API tools faq
paste
paladin316

NetWire_b1d48a8e5aa07f5d85c278410abf79c5_doc_2019-07-11_23_30.txt

paladin316
Jul 11th, 2019
2,799
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 235.18 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "NetWire"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "NetWire_b1d48a8e5aa07f5d85c278410abf79c5.doc"
  7. * File Size: 702446
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "3f01d5e66e5e0c20237fd0085ca47822a573896c22e025f601123842afcebe15"
  10. * MD5: "b1d48a8e5aa07f5d85c278410abf79c5"
  11. * SHA1: "56efe973554a17ab1890bff75892aaf6d58fa5aa"
  12. * SHA512: "9b8c57dd11d49e6b59c563a7990729f3f0bf2e8959130485dbb842e946eac08bc8238aea11c9ca17cb16f6d8cc12d1925309420d339d2f97f5d1f56c660a7efa"
  13. * CRC32: "A6403527"
  14. * SSDEEP: "1536:VBsGXysETsy4LArDY7ojC+dRxo8EOViOg/wU42xuZXysETsy4LArDY7ojC+dRxoz:Vl3c8Y5c8Y5c8Y5c8YfU"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "C:\\Windows\\splwow64.exe 12288"
  23.  
  24.  
  25. * Signatures Detected:
  26.  
  27. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  28. "Details":
  29.  
  30. "IP": "69.192.108.32:443"
  31.  
  32.  
  33. "IP": "65.52.98.231:443"
  34.  
  35.  
  36. "IP": "104.18.24.243:80"
  37.  
  38.  
  39. "IP": "23.15.4.26:80"
  40.  
  41.  
  42. "IP": "52.109.6.6:443"
  43.  
  44.  
  45. "IP": "184.31.248.225:443"
  46.  
  47.  
  48. "IP": "72.21.91.29:80"
  49.  
  50.  
  51. "IP": "52.109.16.4:443"
  52.  
  53.  
  54.  
  55.  
  56. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  57. "Details":
  58.  
  59. "ioc": "rocess.glox"
  60.  
  61.  
  62. "ioc": "ontent.inf"
  63.  
  64.  
  65. "ioc": "chevronaccent.glox"
  66.  
  67.  
  68. "ioc": "ext.glox"
  69.  
  70.  
  71. "ioc": "gosttitle.xsl"
  72.  
  73.  
  74. "ioc": "iso690.xsl"
  75.  
  76.  
  77. "ioc": "gb.xsl"
  78.  
  79.  
  80. "ioc": "gostname.xsl"
  81.  
  82.  
  83. "ioc": "ist.glox"
  84.  
  85.  
  86. "ioc": "ieee2006officeonline.xsl"
  87.  
  88.  
  89. "ioc": "e.gu"
  90.  
  91.  
  92. "ioc": "nline.xsl"
  93.  
  94.  
  95. "ioc": "rings.glox"
  96.  
  97.  
  98. "ioc": "set.dotx"
  99.  
  100.  
  101. "ioc": "chicago.xsl"
  102.  
  103.  
  104. "ioc": "mlaseventheditionofficeonline.xsl"
  105.  
  106.  
  107. "ioc": "rame.glox"
  108.  
  109.  
  110. "ioc": "pictureorgchart.glox"
  111.  
  112.  
  113. "ioc": "adial.glox"
  114.  
  115.  
  116. "ioc": "harvardanglia2008officeonline.xsl"
  117.  
  118.  
  119. "ioc": "sist02.xsl"
  120.  
  121.  
  122. "ioc": "iso690nmerical.xsl"
  123.  
  124.  
  125. "ioc": "ccent.glox"
  126.  
  127.  
  128. "ioc": "rid.glox"
  129.  
  130.  
  131. "ioc": "..3b"
  132.  
  133.  
  134. "ioc": "architecture.glox"
  135.  
  136.  
  137. "ioc": "quations.dotx"
  138.  
  139.  
  140. "ioc": "turabian.xsl"
  141.  
  142.  
  143. "ioc": "content.inf"
  144.  
  145.  
  146. "ioc": "rame.thmx"
  147.  
  148.  
  149. "ioc": "ividend.thmx"
  150.  
  151.  
  152. "ioc": "arallax.thmx"
  153.  
  154.  
  155. "ioc": "asis.thmx"
  156.  
  157.  
  158. "ioc": "eadlines.thmx"
  159.  
  160.  
  161. "ioc": "rop.thmx"
  162.  
  163.  
  164. "ioc": "adge.thmx"
  165.  
  166.  
  167. "ioc": "uotable.thmx"
  168.  
  169.  
  170. "ioc": "erlin.thmx"
  171.  
  172.  
  173. "ioc": "ircuit.thmx"
  174.  
  175.  
  176. "ioc": "g.n9"
  177.  
  178.  
  179. "ioc": "roplet.thmx"
  180.  
  181.  
  182. "ioc": "eathered.thmx"
  183.  
  184.  
  185.  
  186.  
  187. "Description": "Performs some HTTP requests",
  188. "Details":
  189.  
  190. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  191.  
  192.  
  193. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  194.  
  195.  
  196.  
