API tools faq
paste
paladin316

RTF_63aca7dc6bd828794a36fd065b2e95cd_doc_2019-07-10_20_30.txt

paladin316
Jul 10th, 2019
2,134
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 243.77 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_63aca7dc6bd828794a36fd065b2e95cd.doc"
  7. * File Size: 267403
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "77a2d8e84206a20f8a799d2b2789e7082f389fa0fcbda578e53aae895a20e068"
  10. * MD5: "63aca7dc6bd828794a36fd065b2e95cd"
  11. * SHA1: "0428d5ba3f59ed537b5ff4de67403276c12fc310"
  12. * SHA512: "19f610e43046479949e47aa7e6a67e3bd19bd09d2b052ce35af0b5304be57ace12d272478094c8f48a04961c036c5e64c5638e6edbbcd1a203a0864d35ff9b5d"
  13. * CRC32: "E25474B2"
  14. * SSDEEP: "1536:sxxQW3yt3vMyNE16A4OuMZmsgEB3r4xe3:sxt303Ts6A4yZP3"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 1960"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 278 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  41. "Details":
  42.  
  43. "IP": "23.59.214.201:443"
  44.  
  45.  
  46. "IP": "52.109.16.5:443"
  47.  
  48.  
  49. "IP": "23.15.4.32:80"
  50.  
  51.  
  52. "IP": "65.52.98.231:443"
  53.  
  54.  
  55. "IP": "69.192.108.32:443"
  56.  
  57.  
  58. "IP": "52.109.16.4:443"
  59.  
  60.  
  61. "IP": "152.199.4.33:80"
  62.  
  63.  
  64. "IP": "72.21.91.29:80"
  65.  
  66.  
  67. "IP": "104.18.25.243:80"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  73. "Details":
  74.  
  75. "ioc": "ieee2006officeonline.xsl"
  76.  
  77.  
  78. "ioc": "ontent.inf"
  79.  
  80.  
  81. "ioc": "e.gu"
  82.  
  83.  
  84. "ioc": "pictureorgchart.glox"
  85.  
  86.  
  87. "ioc": "rame.glox"
  88.  
  89.  
  90. "ioc": "rocess.glox"
  91.  
  92.  
  93. "ioc": "iso690.xsl"
  94.  
  95.  
  96. "ioc": "ccent.glox"
  97.  
  98.  
  99. "ioc": "mlaseventheditionofficeonline.xsl"
  100.  
  101.  
  102. "ioc": "architecture.glox"
  103.  
  104.  
  105. "ioc": "rc.glox"
  106.  
  107.  
  108. "ioc": "gosttitle.xsl"
  109.  
  110.  
  111. "ioc": "ist.glox"
  112.  
  113.  
  114. "ioc": "gb.xsl"
  115.  
  116.  
  117. "ioc": "chevronaccent.glox"
  118.  
  119.  
  120. "ioc": "nline.xsl"
  121.  
  122.  
  123. "ioc": "quations.dotx"
  124.  
  125.  
  126. "ioc": "ext.glox"
  127.  
  128.  
  129. "ioc": "rings.glox"
  130.  
  131.  
  132. "ioc": "gostname.xsl"
  133.  
  134.  
  135. "ioc": "harvardanglia2008officeonline.xsl"
  136.  
  137.  
  138. "ioc": "turabian.xsl"
  139.  
  140.  
  141. "ioc": "chicago.xsl"
  142.  
  143.  
  144. "ioc": "adial.glox"
  145.  
  146.  
  147. "ioc": "sist02.xsl"
  148.  
  149.  
  150. "ioc": "content.inf"
  151.  
  152.  
  153. "ioc": "iew.thmx"
  154.  
  155.  
  156. "ioc": "etropolitan.thmx"
  157.  
  158.  
  159. "ioc": "asis.thmx"
  160.  
  161.  
  162. "ioc": "ype.thmx"
  163.  
  164.  
  165.  
  166.  
  167. "Description": "Performs some HTTP requests",
  168. "Details":
  169.  
  170. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  171.  
  172.  
  173. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  174.  
  175.  
  176. "url": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl"
  177.  
  178.  
  179.  
  180.  
  181. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  182. "Details":
  183.  
  184. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8fko\\xa1\\x0b\\xa3\\x9b\\xd75ae\\xbf_v\\xa8mm\\x80 \\xd6 g\\xe1_aq\\x1f 4a\\xcc\\x9ej\\xe1>\\xf8\\x1ajc\\x9b\\x01*\\xffm\\x8f\\xe2\\x13\\xd1u\\x7fq\\xe32\\\\xe6v\\xc2@\\xeb(\\xa3\\x99\\xdf\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xff\\xb3\\x0er4v\\xdct\\xf2.&e\\xd9;vvi\\xa2yo\\xaf\\xce\\xffs\\xabz\\xa1\\xdc\\xde\\x02?\\xd5\\x9f\\x95\\xb21\\x95!\\xd5\\x10\t\\x9cf\\\\x88\\xb6"
  185.  
  186.  
  187. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pk\\xb6\\xbc#\\xfe\\xfa_\\xe0\\x8c#d\\xbad\\x8c\\xe79v3\\xfc0\\xdd#\\x95\\xb9\\x89\\x08\\xd8;\\xd55\\x91b\\x04\\x7f\\x02\\xb2,\\x11dz\\x81\\xe3\\xb1q\\xdf\ru^\\xd0\\xad\\xb8\\x81fq<\\x12\\xbf\\x1c\\x05\\x93\\x97\\x94\\xd0\\x03\\xec\\xbdpg\\x1b\\xde\\xbd\\xc0\\x7fi\\xdd(\\x07:\\xbe'o\\xb8\\xee\\x8c\\xfd\\x0e\\xb60m\\xe4\\\\x15-l\rfgm\\xb3m\\x89\\xc7\\x9e\\xda\\xdf\\xc1\\xe4\\xd5u\\x8e\\xad#\\xf1e\\xbe\\x80\\xbe7\\xf3t\\x86\\x05<'\\x18l5\\xb4xg\\x18i\\xc2\\xd4\\x85\\xc1b\\x01\\xe4\\xd7\\x0cs\\x12\\x01\\x89\\xb5\\xb63\\xae\\x9b\\xd8bcd\\xcd\\r\\xdb\\xfe\\x12%\\xc7\\xfen\\xd6\\xf6\\x9b\\xa7\\xb0\\xed\\xf0\\xe6\\x9cz\\x00\\xdb\\x1b\\x1a\\x16ye\\x9d\\x02\\x94o*\\x16\\x97m\\x11\\xb0\\xf0\\xea\\xd4+4\\x1c3k\\xb2\\xdat+\\x1a.\\xbe0\\x98\\xe3\\x07\\xd6e\\x08\\xa4a\\x99$\\xb3\\xd43\\xbf\\xdft\\xe8\rm\\xa6\\xcf\\xb1\\x17\\xaf>\\xbelc`\\xe8|z\\xa1g\\xe3\\xd1zz\\x01e\\x91"
  188.  
  189.  
  190. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01&b \\xe3\\xdey/\\x02w\\xf7\\xa4^/\\xc9n\\xfa\\xe0\\x04\\xf9y\\x83\\xb5\\x9fw\\x004\\x0e^\\x95\\x10\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  191.  
  192.  
  193. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xf6\\xc2$o\nf\\x94\\x80'\\x88i\\xbay\\t>\\x87b\\xc5\\xb3t\\x198\\xb5\\x17ki\\xe6~\\x95\\x8d\\xfd1\\x95\\xd5v\\x0f\\xf1\\xa0ekp\\xe3\\x8b\\xb1\\xdei\\xe3\\xc3\\xb1:s\\xd4\\x15=v\\xaf\\xc3\\x9ce\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf77\\xd4p\\xa3\\xcb\\xb7\\x06\\x0c\\xa27\\x1e\\x06\\xe9\\xf2\\xd6\\xc2\\xc1\\xd0\t3>\\xc8\\x94\\x90x\\xb0\\xa5a<\\x90!(\\:\\xd8\\xb2\\x03i\\xb6e\\x88\\xd0\\xb3\\x82"
  194.  
  195.  
  196. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  197.  
  198.  
  199. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01&b\"'5\\x8eb^\\xdb\\x82\\x95\\x95\\xf5\\xfa\\x9c\\xb9\\x16\\xff\r`\\xf7\\x1eu\\xb3\\xed\\x17\\x90\\x9e'\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  200.  
  201.  
  202. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  203.  
  204.  
  205. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06.\\xd6\\x90\\x8d\\x1a\\xbc\\xb3\\xfd~\\xc8\\xdch\\xc9\\xc3\\x9c\\xa8+\\x11\\xeb,%;u\\xf1\\x03\\x83y\\x13\\x10d\\xed\\x7f\\x7f\\x82\\xce'\\x89\\xb4\r\\x1du\\xc0\\xe4o\\x00r\\xfb\\xfc6\\xb3q\\xd25\\xdci\\xd9\\xda\\xc5`\\x15\\x94b\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3a\\xcb\\xbfp\\xd7\\xed\\xcc\\xd9\\xce\\xf0m\\xcb\\xc9\\x81~<\\xcd4m\\x11v\\x8cs%0v\\x12\\xe9\\x15\\xde\\xfbs\\xe5y\\x94\\x8a\\xa5\\xfc\\xf7\\xda\\xaa\\x08.\\xdb"
  206.  
  207.  
  208. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x11\\x0e\\x95\\x83\\x11\\xc6\\xd5i\\xd6\\xb3\\xe0q\\x7fr\\x9b\\x00\\x9a\\xc1\\x9dv\\xc3\\xc3i\\x05wf\\x8d\\x04\\xee\\x85\\xf44\\xc6\\xc0\\xe5\\x13ch9;\\x11\\x7f\\xc7\\xf4^\\xf3@x\\xc5k\\x8f\\x1br`\\x12\\xbb\\xf1.\\x9aw\\x0c\\xf36q'=\\x10^\\xca\\x05k\\xba\\xbc\\x0e\\x19\\xc0\\xd8q^\\x9d\\x95\\xe8mroq\\x81\\xa3\\x01\\xff9ms\\x1f\\x13\\x82#\\xee\\x83w\\x0e\\x98\\x10z_rw<3;\\xce\\xd9u\n\\xf3qhk\\xe2\\x9d\\xa5f\\xe5n\\xd5\\x82b\\xd4z?\\xad\\x1e%o\\x94\\xb3\\x0b\\x97c\\x84\\x1b\\xb8+onz\\xfe7y;\\xef\\x00@yh\\xdf\\x04o\\xcc\n\\xd6\\xee2u\\x89\\x91\\xa6\\xb8\\xcdo\\xb4\\xe5\\xa9\\xdb\\x82.\\xbd0\\x01\\xcdq\\x15\\xb9\\x83\\x83\\xfa\\xde\t\\xf1\\x1f\\x8b#\\x17\\x99\\xb2\"\\x8ee \\x8c\\x16j5\\xdc(\\x82\\x84%\\x1fk\\xccw4tc\\x18\\xf8\\xae\\x13\\x90\\xe2\\xf6\\x8b\\x9d\\xea\\xeast\\xbf%$\\xf6)\\xd1\\x86\\xdc\\xcd2e\\xab \\x96\\x05\\xb6sx"
  209.  
  210.  
  211. "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: mscrl.microsoft.com\r\n\r\n"
  212.  
  213.  
  214. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01&b#\\xfd2\r\\x8d\\xcf\\xcc\\x1c\\xdd_\\x0c\\x82\\xa7\\xc1\\xce\\x80\\xdb9\\x1e\\xf8p`r\\xf8w\\xc2\\xf8\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  215.  
  216.  
  217. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p`\\x9b3\\xff\"\\x8e\\xb4\\xa8s\\x12\\xf3q\\x14\\xb4\\xe25\\xa6\\xfb\\xe8\\xffi\\x83<\\xc8\\xd5d\\xdf\\x8efk\\xae\\x85\\xed\\xb5\\x88\\x9diu\\xa4\\xdc\\x1a\\xb4\\x07r\\xd0\\x95s\\xcf\\xde~\\xbc\\xf7\\xd1\\x1d\\xf7g\\xde\\xd3-l\\xbd\\xba\\xa6:\\xdc\\x8b\\xe0\\xcc\\x04\\x88\\xe8y<\\xb6\\xf6\\x12ef\\xc5\\xebtgh\\x9f\\xf8\\x14\\xc8\\xed\\x0c\\xc2\\xa3\\x18\\xd0f\\x01;\\xd6?\\xa8\\xdb\\x9d%@4\\x00\\x06`6\\xd3s+\\x19\\x8e\\xa5\\x9c9\\x91\\x19\\x8e\\x97\\xbf\\xe8\\x06\\xee9\\xb0ey\\x06\\x966\\xbb\\xb6~\\xa4y\t\\xc4\\xbep\\x989\\xa2\\xf3\\x9a\\xcb\\xe6\\x80-^h\\x84\\xdf\t \\xa6np0\\xc8\\xa5\\x01tm\\xd0vb6\\xaa\\xbd'\\xf3\\xd1.e\\x05\\xf9\rnp\\x12s~\\xd2p\\xce\\xd20\\x98p\\xd4\\xdf^\\xe7\\x1cy\\xdb7\\x1c\\xb4k,\\xfa\\x10\\x83\\x01pw\\xca\\xde\twt\\x0cze\\xd7\\xa0\\xb0\\x0c\n`\\xcc\\x93\\xbd\\xb4f\\x18\\xdb\\xcbj\\xb8\\xdb\\xe2fh\\xd2 \\xab\\xdf5\\xab\\x17)\\xe4\\x908\\xbe"
  218.  
  219.  
  220. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xf2\\x93f\\xf2\\xed\\xd6fp\\xb6\\xa5\\x1c\\x1f\\xee\\x00\\xe2=\\xe3\\xef\\x19-\\xf5\\xfe@\\xe8$\\x88\\xa4\\xa0\\xec\\x93c!\\xc6f\\xc2\\xf4:z\\xc3\\x11jc\\xae\\xa5\\x03\\x04\\xf6\\x00\\x88\\x97\\xfb\\xb5\\x94?\\xc5\\xc6\\xfa5\\xdf\\xca\\xef\\xa6\\xc7tg\\xc6\\xcf\\x0e*5\\x113yj\\xc3\\xb8\\xb8\\x19,\\x8ffy\n\\x85\\xc3\\xa2q\\x16r\\x03(;0\\xfb\\xa9s\\xe4\r4\\xec\\xbd.\\xc7<\\x95\\x07\\xff\\x03(\\xdb7\\xf5w\\x1d\\xb4n\\xf5\\xcb\\xf50\\xaf|7\\x83k(\\x91\\xee\\x8e\\x95\\xac\\xe0!/5\\x9cl\\x95.k\\x043|l\\xfe\\x89~\\x192\\x95y\\x94\\xc5=\\xe5)~7\\xe2\\x90=fv\\xcd/\\xe0\\xfd\\xe4k\\x04\\xd5\\xe5\\x0ev\\xef!j\\x01\\xe4\\x06\\x07!t\\x8e\\xc0\\x87r\\xd25'\\xc3\\xe6\\x83\\x89q\\x19\\xb3>\\xe5\\xde\\xdc\\xad\\x9er\\xd9\\xc4\\xd9\\xc2\\xdd\\xf8\\x9ca\\x0c\\xd9l\\x13\\xa3\\x86\\xd0p\\xf4;\\xccr^\\x9by\\x82v\\xe2\\xc77rw\\xe8~\\xbe\\xc0\\xf1\\xe3\\x0b\\xcb\\x87d"
  221.  
  222.  
  223. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040kz\\x19)\\xbc\\xfe\\x01h\\xa4\\xcc` \\x97\\x00\\x9d\\xc53\\xcbss%\\xca\\xbd\\xc1\\xd1ge\\x11&e\\x8a\\xc9\\x0b\\x08\\xbe\\x97q-f\\xb9@\\x9e\\x9f\\x96\\x06_\\xad\\x80\\x81\\xec\\xfa\\xb1\\xcc\r\n\\xa7`\\x89\\xad\\x19\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x85v\\xa2\\xdf3\\xf5q\\x01\\x0fg\\x8c\\x80_\\xea\\xd6\\xdbprd@\\xb0vd\\xe9e*<\\x9a\\xff\\x17k~\\x97~\\x19\\x08t5v\\x02\\xac\\xb9mx\\xe0o"
  224.  
  225.  
  226. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pm\\xae\\xfe\\x13\\x96\\xb43\\xbe\\xeb\\xd4\\x1an\\xdb\\x19r\\xacs\\xbb\\x0f\\x87&'\\xc7b\\x85\\xe1\\xcf\\xc5\\xe4\\xfe\\xf9\\xef\\xc8\\xf4\\xb5\\xc6\\xcc\\xd7d\\x8c0\\x14\\xd3\\xf7\\xc0l4\\x01\\x82#\\xb2\\xae^\\x14b\\xd9\\x93\\xfe\\xe4\\xe6?\\xdb\\x10\\xa1\\xbf\\xfd6\\x8d\\xd9\\x07\\xa9)\\x9e_\\x96i7kym\\xde\\xb9!~\\x00\\xb9\\xde\\xac\\xf9\\x06e@\\x05`\\x1bj\\x02\\xe4\\xc1\\xe4\\xcf`\\xff\\xafs\\x1dl0)\\xf8\\x10\\xee\\xc9\\xectc\\xe4\\xcb,\\xab\\xdb\\xb2\\xd1k\\xb3\\xa6\\x0cz2\\xd9b\\x8b\\xf3\\x9e\\xa6\\xae\\x87 \\x11\\xc8p\\xb3\\x04+\\x0c%\\xefz\\x03'\\xc5\\x879\\xf7\\xa8s\\xee\\x92m\\xee>\\xa0\\x98d\\x10^\\xb6\\x9av\"2\\x18\\x89b\\xa0t\\xbc\\xb8\\xf8\\xa1\\xb1l\\x1fb\\xc1\\xa0|dc2=\\xe6\\x8b\\xf7\\xe7?x\\xdc\\x08\\x10\\x17\\x14\\x9bj5\\xfdn\\xc7yb\\x02\\x91\\x14\\xc9\\x1f\\x06\\x1c\\x06\\xd1\\x8ef\\x05(\\x13\\xc1z\\x87\\xcd\\x94qp\\x8b\\x9c&\\x9d\\x18\\xaf\\x1b\\x9c\\x1dgmd?\\xda+r\\xf5\\x1a"
  227.  
  228.  
  229. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x9c\\xafs\\xebv\\xe5\\xf8\\x17\\xd8\"\\xa7\n\r?\\xba8\\xc7*\\xc3|q\\x1a+g\\x9cgvg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  230.  
  231.  
  232. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xd5\\xf6\\xa7vg\\x98sw\\xb0\\xe4\\x92\\xfe\\xc6\\xb3\\x11\\x86\\xce8\\xc6+t \\x8dxq u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  233.  
  234.  
  235. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x00\\xbd\\x05\r6s&\\x83(\\x7fk\\x85\\xbb\\xd9z\\x8bhwli\\xc6\\xfbh\\x88%w\\xec\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  236.  
  237.  
  238. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xac\\x88\\xf1p\\xb2\\xcd\\x06k\\xf0\\xc1=<\\x1e\\xa6*\\xa4y\\x19\\xe5u&\\x01\\x94\\xa7e\n\\xf0\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  239.  
  240.  
  241. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xd1\\xdb\\x91l\\x9f\\xba\\xa3\\xb8\\xb2\\xa5\\xd8\nf\"?18\\x9d\\xb5;0\\x0e\\xe6~qt\\x86\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  242.  
  243.  
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%0(co\\xec\\xc0\\xf2\\xfbb\\xfc\\xc9\\x17\\xfb\\xa8\\xb9c\\x87^\\xfa\\xbe\\x87\\xc1x\\x1f\\x9e\\xb4\\xf4\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245.  
