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5844.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5856.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5854.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5855.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cab58C7.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5886.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A10.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5897.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A21.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5AAE.tmp",
  913. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  914. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E39.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab607D.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60EB.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60FD.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cab61A9.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6227.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6238.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60EC.tmp",
  923. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6258.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6259.tmp",
  926. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6306.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6317.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab675E.tmp",
  930. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  931. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab682A.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6982.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A9D.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BD6.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D72.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C76.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D75.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D88.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D8B.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\iso690nmerical.xsl",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D77.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\mlaseventheditionofficeonline.xsl",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D73.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\architecture.glox",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D9C.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\chicago.xsl",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D8A.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D89.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\gb.xsl",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E29.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\RadialPictureList.glox",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC5.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\Content.inf",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D52.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FA4.tmp",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\CircleProcess.glox",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\PictureFrame.glox",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7072.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\Content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar70B2.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\iso690.xsl",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\gosttitle.xsl",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\gostname.xsl",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7023.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7511.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Equations.dotx",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\Frame.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7510.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\content.inf",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\Content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7512.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\Basis.thmx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\BracketList.glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\Dividend.thmx",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\HexagonRadial.glox",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cab774A.tmp",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar75FE.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\ConvergingText.glox",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Element design set.dotx",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\Metropolitan.thmx",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\ThemePictureAlternatingAccent.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\sist02.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\pictureorgchart.glox",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\ThemePictureAccent.glox",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\Content.inf",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Headlines.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\APASixthEditionOfficeOnline.xsl",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\ieee2006officeonline.xsl",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Badge.thmx",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\rings.glox",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\Content.inf",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\Content.inf",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\content.inf",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\Wood_Type.thmx",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\TabList.glox",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab82B2.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\harvardanglia2008officeonline.xsl",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\chevronaccent.glox",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\Content.inf",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\Content.inf",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\cab86CC.tmp",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\turabian.xsl",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\Content.inf",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\Circuit.thmx",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\TabbedArc.glox",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\Content.inf",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\content.inf",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\content.inf",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\Droplet.thmx",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CAF.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\content.inf",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\Damask.thmx",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\Mesh.thmx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AEA.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Insight design set.dotx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx"
  1089. ]
  1090.  
  1091. [*] Deleted Files: [
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21B8.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21B9.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_920b8022cf38fb202b76f11fe9844e73.asd",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104[[fn=Feathered]].eftx",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937[[fn=Vapor Trail]].eftx",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104[[fn=Feathered]].xml",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60EB.tmp",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929[[fn=Slate]].eftx",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60EC.tmp",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430[[fn=Banded]].eftx",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937[[fn=Vapor Trail]].xml",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927[[fn=Main Event]].eftx",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929[[fn=Slate]].xml",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104[[fn=Feathered]].xml",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430[[fn=Banded]].xml",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917[[fn=Berlin]].eftx",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937[[fn=Vapor Trail]].xml",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430[[fn=Banded]].xml",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105[[fn=Crop]].eftx",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927[[fn=Main Event]].xml",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929[[fn=Slate]].xml",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927[[fn=Main Event]].xml",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105[[fn=Crop]].xml",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917[[fn=Berlin]].xml",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105[[fn=Crop]].xml",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917[[fn=Berlin]].xml",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D88.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\iso690nmerical.xsl",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D89.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B9.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D72.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D73.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D77.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E29.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C76.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D8B.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D52.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D75.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D8A.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D9C.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\mlaseventheditionofficeonline.xsl",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5886.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7072.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar70B2.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\gb.xsl",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\CircleProcess.glox",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Equations.dotx",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7511.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5854.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\architecture.glox",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52ED.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60FD.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7512.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5856.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\chicago.xsl",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FA4.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52EC.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7023.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7510.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar75FE.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\PictureFrame.glox",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6227.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\HexagonRadial.glox",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\cab61A9.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5843.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\Frame.thmx",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\iso690.xsl",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\gosttitle.xsl",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B8.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BD6.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5844.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\Basis.thmx",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cab682A.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\Metropolitan.thmx",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6982.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\Dividend.thmx",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\BracketList.glox",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab675E.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A10.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\gostname.xsl",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\ThemePictureAlternatingAccent.glox",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5832.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\RadialPictureList.glox",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6306.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Element design set.dotx",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A21.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\ConvergingText.glox",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6317.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E39.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\pictureorgchart.glox",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6259.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\rings.glox",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5897.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\APASixthEditionOfficeOnline.xsl",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\ieee2006officeonline.xsl",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\cab58C7.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\TabList.glox",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\ThemePictureAccent.glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\Wood_Type.thmx",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Badge.thmx",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6238.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6258.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC5.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cab774A.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\chevronaccent.glox",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cab525F.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\sist02.xsl",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56CA.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\harvardanglia2008officeonline.xsl",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5855.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Headlines.thmx",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A9D.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\turabian.xsl",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5446.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\TabbedArc.glox",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab607D.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\Circuit.thmx",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab82B2.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\Droplet.thmx",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cab86CC.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{066AE2AC-E5B5-430A-9E2D-37A439D50B48}.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_920b8022cf38fb202b76f11fe9844e73.doc",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\Damask.thmx",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\Mesh.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CAF.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Insight design set.dotx",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AEA.tmp"
  1278. ]
  1279.  
  1280. [*] Modified Registry Keys: [
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ma,",
  1282. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\295334",
  1305. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1306. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\388B53",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1607. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1608. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1609. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1610. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1917. ]
  1918.  
  1919. [*] Deleted Registry Keys: [
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ma,",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ #*",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\388B53",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\295334",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1943. ]
  1944.  
  1945. [*] DNS Communications: [
  1946. {
  1947. "type": "A",
  1948. "request": "blogmason.mixh.jp",
  1949. "answers": [
  1950. {
  1951. "data": "150.95.52.111",
  1952. "type": "A"
  1953. }
  1954. ]
  1955. }
  1956. ]
  1957.  
  1958. [*] Domains: [
  1959. {
  1960. "ip": "150.95.52.111",
  1961. "domain": "blogmason.mixh.jp"
  1962. }
  1963. ]
  1964.  
  1965. [*] Network Communication - ICMP: []
  1966.  