  197.  
  198. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  199. "Details":
  200.  
  201. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01'\\xbc\\xdfa\\xe9\\xefp\\xf9e\\x91\\x9c\\xd6\\xd5\\x19rc:kx\\xdb\\xd3\\x10\\xf9f\\n0c\\x91q\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  202.  
  203.  
  204. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x0ex\\xdd\\xf1my\\x8b\\xbds\\xd7;\\xb7\\xc5\\xcdgl\\xcdu\\xccfi\\xfd\\x86m\\xc7\\xae\\x8e\\xa6\\xfbhv\"\\xa6f\\xad\\x88\\x97sa\\x15\\x01\\xb2\\xa6\\x12\\xc5\\x17\\xf4\\x95\\x84x\\x15\\xc4|s!:a\\x0b\\x1c\\xf5\\xa5f\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4@\\xd6\\xdfh\\x8chs\\xc9\r\\x80\\xd4p\\xbc1p\\x01\\x82\\xa6\\x9b\\x00\\x1bk\\xd8\\x8du\\xfe-|?\\x04:\\xeal\\x81v\\xe2\\xf2\\x1eji\\xfa\\xafs7\\xb8\\xbd\\x93"
  205.  
  206.  
  207. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  208.  
  209.  
  210. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  211.  
  212.  
  213. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xad$?\\xc0\\xe3\\xbb\\xa4\\x88\\xa1\\x07\\x91u\\x9bk\\xacqd\\x03*|\\xack\\x1em\\xb7u\\xec\\x83\\xa6\\xcb\\xddeu\\x11\\xf7\\xa7ihv\\xf0\\x92\\xfe\\xbf\\xcaw\\x95\\xdcn61y\\x9fd\\xfd3a\\xa4,\\xe4\\x7f7\\xe8\\xde\\xdch\\xf8\\x15\\x90;\\x96j\\xf2\\xcb\"\\xca\\xd7\\x01\\xfcg\\xc7\\x01\\xeey\\xd7\\x93\"\\xee\\x86o\\xc3g\\x94\\xf2?r\\x96%\\xbec\\xe8o\\xb2gk\\x84\\x10\\xc1'*\\xadja\\xa6\\x9d $hd\\x8f\\xac\\x17\\xd8\\x93\\xaf&&\\x0f\\xf0\\xbf!\\xcaq\\xe8be*\\xa6\\xe9v\\xd1?:o\\xcb\\x91!\\xae\\xeb\\x8e\\x80p m\\x8c\\x900\\xf0\\xa2\\x07\\xa0ub\\xb8\\x19q\\xdejij\\x9b\\xfe\rr\\x97\\xaes\\xc0w\\xd7\\xe1\\xad\\x13\\x05\\xe5\\x86\\xefg\\xd2\\xd4\\x98\\x1d\\xd6\\x82\\xc1z\\x9f\\xfdk\\xa8e\\xb0\\xc3&b\\x81\\xcb\\xdas\\x80\\xc2yz;\\x08\\x10.kh\\x9b\\xb5\\x1c\\xc2\\xf5s3\\xb4@w\\xbes\\xc6>c\\xf4\\x19\"\\xb7x\\xa76m!y\\xa5\\xdaaz\\x82"
  214.  
  215.  
  216. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 ?\\x9d\\x8f\\xf2+\\xc4\\x84\\xfb\\xab_\\\\xb0\\x8b\\x94\\xe8\\x02w\\xc4%\\x84-\\xc4\\x9a6\\xfb\\xe4\\xe46\\xe6\\xe0)\\xe9v\\xf3j<0\\xef\\xee\\x1f'\\x95\\xf6l6\\x9e\\xd9\\xbe\\xdata v\\xca3\\x06\\x17.cu\\xc4i|j\\xf6z\\xd1uj\\xf2o\\xd5\\xff\\x8c;\\xc4\\x9f.\\xf6\\x13&\\xbf\\x11\\xf1)\\xe3\\xcch\\xce^:1\\xcd\\xa1\\xa2h\\xbb\\xe0's\\xf2s\\x90\\x9e\\xbf\\xd3\\x1as\\xcb\\xe1\\x1c\\xa8u\\x1b%\\xf8gl!\\x1a\\xcaaai\\xc5\\x9bo\\x1d\\x976\\xf1\\xd9\\xa7\\x80\\x90\\xf6\\xc2\\xd1q\\xf6\\xcb\\x1aa\\xc6\\x01sc(\\xc8p\\x98o+5fa\\xa2d:r\\x0e:\\x97\\x9a\\x8ch\\xd9vp>\\x9f(j\\xa1\\xb6\\x81\\x8a\\xe1?:\\x14\\xd3\\x13\\x8c/-\\xb4gy\\x873\\x93\\xb5\\xd4\\x8b\\x0f\\xa9nf\\xbe\\xf3\\xfe_dq\\xf2\\xa9&m\\xcf\\x8d7\\x1c\\xdf\\x942\\xeap\\xa9n\\xacq\\x8a\\x0f\\x06e\\x9a1\\x97\\xdb\\xcc\\x16d\\xe1\\xb11p\\xac\\x134\\xa2\\xcc\\x036e\\xe1\\xe0\\x14\\xcc\\xa9"
  217.  