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x88\\x1f\\xd9n\\x10r\\xc7\\x89\\xdc\\x18\\xa4\\x04\\xc0\\xaa\\xd2\\xf6\\xdb)/\\xa2t\\xb1\\x8ao\\xf7r\\xeet\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x9c7\\xfbk\\xd2\\xae\\x06u\\xaf\\xb9\\xaf\\xa5=_m\\xdf\\x10y0\\xdc\\x13ah\\x89a\\xeb\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xc6\\x85d>\\xd4\\x04\\x90l\\xea\n\\xb1;)\\xf8\\x88g\\x88\\xbb?m\\xfd\\xb1\\xec\\xde\\x08\\xbf7\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%b\\xb9\\xfe\\x19\\xdc\\xa3\\xa5%\\xe74\\xd6\\x13s\\xe8\\x98+\\x00w\\xa7\\xed\\xab\\xe6\\xae\\xf7\\x91e\\x11\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x03?\\xb5\\xc7\\x91m\\x8cf\\xfd\\x96\\x9f\\xc9\\xbe\\xc5k\\x9c\\xbc\\xd6\\xcbh\\xc8\\x0b\\xf31+\\x1d\\xf1q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%tr\\xb6s\\x84#\\xd4\\xa5\\xcd\\xeb=\"&b\\xef\\x0c2\\xf2\r)?>7\\x06.\\xd8\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xf6\\x07;36\\xb5b\\x07\\xc8\\x97@+\\x88\\xec\\x0e\\x10\\x0e\\xfb\\x85\\x08\\x03<\\xba\\x9f\\xdb\\xe0\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xean\\xbc!\\xbd\\x870\\xc8i_\\x84|\\x94g&\\x8f\\xd4\\xc3\\xde\\xa0\\x12\\xc4^\n$k\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xf2\\xe6h2x+\\xf6q7\\xe2n\\x9f\\xd7:g\\x95^w\\xdf\\xdak\\xc6'\\xdb\\xf0>c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xb8\\xfbwy\\xe6v\\xb7\\x84b\\x89\\xc9\\xa1w\\xc7\\x9a\\xb1\\x1e\\xf4\\xd3\\xa3\\x83\\x8c\\xfb\\x15k@\\xe0=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%*\\x1cr\\x15\\x1e\\xfa\\x99\\x10(\\xcc6\\x8c\\xd44\\x97c\\x84\\xf4\\xc8u1\\x85\\xe8r(`d\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xfb\\xeb\\x1f\\xb0xz\\xc9\\xdb\\xcb\\xf2\\x7f\\xb7\\xaf\\x85;\\xfa\\xb9\\xf4ja\\xd2\\xbf\\xda\\x01z`\\xf0\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x12\\x1a\\xaf\\x94\\xbb\\xc49\\x1be\\x17c\\xfd\\xcd\\x84\\x06|\\x08\\xe4\\xc4\\xb2\\xa3#\\x8a\\x1b\\xb5\\xa8b?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xa0\\xe9qi\\x80j\\x0f\\x89\\xbb\\x15k\\x85\\xc8\\xcc\\x82\\xec\\xda\\xa6\\x81>\\xc2\\xf5\\xccr\\xbf\\xa9\\xfa\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%q\\x1f\\x96\\xa5\\x8f\\xd9+\\xc6?yz\\xc2\\xec\ta\\x01\\x86`\\xed\\x11\\xb9uu\\xb5oi?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%zn\\xf5\\x1b\\xfd\\xae#\\xe0 \\xef\\x11\\x9d1\\xde\\xbb,\\xa9-\\x10\\xb7t\\xdf\\xb0j2-\\xc6\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x15\\\\xc7\\xf1\\xc1\\x1d\\xba\\x80\\xadr\\x99\\x19\\xbd<\\xae\\x98\\xeez0\\x96\"\\xf4\\x9b!xm.\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%f\\xbd\\x0c0\\xdd\\x96r\\xbd\\xc3s\\x9c\\x92?\\xe2\\xb1\\x81.\\xbd\\xb5\\x1e,\\x14\\xd5\\x1e\\xd7\\xfe\\xde\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%peo5\\x9c=i\\x0e\\xfb\\xa7p\\xfb\\x12g\\xeb\\x1f\\x12ez7\\x17,\\x9f\\x8b\\xd0\\xde\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xca\\xaa\\x9b\\x12o\\xab/to\\xa7\\xf3=\\xb7\\x97\\xfaj#\\xb4\\x02p\\xfan\\x98\\xb4:\\xfd\\xf3?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xb55\\x19\\x98\\xf8\\x86\\x81l\\xf9mp\\x92n4\\x04\\xe2@\\xbf\\x8e\\xaa\\x0e!\\xb0\\x99\\xd1\\xf6\\xd1\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xc0\\x85\\xbb\\x82\\xccg,%;\\xe1dl\\xe1\\x91\\x0bd&\\xd0\\x14\\xe9\\x9eaq\\x9dg\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xfc8o.\n\\x8f\\xdct\\x8dsc\\x7f\\x16\\xd2\\xc20\\xecp\\xa4\\xdaq|v\\xdc(\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%m\\xca\\xc6\\xd8y\\x15\\xac+\\xd2\\xdc\\x16\\xa84$x\\x85\\xad56\\xd9\\x0b\\x13\\xe6\\xfd\\xba\\xa46\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x1d\\x80u9\\x91\\x7f\\xedc\\x8f\\xe6\\xefq\\xb3\\x03\\xc1\\x9a\\x93\\x08\\xb3q\\xe6\\xb61b'&\\x98\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xe7\\xc2\\x02\\xbdwi\\xc7\\xc5b(\\xc7\\xa0\\xcbb\\xe3\\x12\\x1f\\xfd\\x02\\x95\\xdd\\xa6\\x980s\\x82\\x03\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x9f\\xd3\\xbc\\xa9\\xe3v:\\xa4\\xe3~\\x11\\x8ak\\xb0\\x87%\\xcb\\xf8\\x99\\xb8\\x99\\x8a>k\"\\x85/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xaa_\\x91(\\x7f\\xe6 \\xd1\\xae\\xde\\x04\\xb0\\xe0\\xb7_e\\xca\\xd2\\xb5\\xcc%s\\x8fa\\x8c\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%r\\xb3\n\\\\xa3\\x04v\\xadfdt\\xa5*\\x94\\xa9z\\xe0l\\xf5\\xec\\x1dj\\xd8\\xd4)t\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xb2\\x13\\x1a\\xbf\\x8ew^f\\xb6<\\xf2\\x8e2\\xa4#\\xe0u\\x82\\xcb\\xe6\\xd6a\\xb7z+l\\xd5\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\xe2\\xab\\x8d*\\x94*\\xf4\\x1a\\xd8\\xc6\\x84p\\x1f6\\xfb$\\xc9/\\x06\\x96\\xcc\\x03m\\xad\t\\xaa\\xa18@n\\x8c\\xfc\\xe7\\x03\\xb4\\x00\\x13\\xfet\\x0b\\xe9\\xb4\\x02h\\xb7\\x17_\\xf3@\\x8a\\xd4\\xeb\\x1bm\\xb7\\xd1q\\xd9d\\xbf\\xcbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000et\\xb1^\\xb8\\x96&\\xfe4\\x9e\\xf2\\xe6x\\xad\\x1cav\\x9cht\\xa8\\xec?\\xd5#\\xda\\x82x\\x90\\xc3\\xe54\\xfa\\xd7!\\x81\\xf3\\x81\\x12\\x12\\xea\\xa2\\xbe\\xfe\\x9a4\\x04"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%zosm\\x0fj\\xa6\\xb4\"\\x9e=zji\\xac\\xaa\\x0e\\xc8\\xfawplx\\xe5\\xab$\\xcc\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xdc\\x12\\xd15@s\\xba\\x82\\x99\\xa1\\x16x\\xb0x\\x97\\x87\\xe8\\xfe\\xd0\\x82j\\xc0\\xec\\xec\\x86'\\x8a\\x14\\x1f4m5\\x9cy \\x8au\\xb2\\xfa*n=h~x_\\xcen\\xd6\\xe3\\xfd\\xf8\\3\\x84\\xe1\\xabr\\x80\\xef\\xee@|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7\\xc77n\\x93\\x86;<\\xb4r|'\\xfd\\x8d\\xa2\\xb2\\xc9x_\\xae\\xc8\\x00n\\xa4a'\\xad\\x9d\\x86-\\<\\x90q.c\\x83\\xa6n\\xe3\\x96k\\xa6\\x92\\x14m"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x16c@\\xc7\\xe2\\xa7t\\xc7\ny\\xc0\\xf7\\x98e1\\xc0\\xc0\\xf6)\\x1c\\xe08\\xb8\\xa9\\xbd\r^%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x14l\\xf0\\xd6\\x89\\xb5h\\xf0\\xac\\x99\\xfa\\xd01\\xcb$\\xb52=\\xae)\\x11\\x99\\xf7\\xc4\\xbd\\xee\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x02\\xc7\\xf5\\xfa\\xb9\\xe0\\x1a\\x81\tl\\xc6\\x1d\\xcf\\xecu\\xf4_\\x7f\\x13o\\xa6\\x92\\x0c\\xc6+o9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xf7\\x94d\\xbb\\x05\\xcb\\xecd\\x98:\\x9dv\\xce.\\xd0\\x85\\x8b\rg\\xe4(cg`\\xf9\\xe7\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%,\\x81\\xff\\xf9j\\x1f\\xda$\\xd8)\\x99\\x1fls\\xc0\\xec\\x9bo\\xa23\\xca\\xb8\\xfa\\xa6\\x9b\\xff\\xabf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%e\\x11w\\xe3\\x88\\x85\\xdd\\xa7\\xa3\\xb1\\xac\\x86\\xc5\\x00\\xd3\\xaf\\xdcd\\x13\\xd0\\xd6\\x91\\x88\\xfb\tw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xc4y<#tg\\x9c\\xb8\\xf8n\\xa7\\xcf_\\xdcf\\xfa\\x1dr\\xb2p\\x08\\xe5\\xfen\\xb8d@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%p\\xf8ai\\x1a+ylg\\xd0\\xfcsc\\xca\\x0b\\xf6\\xe2v\\x9b\\x8er\\xda\\xd6;pf\\xf1\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\nz\\xe7*:wbb\\xe0\\xfb\\x7f\\xd7\\x96%\\x08\\xd7\\x03c\\x93\\xc3\\x86\\xac\\xd2\\xb5\\xa9\\xf5\\xdd\\x93\\x02\\xc2\\x9a\\x05\\xa4\\x98\\xae6d\\x93\\xdd\\xe1\\x9c\\xf2\\x9c\\x961qee\\xd4\\xba\\xba\\xa05\\x98f|\\x90hce\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#r\\xe0\\xa7\\xd9\\xe1\\xec\\xd8\\xf4\\xef\\xf21\\xb8\\xa7\\xc7~\\x05=\\xf1\\aca\\xc0kv\\x05rr\\xee&~\\xe2\\xe2\\xeb\\x8f\\xec\\xe3\\xca\\x18\\x04\\xb6\\xd3\\xa1\\x83\\xc9`\\x91"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04wj\\xc7_1\\xb6s\\x8b@\\x93\\xcd*\\x7fq\\xe5\\x01\\xe4\\xc0\\x06k\\x81\\x063\\xdc\\x87%\\x96\\x15\\x19\\xe0\\xf5f\\x8b\\x82\\xbc\\x89fs`\\xf3u\\x1dy>\\xfb\\xdd\\xe7?:\\xe9\\xd9lh\\x90\\x9c\\xbe\\xe1\\x9f%o\\x99\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\x95\\xca\\xb5m\\x8d\\x98\"\\x0e\\x8e\\xd8w|\\xc6\\x19\\xab)\\x18\\x02\\x14\\xc4\\xe3*\\xe2(\\xcf\\xf9\\x865!v'*\\x95\\x06\\x1c\\xc8\\xec\\xda\\xc1\\x02=\\xc9`\\xa9#"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xb6\\xdd#\\x95\\xa4\\xa6lj\\x9fpo'\\xdf\\xcasp\\xd9o3s\\xd7\\xad/n\\x05\\xab#f\\xe7cx\\x9c\\xb2~\\xae\\xdb\\xcd\\xd9\\xf3\\xb9\\xa7\\x07y|\\xa9\\xfe\\xc8\\x894\\xbatz\\x98l\\x05~\\x1fg\\xaf\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x04\\x83z\\xcb\\xbd\\x8b\\xc2\\x96\\x0e\\xe7e\\xf2\\xb7w!\\x04\\x99\\xecg4sl3g\\x94\\xff\\xa7\\x8d\\x0f*=p\\xce \\xa6\\xacx\\xb2_\\xf5\\xc2\\xb5\\xb3\\x9bk\\xd1\\xa7"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\x86\\xd2\\x18\\x9co=\\xb1v;\\xf7\\xc0%\\xd6\\x82\\x03\\dy\\x0e\\xdd\\x1e!\\x85h\\x10@\\x1apl`cy-\n\\x8d=\\xff\\xf1f\\x9e\\xa3!\\xf9\\x8dm\\xd6\\x18,\\xae\\xed\\xddhnq\\xfby\\x06\\xdf\\xbd;\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92\\xf1\\x1b\\xf3b\\x8dy\\x90^v\\xf1\\x0e\\xec\\x05\\x02\\xff\\xf3\\x1a\\xa19^\\xee\\xf0.\\xa5\\x9bd\\x1c\\xb7%pb\\x80\\x92(\\xfc:\n\\x0f\\xf0\\xf0\\x0f\\xe9\\xeel\\xf5"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9fh\\xc9\\xc4\\x15\\x0f\\xe6\\xde\\x08\\x89h<k\\x95\\x04\\xd1l\\x97`;\\\\xcd\\xde\\xbe`6\"h\\xf4l\\xf4n\\xa4\\xe8\\x0bl\\xfb\\x8a\t\\xe5\\x08\\xc3\\xf7\\xe2\\xbf,\\xcf\\xe6m\\xe2\\xd7q\\x94sa\\x01\\xa3\\xfe\\x19)\\x84\\x10m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17mm\\xe2c\\x9d\\xf7\\xccr%\\x08\\x1b\\x9f\\xd6<\\x92n\\x17\\xca\\x8b\\xd9m\\xec\\x08\\xee\\x8a\\xb5;e\\xd0\\x7f8\\xef\\xca\\xfcp\\x8a\\xbd\\x90$kg\\xfey\\xdd\\xadfp"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0ew\\x16-\\xcch\\xd9\\xd8@\\xf7\\x02\\xdd\\x90\\x8f\\x18\\x9aw\\xde\\xb9\\xf0i\\xbe\\xcf1\\x844;\\xbf\\xb6\\x84\\xfe&\\xd6\\xd1\\xce\\x80m\\xafg\\xc3\\x97l\\x08<\\x05(7\\xed\\x87\\x81^\\x93\\x93\\xa8\\x18\\xe0\\x89\\x95\\xe2\\x08y\\xab\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\x13&^\\xf6d\\xa4\\xaf\\xfb)f844\\x80v-2*\\xb9\\xa4h\\xbf\\xd8\\x9f\\xbf\\x16\\x9a\\xf0\\xf6:\\xad\\xee\\xbc\\x8b\\x8e\\xd4\\x19\\x06\\x94\\xd7\\x85\\x16d\\xe3\\xce\\x86u"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\xf3/\\xda\\x00\\xa1\\xe2\\x05jre\\xac\\xf1ba~\\xb4\\xa9\\x8f\\xb9\\x1an\ry\\xcd+(f\\xa0q\\x172\\xb6\\xc3y\\xe4.\\xaan\\x802\\x03\\x9d0\\x0e\\xe0\\x96\\x10\\xc7\\xb2\\xb7<\\xb9fg\\xec\\x1c\\x98\\xd4\\x9f5_\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r:i\\x07\\x19\\xa9\\xb30\\xec\\xce\\xe0c\\x07\\xd2\\xcf\\xf2\\xfbp4m\\xa2r\\x8fh\\xea\\xe0\\x8f\\xaf\\xe4\\xe4\\xe0\\xb0\\x9dnkw\\xd2\\xc5s\\xa1\\x89\\xc4\\x93#ta\\xd5\\xfc"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c.\\xa0\\xc7\\x1f\\x95;_p\\xd2\\xb2-\\xee\\xdc\\xcc\\x0b\\x0fd\\x11\\xb87\\x9a/\\xc9\\x01n\\x0c\\xbd\\x1f|-\\xda\\xb8\\xb8\\x95\\x86\\xcf6\\xb1\\x03\\xe6\\x1b\\x16z\\xfft/\\xc7gk\\xd0\\xfa\\x07e\\x16k\\xff\\xb7\\xbc\\xd4k\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9kn\\x05\\xb4\\x12\\xc4\\x8d+\\x91\\xc6hcy\\x89\\x90\\xb1\\xb7\\xdc\\xa6\\xff>\\xaa9\\xdd\\x10\\x88\\x86\\xef\\xf4(\\xf9\\xfck\\x95\\x1e\\x04!\\xcd \\x99\\xd8no\\xb71;"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\x8fx\\xd27\\xbc\\xc0\\x96\\x05\\x1f\\xbclw6\\x8a.\\xcf\\xf2\\xd0\\x0bi\\x14s\\x00t\\x1d\r\\xee\\xe8\\xbf\\xd6\\x84\\x00\\xc7>&\\xa8\\x0b(\tw\\xbc\\xfe\\xbfq\\xa4+\\x9a\\xb9\\x82\\xa4\\x11q\\xef\\xde\\xc3t\\xd2td\\z\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;c\\xd8\\xcegm\\xa8\\x95\\xd0\\xb4l\\x9b`\\x08\\x0f\\x1b\\xd7l*\\xff|*\\x7f\\xc5sc\\xb5\\xfc\\x90\\xb4-\\xf4\\x9a\\xd9yd\\xe8\\x0cs\\x93b\\xfb\\x9d\\x82\\x8d\\xab)\\x15"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\x90\\xd8\\x8e\\xd1\\x89>\\xd5>\\xed\\x92\\xe5\\xf0\\xfd\\x911o0\\xd2g\\x94\\xd2h\\xfdi\\x82&\\xd3d\\xd6\\x04\\x86\\xffp\\xfa\\xdekz\\xff\\x99\\x9e\\x1a|gg|\\xeb\\xa4\\x1d\\x8cz\\xa6\\xe9\\x07\\xffw\\x1ey\\xd7r\\xfb\\xce\\x94;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xc0\\xb4\\x8c\\xa5;*,\\x80'\\xa7\\xfd3\\xac\\xce\\x8fr\\x06\\x9dw\\xf0\\xcc\\xcf\\x0b\\x10\\xc7w\\xe5\\xce\\xddlx1 o#\\xc5\\xe3\\xfd\\x91\\xc6?p\\xabh4\\xf2-"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x7f\\x81\\xc4\\xd5\\xce\\x913\\xf8\\xe2\\x11\\xe9l\\xbd\\xc1\\x06\\xcf\\xdei\\x80\\xbd*b\\xa0f0t\\x03\\x93\\\\xf1\\xd4n\r~\\x81\\x17~\\xd6!\\xca'\\x10\\x1a2\\x14\\x16\\xb6ut^\\xba\\xe1\\xafu\\xf8\\xeb@\\xb0\\x1a=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd$q\\xdc\\xff\\xb3\\xf1\\xfc \\xc4\\xa3\\xc2,x\\xeb\\xc9z!n\\x8d|s\\xa6e\\x7f\\x19\\x06y\\xa5\\xcc!\\xa3la\\xd4\\xb9t\\xc1\\xa7\\xb3\\x96\\xc24\\x12<\\x131"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xd3$\\xff`\\xe0*8ww\\xac\\xdf\\xc4\\xf6\\xdd\\xd1\\xaby5\\xd6\\x02\\xc0o\\x08!l\\xac\\xe4&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\xc8\\xe6\\xaa\\xc3t\\x0b\\x14\\xcb\\xf9\\xb6a\\x93\\x17e\\x8a\\xabr\\xd5\\x97u\\xe8\\x18q\\x03 \\xe0\\xfa'\\xf0l\\xa1\n~t\\xe2k\\xef\\xdc\\x94q\\xb2\\x8f.\\xf6\\xcai^:\\xfa\\x12`\\xbe\\xffd\\x03j\\x93\\x80\\x16js\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000vhduy\\xb9\\x949\\x04\\x98-d\\x9b\\xa8+\\x0c\\x13\\xbb\\x01\\x99\\xa7i1\\xf9\\xd4v\\xad\\xd1\\xbf(t/\\xe3\\xc9\\xf8\\x8bheh\\xcd\\xf0\\xbd\\x9f\\xcdsv\\x1a\\xb2"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04,\\x8cf#\\x16iel\\xea\\xa9e\\x7f(r\t-\ri\\xd9_=\\x19\ra\\x0f\\x10\\xff?