  1967. [*] Network Communication - HTTP: [
  1968. {
  1969. "count": 1,
  1970. "body": "",
  1971. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1972. "user-agent": "Microsoft-CryptoAPI/6.1",
  1973. "method": "GET",
  1974. "host": "ocsp.digicert.com",
  1975. "version": "1.1",
  1976. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1977. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1978. "port": 80
  1979. },
  1980. {
  1981. "count": 1,
  1982. "body": "",
  1983. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1984. "user-agent": "Microsoft-CryptoAPI/6.1",
  1985. "method": "GET",
  1986. "host": "ocsp.usertrust.com",
  1987. "version": "1.1",
  1988. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1989. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1990. "port": 80
  1991. },
  1992. {
  1993. "count": 1,
  1994. "body": "",
  1995. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1996. "user-agent": "Microsoft-CryptoAPI/6.1",
  1997. "method": "GET",
  1998. "host": "ocsp.comodoca.com",
  1999. "version": "1.1",
  2000. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  2001. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  2002. "port": 80
  2003. },
  2004. {
  2005. "count": 1,
  2006. "body": "",
  2007. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2008. "user-agent": "Microsoft-CryptoAPI/6.1",
  2009. "method": "GET",
  2010. "host": "ocsp.msocsp.com",
  2011. "version": "1.1",
  2012. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2013. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2014. "port": 80
  2015. },
  2016. {
  2017. "count": 3,
  2018. "body": "",
  2019. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2020. "user-agent": "Microsoft-CryptoAPI/6.1",
  2021. "method": "GET",
  2022. "host": "crl.microsoft.com",
  2023. "version": "1.1",
  2024. "path": "/pki/crl/products/microsoftrootcert.crl",
  2025. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2026. "port": 80
  2027. },
  2028. {
  2029. "count": 1,
  2030. "body": "",
  2031. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2032. "user-agent": "Microsoft-CryptoAPI/6.1",
  2033. "method": "GET",
  2034. "host": "crl.microsoft.com",
  2035. "version": "1.1",
  2036. "path": "/pki/crl/products/microsoftrootcert.crl",
  2037. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2038. "port": 80
  2039. },
  2040. {
  2041. "count": 2,
  2042. "body": "",
  2043. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2044. "user-agent": "Microsoft-CryptoAPI/6.1",
  2045. "method": "GET",
  2046. "host": "crl.microsoft.com",
  2047. "version": "1.1",
  2048. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2049. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2050. "port": 80
  2051. },
  2052. {
  2053. "count": 5,
  2054. "body": "",
  2055. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2056. "user-agent": "Microsoft-CryptoAPI/6.1",
  2057. "method": "GET",
  2058. "host": "crl.microsoft.com",
  2059. "version": "1.1",
  2060. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2061. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2062. "port": 80
  2063. },
  2064. {
  2065. "count": 2,
  2066. "body": "",
  2067. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2068. "user-agent": "Microsoft-CryptoAPI/6.1",
  2069. "method": "GET",
  2070. "host": "crl.microsoft.com",
  2071. "version": "1.1",
  2072. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2073. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 03 May 2019 05:00:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2074. "port": 80
  2075. }
  2076. ]
  2077.  
  2078. [*] Network Communication - SMTP: []
  2079.  
  2080. [*] Network Communication - Hosts: []
  2081.  
  2082. [*] Network Communication - IRC: []
  2083.  
  2084. [*] Static Analysis: {}
  2085.  
  2086. [*] Resolved APIs: [
  2087. "mso.dll.#1443",
  2088. "mso.dll.#9214",
  2089. "mso.dll.#199",
  2090. "mso.dll.#1073",
  2091. "mso.dll.#4255",
  2092. "mso.dll.#3459",
  2093. "mso.dll.#1262",
  2094. "mso.dll.#5709",
  2095. "mso.dll.#7353",
  2096. "mso.dll.#5228",
  2097. "mso.dll.#2155",
  2098. "mso.dll.#1725",
  2099. "user32.dll.RegisterWindowMessageW",
  2100. "mso.dll.#4314",
  2101. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2102. "secur32.dll.FreeContextBuffer",
  2103. "ncrypt.dll.SslOpenProvider",
  2104. "ncrypt.dll.GetSChannelInterface",
  2105. "bcryptprimitives.dll.GetHashInterface",
  2106. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2107. "ncrypt.dll.SslImportKey",
  2108. "bcryptprimitives.dll.GetCipherInterface",
  2109. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2110. "mso.dll.#6484",
  2111. "user32.dll.LoadStringW",
  2112. "mso.dll.#8499",
  2113. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2114. "ncrypt.dll.BCryptGetProperty",
  2115. "ncrypt.dll.BCryptCreateHash",
  2116. "ncrypt.dll.BCryptHashData",
  2117. "ncrypt.dll.BCryptFinishHash",
  2118. "ncrypt.dll.BCryptDestroyHash",
  2119. "crypt32.dll.CertGetCertificateChain",
  2120. "userenv.dll.GetUserProfileDirectoryW",
  2121. "sechost.dll.ConvertSidToStringSidW",
  2122. "sechost.dll.ConvertStringSidToSidW",
  2123. "mso.dll.#9871",
  2124. "mso.dll.#4743",
  2125. "mso.dll.#5452",
  2126. "userenv.dll.RegisterGPNotification",