  218.  
  219. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01'\\xbc\\xf0\\x97o\\xf4\\xf8|\\xaf\\x93\\xfa\\xc8\\xb5\\xcc\\x01\\xed\\xd1\\x1c\\x1d\\x9b\\xe24\\x88w\\xa9~8\\xcc\\x1f\\xae\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  220.  
  221.  
  222. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/t\\xf7\\xd1\\x13\\xda-$f\\x92#\\xa1\\xd5\\x98\\x9f\\xb6\\x9c\\xa5\\xb7\\x80\\xaa\\xeehd\\x8ft\\x10jq\\xe22\\xd2\\6\\x93\\xe1\\xba\\x98\\xc7\\xaa\\x85\\x03\\x0e\"\\xca\\xf7\\x04\\xfb0\\x90v\\x90\\xa8\\xd2\\xe7\\xe0\\x93\\xaf\\x12u\\x89y\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\xb90\\x80(u\\xd7\\\\xdb;\\xe6\\xd1\\xa6\\xd9\\xe7\\x191\\xb2\\xfa\\x0e\\xd6\"\\xe8\\xd6\\xcb\\x10\\xb5\\xb1\\xcb%\\xb06\\xad\\x90\\xf1\\xa6\\xd7\\xe7^7\\x1c3\\xc4\n@e\\xd9\\x00"
  223.  
  224.  
  225. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xda%2\\xf7\\xc8\\x9c\\xb2e;r\\xac/\\x0f(\\xe0\\x89h;\\x83\\x0cop|lk:\\x188:\\xe4v,\\xd8w\\xb6\\x949\\xd0y5\\xeb\\x0c*h;\\x15\\xa4\\xe1ov\\x02\\xf2v\\xa5\\xdele\\x81?i\\x88\\xd9v\\x8a\\xc0\\x9e\\xa1\\xbf\\x00\\x07\\x84\\xb7d\\x9ad\\xb3\\xde\\x00ax\\x0f\"\\xf5\\xe5\\x1f\\x90\\xd4\\xber\\xf7\\x0c\\xe3\\xe0vn\\x11\\x04\\xa9\\xec\\xe5\\xd8z\\x7f\\x90\\xbe\\xdfi\\xc8\\xa1k\\x9e\\x88\\x82d\\xc9u\\xfb\\x1ex\\xd5k\\xbf\\xa4\\x86u\\xc6*<\\xda\\x81$\\xd9\\x87\\xb1:~\\x81/\\x97\\xf1\\xe3\\xd6e|ei\\xfd\\xa1\\xa9\\x0e\\xf9\\xefy\\xf9\\xadfh\\_\\xf4>\\xad;;\\xa0g\\xfb\\x7f\\x93\\3\"\\xdf\\xd93\\xa1\\x89\\x8f\\xb9\\x15ya\\xa0&3v\\xfd\\xb9\\x90<:g\\xb7%\\xd4\\xf6\\x15\\x11\\x9cb\\x1a\\xd4ud\\xecw\\x1f\\xfb\\xfeu\\xe6up\\x8ae\\x8c\\xde\\xf6\\xc1\\xe2d\\x11pt\\x0e\\x8f\\xb1q\\x7f~\\x85f\\xf4ka\\x94=a<\\x18\\xa7&\\x01qp\\x9f\\xd2@1"
  226.  
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01'\\xbc\\xf3\\xe8\\xf8%\\x86ge\\xddr\\xf3\\x89!cm\\x02\\x9b\\x01\\xc0\\xb2\\xa3\\xa3\\xf7i\\xf9\\xfb\\x9a\\xd0\\xa8\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01'\\xbc\\xf4\\xb5\\x8d\\xdfqb\\xf26\\xc3m@q9h\\xae~\\x15sq\\xf6w\\xf0\\xec\\xbag\\x8evo\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6q\\x06\\x19ud\\x08\\xc5r\\xcf\\xb8\\xde\\xc06`\\xd9\\xa8\\xd1f\\x86<d\\x10\\xf8y6h\\xb6\\x988!\\x16\\xfb\\x11\\xa5\\xbf\\xcd?\\xc9\\xeb\\x15_\\x90\\x03\\x99\\x11.l\\xea\\xec\\xfdz<\\x8b\\xd74\\xae\\xc2f;z\\x8a,\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\xf0\t \\xf3\\xb4b\\x98\\xae\\xfa wi\\x06\\x94\\xcb@~\\xa5\\xeb3 \\xd2<\\x0e(\\x10r\\xb9\t\\xab\\xb6\\xe0\\x82\\xae\\xda\\xbd\\xba\\x01\\xe4\\xb1\\x06\\xa6h\\x18\\xda\\x98\\x8f"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x9e\\x87\\xf2'%\\x17\\xe0\\x97\\x0b\\x98\\x97\\xbch7xm8\\xcb\\xe6c\\xbc\\xd5\\xd5\\xcc\\xcfq\\xf3\\xfb\\xa0\\xbc\\x89r\tx\\xfd/\\x81wol\\x1c\\x82\\xc7\\x06\\x89\\xde\\xe8\\x02f&q\\xcd\\xb4\\x8c\\xa6!