\\xaf\\xcb\\xa5\\x02\\x17t\\xbe-\\xe6\\xb5by\\x00\\xcc\\x12\\x14\\x87\\xe8\\x8d\\x07\\x1c\\xea\\x9b\\x84\\x0f\\xf4h\\xe0\\xae\\x88v(\\xd2\\xd3\\xc8l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81_\\xfb\\x83\\xf6\\xae\\x91,\\xe0\\xf3\\x95\\x1c\\xa3`\\xc6\\x1d\\x89\\xa8p\\xea\\x9d\\xad\\xb5x|ae\\x91\\x97\\x9a\\xa7\\x82\\xe7\\x94\\xe0\\xe3\\xb4\\xaf\\x05\\xa6;\\x14\\x1d\\xe0r\\x1c\\x81\\x81"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8if\\xb89\\x0c\\xbb\\x86|\\xe1\\xbb\\xaf\\xe2\\xfc8@\\xdb\\x9a\\xe2c\\xae\\xb7\\x92p\\xc5@\\xc7s&z\\x03\\x04w\\xeb\\xfc\\x00kg\\xe94\\x1aicmwhr\\xd8\\x82\\x90\\xd3\\xaa\\xac \\xca\\xfb\n\\xd5\\xc6r\\xe1\\x12\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000cc\\x95\\x1b\\xf1nqtn\\xd4!4\\xc3'\"&\\xaf\\xee\\xb7\\xffc\\xa1\\xc0\\x03\\x89$\\x1a\\xe5\\x80\\x17p\\x0c\\xef\\xf5%l\\xff\\x93\\x9e\\xe0bq 4\\x7fi\\x1e\\xf3"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\x83a\\x0c\\x94m*t\\xbc\\x85\\x0b\\xd7\\xb5\\x121\\x93ki\\xee\\xd21\\x8e;\\xc8\\xf0\\x8eqyls\\x91\\xe6q\\x95\\x07\\x1b\\x05\\xc5vj\\xe8\\xccj;\\xdcl\\xe3\\xa1\\x14\\x14\\xabu\\xf2\\x14\\xda<xi\\x14c5\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91,\\xf9yb\\xacp\\xd9\\x96wd\\x85\\xeb\\xaf+b,\\x16n\\xd5\\xeb/\\xf7\\xb2\\xaa\\xb0\\x1c\\x81\\xee\\xe8\\xb4\\xe4<>\\x00\\x1dv\\xf7./\\xac\\xa6\\xab=\\x9b\\xf1\\x0b\\xfb"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%z\\xf7\\x95\\xf0\\x072t\\x90\\x02?\\xbe\\xb2\\xea\\x1d7m\\y\\xa8f\t\\xe65\\x92\\x91\\x18\\x99,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%n\\xb8a\\x12\\x029(3\\xc6\\x85\\xd11\\xc3=\\xcc\\xffz\t\\xf33<\\x94\\xfe\\xa0\\xbb/\\xcb\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%%\\x8e\\xed.\\xca\\xa0ab\\x80\\xa5\\x99\\x8c\\xa5\\xd4\\x8e\\x9f\\xcd\\x8ft\\x9f\\xc6\\x18\\xa4\\xb1g\\xcee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x8c=\\x96$\\xb8\\xdf\\xcamhi\\x8d\\x10!\\xec\\xf8t\\xae&\\xdff\\xee\\xbd\\xd8\\xb3\\xfb\\xd7r\\x84\\xf9=\\xc4\\xbc\\xb7\\xde\\ \\x00\\xfe\\xbf\\xdeq\\xf8\\xb4\\x88\\x01\\x0cu\\xf1i8t\\xd3kc\\xe7\\xeb\\xda\\\\x1e\\xf3m\\x86\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\xde\\xbf\\xdf\\xb2xx\\xd3\\xd9kik1b\\xa8\\xb7\\xc0e\\xc8=\\xf0\\xfan\\x02u8\\xbb+\\xac\\x19x@o\\xfc)\\x98\\x8f\\xbe\\xa7\\x96\\xa0\\xdb\\xb5\\xb3y\r=d"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9f\\xbc\\x037y\\xd7\\x89\\x19zu\\x9c\\x14\\x90,\\x89\\xf6\\xd0\\xd6\\x1d\\xd0+q\\xb8\\xec\\x14v\\xcc\\x1d\\x9e\\xb6\\x01\\xe1\\x99\\xee\\x95\\xf4\\xb9buv\\xf1j\\xf0f\\x11\\xa6\r\\x882\\xa8=)8\\x87\\xdb.\\x8er\\x92)f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b2\\xa8\\x86\\x85\\x9b\\xd3\\xe9\\x0e\\x9c5\\x07\\x1b<s.\\xc6\\xdb'kf\\x00\\xfes\\x85\\x89\\x99\"\\xebl)?7\\xef\\xd7z\\x88:\\xb8\\xe9y\\x1c\\xf4\\xc6\\xc42\\xcbo"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbdo\\x1c\\x9c\\x12\\x0f\\x06k\\xe8^\\xc9\\xf7\\x8d@\\xb6\\xdb\\xda\\xc7\\x823`u\\xae\\xf3\\x0fj|\\x98\\xb3\\xbd\\xe9\\xee\\xd5\\xd9\\xa9\\xff\\xad\\xc9e\\xdb\\x80\\xc5-\\xcbd\\x0b)|\\xa1\\xc8\\xe6n\\x0b\\xe8\\x88\\xf6,\\x1f&\\xb1\\xd3\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\x96\\xa4g\\xca\\x0f\\xa6.\\xbd&\\xdfj\\xe0\\x7f\\xaa\\xda\\xf3|l*\\xf3\\x93p\\xc6\\xfa\\xed\\xf1\\x04\\x19=h\\xd5\\xca\\x8e\\xe8\\xfd%\\x9aw\\x12\\xc2\\xc5\\x83\\xde\\x83\\xb8\\xbb\\xb0"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xb4\\xd3\\x98\\xdb\\x9b\\xba\\xdf\\x0e\\xc5\\x81\\xe4\\x8a9df6k\\xe6i\nws\\xeavzv\\xe1\\x02+d\\x01\\xb4\\xb6lr\\xc5\\xba)\\xd4m\\xbcq\\x1aab\\xfbcv\\xc4\\x03\\xde a\\xf9<\\xebf\\x873\\x8b\\xa3\\x9c\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\x03>\\xe8#\\xbb\\xab\\x8d\\x01?\\x0e\\x08\\xe4\\x02\\x8a\\x87\\x1f\\x0f\\xad\\xb5|\\xcd\\xcc\\x19\\xa3x\\xac\\xa6\\x9b\\xec\\x04x\\xc1\\xa6xb\\x06i\\xc6.;\\xfc\\x13,(_\\x10n"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\x99\\xf2\\x7f\\xaa\\x8fp\\xbb\\xe4\\x9e$w\\x85gcsxzt\\x95k\\xcd=\\x83e6\\xba\\xdcv\\x81\\x1a\\x08\\xafw\\xa8\\x13\\xe6\\x16\\xa3\\xb2j\\xe0\\x04\\xe6\\x18c\\xa4\\xde\\xb1\\xf2\\xb3\\x9c,\\xa7\\x92q\\xbdhjw\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\xaal50\\x82\\xb8.\\x0e\\x8f\\x89\\xac\\xe5+zz\\xd63g\\x95\\xcc:\\xf3\\x1b=\\xb8'd\\x1a\\x15o\\x831\\xbb\\xf3\\x8f\\xeb\\xf7\\xdap\\x81\\xd3\\xf1\\xb4\\xe7\\x89"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%wc\\xe7\\x8a\\xf3\\x8d\\xb4\\x07\\xef\\x00\\xb5\\xb0\\xf9f\\xed\\xa5\\x15\\xaep\\x83\\x8f!\\xbd\\x99\\x01\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m3<0\\xb2\\x10\\xf9\\x06i\\xb6\\xae(\\x9b>\\xd2lc,@\\xf9=>\\x14\\xd8\\x17\\x98\\xd5\\x86\\x99\\xa4iy\\xf33|\\xb0\\x00'\\xd9\\x02\\xbb.\\x15\\x9f\\xbd\\xdc\\x85\\xe1@\\x8f\\x17\\x1f2\\x13qpizq5!#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xbff\\xab7\\x99zdo\\x83\\xee\\x8ft\\xdd\\xdbw\\xd2\\xc0+\\xact.\\x19~\\xc7t\\x1e\\xf7\\x10\\x9bw\\x9a9\\xed\\x14n*y\\xab\\xf2\r\\xbc\\xfaipo\\xe9"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\x19\\xb9?\\x94\\x05\\xc4_\\x01\\xf5x\\x8d\\xeec\\xbb\\xea\\x1fh\\x96\\x8cv\\x084r\\x9b\\xfd5\"~\\xb2\\x83~b\\xb1\\xbf\\x9a\\xe1g\\xfe$\\xa9w\\xa4\\xb4&\\xa1\\xe8`u\\xbbca\\x19\\x1a\\xdf\\xdf\\xa5\\xf7\\x1bj\\xb8i\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&\\xc1x'\\xa9i\\x06q\\x04\\xdb0\r\\xfe<s\\xdf\\xba@\\x81.\\xea\\x13\\xe1\\x99\\xacw\\xf6\\x84p\\xdd\\x9e\\xd3\\xe4\\xbc(\\xaf\\x10i\\x1e\\xd0g\\xcajg\\xe8gd"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf70?f\\xea\\xcc\\xfc^\\xccj\\xcfq\\xf4\\x19\\xcc\\xb5\\xcd\\x9fh\\x88\\xe7\\xb4\\xeb<\\xa9\\xda\\x86\\x85\\x16\\xe7\\x84\\x8d:j\\xe0\\x01\\xf9w\r\\xeder\\xd4\\xd4\\xa9\\xd6\\x8e\\xe5\\xa4\\x94e\\xffd~|\\xe2\\xef\\x9d\\xd2\\xf8\\x87\\xd0\\xc6+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\xeex\\xfd\\x13j\\xc5\"\\u\r\\x18\\xff\\o\\xb4\\xd5\\x03\\xf3xki\\xeda\\\\xc5\\x17\\xec3\\xf5\\x06m\\xc92t\\xbb\\x960nq\\xe0\\xbfg\\xdb-i\\xbak"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe:\\x0er9b\\xe7\\xcb)r_jo\\x1d\\xae\\xd6\\xd7\\x05b\\x8b\\xda\\xe3@\\xd9\\xed\\xe5q\\x1a\\xdf\\xe7z_\\xff\\x08\\x03\\x08\\xcc\\xfb`v\\xf4\\x7ff2%i\\x8fsk\\xb48z&$i\\xae#\\x91\\xae \\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef \\xa9\\x1d5\\xe9\\xe8\\xcd\\x15v\\x9bm\\xe9\\xa9\\x8b\\xbb\\x90\\x80\\xca.\\x8f\\x0cwb\\x07d2g\\xb8\\xbep\\xe4 \\x067h\\xe7e\\x0be\\x80\\xdb/d\\xb6\\xc6\\xe2"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xf2u\\xac\\xe3\\x81\\xb8yy\\x97i%\\xbf^\\xc1\\xb9\\x8b\\xb7+n\\xb6-wb\\xf2g`\\xdbg\\x00\ri\\xc7\\xbe\\xe3\\\\xc1\\x99\\x17s_\\x06x\\xeelm\\xf7(m\\x99\\xa41\\xdc's\\x07\\x17\\xd3\\xe09lb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\xa6u\\xb97\\xf9\\x0b4=>\\x8f\\xa6~\\xa4@\\xd5\\xa8h\\x03%\\xe68\\x13\\xda\\xf0p\\xd1\\x0c\\xd2 (i6\\xf9\\x9d\\xbc\\x87\\xe8\\xc5u\\xa3\\xc4<\\xa8`\\xde\\xab\\xb5"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\x9c\\xb0\\xc6fl\\x13\\xe8\\xf6\\xd4\\xed\\xc5p\\xb0\\x8f\\x02\\xd9\\x81a^\\xb8\\xf9b\\xc9\\xcb%\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%1j\\xe7\\x0el\\xcd\\j\\xbbr\\xf6f\\xb6\\x0f2n\\x97\\xf3\\xb3\\xb1\t\\xd8\\xb1x\\xf7!\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%f\\x85\\xfdl\\x94\\xd7\\x01y\\x92\\x00\\x19\\xd4/n\\x91d\\xfcno\\xf7\\x1c5\\xdb<\\xb1<\\x99#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#w\\xe2\\xf31\\xbbd\\x82b\\xd2^\\x15c\\x93u\\xa0\\xd7\\xaa\\x165\\x0ct\\xba\\x1bi\\x8b\\x15\\x88\\xb6\"\\xaf\n\\xdf-7\\xf5:\\x1e_\\xe2\\xb5\\xc7\\xea\\xf43\\xb2\\xb2x\\x91\\x8f\\x0b\\xce\\xddq\\x96s\\xda\\xa8o4\\x9b:\\xec\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\x84\\xa0u\\xf9\\x94\\x83c_\\x0b\r\\x00\\x7f\\x8d\\xa0\\xa1\\x80\\xef\\x81\\x83,'ly\\xb1\\xc7\\x1e\\xb5\\x00\\x06;\\x9f\\xf6bj!\\xb0\\x15v\\xaa;\\x8c\\x91\\xae\\xb1\\x8d\\xb7"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a)\\xa91\\xdaux\\xcc\\x0b\\xdc\\xbbl\\x9b\\xea\\xc37\\x0b\\xa2\\x8b^\ni\\xc4\\x81\\xed\\xd4\\xb5*\\x80\\x07\\x8c\n\\xe7\\x08\\xe5\\xe5i\\xdd\\xc0\\xf3\n(\\x90\\x10\\x0f\\xd03\\xea\\xe4\\x8a|\\xe3\\xee\\x05\\xe6\\xf5\\xf2vwj+e\\x86\\x94\\xcb\\xb9\\x15 \\x17\\xf3\\ \r\\x7f\n\\x92\\xe1:\\x88rb\\xfde\\x07\\xb3f\\xe9\\xd6\\xe3o\\x97\\xb0\\xfb\\x1dx\\x15\\x87`\\x00v\\xc8\\xbb\\xda\\xecy)\\xe5ik\\x8d\\x9d\\xd7\\x1em\\x8d\\x1b;\\x87@\\x0e5r\\xf4\"\\xdf\\x0b\\x01\\x85k\\x9c\\xc01\\xff\\x0e\\xf3s\\xecm\\xb9j\\\\x18\\xfe)\\x87\\x9fj\\xdbr\\xab\"\\xcc\\xdf\\xfe\\xeb\\xe5a;\\x00' +\\xad\\x8e\\x02\\xd3$\\xe7\\x97\\xc9*vo\\x18z\\x91\\x8e\\xe8)\\xb0$d\\x1e\\xda\\x17\\x84\\xfb\\x8f\\xea\\x04\\xb7\\x82\\x8cf'\\xd2e\\x84\\xb6\\x17\\x1a47\\xfa\\xfd\\xfe'\\xefe\\xc8k\\x96\\x1d\\xe6x\\xd0\\xf6\\x03b\\x9cb\\x0b>\\xe4:o?cv&p,\\x11dz\\xa9\\x13\\xbc\\x15\\xe7\\xa0\\x1fo\\xd5\\x89\\x94\\xd1\\xd3\\xab\\xbe"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0b\\xcc\\xf1\\xa9\\xa0kl\\xe6e\\xcem\\xec\\x06b\\xfa\\xd0v-\\x99\\x8as\\x8f\\xcb\\x0ez\\xf5\\x95\\xdf\\xaa\\xc7\\xed\\xeff\\xc2\\xbau\\xc7\\xbax\\x1a\\xc7*\\x03\\x99\\xcd\\xa8\\xdb\\xdf\\x0c\\x90\\xf3`k\\xb6\\xc4\"\\xb5\\xe2\\x15\\xf2\\xf0\\xf1\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004c\\xea9\\xf4\\xca\\xe4\\xbe\\x9b(\\x1b\\xf1\\x0e;h\\xd3a\\xacc\\xf2\\x851\\xc4\\xa5z:gc\\x93\\x9b`\\xa1\\xa1\\xe6$fp\\x92\\x03\\x0f\\x02\\x0f\\x9e\\x1a\\x86e\\x14"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xacge\\x87u\\xff\\xa1\\x95\\xa7\\xba\\x85\\x04:\\xb3\\xbfp\\xfc7m\\xc2n\\xfa\\xdc\\xcf\\xc3\\x8e\\x94\\xe7\\xe0\\xe8\\xa2\\xb5`)%'t\\x97\\x15\\xe2\\xe1t8>\\xd07i\\xbe\\x85\\x976e+\\x06\\x01\\xbd\\xc2\\x88;\\xffo\\x1fxz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ekc_\\xe6\\xc9g29\\xec\\xa0f<\\x85\\x82fi\\x14\\xde\"\\x0em\\x85\\xca\\xd6\\x98\\xbe^)\r\\x90k\\xf3\\xda\\xd6\\xf4\\xd2\\xac\\xef\\x8a \\xfb*\\xc1\\xcd\\xdb"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\x13\\xbfj\\xa0\\xf6s\\x11\\xa2y\\x13k\\x81\\xec\\xf7-\\xe7>\\x8b*\\x19c>x\\xe3\\xa0y1->\\xf2\\xef/w\\x10\\x97\\x86\\xbc+\\xebc\\x18\\x96'\\x9at\\xa2\\x0f\\xb1\\x182\\xbf\\xb3u\\xfe\\xf0ap\\x8a\\xbf`|\\xb9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=i\\xf2\\x88\\xa7t\\xee\\xb4h\\xde0\\xed\\xee\\xc2wj\\xc1\\x93i\\x1a\\x10\\x16\\xa9\\xf35l,j\\xf0\\xf50\\xdd_k\\xbe\\x059\\x05\\xf8\\xe9t\\xede\\\\xfd\\x18\\x03\\xe6"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t`\\xf8\\xdd3\\xa2\\x05/\\xdd\\xe9\\xa0\\x896\\xc5+\\xbaqo\\xfad\\xe0<;\\x87\\xc4j)\\x8f\\xe5\\xff\\xe1l\\x07-\\xd6\\x1b\\xd0\\xa0\\xa1\\xbaj\\x9b\\xf3\\xd3\\xa5\\xb8x\\x0bl\\xb5pl\\xfe\\x12\\xfb\\xde\\xa5dz)n2\\xe7l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\rh\\x02\\xb5\\xc2i\\x1c_\\x88*\\x89\\x0e\\xc7v~j\\x19\\x95i\\x95f\\xfa\\x12\\x89\\xc1i\\x01\\x01\\xa3\\xee\\xe5\\xb6\t\\xecl\\x15\\x18\\xce\\xb0\\xdd\\xc5l\\x98\\x84\\xc3\\xcaq\\xac"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\x13,t@uaf\\xc2\\x9c_y(\\x1d\\x85\\xb2\\xefy3r\\x04\\xa4\\xa1\\xdb>\\x9d\\xfb\\xd2s`\\xfe\\xc7\\x1f\\x82vr\\xcc\\xe9\\x9bq.\\x88|kp\\xba/\\xba\\xf8\\x19\\xca\\xcf\\xe6 'v\\xdc\\x96\\x00pufq\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xea\\xa6g\\x89\\x1d\\xc8\\xde\\x1b\\xb26\\xd0\\x8c\\x12\\x89\\x1e\\xb5p\\xdd\\xa0\\x9a\\xee\\x08\\x0cj \\x1c\\x8be0\\xe8f3\\xc4z\\x90\\xb0\\xbd\\xbfv\\xe9|\\xdd\\xf6\\xeb<\\xb8"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xb6\\x94\\xeb(\\xaa\\xafl_?\\xd1\\xb2\\x0f\\xc0\\x1a\\x8d9\\xa4\\xffn\\x88e\\x8a\\xd6\\x8e!\\x04@\\xa5\\xe5\\xf5\\xa1?@\\xcd=\\x8f&\\xdd5`\\x17\\x92\\xa8\\xb6\\xac\\x8d\\x98\\xc5`\\xbe\\x87\\xc3,\\x94\\xc8sd.eg\\xbej\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc6\\x81\\x1e1v5\\\\x92a\\x8304\\xf0i\\xb4'\\xe4\\xc6a^\\xb2\\xd8\\xb4.v\\xff\\xdd\\xa9:wwki\\xe4\\x81\\xc3\\xbb\\xa1\\xf6\\xa5j\\x11f\\xb2\\xc6\\x9e*"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\xa3)\\x8f0k\\x84\\xdam\\xf0\t\\xc7\\xa1\\xc2\\xbb8\\x8a\\xa9\\xcaq>\\x8aa\\xec\\xc1\\xa9o\\xa1o\\xd9\\xe6\\x97sr9&\\xd1\\xe5\\x7f\\xf3\\xcf\\x90p\\x87\\x98.\\xb5\\xb1\\xe1\\xae\\xc0afj\t\\xfax\\xaf(\\xd9\\x8e\\xfec\\xe5\\x06yna\\xe6h\\xfcb\\xb3\t\\xfd\\x99\\xc7\\x80;\\x0f\\xd9\\xf4\\xad\\x1cx6\\xde\\x13+\\x9c\\x18\\x1dio\\x8b\\xa7\\xed\\xcbk\\x8f\\x03\\x1a\\x85<v\\xb7k>\\x196@y\\xbfu\\xa2\\xc1\\xd32\\x14\\xbfm4*\\xda\\x9f\\x03^\\xa55c8\\xe0\"\\xefv\\xf1o\\xc7\\x86\\x9a\\xb0\\x8e\\x91k\\x0f\\xcf\\xb3y<<\\xee\\x8a\\xbce\\xeb\\x93q:b)s\\xc7\\xc2g\\xde\\xea\\x8e\\xc3g'\\x04\\xba\\x9f\\xb4~\\x11\\x87\\xbb\\xcb\\x9e\\xb99o\\x9a\\xcc\\xaet\\x84\\xe1\\x98r\\xc0\\x84$e\\xfby\\xb3\\x1d\\xd1\\xbb\\x00\\x9e\\x18\\xba\\xbc\\x16\\x05q\\xc3\\xe9\\x9f\\xa3\\x05\\xa5\\xc0\\x10\\xe5\\xd5\\x91\\x14\\x19,e\\xd1\\xda\\xb1\\x10\\x0bn,\\xbf\\xbedi\\x7f%b'\"\\xebb\\x03\\xc7\\x8f\\x020\\xe6"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4b\\xc6\\xf9\\x90a=e6vf$\\xc2\\\\x8ah\\x84,\\xc2@\\xb2\\xf8\\xf0\\x04e\\xed\\xb6\\x02\\xc9\\x1b\\x1c9\\xda\\x98~\\xe5z\\x89\\x01m\\xd4\\xa0\\xa7\\x12\\x80\\xedo\\xdc\\xf6\\xd3\\xc1\\x8d\\xe5\\x8c\\xf4\\xc3\\xa6\\x90\\x9d\\xa4\\x12\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\x12\\xd459\\xa3\\x91\\xe3\\x1d\\x97&5\\x16j\\xa5.z\\x88\\x0ba6s\\x16\\x0f\\xff\\xb4\\x11\\xe6l\\xe6\\x94\\x17z\\xb9\"\\xde\";\\x88\\xa3\\xf3:\\x91\\xf4\\x98d\\xb2"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8\\xdb\\xe5\\xef\\x92\\xc7\n'4\\xd3\\xf8\\x91\\x87\\x1d\\xb4>z\\x93\\xf3,vt\\x16\\xcbp\\xc9\\xd8cc\\x8e\\x18l\\x9a%\\xb9\\xec@\\x82\\xfax\\x0b\\\\xce\\x1c\\x02\\xb4\\xe9\\xb2\\x80s\\x17;^\\xc6\\xa2\\x19l\\xe2\\x1e\\xb8\\xe4qy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w'\\xfc\\xfdfw\\x06\\xb7d\\x16\\xe5\\xe7\\xae\\xa9\\xb6\\x85 \\xfd\\xf1\\x87\\x81u\\xb8\\xf65\\x8b\\x17\\xf79\\xfbb\\xdai\\xcee9\\x18:2\\xe3\\xbf\\xf9\\xcb>\\xf3\\x04\\"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046\\xe0u\\x15d\\xe0\\xbf\\xe4\\x85-\\x1ai\\xf8rg\\x91\\xa1\\x95\\xf8\\xe1:\\xd1\\x8d\\x1am\\xe0\\xb3\\xcbd\\xb5\\xa94~\\xbe\\xfex\\xfe\\x91n\\xc5o,1?cv\\xae\\xd2\\xc4hlnct\\xfc\\xdcg\\xde\\xf6uhc&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002g\\xf8\\xf3\\x14<\\xd5gk\\x87\\xbb\\x87|g\\xf0'\\x97\\xd8\\x10<5\"\\xef+fpe-\\x15/g\\xddy\\xf3\\xe6\\xc8f\\xa8v8\\x17\\xd5\\xf4(\\xc0m\\x05\\xcb"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xa1\r\\xa9+\\xc6\\x91\\xa3\\x97\\xbf\\x00f\\x1c\\xa5qu\\xffp\\x06$a\\xb8\t\\xbf\\xd7\\x8d\\xa7\\xcd\\xf3\\x18\\xe1\\xd0\\xbe\\xf9\\z\\x05w\\xa27i\\xce9\\x8b\\x08\\x02\\xd2\\x84w\\xb9\\x8f\\x04\\x81\\xf7\\xbe\\xc8\\xd4\\x97\\x90m\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xc0$\\x88=\\xe2\\xbb\\xc1\\xd3z\\x9dst\\x1c\\xd0\\x0f3v\\xc4\\x9cn\\xc7\\x07=k\\x9c\\x8fv\\x89\\xaf\\xa2l+\\xb4f\\xa2,\\xdc\\xa2\\x030\\x9di\\xab\\xbe\\x9e\\xe0\\xaf"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\xb6\t\\x97\\x86\\x03\\xde\\x13:s&\\x8b\\xa3|\\xb0\\xea\\x89\\x92\\x85#\\xba\\xf2\\xa5o\\x8a\\x11fq/\\xca\\x92h8c\\x0f\\xe2\\xe2t\\x82\\x1e\\xaf\\x00\\xf8\\xc4\\x84\\x9aa#ef \\xb0fy<o\\xad\\x91>\\xfa\\xf6\\xc0 \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x04p\\xa6r\\xd7q\\xcal\\xb4\\x8c\\x84\\xcd\\xe15\\xe6n\\xc9\\xd3\\xe7\\xa4ze\\xfd\\xdb\\xaa,3y\\x99\\xcf@\\xde\\xf8\\x84\"%|8\\xd9r\\x11\\x1a_\\xb6\\xc7\\xf8\\x94"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf\\\\xf2z\\x06w\\x11kd^\\xcd\\xe9\\x8f\\xdac\\xd9\\xadlm\\x1b\\xad/\\x12\\x15\\xc0\\x111+\\xc9&~\\x03\\xf1(\\xe5\\x92\\xa4\\xcfefn\\x1a\\x7fm\\xe4~\\x83\\xf2\\xa0\\xder\\x99d\\xad\\x873\\x89\\xd6\\xcd\\xf3\\x81\\x00\\xd9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9=\\x83\\xdb\\xd560!nn=fp;v\\x1fx\\xa1\\xd6\\x04\\x8f\\x98\\x83\\xd8\\xae,\\xe7)uu\\x05\\x9bo\\x964\\x02%+@\"\\xf9d\\xf0\\x14x\\x9f\\xa5"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i-\\x83&~z\\x13\\x05(\\xfb\\x88\\xcd\\xb0w>\\xb9\\xce\\x1c\\xf3\\x00\\x8dx\\x03\\x8at\\xce;b+\\xbf\\xf7m'j\\x01&\\xca\\xa3\\x90\\xc8c:\\xaf\\xd7~\\xce\\x13\\xe4f)~\\xa4;s\\x91\\xd4%\\xcf\\xee\\x1d\\x8e\\xf2\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000yvz\\x8fp\\xdd\\xa6j6\\xf6k\\xf7\\x96\\x1d\\x83\\xdd)\\x8c\\xc9\\xa2&\\x99\\xf6\\xd8\\xf8\\xf0;\\xd3^\\xc0qi\\xba,\\xf0an\\x1a\\x18\\xa3%\\x98h\\xb6t\\xd23_"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\xfb\\x04\\xd7~\\xeas\\x87my\\x92\\xdd\\xd3\\x8f8\\xc9\\x1f\\xf7\\x00\\xa1\\xde\\x9dz7\\xe9\\xdb\\x05\\x17u\\xde\\x9e\\xcf\\xac\\xd2\\x9f\\x9b\\xd5_\\xbbw9\\xc4\\xb5\\x1b\\x8a_\\x19\\xae\\xd7e\\xbf\\x12>x\\x8e\\x02\\xdd\\xcap\\xa0 b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5\\xd3w\\x95-\\x03zdls\\x95\\x10\\x04x*\\xbf/\\x96o\\xfc\\x8f\\xfe\\xa8(\\xfea\n\\x03g\\x8b\\xec0h>y\\xba\\x18)\\x82\\x8d\\x00\\x9b\\x0e\\x916l"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8dw\\x0b\\xabu\\xc2\\x88%\\x1c?\\x1a<\\x8b\\x90\\xf9fk\\x19\\x85\\x15\\xed\\xe1\\xc2\\xb1\\xb1-\\x1d\\x1b\\xe9nx\\xa1_\\xcb\\x8del\\xea=\\xcf\\x0b\\x0b\\xd1\\x8e:s-7\\xb3\\x10\r4\\xc7\\xbct\\x87\\xe3\\x9f@\\x14m\\xd8>\\xfa\\x86u\\xb9\\xe5&\\xd0\\x84 \\xf0ma\\xb7\\xd5\\xbe\\xbb\\xd8\\xefk\\xc36j\\xfep%\\x950k(\\xd7\\xa6\\xd5m\tt\\xa8\\xe2\\xe3\\xc9\\xb5\\x83\"\\xcc;jg\\x1a4\\x9d;\\xebl\\xf9\\x96z\\xe4\\xaa2-\\xcc\\x18;\\x97br\\x8f\\x14\\xe8\\x8a>\\xaa\\x96\\xd9y\\xd4\\xdd*m)7\\x0f\\x7f\\x98\\xa2\\xa7\\x1an\\x8b(feu\\x1b\\x81j\\x15moe\\x9d\\xa7\\x9a\\xa3\\xb0\\x8b\\x1c\\xbd%\\xf6\\x1c1\\xb4\\xf1\\xcfhk\\xa5\\xf7\\x9co\\xa2\\x86\\x91\\x10erg>\\xa2\\xcaq\\xd9r\\x10\\x8c\\xd1\\xb4c6\\xfe\\xfd\\xbd\\xee\\xb5\\xa9o\\xff\\xaf\\xed\\xe9\\xc4\\xf1\\xfc\\xbf==\\xad\\xc5\\xe9!\\xedc\\xf1\\x86@4\\xf1\\xf3\\x83i\\x0b\\xf4'\\x0f\r\\xf2!\\xa0z&#\\x8by\\xea"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6-\\xb3\\x8d\\x86\\xec\\xb3\\xc5jdc\\xf4\\xfe\\x10f\\x8a\\xb9$\\x8c\\xdc\\x84\\x84\\xd3\\x94\\x98\\xaao\\xc3`a\\x08 \\xfb\\x0c^x\\xd9\\x11\\x8dg\\x98*\\xd2c\\xc1p\\x01\\x19\t_+y\\x8e\\xe5\\xfdtx\\xfd%&\\x02\\x06n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n@q\\x9f1$\\x01\\xf1\\xc7\\xf5~\\x98y\t:\\x12\\xc9h\\x90\\xbd\\xda\\xcb\\xde?\\xc5\\xff<\\xc8\\xeb\\x85\\x06\\xc1\\x9c\\xd9\\xa7\\xfe\\x8a\\xe1\"\\x84\\xeeq\\x15\\xd2\\x13\\xf7\\xf7"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\x14\\x98\\xfd9\\xdb\\xb7z\\xc7\\xf4\\xb9v\\xcabe\\xf39=\\x1f\\xbddi\\x15o\\x8c\\xeay\\xce\\xf6\\x87\\xfa\\xe0\\xfc\\xd2\\x84,\\xfbz\\x87 o\\xaa\t\\xc0\\x8a\\xe4\\xee3\\x9a#\\x15\\x8c\\x12\\xeb\\x9e\\xa1\\xaa1\\xe2\\x84\\x91\\xc1\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|em\\xc6\\xb8\\xf6^\\x0e\\x9b$\\xdb\\xf3\\xf6\\xed1:\\x85\\xb5i\\xcac\\x8e\\xba\\xfa\\xa4\\x07627\\xedh\\x1cx\\xf5\\xde\\x12\\xa0\\xec8\\xa6)\\xa6\\xb1\\xd3-"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\x94\\xb7\\xef\\xf2\\x85\\xc2_9\\x96s\\xb8\\xe4\\xf7\\x1ci<x&\\x1d-\\xb0\\x9fr\\xc8c_)\\xc2\r\\xcd\\xf2zq\\xef\\xb2\\xbapt!'.\\xba\\x8d\\x91,j\\xd6v\\xc4\\xa1\\xd1\\xc5\\xc8\\xbb\\x8f\\xfa\\xbb\\x930\\xf5u\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xa5y\\xc2h\\xbe\\xc4\\xf7\\xb6\\xc1@u\\xb2\\x13\\xfb+7f:e\\xb1`e\\xc8\\xd4+\\x8c\\x04\\x02\\x8a\\xfe\\xa5\\xbcq\\xe5f%h\\xc1\\xf9\\x05v*\\xde\\x1a"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>v\\xd0,;\\xf3\\xc7\\xda\\x80\\xcb\\xfd\\xe5\\x98%\\xf1f)u\\xd3\\x05\\xd1\tqt\n|\\x11\\xe0n\\x83f\\x8d\\xd0i\\x85\\x1b.\\x0c\\xbc5\\x82p\\xcc\\x12\\xa5tb\\x93\\xaf\\xbd\\xc6n\\x8e\\xbc\\x8dn\\xf7\\xd3d\\xf3pdy\\xd5a\\x96\\xfby\\xc2\\xee\\xd7\\x0f\\x02\\xee\\xca:z+7'\\x03\\xfb\\xf6xx\\xcc0x\\xf6*b\\xf4\\xda.3\\x7f\\x98\\xe1\\xf4\\xfe\\xa1\\xba\\x88\\x19\\xdf\\xb1oy\\xfe\\x84hq\\xe7c.\\x92\\x93\\xc34\\xe55x\\xdc\\x97\"\\x91\\x0f\\x9a\\xc0\\xd0\\x13\\xfa\\xeaowh\\xfa'\\xc3\\x97g\\x8a\\x1f\\xa2\\xf4\\x9f\\xde\\xf6\\xb1a\\xa5(\\xafb\\x01\\xc5\\xa1!o\\x9b\\xfep\\x7f\\x1b\\x89\\xfeibv\\xf5\\xfe~\\xa7\\x00\\xe1\\x84\\x8c\\xf3 v\\x94\\xbdg%?kn\\xddcs\\x07\\xb7ba\\xcft\\x14\\xe9y\\x8f\\xb4\\xcb\\x7f\\xe4f\\xa6\\x8c\\x95\\x80s\\x9b\\xb2fk4\\x8b\\xe7#,\\xa1\\xc0\\x9c\\xb6\\x8c\\x8d\\xc0w\\xc7\\xa1\\xe8\\x1c'cg\\x19: ag\\x8c8m&\\x91\\xab\\xb9"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85\\xbb\\x18\\xd0,\\xac\\xe6\\xd9\\xa0\\x87\\x18\"\\xdf\\xd5c\\xa82\\xfd\\xa3\\xe3\\xb9\\xd4\\xe1\\x08\\xb0jp\\xf8\\xd2@o\\xbf\\x06d\\x06\\xc7\\x81\\xe8a59\\xe7\\x01\\xdb\\xf7go\\xbf(a\\xaap\\xbbc \\xaczb\\xf9\\x04\\xf0\\xa9\\xe0\\x9f\\'\\xe2\\xe0\\x90l\\x19k\\x8d\\x14\\xb7\\x936\\xb5\\x1an\\x9dmw\\xf3p@\\x95\\x9d1\\xed\\xfed\\x0b3\\xa4@r\\xff\\x82\\xe0h\\x1c\\\\xf5w\\x14\\xbb\\x9d\\xc2\\xa8\\x83~\\x8d\\xa7\\x80\\x9d\\xa3\\xa2\\x97\\x08\t\\xb5\\xb8\\xdb\\xd0\\xa9k1\\x01\\xc8\\xe0\\x0e#h\\xcc\\xcc\\xd6,\\x0b\\x7f\\x90i\\xc7\\xe7\\x91`y\\xc5\\xdb\\\\xa0r\\xf7-k\\xb4\\xf4\\xd3\\xfe\\x0f-\\x9a\\x89\\xda'\\xf4\\xfc7\\xcf\\xa5\\xe5qd&\\x0c\"\\x83\\x07\\xbat\\xb4\\xb8\\xd0\\x7f-\\x1f\\x8cc\\xca\\x99\\xd6\\xe4r\\xb8lr\\x02k\\xac\\xdeu\\x1e\\x05\\xc1\\x90\\xa2%9<\\xdel\\x1f\\xc9\\xbbh<\\x01\\x90\\xd2i\\x15h|\\x1f^\\xb4c?\\xa4\\xed#l\\xd4n\\xcc@\\xc5\\xa8\\x8c6w\\xa3\\x08\\xb0\\x1e"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xc0\\xedv\\xbc\\xbbghy\\x91\\x15n\\x90e\\x94\\xfa\\x17\\xb7\\xa8$\\x95ken\\x03\\xb7\\xb0\\x97\\xe3\\xf5\\x8d#~\\x01\\xe7iv-\\xb2\\x0c\\xb7\\xfc\\x8d\\xed\\xd0\\x05q\\x7f\\xa1\\x02\\xe3=:\\x1bg\\x07\\xdfgtx\\xc9\\xd6q\\xa1l\\x8b\\xaa\\xc8\\xa6~\\xdf\\x80)\\x8ciz(\\xd1e\\xb7\\xe2ske\\xca\\x12\\x96\\xf5\\xe2\\x7f\\xbb>\\x1bl\\x80j\\xc0e\\x12\\xa2p\\xdeah\\xa1\\x8b\\xeav\\x1f\\x12\\xa7#\\x05\\x10\\xce\\x84g3\\xe5\\xf3`\\y\\xcb\\x07\\x9dk7\\xd8\\x80(p\\x11\\xec\\xa6\\xb4s\\xfa\\xddi\\xe6\\x84\\xe72\\xfe8\\xf9\\xd9\\x8ar\\x86\\x192a\\xaf\\x1c\\xd2\\x05:c\\xff4\\x7f\\xd9\\xd3:x\\x9c\\x8bx\\xa83\\xe1\\xf5\\xd2\\xf7l*\"u\\x99\\xccj\\x8b\\x00\\x19\\xda:\\xaa\\xc5oc>$\\xcb\\xe3\\xd8o\\xd6\\xa77%\\x86\\xe2\\xd3\\x03\\xf7\\xa7n\\xb5\\xbd\\x13\\x19\\xeen\\xe2\\xd8\\x9d\\xef\\xe9\\xc1\\xb8\\x85\\x12\\xc1\\xa0\\\\xab,t\\x12l\\xfc\\x1cx80\\xce\\x98za\\x1c\\xc1\\xb1%\\x03\\x06"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xf5\\xf1\\xf7\\x97\\xa2\\xc2\\xc4\\xc0\\xc7\\xad\\x9a\\xc9\\x07\\x01\\xb8to'\\x87\\x85\\xa8\\x1c\\xe9\\x94\\x01\\xb4\\xa8\\xb3\\xd3li<\\xf3<\\x03\\x04\\x8e\\x0ce\\x86\\x8306\\xf0\\xb0o\\x08^\\xc66\\xb1\\xb9u\\x04o\\xb0\\x12\\xad\\x1b\\x9d\\xbb\\xf6\\xadta)1'\\xc7\\xe3\\xd6\\xc0\\x0eb\\xa2\\x85'7zyt\\xc1\\xb2(l\\x8b\\xe6_\\x13\\xaa\\x86\\xbc\\x97\\xad,n\\x1b\\xdc&\\x81\\xf5\\xc8hb\\x0fg\\xdckrml\\xb8\\xc2\\xcf\\x14\\xd66\\x96\\xe2\\xe1\\xeb\\xe6\\xcb\\x9ck\\xc5\\x85\\x90\\x11\\x89\\xb7\\xed\\xaf\\x90a\n\\xc4\\xf1\\xcag2%\\xd2\\xc4\\x96&3x>\\xaf\\xac\\x06i\\xbc\\xa2\\x82b@:s\\xf9d\\xbcl\\xe5\\xdb\\x94\\xcb\\xfa\\xcf/\\x1a\\xb4`\t\\x0b(\\xb3pme\\x9d\\x8an\\xb2f\\x0f\\xf0\\x83\\xc1:\\x85v\\xa1*\\xaa\\xe0\\x90\\xfdx\\x0f0\\x83pz\\xcb\\xfb\\xdd\\xf8\\x14\\x86\\xa5\\xc5\\xd5\\x19\\xcd\\xed\\x11\\x82m\\xb3l\\x8a\\xf8\\xa0y0\\x06\\x9d\\xf69\\x9e\\x9c\\xb7jl\\xac8/\\x0c\\x00\\x1fio\\xb0v\\x88"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x84mh\\xb4b\\xe3\\xf8\\xc5u8`%m\\x90ya\\x06%\\xfa`\\xe1\\x18\\xb8\\xdcb\\xaf*\\xd4\\x9d\\xf1\\xb9`\\xe8\\xf3\\xcfn\\x18o0o\\xec\\xefn\\xc6(\\x14\\x87\\x90(_t\\x99^\\x06vu\\x9cr\\x13\\xden\\xca\\xe2\\x0b~\\xc5\\xcc\\xe2i<c\\xc58\np.\\x9az\\xc1'zu\\x8a\\x00<\\xb4\\xd1\txr\\xc30.\\xaa\\x03\\xf9\\xf2\\x90\\xd78\\x17\\xa8b\\x114\\x9c\\xe1gf\\x17y\\x98\\x0c\\xd0j\\xcf\\xa8\\xe40@\\xa8\\xef^h\\xa2\\x0e:\\x84\\xd0\\xd0\\xf5\\xb8\\x98|\\\\x10\\xab\\xd2wrv\\xc7yt\\xe4\\xb8(f\\x04\\xf4r\\xa2y\\x99\\xd1)\\x1e\\xfbi\\xbb\\x9f\\x04\\xb4\\xe3\\x942\\xde\\xf7;\\x01\\xf6\\x81s\\x01\\xeb\\x1d\\xd9\\x04\\xd2\\xa8<\\xc5:\\x88\\xab\\xff\\x98\\x99\\xa9\\xee\\x83=\\xdb\\xa6\\xa6\\x0f\t# \\xce\\xe9$\\xf8\\x0e\\xa6\\xd3f\\x87$\\xc7>!\\x8as\\x8e\\x8f\\xed\\x9c\\x10\\xf9\\xe9\\xe7iv\\x8a\\xd0\\xa6\\xa6\\xa9+h\\x9a\\xa12h\\x89\\xf1\\x15\\xcf\\x13$\\x03"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010bv\\x07\\x880$\\x96z\\xd4+\\xb8\\x1bm\\x12\\x8d\\x19xw\\xf32>y\\x84\\xb5)\\x9d-\\x91\\x03\\x88m\\xd3d\\xb0\\xb6\\xd7\\x88\\xaa\\xcbb\\xa0\\xdb\\x00\\xc5\\xa0 \\xb5'\\x13\\xaft\\x93\\x02\\xf2(\\xe3irgx\\xf3\\xedd\\xc7-\\x9b6&\\x9e0(\\xc9%\\xc6%\\xff\\x0c\\xf8\\x0fet\\xdc\\xad\\x08v\\xbc\\x83d\\xf1?\\xa6z\\\\x11\\x7f\\xfe\\x02s\\xe7\\x05^\\x86w\\x0f\\xb7\\xb9\\x93\\x13\\x1dr\\xb8\\x97h\\x91\\x92\\xfb0\\xe5=\\xd5\\xef\\xbb\\x00\\x84yf\\x03\\xa1e4$nk#\\x7f\\xa9\\xed\\xea\\x9et\\xdaas+w\\xa9o\\xc4\\xaf\\x84\\x15\\xa3\\x02\\x163\\xc2\\xac~'\\xa7\\x04\\xcd\\xe4\\xb3o\\xc1\\xaa\\x15v\\xf0\\xde\\xabnw\\xb6\\x03\\xb8\\x83a8gw\\xb6\\xaa|\\xf6\t&\\x1bkc!k\\xa2=2\\xacj\\xf9\\x0e\\xb2\\xb4l\\xb9o\\xfa\\xa6\\x1c*\\xea\\xe0g\\xab\\xd3\\x9btboj\\xe1\\xc2m\\x91\\xb8\\xc7\\x86\\xc2yxs&g\\xf1\\x12bl9\\xb7\\x06\\xa3f\\xdd\\xaa\\xba\\x8bs\\xae\\xbd\\xe1\\xdf"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,l\\xfec\\xc1\\xf8=qd\\x95m+\\xe3\\x82\\\\xf3\\xbc\\xbf\\xd6\\xe1`\\x04mu\\xe86\\x9e\\xad\\xc1\\xb1\\x04\\xc5\\x0b1\\x1f\\xbe\\x8c\\x0e\\xfcd\\x8a\\x96\\xc8p\\\\xd4(\\\\xb31\\xbew\\xb9\\xc4\r4\\xa3w\\xa5\\xb1\\x18,\\x18\\xba\\x12\\xe2\\x19\\xb0\\x93w\\xa0\\x9a\\x0f\\xe2~\\xd9hi7\nd.\\xb9\\xb8\\xfd\\xdc|\\xfb\\x9d\\x0b\\x9c0\\xea\\xe0\\xb6\\x85\\xe8\\xc6\\xcd\\xa8!\\xa3\\xbf\\x0c\\xb4bm\\xaf\\xd9$zg^\\xee\\xd0\\x88g\\xb6\\xca\\xf7\\xd5\\x7f\\x08\\xe5\\xe1%.\\x8ci\\x0e#\\xce\\xe7\\xa6\\xe1\r\\x1fa8@\\xca\\xe7\\xd6\\xed\\x80\\x0f\\xd8o\\xe7\\x96c\\xff\\xb8\\x1b#\\x13\\xa3v+jy\\xe5\\xefc\\xfa\\xbat\\xa7\\xa7y\\x0c\\xf0\\xd5\\xe9(\\xd0w\\x0cx\\xd7\\xbd\\xff?\\x0e\\x88\\x8e\\xea\\x86\r\\xdc\\xcd\\x0f\\xcd\\xa4\\xe8&\\x95\\x17\\x90\\x08\\x12\\x80\\xe6\\x1f\\x1b\\x0b\\x17\\xe9\\xcds@\\x97,\\x87\\xa6\\xc1k\\x15wf\\xfe\\x890\\x15\\x80\\x86\\x15\\xef@\\x03^?:\\xcf!\\xc6\\x16*w\\x1e\\xae?\\xb0\\x9d\\xa4\\"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8\\xfa.\\x8e.*\\xe9+\\x19\\xb0sg\\xe5\\xff;o\\x88\\xee\\xce\\x01\\x06t\\xfd\\l\\x89lw\\x92\\xe7-\\xd1\\xc0\\xdb5\\xf6\\xef^\\x9bg\\xee\\x8f\\x9e0*j\\x9f\\xc9\\xa0ft\\xfa\\xe6w\\x91*c\\x10\\xfa\\xb4q\\x93\\xa6\\x93\\x9a&\\x9e\\x92\\xb5\\xe8so\\x91z\\xb2\\x82\\x80\\x87.\\x8akb\\xa1\\xef\\x9f\\xbb\\x9c\\xfe\\xf8\\xcd\\xc1\\x1c\\xa8\\xd1\\xb1\\x0b\\x1b\\x9e\\xba<\\xda\\xa9:\\xa0:\\xde\\xb0\\x93 \\xebj*\\xc6_w\\xd3\\x7fo\\xd5\\xc9\\x15\\xb38\\xb0\\x0bt\\xe2)s*jq\\x16p\\xd7:\rz\\x02v\\xe1\\xear\\xd7\\xca\\x15\\x06$s\\xf0\\xd8\\x03\\xe7y\\x01\\xc8\\x9fh\\xb7\\xf7<\\x9cg\\x8aa\\x93e(\\xa6l\\x96\\x9c\\xa1%+gn2\\xc2p'\\xa5ku:\\xb5\\xa1\\x93\\xc4i8\\x03\\x855\\x80\\x1b\\xf7\\xc5\\xa9\\xfa\\xfch\\xf4\\xe7\\xc1\\xc4\\xcc\\xd886)\\xec\\xf1\\x06\\xc5\\x9b\\x06\\x0bo\\x9c\\xba\\xd3\\x90?\\x0fe\\x8d\\x84\\x84\"\\x01kx\\xc8n\\xcffo5\\x94@\\x97g\\xd76."