  2127. "gpapi.dll.RegisterGPNotificationInternal",
  2128. "mso.dll.#2088",
  2129. "sechost.dll.OpenSCManagerW",
  2130. "mso.dll.#5274",
  2131. "mso.dll.#3195",
  2132. "sechost.dll.OpenServiceW",
  2133. "sechost.dll.CloseServiceHandle",
  2134. "sechost.dll.QueryServiceConfigW",
  2135. "mso.dll.#8165",
  2136. "mso.dll.#9175",
  2137. "mso.dll.#5315",
  2138. "mso.dll.#8140",
  2139. "user32.dll.IsWindowEnabled",
  2140. "ole32.dll.CoGetCallState",
  2141. "ole32.dll.CoGetActivationState",
  2142. "advapi32.dll.RegisterWaitChainCOMCallback",
  2143. "cryptsp.dll.CryptAcquireContextA",
  2144. "cryptsp.dll.CryptCreateHash",
  2145. "cryptsp.dll.CryptHashData",
  2146. "cryptsp.dll.CryptVerifySignatureA",
  2147. "cryptsp.dll.CryptDestroyKey",
  2148. "cryptsp.dll.CryptDestroyHash",
  2149. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2150. "ncrypt.dll.BCryptImportKeyPair",
  2151. "ncrypt.dll.BCryptVerifySignature",
  2152. "ncrypt.dll.BCryptDestroyKey",
  2153. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2154. "crypt32.dll.CertFreeCertificateChain",
  2155. "crypt32.dll.CertDuplicateCertificateContext",
  2156. "ncrypt.dll.SslEncryptPacket",
  2157. "ncrypt.dll.SslDecryptPacket",
  2158. "winhttp.dll.WinHttpReceiveResponse",
  2159. "winhttp.dll.WinHttpQueryHeaders",
  2160. "winhttp.dll.WinHttpQueryDataAvailable",
  2161. "winhttp.dll.WinHttpReadData",
  2162. "webservices.dll.WsCreateError",
  2163. "ntdll.dll.EtwEventWrite",
  2164. "ntdll.dll.EtwEventRegister",
  2165. "ntdll.dll.EtwEventUnregister",
  2166. "webservices.dll.WsCreateHeap",
  2167. "webservices.dll.WsCreateReader",
  2168. "webservices.dll.WsSetInput",
  2169. "webservices.dll.WsFillReader",
  2170. "webservices.dll.WsReadToStartElement",
  2171. "webservices.dll.WsReadStartElement",
  2172. "webservices.dll.WsReadType",
  2173. "winhttp.dll.WinHttpCloseHandle",
  2174. "crypt32.dll.CertFreeCertificateContext",
  2175. "rpcrt4.dll.RpcBindingFree",
  2176. "webservices.dll.WsFreeReader",
  2177. "webservices.dll.WsFreeError",
  2178. "webservices.dll.WsFreeHeap",
  2179. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2180. "winhttp.dll.WinHttpOpenRequest",
  2181. "winhttp.dll.WinHttpAddRequestHeaders",
  2182. "winhttp.dll.WinHttpSendRequest",
  2183. "winhttp.dll.WinHttpConnect",
  2184. "winhttp.dll.WinHttpCrackUrl",
  2185. "winhttp.dll.WinHttpSetStatusCallback",
  2186. "winhttp.dll.WinHttpOpen",
  2187. "winhttp.dll.WinHttpSetOption",
  2188. "winhttp.dll.WinHttpWriteData",
  2189. "winhttp.dll.WinHttpSetCredentials",
  2190. "winhttp.dll.WinHttpQueryAuthSchemes",
  2191. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2192. "winhttp.dll.WinHttpGetProxyForUrl",
  2193. "winhttp.dll.WinHttpQueryOption",
  2194. "webservices.dll.WsOpenServiceProxy",
  2195. "webservices.dll.WsCall",
  2196. "webservices.dll.WsAddCustomHeader",
  2197. "shlwapi.dll.StrStrA",
  2198. "shlwapi.dll.UrlUnescapeA",
  2199. "cryptnet.dll.CertDllVerifyRevocation",
  2200. "profapi.dll.#104",
  2201. "sensapi.dll.IsNetworkAlive",
  2202. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2203. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2204. "rpcrt4.dll.NdrClientCall2",
  2205. "winhttp.dll.WinHttpSetTimeouts",
  2206. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2207. "winhttp.dll.WinHttpTimeFromSystemTime",
  2208. "shlwapi.dll.StrStrIW",
  2209. "cryptnet.dll.I_CryptNetGetConnectivity",
  2210. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2211. "setupapi.dll.SetupIterateCabinetW",
  2212. "kernel32.dll.RegOpenKeyExW",
  2213. "kernel32.dll.RegCloseKey",
  2214. "cabinet.dll.#20",
  2215. "cabinet.dll.#22",
  2216. "devrtl.dll.DevRtlGetThreadLogToken",
  2217. "cryptsp.dll.CryptSetHashParam",
  2218. "sechost.dll.QueryServiceConfigA",
  2219. "sechost.dll.QueryServiceStatus",
  2220. "rpcrt4.dll.RpcStringBindingComposeA",
  2221. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2222. "rpcrt4.dll.RpcEpResolveBinding",
  2223. "sechost.dll.LookupAccountSidLocalW",
  2224. "rpcrt4.dll.RpcStringFreeA",
  2225. "webservices.dll.WsResetHeap",
  2226. "webservices.dll.WsCloseServiceProxy",
  2227. "ws2_32.dll.#3",
  2228. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2229. "ncrypt.dll.SslFreeObject",
  2230. "webservices.dll.WsFreeServiceProxy",
  2231. "user32.dll.RegisterPowerSettingNotification",
  2232. "powrprof.dll.PowerSettingRegisterNotification",
  2233. "user32.dll.GetWindowThreadProcessId",
  2234. "user32.dll.GetWindowTextW",
  2235. "mso.dll.#25",
  2236. "mso.dll.#1056",
  2237. "mso.dll.#8136",
  2238. "mso.dll.#8931",
  2239. "shell32.dll.SHGetFileInfoW",
  2240. "mso.dll.#5362",
  2241. "mso.dll.#6044",
  2242. "mso.dll.#6516",
  2243. "mso.dll.#6221",
  2244. "mso.dll.#5780",
  2245. "mso.dll.#4870",
  2246. "mso.dll.#6046",
  2247. "mso.dll.#1241",
  2248. "mso.dll.#2821",
  2249. "mso.dll.#2340",
  2250. "mso.dll.#7287",
  2251. "mso.dll.#5290",
  2252. "mso.dll.#1508",
  2253. "user32.dll.IsZoomed",
  2254. "user32.dll.GetWindowPlacement",
  2255. "user32.dll.GetWindowRect",
  2256. "mso.dll.#821",
  2257. "user32.dll.GetSystemMetrics",
  2258. "user32.dll.MonitorFromWindow",
  2259. "user32.dll.MonitorFromRect",
  2260. "user32.dll.MonitorFromPoint",
  2261. "user32.dll.EnumDisplayMonitors",
  2262. "user32.dll.GetMonitorInfoA",