\\xfb\\xc4\\xf7\\x07l\\x9c\\xf5\"\\x8fd\\xbc&\"\\xe6\\xed\\xa5=\\x9ew\\xa4\\x98 \\x8at\\x0ee5\\x1c\\xf8(\\xe2\\xe7f\\xe6\\x8e#)\\xa5\\xc3\\xdd)\\xe2w\\x00\\x0e\\xd9\\x982\\xd3\\xab\\xa9\\xaf\\xf3kg\\xde\\xd3\\xbf7\\x06\\x98\\xc2\\x94\\x19\\x93\\xf2\\x91^\\xdal\\xd8.\\xda+\\x14|\\xb0\\xf7\\xb7\\x85n\\xc9isss\\xce'\\x82\\xc1\\xaes0\\xd2n\\x020\\xd0\\xb3\\x05\\xe5b\\x7f\\x86\\xc9\\xb1f\\x9az\\xd2%\\xb5\\xe7in\\x8br\\xc7\\x85l\\x15s\\xc3\\xf5\\x92<\\x80*\\xcc,\\x96%|yi\\xddw\\xbc\\x8ct2\\x04\\x85\\x90_\\x8e\\x9d\\xe8\\xe9u\\x99\\xf91\\x80oj\\x9f9\\xe2w\\xe0\\x85#\\xd5\\x94c\\xf1\\xf8\\xef\\xf6\\x94\\xf7%\\x14\\x19nc\\xb8k\\xedt\\x90\\xbf"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf1\\xafy\\xa7\\x9e\\xc00\\xe0\\x05\\xd7\\xf1#\\xfb\\~\\xd1\\xec\\xf3\\x80\\x14u\\xb2\"g\\xf2m^\\xc7_j\\x18k#\\xd3\\xbcpu3\\xa7\\xb2\\xf8$\\xc8w;\\xcf0\\x1b80\\xd7rc\\xa7\\xb2\\xf3t\\x13<\\xea\\xf9\\xdc\\xce\\x8d\\x8cw7\\x84\\xc7?\\x07\\x01\\x11\\x84\\x84\\xc0\\x1an\\xc7\\xd3\\x1a\\x1b\\x11\\x90\\xd7\\xf1\\x04\\x9f\\xa1_\\xe8\\xfa\\x9e\\xd0)v9\\xa1\\xb5\\xc2\\xe9#\\x00\\xea\\xb9e\\xac\\xcc\\xc2\\xdc\\xc2,p\\xbc\\xa8tr\\x8aot\\xf3\\x82r\\xb8>\\xf2\\x02\\x07n\\x8c\\x0e\\xa5\\x18'\\xb4w\\xf9m\\xaf\\x03\\xfbg|\\x17\\xe3\\xa0q\\xec\\x9b$\\xc4\\x1b\\xc4\\xb4\\xea\\xc3\\xa6\\xe0\\x83\\xaeh\\x9e619\\xf5\\xa9m\\x15\\xef\\x1a\\x96\\x927\\xe7\\xee\\x89c\\x01\\xf30\\x1d>u\\xc6\\x91\\xc3\\xf1\\x16z\\x87\\x9b;\\x9a\\xd65@\\x03\\xa7\t\\xe2\\xb8\\xee\\xb8\\xa1j\\x9eb\\xcf&\\xc3\\xc8\\xb5l\\xcf\\x19\\x9e1\\xfc\\x18\\xaaw\\xa6r2\\xe8p\\x16\\x1b\\x18\\xefe\\xd2\\x8c0\\x98\\x98_'\\x89\\x17\\xc5\\xa3\\xef\\x80\\xbc\\x83"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`m\\x0f\\x99\\x04\\x98\\xef+x\\xadl\\x87\\xd2\\x92\\xfe\\xbb\\xaf\\x8a\\x8f\\x84u.6b\\xee.\\x10n\\xe1b1\\xa2\\xf8gmz\\x8cl\\xf5\\xc2\\xe8\\x91\\xc3\\x85\\xb3\\xce\ra\\x18\\xee\\x82i\\xbc\\xfd\\x82\\xc6\\xa5\\x13rm\\x01:\\xba\\xd7\n&\\xcd\\x0eyi\\x91\\x11\\x95\\\\x13*\\x1a,h\\xf4&\\xf3\\xfez\\xb0np\\xc1\\xda\\x1c+\\xb8<.\\xa7\\xf8\\xa8_\\x80\\xaf\\xd8\\xbcu\\xf6\\xefc\\x96\\xebe\rm\\xbc\\xa4\\xad\\x90p\\x0em\\x14&v\\xe6\\xb8\\xad\\x1b\\xbeg~\\xdf1d\\xf3\\xe5\\xcc\\xd9\\xc4\\x87\\xea\\x88\\xa1\\x93s\\x86w\\xef\\xb0\\xbbeg\\xdeq:f\\xc6'\\xc8\\x16's\\xc0\\x04q\\x0b\\xf0\\xa8e\\xcc\\xd3\\x19\\xce\\xb6\\xe3\\x18\\xef\\xd4\\x11\nnk\\xef\\x8c\\x1d\\xe1\n\\x1e\\xbf!\\xba\\x97\\xff,<\\x98\\x04\\x1e\\xf6\\xbb*\\xcdb\\xd9v\\xb7\\x05\\xa5:r \\x99ro\\xfb\\x1f\\x0b\\xf7&'\\xff$\\xa2\\x8ei6\\x90\\xb0(\\xd2k:\\x99\\xcd\\xdat*\\x85z\\x97\\x07\\xca\\x9f\\x1f\\xc1\\xdf\\\\xdb\\xe3\\x024"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x03\\xa3\\x9b\\x07|\\xbbl\\xfdyb\\x98\\x9b`nk(\\x04k%\\x04\\xc6\\x84u\\xd0\\x8b*\\xfcm|\\x05\\xccx\"\\x81\\x80a'\\x95\\xdf\\xa6\\x05\\xb9m\\x00f\\x7f\\x98!p\\xf1\\x8c\\xef'\\x94q\\xb4n\\x0f\\x90\\xd8\\xfc\"\\xb9\\xc4\\x86\\x90\\xa7\\x07\\x19h\\xda\\xb9=\\xb1\\xa7\\x92\\xcd\\x9f\\x1b\\x99\\x96%#\\x1c\\xe3\\x87c\\xf5\\xd0b\\xc4\\xf0\\xc2\\x9d \\x8e\\x11q\\xcf\\xfe\\xac\\xe0\\xb3\\x8e1\\xdd\\x04\\\\xe7\\x0b\\xaf\\x16\\xb2we\\x9fu\\xbb\\xf9&\\xbb\\xd5\\xf0\\xf6\\xcb\\xe6\\xa3\\x89\\xb6o\\xca\\xf8%(\\x1a\\xd9\\x94\\xcc\\xf2t\\x0f\\x8c\\x8e-~i\\xec\\xd4\\x11v\\xc5h\\x94\\x03\\x06h?