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mx\\xaf\\xb2\\xb7\\xf8p\\xfae\\xb6\\x17\\xd0vs\\xd7\\x042^\\xd5se\\xa9\\x11\\xd2\\xf4<q\\x86\\xb90\\x1b+\\xd7q$\\x13\\x81,e\\xe3\\x9a\\t\\xb9\\xc0\t\\xc7\\xd5\\x00w>\\x10\\x9d\\xde\\xc4u\\xf0~\\x7f\\xdat\\xec+./\\xe6(\\xa4`f\\xbf~\\xe2\\x1a\\x89\\xa1\\xd1\\xf0\\xdf\\xfd1\\xf5\\xb6\\x97y\\xa1\\xbd\\x05\\x96\\xfd<\\xff\\x9c`\\xcf5\\x19j\\xd7\\x7f\\x15\\x0en\\xf2h\\xd0j\\x02\\x8c\"\\x05\\x15wv\\x93ok\\x92\\xf5\\xf7c\\xc9\\xcer\\xb4\\xcc\\x07\\xfc\\xcf?\\xe8qf#%l\\xa7^|\\xc2b$\\xf9\\x03\\x89\\x8c\\xff\\x1f\\xb6\\xf0\\xb1ey4\\xf3\\x02gf!\\x1f\\xc0\\xfc\\xc3\\x1cld\\xc0\\x17\\x91\\xaf\\xc0t\\x87\\x86\\xda\\xf7\\x0f\\x1a|\\x87\\x1cc4\\xc5\\x9c\\x89\\x1b2\\x04\\x9e~)\\x11\\xe2zf\tw`wi\\x07\\xb1fz\\x98\\x08\\x97\\xa70\\xcf\\xf8\\x15\\xe1\\xb9\\xea:\\xe5\\x95\\x95w\\xfa\\xed\\xfe\\xd2y\\xbf\\x99\\x9c\\xa6\\x8c\\x0et\\xea\\xfd\\xb8 v\\x9cpp\\x9a0km\\x95"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\xc5e\\x02\\x04\\x95w\\xf8\\x1d\\x17\\xdfh\\xc5\\x1d\\x88\\x10m\\x9f\\xa8\\xafwdu\\x15\\x9e\\x0b\\x87y\\xa0\\x0b\\xf9\\x87\\xd6\\xde\\xc5\\xb8\\xd0\\xac\\x91vso~\\x98\\xfb\\x07$\"\\x95\\x8fp(\\x10\\xa4\\xf5\\xec\\x140>\\xa8\\\\xf4p\\xdd\\x11\\xc51\\xc8p\\xce\\x9c\t\\x8968\\xc8\\x9bu\\x92c;\\x12\\x83`\\p\\xe92\\x94\\x05;\\xaa\\x9cag\\x1d\\x87x\\xae\\x07#h\\x9d\\xc4\\x11\\x85e\r\\xa6\\xc5\\xcd\\x0c(\\x01\\x0e?\\x10\\xe7\\xc3\\xfa\\xb0\\\\xb9^\\x15\\xcdm\\xd3\\xdcd\\x8c.|\\x00\\xbdp\\x91-\\xb2\\xe2<\\xcb\\x1f\\xa9\\xa4\\xf6?\\xc3\\xfd\\xcdp\\xe4\\xcb\\x1c\r\\xb1z\\xde^\\xba\\xac\\xbel3=f`,s\\xcd+\\xeb>&e\\x9b_\\xba#\\xb8\\xcd\\xed'\\x88\\xc29\\xc8m(d\\xbf\\xd9\\xf3\\x14\\xb3\\xad\\xcb\\xe2\\xac\\xf1g?\\xe2mtb\\x8c\\x8e\\xd1\\xe2\\xca\\xfc\\x83\\x92\\x87\\x97c\\xd1=+\\xbcod\\xdcp\\xe9pq\\xbe\\x93g\\x07\\xfdki:oh\\xa3\\xd7\\xe2\\xc7h\\x16\\x87lf"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16y\\x19\\xf9\\xd2<d^=\\xf1\\xc3\\xc0\\xc2k\t\\x8a\\xf5'\\x93\\x80;\\xa3\\xac\\xc2gf\\x16u\\x87\\xd0\\xa6\\xc1\\x90\\xbd\\xf6\\xa7\\xc41\\x86s\\xa9v\\xb02v\\x99\\xc1z\\xad*\\xd5\\xda\\x8e\\x82es=\\xb9\\xfc\\xc3\\x9c\\xef\\x00\\xb3\\x9d\\x93\\x01t3\\xde\\xe3h,p\\xe3\\xf1\\xf7\\x94\\xc9\\x10)%\\xf0\\xd4r6b!?\\x9d\\x81\\xf4\\xfc6\\x17\\x1dp\\x12\\xcf\\x12\\x06?\\xc0\\xd0\\xb6\\x178\\xdap\\xa2\\x98\\xe44?\\x8b\\x19\\xab\\xeb\\x1e\\xdb\\xaa3a\\x00\\x05\\x1b6\\x9c#\\x13\\xf9\\xdb\\xc9p\\xc5\\x82\\xd9\\xa8\\xfa\\xb2j\\x06\\xe4\\xd7d\\xfc\\x7f\\xe8\\x87\\xeb\\xbe\\x80\\xa4b=e\\xa6\\xf2\\xceh\\x03\\xd2\\xae\\xdf%\\xe9s\\xfa\\xff\\xeb3r\ri\\x1a\\xb3g\\x1d\\xe8\\xefid\\xb7\\x14z<\\xbf\\xf0 \\xa8\\xc9\\xc9p\\x0f\\xfa\r45\\xe8z\\x11:dl\\xa7\\xe5\\xa9)\\xc0\\x02%\\xcb\\xdcpu\\xa8x\\xa4\\xca-r\\xf0\\xf3\\x9en\\x8dl\\xa2hq\\xa3\\xd7(\\xfd\\x81\\xd2\\xd1\\x81\\x89\\xfeh\\xc7\\xb8\\xc5q\\xb7"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\xc85\\xd6\\xeevyo\\xc0g\\xca\\x0es\\xb2ht\\x87\\xaf\\xf8\\xfe\\xebr\\xc7\\x1e\\xe4\\xf40gip\\xa5w\\xa7\\x81\\xc5,\\xd7\\xc3c\\x00\\xcb\\x8e8\\x99\\xf5lo\\xdfj\\xf5\\\\xb6\\xb5\\x93\\xc78\\xb8\\xa3\\xfa\\xa2\\x90\\x95\\xa5\\xc7\\x1bf\\xd8y'\\x02\\xfex\\x1b\\xe5x\\x08s\n\\xd4\\\\x9c\\xf0\\xf4\\xcaqxy\\x8fu\\xc6\\xa45\\x10\\xc3\\x9ad\\xb8\\x89\\xfd\\xe3\\xff/\n\\x8b\\xb6\\x1d\\xe4\\x81u\\xab\\x98\\xaf\\xca\\xd8)\\xf0\\xe4\\x14\\xb3\\xaf1!\\xaf\\xac\\x9dh\\\\xa4l98\\x83u\\xff;\\xbai7\\x97hw1\\xa75\\xf7\\x9eve\\xa2\\x82\rxl\\xc6:\\x99\\xc9\\xb6\\x90\\xd6\\xf7m\\x94\\x8e \\xf0\\x90*\\xb2\\xef\\xaa\\xe5o\\xa7\\x98u\\x1bl5\\xee9\\xdb\"\\x80`\\x91\\x04k\\xb3\\x8d\\xe7q\\xc7\\x08t\\xb7\\xe9\\xb8!yd\\x9cp\\xd8\\xf4\\xdb\\xd6|\\x9a\\xf4gilp\\x11f=\t<t\\x86\\xbe\\x06r\\x11\\xf3\\x95\\xc0\r\\xd3\\xc1q+\\xf5\\xbc\\xa9\\x82@6\\xa2\\x05\r\\xfcxz\\x9b\\xac\\x8bs"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91t\\xfe\t\\xf1f- \\x04\\xb9x~\\x88\\x83jt\\xaf8p\\xce\\x06\\xc8\\xe3\\x9a\\xd1\\x15\\x13\\xdd\\x8by\\xd9\\xab\"\\x05\\xc2i\\x8d\\x81\\x04\\xb6\\xd6\\x11\\xd6\\xa4\\x04\\xd4f\\xf6\\xb8n\\x12\\x80\\xd7\\xe0\\xdetnq\\xaa\\x97\\xd7\\x93u\\xe2\\xd7\\x90\\xfb\\xc9\\xbd\\xecv\\x01\\xa8\\x1a\\xb1\\x8a\\x91m8\\xca\\xba\\xadi\\xab\\x92b\\xfc\\xaeub\\xe2\\xa3_\\xca?\\xfa\\x1ef\\xba\\x1b\\xf1\\xa4u\\xd1\\x90\\xf0x\\x0c\\xe48\\x89h\\xe0\\xd5\\xc0\\xa8\\xd6z\\x1b\\xc20$\\xbe\\x9e\\xc7\\x8f\\xb6\\x7f\\x97\\xbf\\xbe\\xab\\xea\\x93b\\xa3\\xe2\\xbe\\x06\\xf5e$y\\xc4\\x0fl_\\xb2\\x11\\xff\\x15\\xd4\\xe8e\\xb0\\x8awix\\xc7\\xa2\\xde\\xfe:\\xe4\\x8e\\xcb\\x08\\x8f\\xda\\\\xb2\\x80\\x91\\xd0\\xa7\\x88\\xb4\\x1b\\xe5\\xad\\x93y\\x85/\\xb5\\xe7b;8\\xfb\\xdb\\x12\\xed\\xb5\\xdd\\xb8\\x11\\x152\\x01\\x83\\x85\\x12\\x8b1\\x984m\\xd5\\x9fy\\xd5^\\x90\\x07\\xc3\\xfe \\xe5\\xb7\\x01\\xc6k\\x12h\\xa7\\x19\\x12\\xb8r\\xa0)3yl\\xe8\\xc7\\xc3\\xfe\\x07\\xba\\xf4\\xad\\xc5\\xe7\\x12"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bw\\x0c\\x0e\\xc8\\x121\\xbd\\x8cfq\\x00\\xfb\\x956\\xb7!\\xaa9\\x8d\\xa4\\xfd\\x84\\xbfm?\\x12\\xa3/\\x03u9\\x15w\\xaa\\x1d\\x8b\\xb7\\xf2\\xcbo\\xab\\x01-ls\\xbc\t\\xa7slvtexk\\xce\\xda\\xee$\\xfbe\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006o\\xfb\\xb1b2\\x94\\xdb\\xafn\\x11<\\x1a\\xcc\\xc4gf\\xa7\\x0e\\x80\\xff\\x18&2ne\\x89(\\x87x\\x9b\\x90\\xe3a+\\xe7\\xdd\\x0c\\x0e\\xb6v\\x15\\xbe\\xf4\\xb9\\xfd\\x81s"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xfe:9\",\\xc1e\\x98z7\\xfc\\xb2i\\xda\\xdc\\xa5\\xce\\x99\\xb5\\x96\\x98\\x1c\\xfb\\x05g6\\x94lg\\xf2\\xa0\n^\\xd7^ac\\xb2\\x9b\\xdb\\xc5\\xb0\\xcfz\\x0c\\x87\\x96\\x84\\x1a:\\x045\\xea\\x01\\x0f7o\\xcfjc?\\x196\\x12y.\\xc7\\xff\\xbd\\x94\\xb5f`\\xbd\\x89\\x92s\\xce\\xcd*\\xb1toz\\xbb\\x19\\xad\\xfc\\xcf$\\x18 ?\\xe5\\xdb\\xf9\\xd7\\xfa\\xf8p/\\x88$\\xdd\\x10\\xf3\\xd0\\x05\\x15\\x7f\\xe9q\\x8d`\\x9f\\xbb\\x03\\xf9p\\xc2\\x01\\x9c6\\xf6\\xd3\\x94\\xc9\\xb3rf\\x01\\xf9\\xc5?\\x89&\\xb1\\xe4\\xaa|xx\\xd1a\\xd0\\xa9\\xf9\\xbd\\xef#\\x7f\\xb3z\\x17%\\xbfr\\xb8\\xc78,\\xd7\\xa5s\\xe3\\x17\\xe4&\\x08\\xe1\\xc5\\xc2\\x7f\\xdf\\xcb\\x13\\x87\\x95=\\x0b!^\\x89\\x00\\xe6\"\\x86!\r\\xb3+\\xd5\\x80\\xc5vl9m\\x9f\\xc5\t\\xa5x\\xf0\\x9f\\x1e\n\\xf9\\x92\\x81v\\x9cp\\xbe\\x17\\xa85o\\xd7\\xbf\\xf8\\xf4rw8\\xde\\xd3\\x92\\x11\\xc3g\\x83\\x83\\xee\\x92\\xbc\\x94\\xa89\\x1c\\xaf\\xc1\\xbfaw\\xf0lp"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"\\x86\\xc3\\xeest\\x94(\\xff\\xa5s\\xac\\x12\\xf28\\xb8u\\xe4u\\xa2j\\xde\\xb9>o\\x18\\xc6\\x1e\\x9f\\xe5\\xdc\\xd7\\x0c\\x1ft':\\xc7\\x8a`n?=cs\\xbf\\xf9+\\x86\\\\xb6r\\x83t\\xb4\"\\xbf\t\\xf5\\xe2\\xcfd\\x13\\x16\\x9bj\\xef\\x97\\xf1\\x81\\xfa\\x89\\x1f\\xe7k\\x15\\xa9\\x02\\xa8\\xab\\xa1p\\x83,\\xa0\\xcf\n\\xd5\\x1d&\\x835t\\xa00c^\\xac\\x904\\xe5\\xca\\xfb\\xb3\\xe8\\xad\\xc4\\x05\ryp\\xfe\\x84\\x10\\x11w\\x0c 6\\x11j\\xae#\\xdcm\\xb6\\xb2\\xf5p\\xa0\\x1f\\xfai\\xad6\\x9exc\\xa2\\xa4\\x9e<\rzs\\xb4\\xd9\\x95o?g\\x84\\xc5p\\x7f\\xa3~g\\xd3.5\\xc7\\xe3s\\xc0t\\xb1s\\x8b\\x1d*\\xd4%\\x8b\\xe5tqi\\xbe\\xa2\\x11\\x94\\xcf)j0\\xe4\\xb7\\xab\\xe5(iz&pb\\x90\\xf9i\\xfc\\xab\\xefu\\xdat3\\xbfg\\x17-\\x97\\xa4\\x97b\\xb9\\xb5f\\x87w\\xc3gc\\xb0\\x1e&\\xabq\\x93\\x83\\x94\\x086s:xia4\\xa0x\\xc5\\xc8,\\xc0\\x0e%\\x9c\\x1b\\xff"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9j\\xfa\\x1c\\x9a\\x1e@*\\xbb\\x06\\xf3f\\xedi\\xc2\\xe2\\x9c6\\xcb\\x8d\\x00\\x99\\xf8\\xba\\xc4g\\xce\\xd54~\\x85w\\xc6\\x94\\xba\\x83\\x058xf)rv\\xc6\\xcb\\x03\\xa7\\xb8&\\x9et\\x94\\x82\n\\x9d\\x01\\xe9\\xd3hx\\x0ct\\xb3r\\xdeh\\xd5-\\xc8\\xcb\\xe8\\xc3\\\\xee\\x92\\x9e\\xb1\\xbe\\x1fh\\xf5\\xcc 1\\xb5n\\x91c_\\x96\\xd8%\\xef\\xce0\\xe9z'\\xd89j\\x99\\xf1\\xf4\\x07\\xa4\\xb7\\xeaq\\x9e\\xf3j\\xbc\\x0b\\x94\\xb7?\\xab~\\xea&\\xees\\xe2%\\xea\\xac\\x0by\\xbc\\xc8\\xea\\x0e\\xd5\n\\xe8\\x90\\x85\\xca8\\x16\\x89\\xb6\\xc7\\x08\\xb6l|)az\\xe85y5\\x07\\xee\\xb5z?\\xf2\\xde>\\x90+\\x04\\xf9\\xf3\\xbdkf\\xb5\\xba\\xc96u\\xef\\x8b\\x82\\xe28\\x1b\\xe6\\xd2\\x98|7\\x96s\\x7f\\xa5\\x90v\\x93\\xaf\\xe5\\xf3\\xc4\\x0bbcq~\\x9bg\\x17\\xc3\\x9d\\x89\\xda~\\xceh\\xa5\\xfa\\xd4\\x98\\xe4\\xb3l\\xbf\\xa3k\\xf4#\\xef\\xff0;l2\\x96=\\xa0p\\x7f\\xe3\\xc7\\xec4rzl\\x85w&v\\x0e"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\x05\\x89\\x8e\\x08f7\\x87\\\\x1c*\\xd7\\xb5\\x1el\\xadpmd\\xd5~\\x017p\\xb1c\\xd3\\xbfj\\xf5>n\\xd2\\xac.qc\\x8axo\\xf0\\xf9`\\xce(d\\x95p\\x944\\xae\\x01q\\x7fn\\xdcp>\\x98z\\x19\r\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001~r\\xbc#\\xaev\\x80\\x8a\\xac\\xdbah\\x85\\x84\\xbc\\x91\\xe7>(n;\\xb8|c\\xcc\\x15\\xdd2\\xa6\\xa0!\\xb9q\\x95\\x10yk#\\x97r)\\x01\\xe3-o"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0e\\xcb\\xa6\\xfef@z\\xb2\\xeb\\xf5\\x9a3#\\x80\\x11\\xfd\\x80\\xb1j@\\xe7e\\x85\\xaf(\\xbd\\x91\\xa8\\x8f\\xb5\\xe7\\xae#\\x00\\xeef\\x10\\xbd\\xb6\\x8d\\xfb\\xa8\\x8d\\x10\\xf6\\x14\\xf4\\x02\\x05\\xda@\"\\x8f\\xc5(vig\\xf3\\xa9\\xc8i\\x02\\xa8\\x0c7\\xe8\\xe5x\\xc4s\\x8f\\x03\\xc5\\x8e\\x92\\x87\\x02\\x10.'\\x9d\\xceq\\xb0g\\xa2r\\xe0\\x83\\xd1\\xb9\\xfdq\\xee\\xb5\\xba\\x8c\\xcf\\xe4n\\xdc\\x82\\xf68\\xcc\\xf1o\\x0ezwo\\xf2\\xb4u\\xd8u\\xba!\\x04\\xc7$\\xa0\\xcev\\x93\\xc48i\\xfdlp\\x8e\\xd2\\x95\\xd4\\xfbc\\xc2\\xc0\r\\x17\\xe4\\xe6\\xca\\xf3\\xe1v\\x04\\x86\\xbad\\x83\\xd2\\xf9*\n\\xb8\\xf2\\x85f\\xaa;~>\\xee\\x14\\x9d\\xcc\\xa0\\x92\t-\\x16\\x97\\x0c\\xb3tb\\xc7x\\xfd\\x03\\x8c\\x98\\xe6d\\xc1\\xfa\\xa2\\xaeig\\x83o@\\x96\\xef\\xacm\\x96\\x92s\\xecp-\\xdf\\xb7\\xc4\\xab\\xb6\\xf8\\xbfm\\xcb\\xe4e\\xfa\\x8cs\\x83\\xab\\x1d\\x96\\xab,\\xd4\\xa1\\xf2'\\xfcn\\!\\xa0pg+\\xa7x\\xe7\\x07:\\xd0s?\\xd8"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010&\\xd6\\x0b\\xd5c\\x19\\x8a\\x13\\xdf\\xdd<\\xf2\\xabv\\xcfs\\x90w\\x1buy^\\xd2*\\xfdc\\xef\\xbf\\x12`9+\\xde\\xe8\\xbes\\x82\\x9d\\x1a\\x92\\xa8\\x11<\\xf8\\xc2\\x8f\\xd2\\xbe\\xd9\\xea1lh~\\xafs\\xa1)\\xdd\\xd2\\xdf\\xbb\\xad\\x84\\xa6w\\xa0.\\x13\\x1c\\xe0@(\\x96k\\xa2\\x88x\\x89\\xe1\\xe1>^j\\x1d\\ d\\x98\\x02g\\x96\\x80\\x01t\\xd5\\x90l\\xe7\\x94\\x138jj0\\xbd\\xb6h*\\xfc\\xeb\\xd4>\\x19\\x15n\\xf0\\xe9w\\x17\\x8f\\xd5\\xf9\\x0e\t\\x12d\\xde=\\xd3\\x9f\\xcba\\xa4\\x90\\x85e\\x9a\\xa7ej\\x1dm\t\\x92\\x93~\\x08\\xb2x\\x1e\\xb1\\x9dc^\\\\x1e\\x9fk\\x83|=\\|\\xbd1\\xfa\\xf2\\xfba*#<\\x01i|*\\x88\\x00\\xef\\xdf\\xe46$\\x9e|k#\\x1e\\xad\\xb9\\xa7\\x08\\xf5\\xa9(\\x0c\\xe5\\xec@\\xe2\\xfatrg1\\xf7\\x08f\\xda\tk\\xfc\\x88\\xb87#\\xd9g\\xff\\xff\\xe9\\x0bj%'+,'\\xd0=\\xf87zo\\xe8\\xba\\xf7\\xc6!\\x17\\xa9\\x92\\xeeuf"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xd6\\x99\\xdba\\x97\\x00\\xc5\\xed\\xaf\\xb2\\x1d\\xac\\xf2\\xe2\\xc8\\x8f\\xb1\\x19\\x12\\x83\\xff1-\\xbd\\xf1\\xa9\\xb8\\xd7o\\xf7\\g02!u\\x80.\\x97\\xf23b#\\xa8\\xb0q\\xe4\\xbb\\xd4q\\xe5|\\x95?\\x9ac5\\x14\\x8a_\\x03\\x95\\xcfy,\\x99\\xec\\xfb\\xaa\\xc0\\xf8\\x8d\\xf8\\x86\\xe2?\";^\\xa6*\\x0b\\xc2/\\xa0o\\x05~f\\x8e\\xb7\\xb2,\\x9f\\xa4\\x82\\x14\\xff\\x94+\\xd6\\\\x02\\x12\\x82\\xb0a\\x08\\xf00\\xd2\\xdcr`g\\xb1c\\x92\\xe7\\x11\\xc1x\\xa9\\x0b_\\xed\\xaa\\xedx\\xb9\\xf4\\x0b\\xcdn#y=\\xcb\tc\\x94s>\\xd3\\x92\\x03\\x957\\xb0\\x05\t|a\\xf3\\xcb\\x82\\xe4\\x83\\xdbh\\xb1\\xa5\\x1c\\xa6\\xe2;\r\\x8b\\x8e;_\\xf4\\xe2\\xd1\\x16m\\xa0\\xb8j\\xb86jq\\x10#\\xc9\\xc3u39\\x02\\xa5\\x13>\\x14\\xc1w-\\xe2\\x1d\\xd4\\xe7\r\\x151\\x0c\\x8b\\xb3\\xc8\\x86\\xbd\\x00 h\\x8a*\\x0c\\xc9\\xe3t\\xfa\\xc3\\xd7mh-\\x10\\xc3\\xf3\\x85siv@\\x89-\\x1a\\xce\\xc1\\xe5\\xfck\\x7f\\xa1b\\x04\\xe8"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xc5\\xafi|\\x98\\x04\\x15r\\x95\\x04\\x17\\x9btp\\xfa~\\x8a\\x11\\xc5e\\xee*\\xe0*\\xa7\\x87\\x99\\x81\\xa6,\\xd5nt\\x0e\\x82\\xcd\\x82o\\xcfx\\xd6d\\xd2qw\\xc2\\xe8*\\x9e\\xba\\x08\\xcf\\xd0\\x18\\x0e\\xf8q\\xb4yf\\xef\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\x180\\xcf6\\x8fas\\x85\\x9c\\xf0bhh\\xf8\\xff\\xb5q\\x1d\\x94\\x81\\x04\\xa0\\x13\\x0b\\x86|\\x0c\\xd2\\x06\\xa0h\\xb8\\xb3*\\x17\\xe0\\x16\\xd6\\xf6q\\xb1i\\xf1f\\xb8\\x0e"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x1d\\x93\\xd2~6tc\\x05\\x05o\\xd5\\x87\\xe6\\xa6\\xb5\\xcbf\\xd7zi\\xff+\\xab\\xdd\\x8fo\\x91\\xb5\\xaf\\x1b\\xdfx\\x11u#\\xc8\\xc0\\xb3>\\xc4\\xdf\\xd5\\xa1\\xe5\\xe8=\\xccvt\\xa1\\xd0\\xe0\\x08f\\xbe\\xc6_ki\\x90\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\x95&\\x1f\\xa4\\xdc\\x1b\\xe93\\xb8g+b\\xaf\\xbd\\xfdt\\xf8\\x8d\\xa8l\\xfa\\x9bv\\x0f\\xbc\\xa8fx\\x99\\x8f\\xa8\\xbc0gl\\x10\\xe1\\x8a\\xb2f\\xc6\\xbca\\xbc8y>"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\xc1p\\x8f\\x9e\\x0b\\x86\\xa5y\\x86\\xbf\\x80\\x9d7\\xe6\\xdddz\\x902\\xac\\xbf\\xee(\\x9co+,:\\xf4\n\\x17x\\xbef\\x86%c\\x9f8ygy*\\xf3\\xdc\\xa6\\xab\\x04\\xadu\\xf9\\xe9\\x9987:\\xa6\\x9b\\x85\\xc0\\x19m\\xd5.\\xe64\\xa0,ml%\\xa2!\\x17\\xa8on#;\\x86\\x84\\xdd#o\\xd7t\\x16mav\\xfb\\x0b\\x91g\\xd82\\x95\\x97\\xde\\x1f?\\xb2\\x9dz5\\x00\\x13\\x1a\\xd9\\xfa\\xa9\\x06v\\xe0\\x05f\\x04\\xcb\\x06w,\"\\x80\\xa5\\x17g\\xf5\\xd8j1\\xb5\\xcd.\\xe0b\\xba\\x84\\xd0@i\\x1b\\xde\\x0b\"\\xb0\\xb0\\xa1\\xb0t\\xcb\\xf3c\\xc0\\x1d\\xa4qr\\x07\\xd3\\x96\\xc2\\xddy1sc\\xe8\\xd4\\x7fp\\xef\\xa7\\xa8#m\\xce`\\x08\\x01.\\xeb\\x97\\x9c?\\x102\\xc6\\xd1\\x85:8\\x90%\\xae\\xc8\\xba\\xf5\\x0e\\x1e\\x1c\\xad\\x8d\\xa2\\x0e\\xd0\\xcf\\x02\\x8alij+`\\x9c\\xd3|\\x83\\xed\\xbf\\xef\\x93\\xf3\\xa2@\\xb3\\xb1v\\x03x\\xe3\\xe3eu\\xdc\\xd3@_\\xdd\\x07\\x90?\\x84\\xee\\x94"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\x9f\\xe5\"\\x95\\xf7\\x84r\\xec\\xa4\\x81\\xbfx\\xaa\\x07\\x07\"b\\x97\\x12a\\x9e\\x9d\\xe2\\x91\\xac\\xcc\\xf3\\x03\\xf6\\xf0\\x8b\\xe8=\\xfa\\xde\\xe5\\xd7\\xf8\\x02\\xfcj\\xe4v\\xcd\\x80\\x07/\\xd2oc\\x974\\xa6\\x14\\xf2\\xe4\\xbf\\xa3\\xa8\\x80\\x03\\x9a#!\\x05\\xbd\\xd2\\x88\\x84\\x0b\"qg\\x83\\x95\\x08+\\xfd\\xd7*1\\xff\\x9a\\x9f\\x03g\\x84\\xc4\\xfe\\xdf\\x86\\x9e\\xd8\\xaf\\x1d\\xda!\\x01\\xd0\\xdcp\\xa6\\x85\\xba_\\x1d#\"\\xf4\\x91\\xcb\\x8f\\x9e1i\\xf1\\xd2\\x86\\xb4(n\\xdf\\xb9\\xae\\xa9\\xad%\\x172\\x82\\xearg|\\xb8\\xa5\\x0bf\\xd4\\xa6\\x05&\\xbd\\xb6;\\x97\n@\\x0fj\\x13\\xbbn\\x8c6\\x90,\"nrq\\xccb#\\xf8q\\xbe\\xfat\\x1b\\x8fq_=wop\\xa6#\\xbf\\x14yrv\\x8c?\\xc8\\xca\\x1c\\xbb:\\x83\\xe6\\x82\\xab\\xfd\\xd5@\\x99\\xfb\\x89@\\xf2\\x7fj\\x90\\x99\\xc9\\xdd\\x8f\\xec\\x1f\\x91\\xe7\\xe5\\x08*:\\xdb:\\x18^\\xc2\\x19\\x04%\\xe8l&\\xcfp\\xdc\\xc57\\xc3\\xaap\\x82&\\xd7\\x12|"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86kk|\\xdd\\xdb+\\x0eo\\xc9\\x83\\xbb\r\\xb8\\xf5\\xae\\xba\\x85\"\\x82\\x17'\\x9c\\xb2\\xdeb\\xe3\\x9b\\x90\\x10\\xc8\\x89\\xd7\\xc5\\xe7\\xad\\x9e\\xd3n\\xad\r\\x1f\\x82\\x1c\\xd5*\\x0b\\x04fz\\xdc\\xfb#q\\x15\\xfb\\xf8\\xbez\\xfb\\xae\\xd5\\xd6d\\x88\\xd6\\xb4\\xb3m2\\xae\\xf9\\xd7\\xa3|&\\x87\\xb1\\xd4f\\x9b\\x87\\xe6\\x17\\x95~vs\\xe2zt\\xbd\\x16?4e\\xee^wc\\xa6\\x9fu\\xe7\\xc8q\\xeb\\x92\\x9b\\xf5\\xb1\\x90atr\\xf0\\x7f\\x1e\n\\xf9\\x0b\\xc7\\x1f\\xc4f\\xa7\\xa8\\xee\\xab\\xf6u=\\x1e\\xafkj\\xf8\\xef\\x94\\xb6\\x15\\x96io\\x8d\\x16+)n\\x8e\\x9c\n\\xaf$\\xe8\\x81\\xfb\\xf7\\xd9f*\\xb89\\xf4\\xb7\\xed\\xc7\\x9d\\x0c\\x19\\x106\\xb4\\x90\\xe2y\\x0f\\xe8|/\\xa4\\xe6`)\\x98\\x06\\xc8~\\x96\\x16,\\xa6\\x98\\xf7\\xe2\\x86_\\x99\\xa3#l\\x95pj\\x99\\x88\\xfe\\xf3\\x84\\x84\\xa6\\x065\\xc2,\\x90v\\x89q\\xcf\\x9cg\\x00\\xeb\\xf4p\\xfe\\x05:\\x19\\xf0j\\xda\\xa2\\x8e\\x8bei\\x90?\\x97t\\x86(y\\x9a\\xb3"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14\\x97\\xb4\\x92\\xec!\\xa8\\xda\\xab|\\xf9\\xaf2\\xe4\\x9f\\xe7)\\x93\\x9f\\x16\\xff\\xcb_t+\\x90\\xadz\\xf0v\\xe1\\xf1c\\xad\\xfa\\xce\\x08\\xe6\\x03rb\\xd3\\xfd\\xa9\\xa2\\xb5bov\\x10\\xba\\x01m\\xe13\\x15\\xcc\\xd5\\xf3\\xdf\\xda\\xfb\\xfd\\xc1\\xf7\r\\x1a\\xd9%\\xf0\\xd6\\xbd|\\xdcg\\x7fqu\\x9a\\x8fx#\\xac\\x92\\xf9\\x136\\xe9$\\x15\\xdb\\x1a\\xb7j\\x1c\\x82\\x18\\xda\\x01\\xdb\\x05\\x97\nl\\xdbbr\\x8c\\x8e\\x05\\x80\\xe4t\\x16\\xf2\\x94\\xcb\\x839\\x81\\xe9\\xdb)\\xb8\\xbez<\\xba%j|y\\xdb\\xe9\\xd9\\xe4\\x85v\\x14>\\xab\\xa1\\xbbri\\x04\\xa3\\xa0\\x12\\x13\\x18\\x0c\\xd2\\xaf\\xa62kc\\xc9h#\\x9f\\xb6o\\xf2#\\x89\\x00d\\xfc\\x13\\x000\\x1bdf\\xf3\\x85y\\xac\\xf2b\\xbbp\\xe0>\\xb7\\xc2\\xc6\\x9b\\xbf^\\xb2d\\xb3sm\\xca\\x07k=n\\xa8\\xa9\\xd0\\xdb=\\xc8!%\\xb3\\x7f\\x97\\x16\\xce!\\xdd2\\x0c\\x0e\\xcc0\\xac\\xe6\\x9c\\x81\\xdc\\xb18\\x80y\\xe3k|\\x90\\xfd\\xe0f\\x1d0\\xe1\\x15hpc"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04nhd(wri\\xd1`\\x0e\\xf6no\\xcc\\xe5raf\\xc6\\xc0\\xba\\xd5\\x06\\x82e\\xe2\\xa8v*\\xa5\\x10\\x8a\\x8e\\xcfq\\xfd\\x94\r1\\xf2\\xc9h\\xd5\\xa6\\xc3x\"\\x19\\x04\\xaa\\x83\\xa1\\xdb\\xb8<\\xa3\\xa8\\x97\\xac<\\x8e\\x97\\xa1+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_v)y\\xc7?\\xc1&d!vx\\xd0\\xaa\\x97\\xa1\\xfa\\x95\\xc4\\xe5\\xba\\x10\\x0f\\x1a\\xc3fy\\xd1d\\x95\\xe0y\\x02\\n\\xc7\\xa8\\x81\\xadgp\\xc9\\xa6\\xdf\\x99\\x19 "