  2263. "user32.dll.EnumDisplayDevicesA",
  2264. "mso.dll.#2378",
  2265. "user32.dll.SetWindowPos",
  2266. "user32.dll.AdjustWindowRect",
  2267. "mso.dll.#5912",
  2268. "mso.dll.#9719",
  2269. "mso.dll.#8824",
  2270. "mso.dll.#6117",
  2271. "mso.dll.#3307",
  2272. "user32.dll.SendMessageW",
  2273. "user32.dll.DestroyIcon",
  2274. "mso.dll.#3813",
  2275. "mso.dll.#1815",
  2276. "user32.dll.PtInRect",
  2277. "mso.dll.#1613",
  2278. "user32.dll.SetWindowTextW",
  2279. "user32.dll.GetClassLongW",
  2280. "mso.dll.#8572",
  2281. "gdi32.dll.CreateDIBSection",
  2282. "gdi32.dll.CreateCompatibleDC",
  2283. "gdi32.dll.GetViewportOrgEx",
  2284. "gdi32.dll.SetViewportOrgEx",
  2285. "gdi32.dll.SetBkColor",
  2286. "gdi32.dll.ExtTextOutA",
  2287. "mso.dll.#1573",
  2288. "mso.dll.#8612",
  2289. "user32.dll.SetScrollRange",
  2290. "mso.dll.#2509",
  2291. "user32.dll.BeginDeferWindowPos",
  2292. "user32.dll.DeferWindowPos",
  2293. "user32.dll.EndDeferWindowPos",
  2294. "user32.dll.OffsetRect",
  2295. "user32.dll.EnumChildWindows",
  2296. "user32.dll.GetScrollInfo",
  2297. "user32.dll.MapWindowPoints",
  2298. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2299. "gdi32.dll.DeleteDC",
  2300. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2301. "mso.dll.#6126",
  2302. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2303. "gdi32.dll.GetFontRealizationInfo",
  2304. "gdi32.dll.GetFontFileInfo",
  2305. "gdi32.dll.GetFontFileData",
  2306. "mso.dll.#7261",
  2307. "mso.dll.#9540",
  2308. "usp10.dll.ScriptGetFontScriptTags",
  2309. "usp10.dll.ScriptGetFontLanguageTags",
  2310. "usp10.dll.ScriptGetFontFeatureTags",
  2311. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  2312. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  2313. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  2314. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2315. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2316. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2317. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2318. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2319. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2320. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2321. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2322. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2323. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2324. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2325. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2326. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2327. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2328. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2329. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2330. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2331. "user32.dll.SetRectEmpty",
  2332. "user32.dll.InflateRect",
  2333. "mso.dll.#1100",
  2334. "mso.dll.#7047",
  2335. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2336. "user32.dll.GetCursor",
  2337. "user32.dll.GetClientRect",
  2338. "user32.dll.SetScrollInfo",
  2339. "user32.dll.SetScrollPos",
  2340. "mso.dll.#3747",
  2341. "mso.dll.#8218",
  2342. "mso.dll.#5394",
  2343. "mso.dll.#331",
  2344. "mso.dll.#6829",
  2345. "mso.dll.#539",
  2346. "mso.dll.#4959",
  2347. "mso.dll.#6463",
  2348. "mso.dll.#4987",
  2349. "user32.dll.GetWindow",
  2350. "mso.dll.#7195",
  2351. "mso.dll.#7573",
  2352. "mso.dll.#445",
  2353. "user32.dll.GetCaretBlinkTime",
  2354. "user32.dll.CreateCaret",
  2355. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2356. "user32.dll.IntersectRect",
  2357. "user32.dll.DestroyCaret",
  2358. "user32.dll.GetCaretPos",
  2359. "user32.dll.SetCaretPos",
  2360. "mso.dll.#5932",
  2361. "mso.dll.#2071",
  2362. "mso.dll.#1024",
  2363. "mso.dll.#6245",
  2364. "mso.dll.#9041",
  2365. "mso.dll.#1767",
  2366. "mso.dll.#9369",
  2367. "mso.dll.#4617",
  2368. "user32.dll.FillRect",
  2369. "mso.dll.#343",
  2370. "mso.dll.#9636",
  2371. "mso.dll.#2022",
  2372. "mso.dll.#4750",
  2373. "mso.dll.#4577",
  2374. "mso.dll.#850",
  2375. "mso.dll.#1776",
  2376. "mso.dll.#9026",
  2377. "mso.dll.#4497",
  2378. "mso.dll.#4647",
  2379. "mso.dll.#8926",
  2380. "mso.dll.#7212",
  2381. "mso.dll.#5407",
  2382. "mso.dll.#5152",
  2383. "mso.dll.#3327",
  2384. "mso.dll.#6333",
  2385. "mso.dll.#420",
  2386. "shell32.dll.SHAddToRecentDocs",
  2387. "mso.dll.#1335",
  2388. "mso.dll.#2041",
  2389. "mso.dll.#7834",
  2390. "mso.dll.#239",
  2391. "mso.dll.#6357",
  2392. "mso.dll.#7026",
  2393. "mso.dll.#1671",
  2394. "oleaut32.dll.#7",
  2395. "mso.dll.#8263",
  2396. "mso.dll.#9307",
  2397. "mso.dll.#1441",
  2398. "mso.dll.#9223",
  2399. "mso.dll.#6453",
  2400. "ole32.dll.PropVariantClear",
  2401. "oleaut32.dll.#9",
  2402. "mso.dll.#8044",
  2403. "mso.dll.#3698",
  2404. "mso.dll.#8565",
  2405. "mso.dll.#8373",
  2406. "mso.dll.#9741",
  2407. "mso.dll.#478",
  2408. "mso.dll.#479",
  2409. "mso.dll.#340",
  2410. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2411. "bcrypt.dll.BCryptGetProperty",
  2412. "bcrypt.dll.BCryptCreateHash",
  2413. "bcrypt.dll.BCryptHashData",
  2414. "bcrypt.dll.BCryptFinishHash",
  2415. "bcrypt.dll.BCryptDestroyHash",
  2416. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2417. "mso.dll.#8633",