\\xfd\\xbf\\xfd\\x1f\\x18\\xf1.\\x87\\xed\\xbf\\xbd=\\x95%|2(p\\xbdk\\xb3\\xb9\\x81\\x1c\\xe7n0\\x95\\xf2\\x9cf\\xc7+\\xf9\\xb6m%r\\xc6r\\xfc\\x94\\xd2p\\xf1\\xcbd\\xf9\\xa0\\xcbz\\xd7fz\\xf0d\\xb6\\x9d\\xec\\xb8\\x95\\x80\\x11\\x9d\\x0f\\x03\t`\\x86\\xc4t+\\x8d\\xf7t\\xc6\\x82\\x84\\x8f\\x86\\x95\\x05\\x03\\x8d+\\x1adj\\xa8;"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xd4\\x80n\\x0e\\x8c\\xf5q&\\x11\\x8b?@8\\xb4\\xff\\xebc\\xa8na\\x17\\x1a\\x8d\\xd7@&\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xb8\\x7f\"\\xa0\\x82\\x84)\\xa2c\\x95\\x1b\\x90\\xd3rbp\\xc7\\xa6\\x03c\\x10\\xc5w\\x1f\\xdd\\xb4p\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x1abw\\x86\\xb6\\xf3i\\xc5x4\\xa7\\xa4\\xb1h\\x9c\\+nr\\xcfr\\xcf\\x95u\\x13\\xaf\\x89\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xbd\\xa4y\\x81\\x98\\xbbi\\xa1b\\x15\"\\x89u\\xea\\x8d6\tu\\x18\\xac\\x04)\\xae\\xa9\\x0b\\x00\\x8d\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x99sk\\xfa!\\x08a\\x074\r\\xf7\\x82\\x19\\xe3jgw\\xd1\\xd6\\x8c/\"\\x88\\xffb\\x11\\xf0\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5,\\x06x\\x135c\\xfa\\xd7e\\x8cvh\\x87\\xec?oniw\\xda\\x84\\xda\\xecv\\xb9w'\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5b\\xd8oh\\xcf28q\\xfc\\xb2\\xe7\\xee\\x82\\xea\\xef/\\x95p\\xee\\xb4\\xae\\x06\\x16eg/\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xb5\\xdc\\x08a\\x9bv1\\x05\\xa4 \\xc7n`1\\xcb\\x03\\xc0%c\\xd9\\x14=w\\xd0\\x0bw\\x18i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xe3\\x7f\\xc7\\xca\\x02r\\xa5-|\\x12\\x1bp\\xfc\\x14\\x82h\\xe5bnxj\\xd6b\\x8e\\x0bpe%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xa6\\xa3\\xbc+\\xbbs-\\xaa\\xd5x~\\x7f/\\xdem\\x97\\x82u\\x96\\x86\\x7f\\x81\\xea\\xca\\xb2\\x04\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5 c\\xe1\\x9d$\nn)d<\\xf2\\xc86\\x84bq\\xa6\\x11\\x00\\xc7\\xd9\\x9a\\xee\\xea\\x1a\\xf7/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xc2\\x97\\xa7o\\x1ej\\xd8d\\x89\\x8a\\x993h\\xbf\\xe0^o\\x0b\t\\xd9%m\\xb1\\xae\\xfc\\x05\\x8e\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x0c:\\xff\\x8c\\xa9zuf*\\xf8\\x83\\x1b\\xd4\\xe0b\\x84\\x9e\\x8e\\x93#a\\x07<@\\xf0)'\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5_\\xfb\\xd2\\xe6b\\xcf\\xf8\\xe5\\xc7df\\x15\\xb1\\xe3v\\xfb\\x88\\x81\\x98\\xadi\\xef\\x92b\\xc5_#\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