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(ew\\x9f8\\x16e\\x8d\\xf6\\xa0xh\\xf3\\xa9\\xc0\\x00s\\xc5\\xa2\\xba\\xedq\\xa5e\\xc8m\\x12\\xd63\\xc1\\xb5\\xb2tc\\xd1y9\\x14\\xd5\\xb1dg\\x85?2c\\xc5\\xbe\\x87tk\\xdc\\xf9\\xa9`\\xd9\\xc0c\\xa0:2\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xcd;(\\x1e\\x0e\\xfa\\x81\\xecw\\xb1\\xf3\\x15j\\x7f)\\xfe3\\x8d!\\xca/\\xf5\\xe5\\xaa\\xd9\\xbfu\\xe8\\x19\\xe2;<\\x84\\xd8vj=\\xdevom\\xf7\\xd9\\x0c\\xd8l"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\x87\\x93\\x9f\\xf5\\x8e\\x0c\\xa2\\x17\\x81\\xd8\\x86\\xad\\xf2=\\xd6\\xae\\x89x5q\\xda\\xc8\\xf2\\x86\\x13o\\xc6\\x10#\\x979\t!\\xe7\\x83\\x8f#\\x10(\"\\x18\\xeb\\x94\\x95\\x12\\x10\\xc8a6\\xb5?\\x0boa\\x9c\\xb24\\xcc\\xd5f\\x87\\xdd\\xfe\\xd0s#m3\\x07\\x0c\\xea\\x16!x>\\x05e\\xb0\\xfb\\xda\\xa7\\xdc\\xe9\\xa9\\xc1\\xeb\\x8cm?\\x8f\\xa0\\xaa\\x87\\x14\\xd6\\x1b\\x8b\\xeb~\\x19\\xd0\\xdb\\xbbfk\\xa9'o\\xb1\\x13\\x99\\xc1c\\xeesh\\xff\\xcc\\xdey\\xf9\\xd2w\\x97\\x1e)\\xa4\\x1d(\\xb2lx@\\xfe\\xa6\\xe6ndz=\\x8f\\xd3\\x06\\xb5\\x99\\xa5\\xf4\\xc3\\xdcq\\x8an\\xdd\\x1f\\x0f\\xe3\\x1d\\xe2\\x8b\\xea@gj\\x0b\\xc5k\\xd6jv\\xe6\\xa0\\x8d\\xf0\\x04\\x9b\\xc8olj\n\\x05\\xc8?\\x0f)`\\x80\\xb8\\x82\\xe5z\\xd5#\\x14au\\x92pn\\xa1\\xe9\\xa1\\xa3\\xcb\\xd8\\xb6\\xf8\\xe3\\xedm\\xca\\xe8\\x90\\x86\\x17\\x12\\x86k\\xdab\\x81\\x9f\\xc7\\xea.\\xdd\\x14\\x05\\xeas>\\xb6\\x9br\\x87\\xa3\\xe7\\x8d\\xc450\\xf6al\\x1at\\x86"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6\\xb7\\xdc\\xb7\\x13\\xdc\\x1e\\xd6\\xfd?j\\x98\\x86\\x1d\\xd7d(\\xbe\\x8e\\xaan\\x7f\\xe6\\\\x86w`\\xfe\\x90\\xdf\\xda\\xc9u<\\x7f\\x0c/di;\\x15\"\\xd3\\xb8\\xb3\\xa8\\xf6k\\xa3z\\x16\\xe5\\xa2\\xcdkj\\xf7\\x16e\\x00\\xb9y%\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xb8b\\x14\\xf9\\x08\\xbe\\xd8\\xeb1-\\xb7o\n\\x16\t\\xc5\\xecu\\xba\\xab\\x8c\\xa9~\\\\xf5\\xd5\\x84\\x86h\\xd8\\xd4-\\x05*\\x96\\x9f\\x930;6x\nx\\\\xd0"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\x8d\\x18\\xb1r\\x94+f\\x85\\xd9\\xd4-gm\\xce\\xca\\x0e\\xf0n\\xcbf%*3\\x1d7\\xebj\\xfc\\xc7\\xc0g57\\x16\\x10\\xc2e\\x1ao\\xa2\\xaa\\x08\\xcc\\xa6e\\x017*\\x1f\\xf7\\x9dm^\\x1efl\\x87\\xe8x\\x90df\\xf9\\xd5m\\x07\\xa9.~\\xc4\\xbey\\x17ev\\xc6\\xd6)\\x127\\xbf\\x88b\\x13\\x91\\xa1mdd\\x93\\x97\\x0b\\xaf\\x1e\\x8c\\xbc\t\\xd1\\xacu\\xf2\\x80\\xeb\\xe4l\\x12\\xec\\xea\\xba\\x17\\xe2^\\x07\\x98\\xd6.\\xc9\\xcb\\x05\\xeb\\x99\\xc1\\xae\\xabyr\\xf9\\xed\\x8cx\\xd2\\xa74@\\x01\\x1a\\x7f\\x00\\xe9\\xf0\\x83\\xdf_\\x97c\\xbe\\x18\\x05jg\r\\x03\\xd1\\x1d(\\xac8\\xcb@?g\\x00\\xdeq6p\\xe4\\x1dl\\xa3\\x9aky \\x8dy\\xe2\\xb7\\xfd\\x90\\x14?\\xf9z\\xc4\\x01<q\\x11\\x03\\xe5\\xa43\\x17\\xd0\\xdbt \\xff\\xb0\\xe4\\x7f(\\xe0\\xe1u\\xb8\\x108(\\xe8id\\xdd\\xf7\\xf3.\\x83\\xeatj\\x95\\xd0\\x82\\x13\\x86eq\\xdf\\xb0\\xeb`\\xb8mg\\x971d\\xd9\\xcfk\\xae\\xe4"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\x05\\x89\\x07\\x80&p\\x08\\xec\\x82lfuz\\xe2\\xc4%\\x93lz`\\xa1h\\xa15\t\\xa8\\xd5l\\xe77\\xca\\xdec\\x93\\xa5\\xdd@ug\\x81\\xdd\\xc8v\\xde\\xd3\\xc5n\\x8d\\xbd%\\x14aoa\\x01\\xe80\\xa3-g\\x07\\xcew\\x898\\xff\\x9b\\x89\\x98g\\x0e\\x1b\\xca2\\x1e\\xe4;\t\\x7f\\xc0n\\x9e\\x8d\\xa0jl\\_0\\xaf\\x89\\xf6\\xd9'\\xdfh\\x95\\xd2=*\\x13\\x88\\xd7:\\xe2\\xee\\xf7\\xc6\\xef=\\xab\\x96\\x83v\\xc9\\xac<\\x150++\\x83y\\xa8q\\x840\\x12p\\x98~v\\x1e\\x1f\\x0b\\xa0\\xde>\\xbco\\xff\\xca\\xdcj\\xe5\\xb7\\xaaw\\xe3\\xbat\\x0c\\x99\\xd6\\xba\\xbf$\\x0f\\xf9bs\\x985t\\xc8<\\xcc\\xbd\\x12\\xd6'u\\xc8i\\xf1\\xa3\\xec\\xd5\\x05\\xf2c\\x8fa\\xf3\\xa0qeve\\xec\\x17\"\\xaf\\xf1\\x9c\\x86d\\x86\\x85)\\xd9;\\xe0k3n\\x9e\\x97\\xa4\\xdf6\\x97#\\x93?ymmx\\xcf\\xc9\\x87\\xf8\\xe7\\xeci\\xd1\\xec\\x99\\x03\\x8f\\xacw\\xd9\\xd9<60\\xf3r\\xf0\\xcc\\xa7\\xc4\\xed9\\xd2\\x10\\xfd"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\xcdc\\xea\\xf8\\xdd\\x8f\\xd6q\\x19\\x7f\\xf5\\x9c\\xca\tp+\\x01|n8pt\tm\\x9c\\xc5m\t\\xc4\\xbcf\\xd3\\xef:'s\\xdb\\xdfj0k\\xe0d#\\xb0\\x87\\x18\\x08x,\r\\xa6\\x9fsjh\\x87t\\x1f\\x9e\\xcb\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xd4\\x1e\\xe6+p\n\\x8a\\x05\\x00\\xd1\\xd0\\xfa\\xd4+\\x04\\x16\\xba\\x04\\xda\\x18\\x05qk\\xffa\\x1c\\x06;\\xbec\\xabu.qi\\xd7\\xaf\"a\\xba\\xd0k\\xcdi\\xd0mc"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\xbd\\xbfd\\x92\\x91\\xac\\xbew\\x86,b\\xd2r\\xdf\\xbb\\xed\\x9aq\\xf7z\\xb2\\xd2\\xb1\\xcan\\x8fm\\x9a\\xda\\xf6\\xacl5\\x9f)\\xba\\xe00\\x10a\\xfb\\xb0(\\xa8\\xf1\\xec\\xe7vl\\x1f1\\xbc\\x1a\\xc8i=\\x8e\\x08g\\x82\\xc6\\xf440\\xe7\\xe70\\x9188a\\xd0\\x84\\xbcg\\x91\\xecgo\\xf8\\xa5\\xad0\\x81\\xacw\\x81\\x9b\\xbf`\\xb3z\\xc1b\\xf8\\xd5oe\\xa4vv\\xd0\\xb6s\\x1d\\xa4\\xda/b(|.\r\\xc2\\x10\\xef\\xd0\\xfd\\x07\\xbe\\xe1\\xef\\x14\\xf9\\x86',\\x1a\\x98#y\\xa5a\\x9c,\\xd4\\xcb;\\x11\\xa8pr\\xf6\\xf00\\xbf!f\\x82n\\xbd\\xbe\\x15&%\\xda\\x94\\xe4\\x80crf\\xeb`\\x84vus\\x91\\x08\\xf7\\x15\\x9c\\x15\\xabi\\x93\\x07\\x0e\\xf6@\\x1fiv\\x0el\\x0el#a\\xc0 \\xd0\\xb2x\\xde\\xe4\\xb9th!\\x9a\\xe1,ba\\x14|\\x8b\\xad\\xfbw\\xf1a\\xf5<\\x86\\x14b\\xaf\\xebi\\xee\\x1b\\xb4\\xd1q1\\xdc3vr\t'\\x08\\x81\\x92p\\xa8-f\\xec\\x88\\x0bws"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\xb9\\xdf\\xc6n\\xa3\\x95fx\\xc2\\xb6q8\\xd5\\xd2\\x9d\\xa8\\x88d\\x85\\xdd\"\\xf3\\xdd\\xf6\\xa9m\\xccb\\xd4|\\xb5\\x8c\\xe6\\x80\r\r\\x00\\xd8&\\x07p&\\x91\\x9c2\\x9a\\x97 \\x88g\\x82if~\\x1a\\xd39\\xde?\\xef\\x18\\xa7q\\x01\\xe4\\x08\\x91\\xb6\\xf2|\\x8av\\xdd\\xbe\\xe6l^\\x14\\x8d^\\x98_\\x80?\\x9b<\\x1ew\\xadd\\xfcmg)\\xdfk\\xa1\\x96bx\\x8c\\xc5\\xfao\\x03u\\xef\\xa4\\xdd\\xd8\\xb8\"\\x02y\\xc0\\xb9\\xbe\\xa9\\x89i\\x8a\\x7f\\xbfj\\x87\\xf8\\x97\\xe4\\xc0\\xd7\\xb3\\xe8\\xeal<2\\x13%\\xd4\\xece\\x9e\\x9e\\x0e\\\\x15\\xab\\xf6\\x9ed\\xe0/\\x15\\x82\\xfa\\xbd\\xc0\\xb6\\xf2\\xb4\\xf1eu\\xc5\\x8d\\x0f\\xcd\\xa6\\x99\\x12\\xfe\\xd6\\xb1\\x82\\x91\\xf1_\\xa8\\xd8zx5\\xe1b\\xa0\\xa7\\xa1\\xe2\\xdbu\\xabky\\xab\\x04\\xe0\\xe3\\x14tv'\\x87f\\x80\\x13r\\xe0$g-+\\xb6\\xaek\\x08t\\xe4\\x10)\\xf7\\xcc\\xde@\\xa3,\\xf3a\\xf5m\\xfd\\x9c\\x7fgt\\xb6\\x1cy\\x11xvk\\xa1%\\xe4\\x1a"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\\x1a\\xdf\\x96\\xef\\xbb\\xe3\\xfb\\xbau\\xb0\\xc1\\x177\\x8e\\x91m\\xd3\\xb2\\xb7\\xc4\\xe6\\x1b\\xe7\\x8f*\\x81\\xe8\\xce\\xe8\\x83\\x1b\\x88\\xed\\xcet\\x87)\\x01\\xb1\\x04\\xf0<\\x8f\\xa1m\t$\\x04\nd\\xa5\\xfbw\\xea\\x0ex^1g:\\xd6\\xab\\xba\\xa5\\xba\\xe9\\x1b\\xe0\\xefn\\xa5&\\xf0d\\xe5\\x8d\\xa7\\xdd8z\\xf5\\xcc\\x92\\x81\\xbdo\\xc0\\xec\\x1a\\x04\\xadi'\\x10\\xd8\\xb9a-=\\x1d\\xb3\\xf6*\\xc0\\x81i\\x0e\n\\xf0e5 \\xeeu\\x8c\\x1e!y\\x1c !\\xa3\\xddm\\x13g\\xc8\\xf0fh_gr\\x80\\x08&j\\x94\\xd1\\x04\\x9b\\xa3\\xb1\\x0e\\xd1(o0\\xe0\\xbe\\xc2\\xf7\n\\x00\\xe2\\xad\\xd7\\xd8\\x1c\\xfap\\x8eg\\xafc\\xbbe\\xa2/ji\\x1f\\xc5\\xdc\\xb6\\xb1\\x08&\ro\\x80wqp|\\xef\\xf3c/;d.\\x80\\x1c\\x86\\x94\\xd2\\x05\\xae\\xbd\\xe3\\x92\\x17\\x1ck\\xe6q\\xca\\x95$q\\xe7\\x90\\xae.\\xaa\\x08o+.\\x80\\xc7\\xb5\\xe5d\\xd2\\xbf1\\xb1c\\xa0\\xfe*(\\x91\\xcc5d\\x18*\\xf0\\x9e\\x18\\xb6\\xe2\\xed"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe2d\\x0c@\\xdc\\x92\\xb1\\x8d@h\r\\x89\\xc9\\x07^\\xdf\\xd7\\xa3s\\xf4w\\xf5\\xe9+\\xa2(\\x9f\\xa0\\xaf\\x157\\xf0\\xc7 \\x91\\xcau0\\x11\\x02\\xdc\\x00\\xe7\\xd4\\xe1\\xe5k\\xb2v\\xe9u\\x03k\\xa5\\xce\\xb2\\xe9\\x8ew\\xad\\x81w\\xad\\xd8.i\\x83e\\xbb\\xa8!np\\xc2\\xc9\\xa5\\xf4l\\x8b\\xd5\\xf0\\x10\\xf0\\x93\\x80\\x03x'f\\xeb\\xbc\\x0b\\xe9*\\xb4j\\x10\\x1de\\xcfo\\x90'\\xaf,\\xfbp\\x16.\\x00\\xe3\\x84\\x04)b@p\\xe1\\xcb\\x84\\xe9,\\xd7\\xb2\\x92\\xf7\\x88ao\\xb0\\xadqh\\xadf\\xce\\x13\\xdf$\\xc86/'\\xe1*\\xc2\\|,xv\\xa1\\x1a\\xf7k\\xbeo.x\\x1c\\xc3!\\xe2&\\xde\\x05\\xc0\\xcd\\xddv\\x8d\\x9b.\\xb5j\ni\\xad\\xa8\\x86 \\xec/\\x90\\x86\\xee\\x9e\\x13\"l\\x7f\\x1b\\x88\\x9b\r\\x01\\xc3\\xeb\\x11\\x1d\\x8c\\xc8\\xeci\\xe8:\n\\x0b\\x89\\x11\\xa8\\x0f\\xe5\\xc59d\\x18y\\x03\\xb1\\x83\\xa7t\\xacoo\\x8fw\\xdf-\"\\xd9\\xca\\x0c\\xb1\\xa1\\xfa\\xe7w`\\x854w7@\\x12"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\x1ck9r\\x97w=ecx7^\\x07\\x9c\\xe9\\xc8\\\\x17\\x9atu\\xccc;rk\\xc5h\\x9d\\xa3\\xe2\\x92\\x0bya\\xd1\\x88k\\xd3\\xa7.\\xbcnx\\x0br\\xab\\x96*\\xeb\\xa4/\\xce\\x89\\x0e0\\x134\\x10\\x9d\n\\xa1\\xd3zt\\x8dxi\\xf6t\\x17\t\\x7f\\xe0%\\xb9\\xb4r\\xf5+\\x05\\xc2\\x11\\xbc\\xa9\\xc4\tj\\xa2te\\xf9\\x13\\xc8\\xb9\\x08@d\\x86\\xa0\\x18\\xb4r\\x829\\x9an%\\xf5\\xbf\\x8d?*@\\x05\n\\x8ar2\\xdc\\x1d\\xd4kk\\xa4e\\xa2\\x03e\\x1ct\\xe2\\xb6\\xc7y7\\xed\\x8f\\xcc\\xc4ak\\x874h\\xd4\\x84\\x97\\x9e\\x863\\x15yto\\x138\\x83\\xcdl\\x19\\x87\\x7f\\x88\\x05\\x81\\x14\\x0e\\xe3\\xc0\\x83\\x8b-#\\x98a\\x07\\xdbory_o\\xc4^e\\x8c\\xe5\\xcfc\\x08\\xaf#\\x0b'\\x1e\\xba\\xbf\\x94\\x15&*&\\x15\\x01\\x1c\\xda\\x0e\\xd2\\x1a\\x1apy`\\x94j\\x86\\x08*`\\x18|gv\\x0c\r\\x9f%6u\\xcc$i/\\xae\\xc5\\xdf\\xa5\\x89\\xd3\\xdclg\\xb0"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8&\\|\\xea\\xb1\\xa9@\\xb4r\\x0fp^,t\\xa4\\x16\r=f\\x05\\xc9\\x9f\\x1aq\"\\x90\\x08\\x15\\xe3\\xd3\\x19\\xf7\n\\x86a\\x8a\\x97:\\x0420/\\x87\\x91\\x16\\xd9q\\x19\\x08i \\xf8u\\x0c\\x97\\x9de;\\xf4\\xa2\\xd0r+\\xa5\\x02\r\\xd2y\\x83\\xbe\\x82 h@\\xf6w\nhr\\x8c/fm\\xe27\\x8cb\\x06\\xd7q\\x14\\x9bv+\\xb0p\\x1d\\x0c\\xd3%\\xe2\\x04z,\\xa2\\xe25\\x89&\\x80\\x9a!g\\xf6\\xe5/\\x82\\xa2*\\xf1\\xa8\\xd1a\\x984\\xd7o\\x1f\\xdcx(\\xe44\\xdc\\xc4r\\xb1;e\\x08\\x08u\\x80\n\\xbc\\x8c+g\\xa77\\x14\\xca\\xcfr\\xe4\\xa2\\xe7\\xa1k\\x82\\x12\\x88\\xf4\\xd3l\\x91\\xbc\\x88\\xe2\\xa2\\x95\\xf3.\\x94\\xf4/\\x16\\x1e6m\\xdd'q\\xb5\\xdb\\xf4\\x1c=4m>? \\xcfb\\x1be\\xb5p\\x02&@'\\xbc\\xc9e\\xe5\\x02\\x81\\x8c\\xd4a\\xf2-\\xe3h\\xea\\xf39\\x18\\xe3\\xe4f\\x8c\\x12\\xdb\\xf5\\xe7&\\xbf+\t\\xddq\\x90_\\x9f9\\xeb\\x84-\\x19)\\x9f\\_z\\xae\\xc9"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\xdf\\xaa\\xd9\\x86\\xd0\\x17\\x01\\x90r\\xbc\\xf0\\xca\\x83):\\x9f\\x98\\xd9\\xa6c\\xc9\\xd3\\xe7\\xc3\\xd5oo\\x13g\\xa1\\xd05\\x04\\x92\\xd3\\xad\\x9c\\xf7x\\xd1\t&y\\x91\\xa9\\xadk\\x8c\\xd1\\xe5\\x81\\x8d\\x8c>;\\xbeek_\\xd5v\\xfad\\x0e\\x90\\xe0mo|\\x89\\xc4\\xec\\x1a\\x84zqg\\x8b\\xeb\\x98\\xc3\\x0f\\x85\\x8d,g#\\x18\\xe2\\xe6l\\x19\\xde\\xc6\\xd8\\xd6%\\x17`n\\xf5\\xeb\\xe1\\x03\\x99\\x07p\\xd2\\xc6\\xe4wg\\x99\\xfdp\\xae\\xcc\\xc4\\xf1\\xf1t\\x97(!\\x97\\x06\\xcb*\\xe8\\x1bv\\xa1\\x90!2j\\xca\\xc7\\x15\\x0f\r\\x91u'e\\xa0_\\xbf\\xeb\\x80\\x03\\x13\\xec\\x986rq\\x15\\xa0\\x17d\\x07\\xfa3\\xe2\\x19\\xac\\xce\\xd3\\xed\\xc2\\xca\\xeer\\x0e\\x1bg-v\nem\\xa2\\xc5'\\xb5\\xc1\\xf3\\xe3cc\\x106\\xb5e\\xec\\x0c\\xf3y\\x8e\\xb6\\xa6&\\xd3\\x8c\\x8a\\xcd=\\xeb5\\xfc\\xf7\\x9a!\\x92\\x81r\\xf0\\xd6\\xfb\\xc4\\xcef\\xa1t\\\\xa7\n\\x0f\\xec\\xeb\\x82\\xab\\xa1\\xc6\\xe5\\x8d\\xd7\\x15\\x8e\\xa3k0"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01023\\xbe\\xb9\\xd4\\xc6\\xf0\\x95!\\xa0\\x15>\\xdd\\xfd\\x84\\xd3enp\\xa1\\x90\\xb8\\xfe-\\x1c\\xc4d%\\xee\\xa1\\x96%v\\x86\\xd4/\\x9e\\x03\\x05\\xf8\\x8e\\x1e\\xe0l\\x14u\\xe0\\x065\\x10n\\x9af\\x92g\\x04\\x1b\\x94-\\xd7v\\x80y\\xce\\x9e\\x12r\\xefa\\xd2(%\\xed\\xb5g\\x9d\\x02\\x9d\\x96\\xee\\xdd\\x84\\xd4\\xab\\xec\\xb8;c\\xecd3\\xb3\\xe7\\xaco\\xc8\\x85\\x81\\xa1k\\x01j\\xd0\\x10\\x05\n\\xc6;\\x8el\\xe1\\xf8p\\xf5a8\\xc1\\xb0\\xb2)y\\x8e!5\\x89c\\x0fo\\xa3\\x8c\\xb8ln\\x9e\\xb8\\x03i\n.\\xe1(\\xcb\\x9byc\\xa10k\\x9fu\\xe8o\\xba\\xc7\\xa3\\x03a\\xd3\\x8fu/=\\xcew0\\xc6\\xab\\xb1\\x12\\x98\\xe7\\xc5\\x82~\\xc0\\xa9\\x86\\xb6k\\xf7iib\\x19v\\xd18f(\\xb3\\xbe\\xf3j\\x80\\x9a\\x99lt\\x98l\\xf5i\\xf5\r\\xd7\\xe4jvj\\x15w\\xcd\\xf6g<\\x82yrf\\x14\\x92\\x8ew\\x02\\xdb\\xe0'\\xbb\\xd4\\xd9+\\x16&'\\xa3f\\x8ff\\xda\\xc6n\\x1c'\\x069"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xe2\\xe0\\xfa\\x82h2+\\x90ac\\xc9\\x14dk\\xe0\\xc8\\x1c\\xf8\\x044k\\x826\\xf6s\\xec\\x08w\\xb69d4)\\x038!