  2418. "mso.dll.#5213",
  2419. "mso.dll.#6163",
  2420. "mso.dll.#552",
  2421. "mso.dll.#5630",
  2422. "mso.dll.#2513",
  2423. "mso.dll.#1607",
  2424. "mso.dll.#791",
  2425. "mso.dll.#1848",
  2426. "mso.dll.#8735",
  2427. "mso.dll.#9374",
  2428. "mso.dll.#5286",
  2429. "mso.dll.#6368",
  2430. "mso.dll.#4262",
  2431. "mso.dll.#1010",
  2432. "mso.dll.#7979",
  2433. "mso.dll.#8549",
  2434. "mso.dll.#8970",
  2435. "mso.dll.#9198",
  2436. "mso.dll.#4795",
  2437. "mso.dll.#1865",
  2438. "mso.dll.#9688",
  2439. "mso.dll.#320",
  2440. "advapi32.dll.RegDeleteKeyA",
  2441. "user32.dll.DestroyCursor",
  2442. "mso.dll.#7173",
  2443. "user32.dll.IsHungAppWindow",
  2444. "mso.dll.#8511",
  2445. "mso.dll.#3299",
  2446. "mso.dll.#7001",
  2447. "mso.dll.#3913",
  2448. "user32.dll.PeekMessageA",
  2449. "mso.dll.#1380",
  2450. "mso.dll.#9500",
  2451. "user32.dll.TranslateMessage",
  2452. "user32.dll.IsWindowUnicode",
  2453. "user32.dll.DispatchMessageW",
  2454. "user32.dll.DispatchMessageA",
  2455. "user32.dll.UpdateWindow",
  2456. "mso.dll.#999",
  2457. "mso.dll.#287",
  2458. "dwmapi.dll.DwmIsCompositionEnabled",
  2459. "mso.dll.#1575",
  2460. "mso.dll.#5034",
  2461. "mso.dll.#1517",
  2462. "mso.dll.#718",
  2463. "mso.dll.#4708",
  2464. "mso.dll.#8046",
  2465. "mso.dll.#4175",
  2466. "mso.dll.#8672",
  2467. "mso.dll.#1990",
  2468. "mso.dll.#3051",
  2469. "mso.dll.#1819",
  2470. "mso.dll.#1419",
  2471. "oleaut32.dll.#147",
  2472. "kernel32.dll.WerRegisterMemoryBlock",
  2473. "dwrite.dll.DWriteCreateFactory",
  2474. "gdi32.dll.GetCurrentObject",
  2475. "gdi32.dll.BitBlt",
  2476. "gdi32.dll.GetClipBox",
  2477. "gdi32.dll.StretchDIBits",
  2478. "riched20.dll.REExtendedRegisterClass",
  2479. "user32.dll.GetWindowLongW",
  2480. "user32.dll.GetSysColor",
  2481. "user32.dll.SetWindowLongW",
  2482. "user32.dll.RegisterWindowMessageA",
  2483. "user32.dll.RegisterClipboardFormatW",
  2484. "user32.dll.GetDoubleClickTime",
  2485. "user32.dll.SetCaretBlinkTime",
  2486. "user32.dll.SystemParametersInfoW",
  2487. "user32.dll.GetKeyboardLayoutList",
  2488. "mso.dll._MsoGetFidUspDll@0",
  2489. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2490. "usp10.dll.ScriptGetProperties",
  2491. "usp10.dll.ScriptItemize",
  2492. "user32.dll.LoadCursorW",
  2493. "user32.dll.IsWindowVisible",
  2494. "user32.dll.GetKeyboardLayout",
  2495. "user32.dll.PostMessageW",
  2496. "user32.dll.DefWindowProcW",
  2497. "uxtheme.dll.IsThemeActive",
  2498. "uxtheme.dll.IsAppThemed",
  2499. "uxtheme.dll.OpenThemeData",
  2500. "user32.dll.GetDC",
  2501. "user32.dll.ReleaseDC",
  2502. "user32.dll.IsIconic",
  2503. "user32.dll.GetParent",
  2504. "usp10.dll.ScriptGetCMap",
  2505. "user32.dll.InvalidateRect",
  2506. "user32.dll.HideCaret",
  2507. "user32.dll.ShowCaret",
  2508. "user32.dll.NotifyWinEvent",
  2509. "user32.dll.GetWindowTextLengthW",
  2510. "user32.dll.EnableWindow",
  2511. "msctf.dll.SetInputScope",
  2512. "advapi32.dll.RegQueryValueW",
  2513. "user32.dll.GetWindowRgn",
  2514. "gdi32.dll.CreateCompatibleBitmap",
  2515. "gdi32.dll.SaveDC",
  2516. "gdi32.dll.SetPixel",
  2517. "gdi32.dll.GetPixel",
  2518. "gdi32.dll.RestoreDC",
  2519. "apphelp.dll.ApphelpCheckShellObject",
  2520. "imm32.dll.ImmAssociateContext",
  2521. "mso.dll.#806",
  2522. "mso.dll.#4908",
  2523. "user32.dll.SetRect",
  2524. "mso.dll.#8439",
  2525. "mso.dll.#2736",
  2526. "gdi32.dll.GetTextAlign",
  2527. "gdi32.dll.ExtTextOutW",
  2528. "mso.dll.#8122",
  2529. "mso.dll.#2114",
  2530. "ole32.dll.CoRevokeInitializeSpy",
  2531. "comctl32.dll.#388",
  2532. "mso.dll.#6558",
  2533. "gdi32.dll.GetFontData",
  2534. "usp10.dll.ScriptItemizeOpenType",
  2535. "usp10.dll.ScriptShapeOpenType",
  2536. "usp10.dll.ScriptPlaceOpenType",
  2537. "mso.dll.#8395",
  2538. "mso.dll.#379",
  2539. "mso.dll.#6338",
  2540. "mso.dll.#7964",
  2541. "mso.dll.#1437",
  2542. "mso.dll.#1427",
  2543. "mso.dll.#6137",
  2544. "winmm.dll.timeGetTime",
  2545. "mso.dll.#5940",
  2546. "usp10.dll.ScriptPlace",
  2547. "usp10.dll.ScriptShape",
  2548. "usp10.dll.ScriptJustify",
  2549. "usp10.dll.ScriptTextOut",
  2550. "usp10.dll.ScriptCPtoX",
  2551. "usp10.dll.ScriptXtoCP",
  2552. "usp10.dll.ScriptFreeCache",
  2553. "usp10.dll.ScriptCacheGetHeight",
  2554. "usp10.dll.ScriptLayout",
  2555. "usp10.dll.ScriptBreak",
  2556. "usp10.dll.ScriptIsComplex",
  2557. "usp10.dll.ScriptGetLogicalWidths",
  2558. "usp10.dll.ScriptApplyLogicalWidth",
  2559. "usp10.dll.ScriptGetGlyphABCWidth",
  2560. "usp10.dll.ScriptGetFontProperties",
  2561. "usp10.dll.ScriptApplyDigitSubstitution",
  2562. "usp10.dll.ScriptRecordDigitSubstitution",
  2563. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2564. "mso.dll.#7578",
  2565. "mso.dll.#8483",
  2566. "mso.dll.#2613",
  2567. "gdi32.dll.GdiIsMetaPrintDC",
  2568. "mso.dll.#7848",
  2569. "user32.dll.GetForegroundWindow",
  2570. "user32.dll.GetFocus",
  2571. "user32.dll.GetClassNameA",
  2572. "user32.dll.IsWindowRedirectedForPrint",
  2573. "gdi32.dll.CreateRectRgnIndirect",
  2574. "user32.dll.GetUpdateRgn",
  2575. "gdi32.dll.GetRgnBox",
  2576. "user32.dll.ValidateRect",
  2577. "user32.dll.GetUpdateRect",
  2578. "user32.dll.BeginPaint",
  2579. "user32.dll.EndPaint",