xa9\\xe8\\xc6x63\\x0e_\\xfa\\xc0\\x83<|&\\x8c\\xd0\\\\xa2q\\xec\\xdb0\\x1c\\xdc\\x0f0\\xb8\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5c~\\x9a\\x15\\xeb\\x82\"\\x82\\xd2w\\xa6$k\\xd46\\xe6\\xd9\\x10\\xd3\\x88\\xf8p\\xb0\\xe7\\x88\\xa9b\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5h\\xe2\t\\xf0\\x16r\\x031\\xda\\xcc\\x8b\\xa5\\xa7e\\xf1\\x8a\\xba-\\xeck%\\x06j\\xddr\\xe9\\xa9\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xca(\\x92g\\x88\\xc5\\xe5y\\x9c\\xfe\\x19o`\\xfc\\xb1\\x83\\xa7\\xb6\\x06\\xa6\\x8b\\x1f\\xb6x\\x90c\\xb3a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xcd\\xfe\n\\xac\\xb6\\xadwbm\\xce`^\\xa5\\xf0\\x17\\x13>\\x9c'd\\xbd\\xf0j\\xd7wd\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xff\\xf9lwo\\xa3?\\x95\\x0ey\\x08\\xf8\\xcb\\xbaq.\\xef\\xfd\\xd1\\xdf\\x1f\\x17\\xcf\\x1b\\xdf\\xbb\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5=x\\x15\\xe5\\xc5\\xbe+\\xa0\\xf6a\\xe5\\xb2\\xda\\xb1\\xde\\x1a\\xa9\\x82j\\xd0b\\xff6\\x9b\\xdec@\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x120\\xc0\\xe6d\\x87\\x93sd\\xfa\\xce\\xd9\\xa7\\xa3\\xa9-\\xbf\\xe1*\\xd5\\xc2\\xc2\\xebx\\x1a\\x19\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\x8b\\xc7(\\xb7\\xc9y6$\\x14\\xdc\\xf4\\x90v>lr\\xfb4|\\xaa\t\\x85\\x99\\xee\\xc0\\xeev\\xf8s\\xb4\\xfa\\xdc\\x95\\x14\\xc6\\xf4q\\xcf\\xf9\\xe6n\\xcd\\x85\\xbe)zc\\xd6\\xce\\x0c\\xbbxj\\xeb\\xae\\xc1b\\xdak%\\x85\\xdds\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\xfa:v\\x88\\xec\\xf9b\\xad\\xc5\\x04\\x0c\\xc2\\xa8\\xbdr\\x86f\\x14\\xeeu?\\xd0\\x99\\xfd\\xa0d\\x06-\\x96\\xee\\x90\t\\xa6i\\xaf\\xf0\\x8e\\x08j\\xe5n\\x92\\xf9f\\xc12j"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<=3*\\xfbi\\xf1\\xdc\\xd1c\\xafi\\xe4n\\x97\\xd1\\xa9\\xf7\\xadzj\\xfe\\xd5a\\xc65vq/n\\xef\\xdd\\x90\\x1c\\x89\\xf5\\xda\\xda\\xe6\\xf5\\xb6\\x04\\xfb\\x8c\\x130\\xbeu\\xd7\\x05\\xb7u@\\xb8\\xb8@n\\xfc(\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\xd3\\xfe\\x04\\xdfe\\xde\\xd7t\\xe6\\xf0b\\x9a\\xfe+\\xb87\\xd5\\xb5v\\xb7#\\x9d\\x93\\x8a\\xe3\\xc5fs\\xd3\\xa4\\x85vtl.=!a4\\x12e*.\\x1ei\\x14b"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\x837b\\xa1\\x1fw\\xe5\\x9d\\x87\\xc94\\xbd\\x9b\\x9e\\xcd\\xb9q\\xd9\\x92(\\xe3t\\x11r\\x8f\\xb5\\x85\\xe1\\xaa\\x0b\\xa6\\x0f\\x15n\\xad\\x0b\\x134\\x9eq\\xebky\\xaf\\x18r*t\\x1ayybc\\x16 (\\xb6\\xc6\\xb0m\\xd1\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xd5\\xe9\\x12\\x879\\x9a,\\xad\\xb3\\xe6o\\xb8\\xf0\n\\xdd\\x97\\x9a\\xdbzn\\x03\\x13\\xc9\\x15\\xf7\\xfc\\xd8\\x940\\xf8\\xb1\\xb6\\x88l\\x13\\xadn\\xe5\\xae\\x83rsu\\x06\\x16\\xf1\\xb4"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\x9b\\x82\\x97\\x12\\x03\\x8en\\xfb +\\xbd\\xc1q?