\\x02\\xbd`\\xbbyc\\xf0u\\x01\\x87,!-4\\xd7\\xdc\\xb5\\xd0\\xd8\\x9fe\\e\\x17\\x1ci\\x98+\\x9d-.\\xcd\\xa5\\x1e\\x90\\x1dd\\xf0p\\x086_\\xbe\\xdb\\x17\\xbfk\\x90\"\\xa62t\\x115\\x81\\x98j0\\x83\\x93g153\\x84\\xa3\\x96:\\x8e\\xc4`\\xd4;d\\x123\\xc2\\x7f\\x1a\\x0b\\xbb\\xbd\\xe7\\xbfz\\x8d0\\xa1\\xec\\xf6\\x1ap\\xa3(\\x17a\\x84\\x98\\xaf\\xa1\\x8a\\xc1\\xaa\\x87r\\xc7'p\\x05\\x0c\\x1e\\xac+ t\\xc3%5\\xa8\\xeb\\x1e\\xad\\xa4\\x91\\xcc\\xb4o\\xf3w\\x1d\\xd1\\xef|\\x93c\\x0e\\x9c\\xc7\\xe9\\xb5\\xc98=a\\xf2f\\x94n\\x1d\\xcd\\xb9\\x10$\\x02\\xc3\\x86\\xd4\\\\x00x\\x16\\x1f\\xcc\\xa85vkz\\xd9\\x02)\\x05\\x08\\x1afk\\xca\\x8cjt:u\\x01jf\\xae<\\xe1\\x83k4\\x0b\\xda \\xb8\\x0cil\\xf4\\x01\\xc7\\xe6\\x91\\x13nja p#\\x04"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xfb\\xb2\\xb8\\xaeh/\\xf2\\x87ho\\xd6\\x96\\xaa5\\x86\\xce\\xf6\\x96\\xd6\\x87\\xf3\\x91j\\xecd\\x1e\\x0cu\\x97\\xf9\\xa2j\\xad\\xf8w\\xdf\\x82\\xea\\xee3\"\\x9c\\xc2\\xd2\\xf2k\\xad>y\\x8a4v\\x1f\\xd6\\xbe6=\\xaezt\\xed\\xa5\\xbd\\x84m\\x14\\xe4\\xde\\xc7\\xe6\\x98o\\x00\\xc8\\xf5'\\xec\\xd7|w\\xfc\\x00\\xdb\\x11\\xaf\\xee\\xe2\\xe2\\x8e\\xf8\\x8f\\xd7bvj\\xc6\\xb3-q\\x93p;\\x1b\\xdeod\\xc9\\xff\\x0b\\xe7\\xcfcwvl\\xc5v\\xafv\\xaa\\xa5\\xaek\\x1f\\xc6\\x16^zf\\xa6q3\\x19.s!`\\xb3\\xca f\\xd6\\xca\\xa2o\\xb8\\xc4\\xc0\\x11\\x02\\xe7g\\x08kz\\xfc\\xfb\\xb7\\xd1\\x92p\\x86l\\xe8f\\xa0\\x97\\xbf\\x82t\\xe1\\xc6\\xaf\\xec\\x8e\\x8d\\xf5\\x90\\xaf\\x82\\x94\\x9d?\\x90\\x99zj\\xd49\\x8c\\xb8i\\xc8\\xa3\\xfc\\xdc\\xc626\\xdbr\\xe5\\xfa\\x86\\xb5\\xd4\\xf5|\\xf0$\\x0c\\x81\\xfb\\xab\\xd4z\\xb6$\\x9a8\\x87\\x88z\\xaa3\\xf7\\xd3\\xd2v@\\x08e\\xf3\\xb4\\x0b>\\x0c=\\x04\\xad\\x96\\xcfc\\xed\\x16"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9gw\\xc8\\x9b?m\\x04`\\x9b\\xb9(\rd\\xe4\\xd2\\xa2f\\xb0\\x9d\\x96q\\xf6\\x8c\\x9d\"\\x89\n\\xab-\\x85n\\x84\\x11~\\x02ggu\\x16\\x80\\x13u/\\xb5t?f\\x04o\\x85\\xbc\\xb5\\xc7\\xce\\xdfo\\xdf\\xc9\\xa7t\\xe6\\x92!*\\xd7@\\x0c\\xed9\\xa6\\x92yt\\xbd\\x91/\\xebx6\\xc2l\\xf3\\\\x9bt\\x89n\\xe0\\x88vh\\x14sx\\xc5\\xd6td\\x97\r\\xa5 \\x9c2;0\\x11~\\xb1\r\\x1d\\xfbn\\xaf/\n\\xf2+\\xb9\\xa0\\xc7\\xc4\\xc0+u%\\x82j\\xfb\\xe6q\\x8f\\xae3\\xee\\x18\\xa7\\x8d\\xf5<\\xea\\xa3\\xe5amd\\xb3\\xdf\\x02\\x01\\x93\\xe1\\x8b\\x19\\xe2\\xc8l\\x0bfj\\xf1\\xfa\\xc7am\\xce\\xa3b\\x00\\x9d\\xaa\\xd36\\x07\\xba\\x8f\\x10\\xaf\\x8ar!\\x08\\x05h_z\\xa5=\\xed\\xf3\\x1b@\\xd6\\xe1\\x8c\\xf6p\\xc95\\x8c\\xa6\\xdd/\\xd9\\xb6\\xf18\\xb3\\xe4\\x15\\x94\\x079\\xebf\\xee\\x96-z\\xc7\\xcf\\xba\\xbc\\x9e\\xeb\\xb5\\x98\\xdd!'k\\xd4\\xc6\\xdd,b\\x177\\x84\\xb9<\\x06\\xd0\\xeb\\xac"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\x08&8\\xab\\x98n\\x13\\xa8o\\x80\\x91\\x90w\\xb8\\xd7~'*~8\\xb4\\xa5\\x11\\xa4\\xf0l\\xb7\\xc1\\xd5\n\\x85e6\\xfd\\x83\\x80\\x13\\xa5\\xe7\":\\xf9\\xe9\\x03\\xe8\\xa2$\\x07\\x0bp\\x90\\xa5\\x8blod\\x94\\xa7\\xf3\\xaa|\\x8e4d\\xf3\\xb7/4mc\\xb87\\x84\\x9alk\\x16\\x8b\\x1c\\xc4\\xcb\\xa3\\xd7\\xe4\\xbd\\x02\\xb5op\\x05\\xbb\\xb3\\xe0\\x91\\x18$<\\x11p\\x15ke\\xf3\\xdd\\xf6\\xb0\\x12\\x94\\xc2\\x8b\\xe5u\\xec_\\xbc:\\x83\\x7ff\\xbag\\xb1\\xb0\\xf3iqjz\\x9f\\xc84n!4\\xac\\x8b\\x91\\xd79\\xb7\\x16qe\\xf4\\xfe\\x07a\\x94\\xd4\\xb0\\xe9\\y@?\\x82\\xe9tz(x\\xa3\\x10\\x7f\\x96\\x1dtz<\\xb0wq\\x9cu\\xa7jx\\xee\\xd2\\xc8\\x10b^\\\\xb2x\\x01r(\\xd7\\xc4\\xec\\xcf\\xa2\\xa4\\xbejc\\x19e\\xa1a\\xf4\\x1c1\\xc7y\\x19u\\x19\\x98\\xca\\xb6u \\xc8\\x83\\xb4\\x03ju\\xfa\\x00\\xfb\\xe8\\x80\\xf36r\\x9cr\\x0cf\\x1cg\\x01eaq\\xec\\xa1\\xe0\\x1b\\xca*t\\xa9"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\x16\\x07\\xbc$\\xab\\x96\\xb9\\xc6\\xc47x)6\\xd5\\xd6\\xc8u\\xeel\"d\\xea\\x9e\\x7f\\x98sh\r\\xdf\\x15\\xe7a*_8d\\x9cq?\\xc7\\xe5yn5\\xecc\\x93\\xe9(\\x883\\xf7\\xc8\\x9d\\xa8\\x8e\\x17e\\x91\\xed\\xea\\x1d \\xc0c\\x9at\\x05\\x10\\xc8\\xa5_\\xea\\xfd\\xa62\\x07f\\xe3\\xe0\\xb0\\x04\\xfe\\xf3\\xb9\\x7f\\xdd\\xa9\\xc6\\x1d\\x9e\\xf0p.\\xbf\\x85\\xfe\\xf2|\\x86d\\x12\\xd4r\\xc6s\\xde\\xb0=\\x10\\x85\\xf7\\xb5a\\xaek\\xe9\\xf3\\xae\\xef\\xc4\\xf4f\\xf8\\x84\\xfdf\\xf7\\x1b\\xa2:\\x0c\\xbb\\x02+\\xc9\\x82-\\xdb\\xb8\\xc5\\xf3\\x94\\xae\\xceue\\xc1\\xe9\\xca\\x07\\x15\\x97a\\xdb\\xea\\x0f\\xd0\\xc0\\xabm%\\x00\\x08(r\\xdbgf\\x14\\xd9\\xe4\\x89\\xa4\\xb4a\\x99\\xa4+\\x90z\\x073\\x00\\x0e\\xd8\\xfbvo\\xd6\\xd9\\xb1\\x08\\xd4a\\xe2$\\xf3\\x1byf1\\xf3d\\xb5v\\xb7\\x81\\x07\\x96\\xf7\\x7f\\xa4*\\x19\\x1e\\xbb5\\xe7 \\x06\\x12\\x9d\\xcd\\xd2\\x85\\x00-\\x846\\xf6\\x1bp\\xa0\\xd1\\xdf\\x85\\xe7\\xbd;\\x9d\\xc4f\\xae\\x07\\xf0\\xaf\\x92"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xca\\x14\\xb6\\xfe\\x80\\xc2'1=\\x95\\x88\\x9b\\xb4\\x1e\\xb4\\xb22\\xb6-\\xc9\\xa7p|1 &\\x87\r\\xa9\\x8fy\\xda)\\x90e\\xe8\\x98\\xdf)\\x14\\x16p\\x0bm\\x91\\x9a\\xec\\x15b\\xfcs\\x02\\x9eh\\xeb4pp\\xcb\\xc1\\xe3pb\\xe2\n+\\xec-6\\x95\\x9e\\x8b\\x05@\\x07\\xfe\\x86g'\\xd6\\xd6\\xed\\x88\\xc2\\xc9z\\x1d\\xfat\\xeag\\x0b\\x07\\x1baz\\xb2\\x10\\x16\\xc1\\x85\\xc4\\xac\\xe1\\xbe\\xd0\\xb1*\\x8d\\x94\\x1ar\\x82\\x16\\xdbob+~\\xff\\xec\\xfd\\xb8y\\x95us1c~f\\x16z\\xe7\\x8cy\\x06\\xf5\\xcchsmz\\x960\\x8a2\\x7f\\xd8\\xfd\\xfa\\xa2\\xe8\\x9a\\xabi\\xcc\\xf8\\x00\\xb7f\\xae(\\xd7n@x\\xe0\\x06!\\x1c+\\xdd6\\)p\\xf28s\\xf3%\\x9e\\x19/\\x9eu\\xb4\\xde\\xf0(a\\x91\\xf2t\\xb4\\x90\\x97n\\xfbye\\xd3t\\x86\\xd7~\\xca/\\x98\\xc8r\\x834\\xed`a\\x9f\\x189l\\xd1\\xb6\\xc5\\xf9\\xeb\\xa3t\\xc0*v+p\\xff.rc\\xfa\\xe2_9:?"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xc7w\\x97\\xc8\\x03f*`\\x9axh\"\\xf4\\xd4\\xa2\\x92\\x12\\xfb0\\xb2\\xf2=i\\xf4^\\xadm\\x14\\x07\\x8a\\xccu\\x9b=\\x9b\\xe6\\xba\\x07\\xf59k_v\\xaf1\\x8d\\x894\\xeax\\x15\\x18\\xc0\\xe5\\x9f\\x048|r\\xb9\\xea\\xfe\\xed\\x99\\x1bu\\xa6)u\\x037\\xd8\\x8f\\xbf\\x01<\\xf05\\xc2,\\x91\\x13\\xd4&\\xb6\\xce\\xa9\\x80\\xae\\x90d\\xc0n\\xe0c8\\xf6\\x8fuk\\x96\\xae\\xe0\\x8a$\\x85\\xd3\\xbcf\\x0ce\\xb4\\xafr\\xe2\\xa40g\\xbf\\xe1\\xf9\\x8ct\\xf9\\xb96\\x892m\\x98\\xe0\\xdb^n-k+^\\x1740\\xf3\\xbe?\\xc3+\\xf7k1=\\xa7\\x8e\\xba\\xfc\\xc9\\xfb\\x9a\\xfa\\xe9\\xc5s\\xcc\\x8bg\\xef\\xacy\\xcd\\x00og\\xf3\\x01\\xd6m\\x1fok\\xe9p\\\t\\xa9\\x8e\\xdc,\\xd4\\xf2\\x12\\xdc_\\xc1\\x1c\\x93\\x9f\\x94\\xfe7\\x91gqg\\x10`\\xb7\\xd2\\xf1\\xa6\\x92\\xe2kx\\xc1t\\xe1\\xf3\\x97ec\\x130<k\\x08\\xedy\\xf5\\xa6%\\xe9\\xae\\xbe&p\\x15\\x07\\xa2\\x9awz\\x86-\\x7f\\xf7\\xe0\r\\x8a-"
  677.  
  678.  
  679. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?iw$\\xdc\\xe3d\\xfb\\xa9\\xe2\\xab\\xa4)\\x81\\x11\\xca\\xf4e\\x18\\xd6\\xb0\\xedve\\x94 \\x89\\x11w\\xf8a\\xb6\\x03l\\xac\\x9d\\xbei\\xb6\\x88\\xab\\x06\\xc5$\\x86\\xd0\\x87\\xc6\\x16\\xf3\\xb1\\xef&hici\\x9a\\x14\\xd6\\x8a\\xe6\\x92\\x0c\\xa0\\xab\\x05l\\x9f)\\xb8\\x01\\xe7\\xecw\\xf7\\x07\\x8f\\xdb\\x9e^k\\xa1a\\xde4~an+\\xb3\\xfa\n q\\xa4r\\xbf!\\x8dt5\\x85z\\x1a\\xeb\\x8e\\xc2a\\xf1\\xa8\\x04dy\\xa2\\x94\\xf4\\x14\\x99\\x8d*\\xf4>\\x06*\\xc9@2\\x82\\x99\\x95.\\x11^\\x90u\\xde\\x9b\\x07\\x98\\x99er)o<@\\x02be\\xaf=\\xca\\x8el\\xe4\\x0e-\\xd2\\xc1\r\\xaf\\x03dd5\\xbe\\x91b\\xed\\xcb\\x94\\x1c1\\xa3\\xdee\\xea#\\xdb\\x07\\x02\\x81\\xf9\\x16ku8\\xcb\\xaa\\xc3\\xa8\\x18\\\\xa1~\\x19\\x8b/\\x97\rhqi\\xf8\\xca\\x89\\x00\\xaa\\xacw\\xb6ky!s%-\\xfb\\x16n\\xf7\\xa6\\x1b\\xef\\x1c\\xa9m~\\xa1\\x9by\\xd1\\xd1\\x81\\xf4:\\x18f=\\xb4\\x0f\\xe6\\xdc\t\\x01"
  680.  
  681.  
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xed)\\xc9'\\xe9\\x93\\x11\\x8adni\\xd4\\xd3\\xab\\xe5\\x198r\\xde\\xcfv\\xa1\\x0f\\xb8\\x91\\xae6~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  683.  
  684.  
  685. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&b%\\xcbp\\xd6\\xbd\\xde\\xbb\\x11\\x8b\\x19\\xb5l4r\\xbc\\xf30\\x98)ly\\xfe\\x16\\x8e\\xd8a~\n\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  686.  
  687.  
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\xd0k\\xb7\\x0e\r\\xb3\\x0c\\x02\\xe2mv\\x1f!!\\xe9o\\xca\"\\x01\\x1cq\\xec\\xa9\\x18\\x0b\\x9c\\x1du0n\\xfa\\xd6wn\\x1a\\xfd\\xa4s->elid(\\x01\\xea\\xdf\\xfbu\\x88_m\\x05\\xd6\\x06c\\x14^m\\xab\\xe8\\xba\\xc3\\xe62\\xce\\x841\\xb2\\x7f\\xcd\\xe2\\x18b$\\xb9?\\x1f\\xaar\\xe2\\xc4\\xe3d\\x0b\\xa0\\xe8\\xe0\\l<\\xa7\\xebc\\xfb\\x1d\\xd9r\\xdb\\x94ks\\x91\\xb5\\xed\\xee\\x16\\xdep\\x0b\\x81m\\xa3\\xe0\\x84d(9$\\xeb\\xbd\\xe8ff\\xd5\\xe1:ki\\xc0\\xf4q$\\xa4\\x9bj\\xf5a!\\xfa~|\\x9d f\\x0b\\xd9e\\xc8\\x83\\x17>\\xe2n\\xf2a\\xe8x\\x05\\xf8\\xb7o\\xc9h\\xb4\\\\xae\\xbdt\\xb2\\xae\\xfb\\xa5\\x8f:g\\xcf\\xd1\\xa4_h\\x95\\x0b+\\xf2b\\x8ci\\xa6\\xfa\\xaa\\\\xfe\ne\\x01\\xfe\\xc4\\x10\\x00\\xcd\\x88wy`\\x7f\\x97<\\x81n\\xe8\\xd6\\xcb^\\x9c\rw\\x8a\\xf6\\xb3\\xbb\\xd4\\x85h|\\x0e)\\x96:\\xf0\\x80\\x0b)\\xef\\x93a,\\xf6\\xb0\\x1d^\\xd9\\x92\\xd8\\x05\\xc2"
  689.  
  690.  
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\x9fu>^i\\xf3\\xfd\\x95\\x07\\x129\\x18$\\x9d+5\\xe5\\x1d\\xc8_;\\x1fw\\xa2x\\x1f\\x98l\\xe4o\\x1c\\xf4\\x19\\x8d\\xfcy\\xb2w#xpg\t\\xd68\\xeb\\xa5\\x82d\\x139qtq\\xbd0\\xdf\\xc5q\\x9d\\x88_\\x0ee\\xaa.&\\x06:6\\x81\\x01q\\xc1\\xecf\\xa8k\\xbf\\x89\\x0c?\\xc5\\xd8\\xf4\\x16\\x81\\xaacj\\xfcw\\xcd\\x86'\\xff\\xfa/\\xfe\\xf4\\xcbsv\\xdf\\x1c\\x07/1\\xb4\\x98\\xa3\\xd9\\xce \\x91\\x03\\xe9\\x9f\\x10\\xe0\\x01'7\\xea\\xd0\\xea^y_s\\x90\\xa9\\x1d\\xcb\\xcbl\\x9c\\xfe\\xcf\\xde\\x16n.\\x02\\x0b\\x864\\x93\\xce3)\\x93\\xae\\xee\\xd1\\xce0\\xae\\xf2@\\x95\\x8e\\x9am\\x85f\\xf4\\xbb\\xf5x\\xfdo\\x0ee\\xf8\\xffz\\x81\\xb95\\x12\\xe3\\x83\\x89\\x8d*\\x0b\\xcb4s\\xdd\\x16j\\x19jm\\x1ak\\xc2\\x14w\\xddyx\\x97\\xa9^|\\x05t<,\\x1b\\xa6\\x04\\x1ae\\xb8\\xcd\\x04hv\\xc1\\x1c\\x91e\\xb3\\x14\\x81\\xc8\\x7f\\x13x\\xf1\\xc9l\\x1e\\xc2\\x19w\\x1a\\x9c\\x07\\x96\\xd7\\x94"
  692.  
  693.  
  694. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xcdk\\xd8\\x05h)\\xbcu\\x16\t\\xc6imsw n\rn\\x1a\\x13f\\xc0\\x97\\xc0\\xad\\x8d\\xa3up\\x80$\\xcf\\xb8\\xdf\\x06r\\xe3\\xd9\\xd8f\\x01\r\\xa0\\xf5\\xecu\\xf1a\\x1b\\xb8\\xf0\\x1f\\xee\\xce\\x15r\\x00a-\\x97\\x81ii\\xb4#\\xfei\\xda\\xff\\xba7'\\xdf\\xa73\\xd9/=i\\x87\\xc0\\xe4\\xf0#\\xbf\\xb7\\xfa@\\x9e\\xa6p\\x1ak\\x9b\\x16j\\xd9k\\xbb\\x9a\\x81w\\xe8?\\xba\\x92\\xb18\"\\xa5\\x9e\\x05g\\xd3ji0\\xe6|\\xde*\\xa1f7\\xd7e\\xcc\\xe7\\x07\\x08\\xf1\\x9e\\x1dk\\xea\\x19\\x9d\\xbao\\x1c\\xe7\\xdep1\\x06r?\\xf7p\\x0b\\\\x9c\\xad\\xcee\\xba7?\\xf0\\xc0\\xdd\\xfc\\xc6\\xf1\\\\x1a\\x91!\\xa7\\xbee\ta\\xb3\\xa2;\\x00v\\xfap\\xe2\\x17\\x1e\\xc3\r\\xf7\\x11?\\xd9\\xf9\\x87n\\xae\\xa4\\xf6\\xa9f\\x83\\xcbo\\x83\\x89\\xb3\\x84\\xb7?\\xe6spx`\\x81\\xa1\\xfb\\x8b\\x11\\x81b\\xb7\\xa2\\x08\\x0b\\xe0\\xf8\\xa7\\x9d\\xcb\\xd5\\x89\\xf79\\x12\\xc9\\x18\\x89\\xe1\\x96\\x07\\xd7\try"
  695.  
  696.  
  697. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010oi\\x15\\xe1\\x82\\x1c\\xe3\\x11\\xb1\\xde\\xedi\\xde\\xb6\\xf8i3=\\xaf\\xa3p\\xfb\\xd5mqtf\\xd2\\x81~_\\xd8\\xcb\\xc1\\xb2jm\\x05\tbm\\xb0\\xf8\\x19\\xb6*\\x01\\xd6llb\\xe0\\xb1\\x98i\\xd4\\xc4m*\\x04;\\x8e\\xa2,\\x8dp\\xbbcc4<@\\x04pp=\\xdf\\xfe\\x95\\xffe\\xd9\\xa7\\xf8zm\\xcdu\\x83\\xbb\\xfej\"\\xd5\\xa7\\x9f\\xce\\xe5'`\\xd22\\xcd\\xcc\\x1f\\xb9.\\x1f\\xeb\\xf2\\x13\\xa8g\\xe7\\xfc\\x10\\xa92\\xf9m`\\xdc\\xdb\\xde\\x03\\x95a\t-\\xe3$\\xdd\\x86rb\\xc6ts\\x8dl>m6\\xbdw4\\x8c0t\\xe2\\x0e\\xfc\n\\xc8~0\\x96\\x19\\x0b0\\xd4\\xf4\\x06\\xcf;&\\x8f\\xe2\\x08\\xb7p\\xf2\\\\xb9\\x04\\xf0\\x16-m\\x92\\xca\\x12\\xbf\\x11;\\x11c\\x08fh\\xb3@\\xd5\\xae\\x8d\\xd3\\x16\\xaf\\xb1i\\x91\\x1ac\\x1c9\\x18~\\x9b\\xc8\\xc1\\xfdb\\xd8\\xb3\\xdd\\x03b\\x0e\\xbc\\xb7d\\xad8\\xee*\t\\xa9v&\\xc5\\x07\\xc9y~\\xd3\\xbc\\x05\\x1a\\x18\\xa5,\\x84\\x18_\\xdes>\\xa9\\xb3"
  698.  
  699.  
  700. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z,^yn\\xdd\\xc9\\xd76\\xb2)\\xd9\\xcd\\xad\\x00\\xe6\\x8e\\xf8\\xc1c|\\x06:\\xc2\\x85\\xb5\\x82\\x1ct\\xd3\\xa5\\xf0yq1_\\xd8%r\\x8et\\xb3\\x84\\xabj\\x91\\xe8\\xf4<\\x8f\\x08v|=\\xa9,ydyz\\xe3cv\\xb1\\x1f\\x85&\r\\xd0q\\xce\\xf0\\xe0\\x97!\\x16\\xbd\\xd7||\\x1c\\x15 \\xfa\\x12vi\\xf2\\xa6\\xac\\xe7\\xbf\\xec)\\xfc6\\xa3\\xf5e\\xdb\\xde\\x95\\xc6j\\xe3;\\x84\\xf9\\xc3t\n\\x12\\xd7m\\xd3\\xcd2m\\xd3\\x7fa\\xf6!p\t\\x1ch\\x03\\xcb\\xafr\\xdb\\xe3\\x8c^\\xd5/b\\x85\\xc9\nu\\xf1\\x8e\\x9f\\xc0s\\xd6+\\x19z\\xfc\\x8es\\xbe\\x96\\xae\\xdf\t\\xe27\\x181@\\xb8\\xe8\\xb1\\x88\\xf5\\xbb\\xee\\x85\\x80\\xb6\\x82=\\x90\\x8c\\x87*\\xdd\\xe9(\\x82%\\xfb\\xc8ft\\xd8\\x1eh\\x85v\\xa5\\x7fih\\x9fl\\xedp\\xa9\\xc4u\\xea\\x123\\xf1\\x13\\x95\\x9b\\xb9~\\xe5r\\xa5\\xf0r/w\\xc2\\x9a?\\xc1\\xd4\\xd1\\x04\\xe4(\\xce\\xb9ty\\xfe\\xf9g\t\\xee\\xc7\\xc3#j\\xe8\\x05/\t"
  701.  
  702.  
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xcb\\xe2\\x03\\x1a\\x1b,`\\x9f\\xc3\\x1a\\xc4-\\x08\\x06\\xcdd;+\\x1a\\xe3\\xec1\\x1f\\xf5#\\x1en\\xe0\\x7f\\xb9\\xc94\\x7fd\\x1e\\xfb_\\x89\\xe1cy\\\\x06\\x86\\xa7\\x15\\xe333\\x9cd\\xc9/\\x99\\xd5\\xbb\\x9f\\xd3i\\x9d\\xe1\\xf5\\xf9#\\x1f\\x99\\x8f\\xc26\\xcdc\\xd2p\\xef\\xb2~\\x08\\x82\\x11#\\x9f\\x92u\\xafw\\\\xc4\\xcf\\xfa\\xb1\\x9blv2\\x85\\xdf\\x19\\xf5\\x0e\\xe2\\xfdttqq<,\\x16\\x0b\\xf4\\xf6q\\xe4\\xef\\xc2\\xda\\x08,\\xf65\\xe3\\x8a\\xde.m\\xe5\\xef\\xb0~\\x08\\xca\\xc5\\xe9\\xd5\\xebx\\x86\\xb6\\xe6\\xce\\xf4\\xb4o;\\xeb\\x0f\\x97\\xed\\xfbb\\x86\\xcdv8\\xb6h\\x86\\x04\\xeb>1\\xaf\\xc4\\x1d\\xc2h\\xfbxaim4\\xd6x\\xc8hvk\\x8f\\xa1\\xb8s\t\\x96gp\\xef\\x8f\\xfbr\\x10d\\xbe\\xb7lfi\\xd5\\x9a\\x8a\\x8cn\\xcc\\x95\tb\\x05\\x17\\xee\\xf7\\xd5s\\xb6\\xcb\\xbe%\\x8f\\x11\\xc3fn\\x9f\\xff\\x01b\\x01\\xfe|m\\xd9\\xba\rb!\\xd7\\xe0\\xb0#\\x1eh\\xd35>\\xb0\\x8br\r\\x88"
  704.  
  705.  