  2580. "mso.dll.#3624",
  2581. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2582. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2583. "mso.dll.#6247",
  2584. "gdi32.dll.TranslateCharsetInfo",
  2585. "mso.dll.#3300",
  2586. "mso.dll.#7465",
  2587. "gdi32.dll.SetWindowOrgEx",
  2588. "mso.dll.#732",
  2589. "mso.dll.#5804",
  2590. "mso.dll.#9465",
  2591. "ole32.dll.CoCreateInstance",
  2592. "mso.dll.#434",
  2593. "user32.dll.GetMessageExtraInfo",
  2594. "user32.dll.TrackMouseEvent",
  2595. "user32.dll.GetInputState",
  2596. "mso.dll.#8461",
  2597. "user32.dll.GetClipboardOwner",
  2598. "mso.dll.#1422",
  2599. "user32.dll.SendNotifyMessageW",
  2600. "user32.dll.MsgWaitForMultipleObjectsEx",
  2601. "mso.dll.#8202",
  2602. "advapi32.dll.NotifyServiceStatusChangeW",
  2603. "mso.dll.#5360",
  2604. "mso.dll.#8574",
  2605. "msi.dll.#39",
  2606. "mso.dll.#8318",
  2607. "mso.dll.#1283",
  2608. "mso.dll.#8705",
  2609. "mso.dll.#9685",
  2610. "mso.dll.#3579",
  2611. "mso.dll.#8747",
  2612. "mso.dll.#2880",
  2613. "mso.dll.#7615",
  2614. "mso.dll.#4219",
  2615. "mso.dll.#3244",
  2616. "mso.dll.#408",
  2617. "mso.dll.#2714",
  2618. "mso.dll.#8622",
  2619. "mso.dll.#3380",
  2620. "mso.dll.#2566",
  2621. "mso.dll.#1429",
  2622. "mso.dll.#6502",
  2623. "mso.dll.#2968",
  2624. "mso.dll.#709",
  2625. "mso.dll.#5913",
  2626. "mso.dll.#8051",
  2627. "mso.dll.#6505",
  2628. "mso.dll.#3901",
  2629. "user32.dll.GetWindowDC",
  2630. "gdi32.dll.SetLayout",
  2631. "gdi32.dll.RectVisible",
  2632. "gdi32.dll.GetClipRgn",
  2633. "gdi32.dll.ExcludeClipRect",
  2634. "gdi32.dll.SelectClipRgn",
  2635. "advapi32.dll.RegDeleteTreeW",
  2636. "user32.dll.WindowFromPoint",
  2637. "user32.dll.IsClipboardFormatAvailable",
  2638. "xmllite.dll.CreateXmlReader",
  2639. "user32.dll.GetCursorInfo",
  2640. "user32.dll.GetCapture",
  2641. "user32.dll.GetMessagePos",
  2642. "user32.dll.ScreenToClient",
  2643. "user32.dll.SetFocus",
  2644. "user32.dll.GetDesktopWindow",
  2645. "user32.dll.FindWindowExW",
  2646. "uiautomationcore.dll.UiaClientsAreListening",
  2647. "mso.dll.#8662",
  2648. "advapi32.dll.ConvertSidToStringSidW",
  2649. "msi.dll.DllGetVersion",
  2650. "msi.dll.#111",
  2651. "user32.dll.GetActiveWindow",
  2652. "user32.dll.GetAncestor",
  2653. "mso.dll.#7009",
  2654. "mso.dll.#6429",
  2655. "mso.dll.#5667",
  2656. "mso.dll.#86",
  2657. "mso.dll.#4746",
  2658. "mso.dll.#2052",
  2659. "mso.dll.#7778",
  2660. "mso.dll.#5127",
  2661. "mso.dll.#7590",
  2662. "mso.dll.#2687",
  2663. "user32.dll.GetQueueStatus",
  2664. "mso.dll.#8060",
  2665. "mso.dll.#5925",
  2666. "advapi32.dll.CryptAcquireContextA",
  2667. "advapi32.dll.CryptGenKey",
  2668. "cryptsp.dll.CryptGenKey",
  2669. "advapi32.dll.CryptImportKey",
  2670. "cryptsp.dll.CryptImportKey",
  2671. "advapi32.dll.CryptExportKey",
  2672. "cryptsp.dll.CryptExportKey",
  2673. "advapi32.dll.CryptDestroyKey",
  2674. "mso.dll.#3638",
  2675. "mso.dll.#3258",
  2676. "mso.dll.#7974",
  2677. "mso.dll.#2609",
  2678. "mso.dll.#3500",
  2679. "mso.dll.#3347",
  2680. "mso.dll.#1905",
  2681. "mso.dll.#2812",
  2682. "mso.dll.#4416",
  2683. "mso.dll.#4008",
  2684. "advapi32.dll.CryptCreateHash",
  2685. "advapi32.dll.CryptSetHashParam",
  2686. "advapi32.dll.CryptHashData",
  2687. "advapi32.dll.CryptGetHashParam",
  2688. "cryptsp.dll.CryptGetHashParam",
  2689. "advapi32.dll.CryptDestroyHash",
  2690. "mso.dll.#7366",
  2691. "mso.dll.#7546",
  2692. "mso.dll.#1406",
  2693. "mso.dll.#4926",
  2694. "user32.dll.GetScrollPos",
  2695. "mso.dll.#629",
  2696. "mso.dll.#676",
  2697. "mso.dll.#8644",
  2698. "mso.dll.#3141",
  2699. "mso.dll.#8472",
  2700. "mso.dll.#2281",
  2701. "mso.dll.#2628",
  2702. "mso.dll.#3425",
  2703. "mso.dll.#5291",
  2704. "mso.dll.#1718",
  2705. "mso.dll.#4777",
  2706. "mso.dll.#424",
  2707. "user32.dll.IsWindow",
  2708. "mso.dll.#3544",
  2709. "mso.dll.#900",
  2710. "kernel32.dll.FlsAlloc",
  2711. "kernel32.dll.FlsGetValue",
  2712. "kernel32.dll.FlsSetValue",
  2713. "kernel32.dll.FlsFree",
  2714. "ieawsdc.dll.HrExtractTemplateToPath",
  2715. "msi.dll.#90",
  2716. "mso.dll.#8837",
  2717. "mso.dll.#1455",
  2718. "user32.dll.LoadImageW",
  2719. "user32.dll.CreateWindowExW",
  2720. "comctl32.dll.HIMAGELIST_QueryInterface",
  2721. "comctl32.dll.DrawShadowText",
  2722. "comctl32.dll.DrawSizeBox",
  2723. "comctl32.dll.DrawScrollBar",
  2724. "comctl32.dll.SizeBoxHwnd",
  2725. "comctl32.dll.ScrollBar_MouseMove",
  2726. "comctl32.dll.ScrollBar_Menu",
  2727. "comctl32.dll.HandleScrollCmd",
  2728. "comctl32.dll.DetachScrollBars",
  2729. "comctl32.dll.AttachScrollBars",
  2730. "comctl32.dll.CCSetScrollInfo",
  2731. "comctl32.dll.CCGetScrollInfo",
  2732. "comctl32.dll.CCEnableScrollBar",
  2733. "comctl32.dll.QuerySystemGestureStatus",
  2734. "uxtheme.dll.#49",
  2735. "uxtheme.dll.CloseThemeData",
  2736. "user32.dll.EnableScrollBar",
  2737. "user32.dll.ShowScrollBar",
  2738. "user32.dll.ShowWindow",
  2739. "user32.dll.SetParent",
  2740. "user32.dll.KillTimer",
  2741. "user32.dll.ClientToScreen",
  2742. "user32.dll.MoveWindow",
  2743. "user32.dll.DestroyWindow",
  2744. "gdi32.dll.GetViewportExtEx",
  2745. "gdi32.dll.GetWindowExtEx",
  2746. "gdi32.dll.GetTextCharset",