\\x8d\\xb7\\x9d\\x8c\\xfe\\xc0\\xe9\\xba0\\x88\\xb1\\x19\\x80\\xff4\\x11\\xca\\x7f\n-\\xa4\\xfd\\xfe\\xe2t\\x0b\\x1b\\xd9d\\xd2\\x1c\\xf6c)\\xc6\\xc4\\xe7\\xa9/\\xb6\\xdc<@k)\\x98\\xfb\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3\\x16\\x0b\\xe1&:\\x89\\xdb2\\xe7\\xee\\\\xac\\x00l\\x0f\\x08\\x12\\xc5\\xfc\\x9e\\xa1\\xfb\\x18wse<\\xdcb\\xabq\\xe0\\xa6\\x0c<\\xf6v\\x0c\\xe1\\x1a\\x18\\x88grf\\x16"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\x88c\\xbd\\x1b\\x87s\\xf1f@\\xd0\\xa1o\\x8e(9\\xaf\\xb3\\x85/\\x8f\\xc0\\x80\\x92\\xf4d\\xf4\\x9c\\x17\\x85\\x8b\\x12\\xeb\\x82\\xd3\\xf0\\x8f5\\xe2!\\xb0\\x9f\\x02e?\\x0cj\\xa2\\x807\\x9dfkp\\x9f\\xa92x\\x1b_\\xb7\\x11`k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\xc2\\x12\\xd3\\x1cq\\xf8yd6ymy\\x1ax\\xc3\\x13\\x11\\x90\\xdem\\xa6\\x8e\\x087\\xeb\\x86\\xffl~.\\x0f\\x1b(\\x15&\\xc4\\xc5\\x84\\xcds:@\\x19w`\\xea"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8f\\x94s \\xd9\\xb2\\x0fu\\xab\n\\xeb\\x16\\xd9\\xea\\xfc\\xb8\\xe0\\x8co\\ \\xd7\\xe7\\xe0\\x1a2\td\n\\x05\\x8e\\xac+\\x1c\\xe9-\\xe7\\xf79\\x94\\xa1d\\xe5xt2^\\xe1\\xccd?<\\xa6\\x89s\\x06k\\xfe\\x04mj\\xbfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea<2\\xc3\\x89iw\\xd2u3\\x14\\x96\\xc0\\xb1\\xc2\\x16\\xe7\\x19\r\\x12\\xf8\\x7f\\x84\\x9e\\x98\\x19\\x17?\\xa9tt\\xc3\\xa2\\x8f/\\xf6t\\x9d\\x1a\\xf1x\\xa7\\xf7\\xbf6\\xb26"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xabc\\xe0#w\\x13\\x1b\\xf9\\x10'wj\\x92\\x95\\xf5\\xc6\\xa4z\\xdc\\xfd\\xdf+\\xc3-\\xfc\\xc2\\xe0\\x1a6\\xf1h\\xc2.\\x01\\x82\\xedtv;dyf\\xbd\\xf8\\xdf\\xafs\\xbe\\xba\\x1d\\x01\t7\\xd4sh\\xd09d\\xb3t\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xd1\\xa5i;\\xc2l?#\\x93\\x89\\xbe\\x8cx\\xcd\\x07r\\x91t\\x06\\xb1\\xa2\\x89(;1p\\xc5e\\x8fp\\x92n0\\x8dbg\\xf0\\xb1qn\t\\x1e\\x9b\\xc0\\xda9"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xbf@\\xe00\\x88\\xf0\\x13\\xfb\\x1a\\xf9\\xc2\\xba_\\xd2`\\xf6\\x99\\xe5b\\xb9\\x1c\\xcc\\xad\\xe1w\\xff\\x0ewi3=\\xd5(\\x9c\\xf5\\x86\\xa1\\xa2\\x86:\\xab\\xd5\\x99u\\xc0\\xb6\\xc3\\x86\\xa7\\x00w\\x9c\\xe2\\xd3y\\x14k\\xef\\x13\\x18\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x9e\\x12\\xd9n\\x82ej\\xf3\\x8ec\\xa52\\x84\\x1b\\xcf\\x08\\xe7\\x86\\xac\\xea|7%\\x96\\x86l\\x03c\\x86\\xddm\\xb7\\x15\\xa8\\xca\\x01\\xa5\\xa4\\xe4\\xcak\\xd8\\xf4\\xf2\\xb8yy"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xd9\\x17z^\\x11\\xad\\xce\\xd2\\x1dl\\x1a\\x17=\\xf1\\xc8\\xac\\xc7\\xd7\\x82\\xf2'\\xab\\xcb\\x13\\xb6\\xfb`\\xdange\\xb1\\xe6\\xc5\\xc4ff\\xb8\\x95w&it\\xc9e\\x123_\\xb9y\\xec\\x9d\\xbei\\xb5\\xa5\\xa1\\xb9\\x80\\x07\\xbdp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\x97\\x0ftgiv\\x16k\\xc83\\xbc\\xfc>\\xcb\\xe37\\xd7o\\xf4 \\xfbx\\xc5\\xe9f\\xa8k\\x8a\\xfe\\xf7\\x0749#\\\\x12-t\\x1e\\xe8\\xbf\\xb0;\"\\xe8\\x13"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4/\\xdf&q1<l\\x14a\\x92u\\x8b\\x9aq\\x1a\\x83\\xcd\\x1e\\xeea\\x13s\\xb7\\xcf\\xc5\\x18z~\\x1bm\\x98\\xffc\\xe5\\xdc\\xa6d\\xa6\\x80=\\xb9\\x8a\\x0c:\\xf0\\x8a\\x12?