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\xd8\\xc1^^\\xbc|\\x0e/\\xe3\\xd6\\xa3p\\xd4=\\x05\\xd6\\xc6?\\x12\\xa8/py\\xc6\\xc2&z\\x9dxr\\x0cx\\x8d@\\x80)\\xab`\\xa7:\\xf5k\\xdaheo\\xc9\\xc9\\xeck\\x93\\xfe\\xd8\\x91r\\x8c\\xf0:\\xc6\\xee5\\x92q\\x11\r\\x06\\xe7\\xcf\\xcaq2k\\x90\\xf1\\xeb\\x82-\\xae\\xeb\\xe1\\xdc\\x1f\\x8ehu\\xd4\\xf9\\x8a\\x0c\\xef\\xce<\\x06\\xbev\n\\x108c\\x82\\xcam\\x8c|\\x9d\\x12\\xb5\\x82aw+\\xce\\xa3\\xb9\\xd1cy\\x8f:\\xc8\\x17\\xd0\\xfc\\xe9\\xe4\\xea\\xac\\xf3\\x17s,\\xf3t\\xc5s\\xe8\\xcab&\\xb3\\x94\\x13d'\\xf6)t&-h\\xdc\\x04\\xce%_\\x00v\\x9c\\xf1\\x96\\x862\\xb8\\xb6\\xbd\\x13a\\x91y\\xca\r\\x8fqi.\\xed;\\xcfs\\xac(\\xac\\xad\\x95b\\xbb\\xc8\\xc7\\x94\\x0508m\\xb6\\xc5q\\xeb\\xe0\\xe9\\x10l\\x9b\\xe9\\xf2\\xce8\\xc0c\\x9b\\xd6\\x02\\xd0o\n\\xf4\\xca\t\\xc8&\\xb6\\x88$\\xc5\\x953\\xa8\\xfe\\xe3\\x9dm\\xechs\\xd3\\xc6<<\\xeb\\x1c\\\\xe4"
  707.  
  708.  
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\xba\\xb5gs\\xb8h\\xdb\\xa4x\\x0e\\x95\\x0e\\xf6w\\xd4\\x07\\xee\\xb7\\x8f\\x83\\xe8d\\xf8\tj\\xb1\\xad\\x9a\\xd5\\x93\\x0b'l\\xc6\\xf5\\xca\\x0f\\xf9x!\\xccu\\x119\\xcb>\\xf7\\xd0\\xcb\\x8bu\\xeb\\xd1:\\x19\\xa7\\x81w\\xf7(\\xb5\\xe3p\\xc4\\x8107\\x94\\x95mz\\x91\\xb7\\xf2\\xfb\\xe8\\xd2\\x18u\\x97\\xea\\x9e\\xef\\x02\\xb3!\\x19\\xf4\\xd5a\\xcc\\x8d\\xeem\\xee\\xb0\\x8f\\xfd\\xbf\\xa6q0:\\x85\\xb8\\x83\\x0e\\x1dvq\\x04\\x89\\x82\\xd8i\\xdc19\\xdf\\xb1\\xbf\\xdc\\xf8.\\x1c\\xd68\\x80e\\x10\\xd8\\x1c\\xc5v\\x05lu:y@y\\xb0\\xd5*nl\\xace.\\xfc\\xd9\\xfc\\xb9\\xc8\\xad\\xd8\\x97\\xf0\\xf3\\x07\\x92\\x0ci3\\x88(\\x07\\xc51\\x18y\\x82-\\x15\\x1c,\\xa7\\xdd\\x04\\xda\\x9e\\x01\\xcd\\xadv8x\\xff\\xc7re\\xd7\\x8do\\xc7:\\xbeu\\x0f\\x9e\\x08\\xd9\\xde\\xc6\\xa51\"\\xc0z\\x1ee\\xea\\xc7\\x1b\\x18s\\x96\\xeb\\xfek\\xc2m\\xa0\\x04\\xe1\\xde0!\\x12\\x7fg\\x8c1#q\\xdf\\x7f\\xda\\x9b\\xcef\\x03<\\xee\\x843"
  710.  
  711.  
  712. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01&b'\\x02p\\x04\\xbf|w\\xdbfq5q\\xb3s\\xc2x8\\xe2h\\x07\\xc0\\x15\\x18\\x8dx\\xe9\\xf2\\xd0\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  713.  
  714.  
  715. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xc1d\\xeb\\x17u&\\xe8\\xe2\\x93\\xa32\\x03\\xab\\x91\\xbf\\xd2r\\x91\\xe9\\x86$.\\xba\\x9b\\xf2\\x1ba`t\\xc0e\\xd4\\x98\\xad\\xfc2\\xaew\\x16@\\xfbb\\xe8@\\xce\\xd8\\x13\\x8b%c\\x03\\xe3\\x10\\xe5\\xf4\\xa0\\x145>m\\xc7\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9/&\"q&wv\\xb7'douu\\xe2m\\xd5\\xc4\\x1cx`d\\x12acs:\\xf0\\xae\\xcde\\xc8$\\xfd\\xd9t\\xa3\\xc0\\xb8\\x8d\\xf2e\\xda\\xf8n\\x1a\\x17\\xc6"
  716.  
  717.  
  718. "http_request": "winword.exe_WSASend_\\xaa\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94\\xd6g\\xec\\x17\\x98<k\\x96\r\\xecf4\\xbdb\\xb8\\x85/\\x83j\\x973\\xdcbk\\x05q\\xf2\\x06\\x96v\\xf4\\x07q\\x95m\\xab\\xf1\\x03\t+\\x10\\xab\\xe2\\xb1\\xc8\\x8b\"\\x99\\xf7\\xcb\\x950\\xc8\\xbe-\\xdb\\xdc\\x1cm\\xca\\x9d \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\x8a!\\xde<\\x08ha|\\xf8\\x89^\\x80\\x90\\x96\\xcd\\xd1\\xa1#g2\\xd5\\x9et\\xd1\\x06\\xa5&\\x8e\\xb213\\xb1\\x9ek\\xb1l\\x04=\\xc8bl\\xac\\xf8\\xf1,@\\xd4"
  719.  
  720.  
  721. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x0076w\\xf7\\xabn\\xe6\\xd5\\xd9v\\xe4q\\x03\\x89\\x8f\\xb4\\xaa$g\\xbao\\xe0\\xc8x\\x86q\\xcfjb\\xb4\\xd6\\x8dz7\\xcd\\x0bd\\x11\\xc8!\\xeb\\x19\\x98\\xa5x\\x93\\xe2;k\\xeb\\xa5y\r\\xa8=\\xadv\\xbc!\\x01n\\xec\\x84ux\\xec\\xd4\\xbcwny\\x91\\xd0\\xbd\\xb0\\xe8w\\xf2\\x98\\xa6\\xb8\\xf4\\x9e;\\xc7\\xe7\\x0c\\xde\t\\x01\\xa0o2\\xe6\\xf3\\xa9y\\xc1\\x9a\\xa03\\x99\\xf9\\x96d4\\xad\\xa1\\xa5\\xaea\\x98\\xd0\\xef\\x9a\\x0c\\x17t\\xca\\xbat\r\\xf4#\\xe3\\xd1\\x9e\\x8e\\x83\\xb0\"\\xf4\\xaa\\x0b\\x87\\xe4avm\\xe3\\xc7\\xb0\\xc9\\xcas\\x85u\\xef\\xcc%\\xe5yy\\xb2\\xc2$\\xb1\\xe3\\x07~e\rn\\xd8g\\xab\\x17\\x8b\\xcd\\xabau$\\xef\\x03>\\x010\\x15_sl9\\xbcdr\\xab\\xe8r\\xf6\\xd3xr4\\x9aj\\xb0c\\xae\\xa9\\xed'\\xf3\\xd1\\x86\\xc7\\x8a\\x1e\\x8c\\x8bv#l\\xb6g\\xcb1`\\xc7\\x0eh\\x97~u\\x83\\x1cz\\x8d\\xaa\\x94\\x89>\\xff\\x8b\\x03yj\\x9cq\\xf9o"
  722.  
  723.  
  724. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  725.  
  726.  
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`:q1\\xba-\\xf1h\"u\\xf7\\x93\\x8a\\xcc\\xc6\\xb2\\x8d\\xde\\x8c\\x91\\x04\\xa2\\x01\\xbe\\xbb\\xbe\\x84\\x07\\xf9\\x01\\x9fz~<\\xe0\\xff\\xd8\\x03.\\x89hc\\xdd\\xec\\xc2\\xf9\\x1cde\\xc1\\xd6\\xba\\x92|\\xfc\\xba\\xd3\\x83\\xae;\\x15\\xb3z\\xa4\t\\xfcz\\xad>\\xf3\\x17|dq\\xc3c\\x8fyfcd\t\\xa2\\x1cn(\\xb2\\xb2\\x8ah\\x15\\xe0p\\xc3l\\xd5\\xc6z\\xfbl\\xdf\\xda\\xab3pp\\x02~\\x94g\\x88u\\x00w4r\\x9a\\x8e\\x00\\xc2y_\\xcb\\xd2\\x12_\\x0e\\x8ajdf\\xb0\\xf4\\`\\x11n\\xc7p\\xdb\\x17 \\x1d \\xd0\\xba\\xf9\\xf4y\\x03mn\\xa5\\x16\\x7f6\\x02\\xf1om\\xef\\x1b \\xd4\\xcf\\x12\\xe0$\\xbb\\x1b/\\xe5\nu\\x9b|\\xc0y\\xc81\\xe5\\xc2vn\\xbf\\xa16\\x8c\\xbd\\xdc\\xff\\x9au\\xb5\\x11t.\\x948\\x04w\\xf5\\xb0\\xdc\\xa8\\xb6\\xa7\\xc0\\xd3\\xf9\\xed\\xdb\\x9a\\xf7\\x11\\xbbp!\\xa70o\\xbbu\\xee\\xa0\\x1c\\xdb?w\\xac&o\\xdd\\xa6f\\xb4\\xa4\\xa2\\x93\\xebq\\xcd\\xe4\\x9dv\\x9b5cr"
  728.  
  729.  
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xa0\\x180#q^d\\xcc$\\xf4a\\x98ps^,\\xe3\\x01\\xb2\\x1e\n8^b/j\\xf0 \\x98o,\\x83\\xa5j\\x89\rfg8\\xc11\\xf0i\\xe9\\x9a\\xfe\\xb1\\xb9 \\xccn\\xe7n\\x894\\xe8\\x84\\xe5\\xf8&\\xb7\\xfcq\\xf6p\\xad4\\x8a\\xc0\\xf8\\x0b\\x9d\\x06\\xd3\\x04\\xceo\\xf8\\x00/\\xe7\\xd8u\\x99\\xb65\\x00`\\x1e\\xff\\xabf\\x08\\x84\"\\x16f\\x85\"\r\\xa9sg+\\xac\\x1ckw\\xc5\\xac\n\\xd0\\x1a\\x1e\\xb13:\\xc8\\xe8x\\xd3\\xfeh\\x00\\x91g\\xf9<\\xa4\\x8a\\x0br\\xe5'\\xd6.\\xe5z\\x18x\\xeb\\xd6\\x9a\\x0ckp\\xd0w\\xd5t\\x14\\xc5\\xca\\xbah\\xea\\x84@\\xe7i\\xe8\\x93ov.\\xa9\\xba?-<\\x90e^\\x1as\\x82s\\xc7q\\x8d\\x0e\\xe1j\\x19 \\xcc\\xc6\\xa9\\xe1h\\xd5\tv\\xd0\\x94\\xf6\\x14\\xa9\\xdbz-\\xff\\xbf\\xb4\\\\xb1\\x93q\\xafj\\x13\\xab\\xd5hb\\xde\\xd48%\\xb7?\\x19/5\\xd0u\\x1a'c!0v\\xe1'\t\\xed\"\\xd7\ti\\x1c\\x8f\\x8c\\x16>\\xd8"
  731.  
  732.  
  733. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  734.  
  735.  
  736.  
  737.  
  738. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  739. "Details":
  740.  
  741. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  742.  
  743.  
  744. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  745.  
  746.  
  747. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  748.  
  749.  
  750. "McAfee": "Exploit-CVE2017-11882.ah"
  751.  
  752.  
  753. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  754.  
  755.  
  756. "Symantec": "Bloodhound.RTF.12"
  757.  
  758.  
  759. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  760.  
  761.  
  762. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  763.  
  764.  
  765. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  766.  
  767.  
  768. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  769.  
  770.  
  771. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  772.  
  773.  
  774. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  775.  
  776.  
  777. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  778.  
  779.  
  780. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  781.  
  782.  
  783. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  784.  
  785.  
  786. "TrendMicro": "Possible_SMBCVE20170199"
  787.  
  788.  
  789. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  790.  
  791.  
  792. "Sophos": "Exp/201711882-P"
  793.  
  794.  
  795. "Ikarus": "Exploit.CVE-2017-11882"
  796.  
  797.  
  798. "Cyren": "CVE-2017-11882!Camelot"
  799.  
  800.  
  801. "Avira": "HEUR/Rtf.Malformed"
  802.  
  803.  
  804. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  805.  
  806.  
  807. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  808.  
  809.  
  810. "AhnLab-V3": "RTF/Malform-C.Gen"
  811.  
  812.  
  813. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  814.  
  815.  
  816. "GData": "Exploit.RTF-ObfsStrm.Gen"
  817.  
  818.  
  819. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  820.  
  821.  
  822. "Zoner": "Probably RTFObfuscation"
  823.  
  824.  
  825. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  826.  
  827.  
  828. "MAX": "malware (ai score=88)"
  829.  
  830.  
  831. "Qihoo-360": "susp.rtf.objupdate.gen"
  832.  
  833.  
  834.  
  835.  
  836. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  837. "Details":
  838.  
  839. "target": "clamav:Rtf.Dropper.Agent-7014837-0, sha256:77a2d8e84206a20f8a799d2b2789e7082f389fa0fcbda578e53aae895a20e068, type:Rich Text Format data, version 1, unknown character set"
  840.  
  841.  
  842. "dropped": "clamav:Rtf.Dropper.Agent-7014837-0, sha256:77a2d8e84206a20f8a799d2b2789e7082f389fa0fcbda578e53aae895a20e068 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RTF_63aca7dc6bd828794a36fd065b2e95cd.doc, type:Rich Text Format data, version 1, unknown character set"
  843.  
  844.  
  845.  
  846.  
  847.  
  848. * Started Service:
  849. "osppsvc"
  850.  
  851.  
  852. * Mutexes:
  853. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  854. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  855. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  856. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  857. "CicLoadWinStaWinSta0",
  858. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  859. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  860. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  861. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  862.  
  863.  
  864. * Modified Files:
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_63aca7dc6bd828794a36fd065b2e95cd.doc",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_63aca7dc6bd828794a36fd065b2e95cd.doc",
  867. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF2E044378-43EB-43B4-BDCA-B6B3006D21E0.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSAA7533F4-2B3E-464D-9D3A-79C4E9A8624B.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS87B1085E-BD9C-4199-9FE1-41E2C763B81B.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  871. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  872. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  873. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F52EFD459704E23E98B5C774A45162",
  874. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C1F52EFD459704E23E98B5C774A45162",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8138.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8139.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab88CC.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cab892B.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab892A.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AC3.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD3.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE6.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE7.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD5.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF9.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF8.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B1B.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B0A.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B2B.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD4.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DEB.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DFC.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E5B.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E7B.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E8C.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EFA.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EFB.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2D.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2B.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2C.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9057.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9077.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9134.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92FA.tmp",
  906. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  907. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  908. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  909. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9627.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9628.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9669.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cab966B.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9658.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96EA.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96FA.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar968B.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar966A.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab992E.tmp",
  920. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab999D.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99AF.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99C0.tmp",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99B0.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A50.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99C1.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A20.tmp\\pictureorgchart.glox",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9A51.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A62.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AD0.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar992F.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar999E.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A20.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B80.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B21.tmp\\Equations.dotx",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B10.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B81.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B11.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B21.tmp\\Content.inf",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BE0.tmp\\CircleProcess.glox",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BE0.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C10.tmp\\Basis.thmx",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F4D.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C10.tmp\\content.inf",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA24B.tmp\\ConvergingText.glox",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA24B.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA2CA.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA26C.tmp\\TabbedArc.glox",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA2DC.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA31E.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA31D.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA331.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA333.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA335.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA30C.tmp",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA357.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA26C.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA31C.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA388.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA31F.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA320.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA347.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA332.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA336.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA334.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA399.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA2CB.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\BracketList.glox",
  973. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA358.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3E9.tmp\\turabian.xsl",
  977. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3E9.tmp\\Content.inf",
  980. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA551.tmp\\content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA591.tmp\\content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA551.tmp\\Metropolitan.thmx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5FF.tmp\\ThemePictureAccent.glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA610.tmp\\sist02.xsl",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA591.tmp\\View.thmx",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA611.tmp\\PictureFrame.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA611.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5FF.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\Wood_Type.thmx",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FF.tmp\\chicago.xsl",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DE.tmp\\gostname.xsl",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7AC.tmp\\harvardanglia2008officeonline.xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FE.tmp\\HexagonRadial.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FF.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7AC.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA610.tmp\\Content.inf",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FE.tmp\\Content.inf",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DE.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8D6.tmp\\rings.glox",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8D6.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB77.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB77.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC81.tmp\\ieee2006officeonline.xsl",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC81.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD0F.tmp\\ThemePictureAlternatingAccent.glox",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD0F.tmp\\Content.inf",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADDB.tmp\\InterconnectedBlockProcess.glox",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADDB.tmp\\Content.inf",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF24.tmp\\mlaseventheditionofficeonline.xsl",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF24.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB08D.tmp\\APASixthEditionOfficeOnline.xsl",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0AD.tmp\\chevronaccent.glox",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB08D.tmp\\Content.inf",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0AD.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C7.tmp\\RadialPictureList.glox",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C9.tmp\\iso690.xsl",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1CA.tmp\\VaryingWidthList.glox",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1DB.tmp\\gb.xsl",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C8.tmp\\gosttitle.xsl",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C7.tmp\\Content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1CA.tmp\\Content.inf",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C9.tmp\\Content.inf",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1DB.tmp\\Content.inf",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C8.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2E5.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB383.tmp\\TabList.glox",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB383.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1057. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3B0EE633-1B76-4AEE-AC0E-4A0AED4D6475.tmp"
  1058.  
  1059.  
  1060. * Deleted Files:
  1061. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8138.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8139.tmp",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464fn=Dividend.eftx",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464fn=Dividend.xml",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496fn=Parallax.eftx",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464fn=Dividend.xml",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496fn=Parallax.xml",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496fn=Parallax.xml",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9627.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9628.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9658.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar966A.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9669.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar968B.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A20.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B21.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99AF.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99B0.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A50.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9A51.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99C0.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BE0.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99C1.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C10.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A62.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab999D.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B10.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar999E.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A20.tmp\\pictureorgchart.glox",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AC3.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B80.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AD0.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA24B.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B81.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B11.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B21.tmp\\Equations.dotx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab992E.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA26C.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar992F.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9057.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BE0.tmp\\CircleProcess.glox",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E5B.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3E9.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA2DC.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA31E.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA26C.tmp\\TabbedArc.glox",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA31F.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA31C.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cab88CC.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA333.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA334.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA30C.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA388.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA24B.tmp\\ConvergingText.glox",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C10.tmp\\Basis.thmx",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA347.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\BracketList.glox",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA31D.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA331.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA357.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA399.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA2CA.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA551.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3E9.tmp\\turabian.xsl",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA335.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96FA.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA320.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA332.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA2CB.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA591.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EFA.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA336.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5FF.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA358.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA610.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9134.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA611.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2C.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FE.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FF.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DE.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA611.tmp\\PictureFrame.glox",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cab892B.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7AC.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8D6.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FF.tmp\\chicago.xsl",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B1B.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA591.tmp\\View.thmx",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\cab966B.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DE.tmp\\gostname.xsl",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5FF.tmp\\ThemePictureAccent.glox",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E7B.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA610.tmp\\sist02.xsl",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EFB.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\Wood_Type.thmx",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92FA.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F4D.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8D6.tmp\\rings.glox",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA551.tmp\\Metropolitan.thmx",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7AC.tmp\\harvardanglia2008officeonline.xsl",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6FE.tmp\\HexagonRadial.glox",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96EA.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB77.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DEB.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2D.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E8C.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB77.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD5.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC81.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC81.tmp\\ieee2006officeonline.xsl",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD3.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD0F.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD0F.tmp\\ThemePictureAlternatingAccent.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B0A.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADDB.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADDB.tmp\\InterconnectedBlockProcess.glox",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD4.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF24.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF24.tmp\\mlaseventheditionofficeonline.xsl",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B2B.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB08D.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0AD.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0AD.tmp\\chevronaccent.glox",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB08D.tmp\\APASixthEditionOfficeOnline.xsl",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DFC.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F2B.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C7.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C9.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C8.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1CA.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1DB.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2E5.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C7.tmp\\RadialPictureList.glox",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1DB.tmp\\gb.xsl",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C8.tmp\\gosttitle.xsl",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C9.tmp\\iso690.xsl",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE7.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1CA.tmp\\VaryingWidthList.glox",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF8.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB383.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9077.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2E5.tmp\\architecture.glox",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE6.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB383.tmp\\TabList.glox",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\cab892A.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_63aca7dc6bd828794a36fd065b2e95cd.doc",
  1260. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1261. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3B0EE633-1B76-4AEE-AC0E-4A0AED4D6475.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSAA7533F4-2B3E-464D-9D3A-79C4E9A8624B.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS87B1085E-BD9C-4199-9FE1-41E2C763B81B.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR67F2.tmp.cvr"
  1265.  
  1266.  
  1267. * Modified Registry Keys:
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\9~u",
  1269. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4EA4E1",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4EA4E1\\4EA4E1",
  1289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1549. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1592. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1593. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1594. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1903.  
  1904.  
  1905. * Deleted Registry Keys:
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\9~u",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"bt",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4EA4E1\\4EA4E1",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1936.  
  1937.  
  1938. * DNS Communications:
  1939.  
  1940. "type": "A",
  1941. "request": "compute-1.azurewebsites.net",
  1942. "answers":
  1943.  
  1944. "data": "waws-prod-dm1-101.sip.azurewebsites.windows.net",
  1945. "type": "CNAME"
  1946.  
  1947.  
  1948. "data": "waws-prod-dm1-101.cloudapp.net",
  1949. "type": "CNAME"
  1950.  
  1951.  
  1952. "data": "23.99.183.149",
  1953. "type": "A"
  1954.  
  1955.  
  1956.  
  1957.  
  1958.  
  1959. * Domains:
  1960.  
  1961. "ip": "23.99.183.149",
  1962. "domain": "compute-1.azurewebsites.net"
  1963.  
  1964.  
  1965.  
  1966. * Network Communication - ICMP:
  1967.  
  1968. * Network Communication - HTTP:
  1969.  
  1970. "count": 1,
  1971. "body": "",
  1972. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1973. "user-agent": "Microsoft-CryptoAPI/6.1",
  1974. "method": "GET",
  1975. "host": "ocsp.digicert.com",
  1976. "version": "1.1",
  1977. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1978. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1979. "port": 80
  1980.  
  1981.  
  1982. "count": 1,
  1983. "body": "",
  1984. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1985. "user-agent": "Microsoft-CryptoAPI/6.1",
  1986. "method": "GET",
  1987. "host": "ocsp.msocsp.com",
  1988. "version": "1.1",
  1989. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1990. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1991. "port": 80
  1992.  
  1993.  
  1994. "count": 1,
  1995. "body": "",
  1996. "uri": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1997. "user-agent": "Microsoft-CryptoAPI/6.1",
  1998. "method": "GET",
  1999. "host": "mscrl.microsoft.com",
  2000. "version": "1.1",
  2001. "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  2002. "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: mscrl.microsoft.com\r\n\r\n",
  2003. "port": 80
  2004.  
  2005.  
  2006. "count": 17,
  2007. "body": "",
  2008. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2009. "user-agent": "Microsoft-CryptoAPI/6.1",
  2010. "method": "GET",
  2011. "host": "crl.microsoft.com",
  2012. "version": "1.1",
  2013. "path": "/pki/crl/products/microsoftrootcert.crl",
  2014. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2015. "port": 80
  2016.  
  2017.  
  2018. "count": 2,
  2019. "body": "",
  2020. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2021. "user-agent": "Microsoft-CryptoAPI/6.1",
  2022. "method": "GET",
  2023. "host": "crl.microsoft.com",
  2024. "version": "1.1",
  2025. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2026. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2027. "port": 80
  2028.  
  2029.  
  2030. "count": 1,
  2031. "body": "",
  2032. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2033. "user-agent": "Microsoft-CryptoAPI/6.1",
  2034. "method": "GET",
  2035. "host": "crl.microsoft.com",
  2036. "version": "1.1",
  2037. "path": "/pki/crl/products/microsoftrootcert.crl",
  2038. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2039. "port": 80
  2040.  
  2041.  
  2042.  
  2043. * Network Communication - SMTP:
  2044.  
  2045. * Network Communication - Hosts:
  2046.  
  2047. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!