  2747. "gdi32.dll.GetMapMode",
  2748. "gdi32.dll.GetLayout",
  2749. "oleaut32.dll.SysAllocString",
  2750. "oleaut32.dll.SysStringLen",
  2751. "oleaut32.dll.SysAllocStringLen",
  2752. "oleaut32.dll.SysFreeString",
  2753. "uxtheme.dll.GetThemePartSize",
  2754. "user32.dll.GetMessageW",
  2755. "gdi32.dll.IntersectClipRect",
  2756. "gdi32.dll.SetTextColor",
  2757. "gdi32.dll.SetBkMode",
  2758. "gdi32.dll.SetTextAlign",
  2759. "gdi32.dll.ExtSelectClipRgn",
  2760. "gdi32.dll.GetTextColor",
  2761. "uxtheme.dll.DrawThemeBackground",
  2762. "user32.dll.WaitMessage",
  2763. "wininet.dll.InternetGetConnectedState",
  2764. "rasapi32.dll.RasConnectionNotificationW",
  2765. "sechost.dll.NotifyServiceStatusChangeA",
  2766. "cryptsp.dll.CryptAcquireContextW",
  2767. "osppcext.dll.SLActivateProduct",
  2768. "osppcext.dll.SLGetTokenActivationGrants",
  2769. "osppcext.dll.SLGetTokenActivationCertificates",
  2770. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2771. "osppcext.dll.SLSignTokenActivationChallenge",
  2772. "osppcext.dll.SLDepositTokenActivationResponse",
  2773. "osppcext.dll.SLFreeTokenActivationGrants",
  2774. "osppcext.dll.SLFreeTokenActivationCertificates",
  2775. "gdi32.dll.GdiFlush",
  2776. "crypt32.dll.CryptQueryObject",
  2777. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2778. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2779. "cryptsp.dll.CryptGetDefaultProviderW",
  2780. "crypt32.dll.CertEnumCertificatesInStore",
  2781. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2782. "cryptsp.dll.CryptReleaseContext",
  2783. "wintrust.dll.WinVerifyTrust",
  2784. "wintrust.dll.WintrustCertificateTrust",
  2785. "wintrust.dll.SoftpubAuthenticode",
  2786. "wintrust.dll.SoftpubInitialize",
  2787. "wintrust.dll.SoftpubLoadMessage",
  2788. "wintrust.dll.SoftpubLoadSignature",
  2789. "wintrust.dll.SoftpubCheckCert",
  2790. "wintrust.dll.SoftpubCleanup",
  2791. "wintrust.dll.CryptSIPVerifyIndirectData",
  2792. "advapi32.dll.RegDeleteValueW",
  2793. "mso.dll.#7531",
  2794. "mso.dll.#8606",
  2795. "user32.dll.SetCursor",
  2796. "mso.dll.#5787",
  2797. "user32.dll.ShowCursor",
  2798. "user32.dll.IsChild",
  2799. "mso.dll.#5070",
  2800. "mso.dll.#6899",
  2801. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2802. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2803. "advapi32.dll.SaferiSearchMatchingHashRules",
  2804. "wintrust.dll.WTHelperProvDataFromStateData",
  2805. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2806. "crypt32.dll.CertCloseStore",
  2807. "user32.dll.GetClassNameW",
  2808. "mso.dll.#4702",
  2809. "advapi32.dll.CryptReleaseContext",
  2810. "cabinet.dll.#23",
  2811. "mso.dll.#1885",
  2812. "mso.dll.#832",
  2813. "mso.dll.#3702",
  2814. "mso.dll.#3484",
  2815. "mso.dll.#1966",
  2816. "mso.dll.#6960",
  2817. "mso.dll.#7892",
  2818. "mso.dll.#1414",
  2819. "user32.dll.SetForegroundWindow",
  2820. "mso.dll.#7651",
  2821. "mso.dll.#5071",
  2822. "mso.dll.#2802",
  2823. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  2824. "mso.dll.#4111",
  2825. "mso.dll.#2386",
  2826. "advapi32.dll.RegisterEventSourceW",
  2827. "advapi32.dll.ReportEventW",
  2828. "advapi32.dll.DeregisterEventSource",
  2829. "mso.dll.#816",
  2830. "mso.dll.#511",
  2831. "mso.dll.#2620",
  2832. "shell32.dll.SHGetKnownFolderPath",
  2833. "mso.dll.#9748",
  2834. "mso.dll.#3496",
  2835. "mso.dll.#2901",
  2836. "mso.dll.#7830",
  2837. "mso.dll.#5396",
  2838. "mso.dll.#6895",
  2839. "mso.dll.#7931",
  2840. "mso.dll.#3837",
  2841. "mso.dll.#8398",
  2842. "mso.dll.#2477",
  2843. "msproof7.dll.DllGetClassObject",
  2844. "msproof7.dll.DllCanUnloadNow",
  2845. "mso.dll.#4172",
  2846. "mso.dll.#1439",
  2847. "mso.dll.#8986",
  2848. "mso.dll.#7945",
  2849. "mso.dll.#9566",
  2850. "mso.dll.#111",
  2851. "mso.dll.#4191",
  2852. "mso.dll.#3802",
  2853. "mso.dll.#6982",
  2854. "mso.dll.#8800",
  2855. "mso.dll.#3572",
  2856. "mso.dll.#167",
  2857. "mso.dll.#988",
  2858. "mso.dll.#5177",
  2859. "mso.dll.#3334",
  2860. "mso.dll.#7320",
  2861. "mso.dll.#9639",
  2862. "mso.dll.#9436",
  2863. "mso.dll.#5541",
  2864. "advapi32.dll.GetFileSecurityW",
  2865. "advapi32.dll.SetFileSecurityW",
  2866. "advapi32.dll.GetSecurityInfo",
  2867. "advapi32.dll.SetSecurityInfo",
  2868. "advapi32.dll.GetSecurityDescriptorControl",
  2869. "mso.dll.#2955",
  2870. "mso.dll.#1914",
  2871. "mso.dll.#5737",
  2872. "mso.dll.#590",
  2873. "mso.dll.#1401",
  2874. "mso.dll.#5919",
  2875. "mso.dll.#4597",
  2876. "mso.dll.#7189",
  2877. "mso.dll.#2738",
  2878. "mso.dll.#8691",
  2879. "mso.dll.#6079",
  2880. "mso.dll.#7167",
  2881. "mso.dll.#7163",
  2882. "mso.dll.#333",
  2883. "mso.dll.#1785",
  2884. "mso.dll.#8693",
  2885. "user32.dll.RemovePropW",
  2886. "mso.dll.#5973",
  2887. "mso.dll.#2014",
  2888. "mso.dll.#9668",
  2889. "mso.dll.#2294",
  2890. "advapi32.dll.RegDeleteKeyW",
  2891. "mso.dll.#235",
  2892. "mso.dll.#3758",
  2893. "mso.dll.#9398",
  2894. "mso.dll.#1442",
  2895. "mso.dll.#4388",
  2896. "msgr3en.dll.CheckVersion",
  2897. "mso.dll.#8022",
  2898. "msgr3en.dll.#29",
  2899. "msgr3en.dll.#30",
  2900. "msgr3en.dll.#31",
  2901. "msgr3en.dll.#32",
  2902. "msgr3en.dll.#33",
  2903. "msgr3en.dll.#34",
  2904. "msgr3en.dll.#35",
  2905. "msgr3en.dll.#45",
  2906. "msgr3en.dll.#46",
  2907. "msgr3en.dll.#47",
  2908. "msgr3en.dll.#48",
  2909. "msgr3en.dll.#51",
  2910. "msgr3en.dll.#50",
  2911. "msgr3en.dll.#49",
  2912. "msgr3en.dll.#43",
  2913. "msgr3en.dll.#41",
  2914. "msgr3en.dll.#42",
  2915. "msgr3en.dll.#44",
  2916. "msgr3en.dll.#39",
  2917. "msgr3en.dll.#40",
  2918. "msgr3en.dll.#36",
  2919. "msgr3en.dll.#38",
  2920. "msgr3en.dll.#37",
  2921. "msgr3en.dll.#56",
  2922. "msgr3en.dll.#52",
  2923. "msgr3en.dll.#53",
  2924. "msgr3en.dll.#57",
  2925. "msgr3en.dll.#58",
  2926. "msgr3en.dll.#59",
  2927. "mso.dll.#6889",
  2928. "mso.dll.#3633",
  2929. "gdi32.dll.GetTextExtentPointA",
  2930. "user32.dll.MessageBeep",
  2931. "user32.dll.LoadStringA",
  2932. "user32.dll.DialogBoxIndirectParamW",
  2933. "comctl32.dll.RegisterClassNameW",
  2934. "uxtheme.dll.EnableThemeDialogTexture",
  2935. "uxtheme.dll.GetThemeBool",
  2936. "mso.dll.#2561",
  2937. "mso.dll.#1266",
  2938. "gdi32.dll.GetStockObject",
  2939. "user32.dll.GetDlgItem",
  2940. "mso.dll.#6501",
  2941. "riched20.dll.REMSOHInst",
  2942. "mso.dll.#6900",
  2943. "user32.dll.CallNextHookEx",
  2944. "mso.dll.#8118",
  2945. "gdi32.dll.GetGlyphIndicesW",
  2946. "uxtheme.dll.BufferedPaintInit",
  2947. "uxtheme.dll.BufferedPaintRenderAnimation",
  2948. "uxtheme.dll.GetThemeTransitionDuration",
  2949. "uxtheme.dll.BeginBufferedAnimation",
  2950. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  2951. "uxtheme.dll.DrawThemeParentBackground",
  2952. "uxtheme.dll.GetThemeBackgroundContentRect",
  2953. "uxtheme.dll.DrawThemeText",
  2954. "uxtheme.dll.EndBufferedAnimation",
  2955. "user32.dll.GetDlgCtrlID",
  2956. "mso.dll.#844",
  2957. "user32.dll.IsDlgButtonChecked",
  2958. "user32.dll.EndDialog",
  2959. "uxtheme.dll.BufferedPaintStopAllAnimations",
  2960. "uxtheme.dll.BufferedPaintUnInit",
  2961. "user32.dll.UnhookWindowsHookEx",
  2962. "user32.dll.SetActiveWindow",
  2963. "mso.dll.#3144",
  2964. "mso.dll.#1213",
  2965. "mso.dll.#4220",
  2966. "mso.dll.#3214",
  2967. "mso.dll.#6521",
  2968. "mso.dll.#6489",
  2969. "mso.dll.#613",
  2970. "mso.dll.#1541",
  2971. "gdi32.dll.CombineRgn",
  2972. "user32.dll.CopyRect",
  2973. "gdi32.dll.SetStretchBltMode",
  2974. "user32.dll.UpdateLayeredWindow",
  2975. "mso.dll.#6344",
  2976. "mso.dll.#9099",
  2977. "mso.dll.#8320",
  2978. "mso.dll.#7770",
  2979. "mso.dll.#6216",
  2980. "user32.dll.EnumThreadWindows",
  2981. "user32.dll.EnumWindows",
  2982. "mso.dll.#1923",
  2983. "mso.dll.#3784",
  2984. "mso.dll.#4317",
  2985. "user32.dll.GetLastInputInfo",
  2986. "ws2_32.dll.#116",
  2987. "gdi32.dll.GetBitmapBits",
  2988. "user32.dll.VkKeyScanW",
  2989. "ws2_32.dll.WSAGetOverlappedResult",
  2990. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2991. "gdi32.dll.D3DKMTCloseAdapter",
  2992. "gdi32.dll.D3DKMTQueryAdapterInfo",
  2993. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  2994. "setupapi.dll.SetupDiGetClassDevsW",
  2995. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  2996. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  2997. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  2998. "setupapi.dll.SetupDiGetDevicePropertyW",
  2999. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  3000. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  3001. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  3002. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  3003. "d3d10warp.dll.D3DKMTSetDisplayMode",
  3004. "d3d10warp.dll.D3DKMTCloseAdapter",
  3005. "d3d10warp.dll.D3DKMTSetGammaRamp",
  3006. "d3d10warp.dll.D3DKMTGetDeviceState",
  3007. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  3008. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  3009. "gdi32.dll.D3DKMTCreateDCFromMemory",
  3010. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  3011. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  3012. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  3013. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  3014. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  3015. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  3016. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  3017. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  3018. "d3d10warp.dll.D3DKMTDestroyContext",
  3019. "d3d10warp.dll.D3DKMTCreateContext",
  3020. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  3021. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  3022. "d3d10warp.dll.D3DKMTPresent",
  3023. "d3d10warp.dll.D3DKMTDestroyDevice",
  3024. "d3d10warp.dll.D3DKMTCreateDevice",
  3025. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  3026. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  3027. "d3d10warp.dll.D3DKMTDestroyAllocation",
  3028. "d3d10warp.dll.D3DKMTOpenResource",
  3029. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  3030. "d3d10warp.dll.D3DKMTCreateAllocation",
  3031. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  3032. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  3033. "d3d10warp.dll.D3DKMTEscape",
  3034. "d3d10warp.dll.D3DKMTUnlock",
  3035. "d3d10warp.dll.D3DKMTLock",
  3036. "d3d10warp.dll.D3DKMTRender",
  3037. "d3d10warp.dll.OpenAdapter10_2"
  3038. ]
  3039.  
  3040. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!