\\xb73\\xa2\\xd1\\x89g\\xd9u\\x993\\x9ct\\x9e\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xa6\\xaft\\x1a\\x9f\\x8d9\\xf1o\\xc0 \\xac\\xbc\\x83j$r\\xff\\xc6w\\xb0l\\xed\\xdb\\x02\\x91\\x14\\xa7\\xb0\\x8d\\xaa\\xed\\xf9c\\xe9r\\xea\\xd9\\xf7\\xda\\x13\\xd3rr"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<\\x91+\\x07\\xcbh\\xf7ex/c^dy\\xa4p\\x05\\xbf\\x8a\\xca\\x11\\xe7\\xd3\\x80\\x83\\xd7\\x89\\x80t=\\x1c\\xe6\\xdd\\xae\\xef\\xac06\\x07\\x020*\\xf1\\x01\\x99y\\xa1d\\x14\\xe9\\xf3\\xe7\\x06\\x9bs\\xe2.\\x1ecod\\x81\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;\\x8d\\xe0k\\x0e \\xa4\\xdat\\xf6-\\x80\\x1d\\x0c\\x06\\xdb\\x97f\\xf3cp\\xa5\\xb9 \\x17\\xf7\\x0b_\\xb8\"\\xa6o-\\x1db\\xden\\x94\\xe6#.\\xfd\\xcc\\xa0s\\xd6\\x98"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4#h!m\\xd5o^\\xbe\\x98\\xfb&\rk\\xab\\xcc\\xf7\\xf4\\xa3\\xe2g+h)\\x13\\x92c\\x87t\\x85\\x8a|z\\xedc\\xdd^\\xc9\\xc9\\xce6w\\xec~\\x85\\x17hdws@w\\x8b\\xf7\\xf6\\xdcq/ \\x00\\x15u\\xa1\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000jji~\\x15\\x06\\x9e/d\\xb4\\x88pk\\x01m\\xf5\\xd7\\x13\\x14\\x87\\xa5bcc\\xfdm\\xb4\\xbbl\\xac\\xf4\\x97\\xcd\\xc9\\x16\\x9f\\x94m\\xe6q~\\xb6\\x7f-\\xc0\\xb6n\\xac"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x8c\\xc7\\xcbfe\\x18)\\xa4s\\xa8\\xbec\\x9d\\xc6u\\xb3\\xb1=g\\xf1ln\\xad\\xa5\\xde\\x80\\xac\\x13\\xb9v\"^\\x1d\\x89\\x91\\x1e\\xe0,ub\\xf7r\\x15\\xdd\\x1bmsi\\x19\\xf1tyq\\xe9o\\x145\\xee\\x08\\x14\n\\xb1\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xa0o\\x087\\xd2\\x82\\\\x\\xd0\\x1c\\x17t\\xb1n~0\\xb3\\xb9r\\xed\\xa0\\xfe\\x0e\\xce;\r\\x18\n_\\x96\\x1f\\xf5\\xf4\\x1e\\xb7\\x14\\xd3\\xafd\\x87\\xbax\\xc1\\x02\\x18\\xbd"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9cu\\xe3w7\\x02\\xdc\\xff\\xb59\\x8e\\xf9\\x86^\\xe9\\x94<\\xbct\\xf2t\\xe8\\x95!\\xdb\\xe6k\\xdf\n\\xd6\\xb9\\xd4\\xf1t#a\\xe5\\xc2\\xd8\\xef\\x00l\\x8e\\xd9<l\\xd4$\\x19at\\xf3\\x01\\xebh\\xf2\\xff\\xa1\\xf8\\xf1m\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xc6\\xfaig|?^|\\xfa\\xff\\xcat\\xec\\xf1\\xc6\\x1a'\\x93l\\xe5\\x0c\\xf5\\xb8\\x91*\\xa0s\\xbd;\\xea!\\xe6\\x8c\\x17\\xd2\\xb0#\\xa9\\x9ex\\xda\\xcd\\x81\\x01)\\xe3"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab*\r\\x8fx\\xea\\xa7\\xdb:\\x16\\x8b\\xb4fx\\x96\\x1buy\\xee(\\x10\\xd6\\x1b\\x8b\\x9bze\\xf5 8nr\\xce\\x99\\xef\\xde\\xf0\\x8c\\x03\\xda\\x8ai\\xc3\\x87s\\x9b\\x90\\x90j\\x87&\\x91\\xc0\\xec\\x04\"\\x1b\\x1bdad\\xfavi\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\x1a\\xde\\xbb\\xd3\\x00\\xd9z0\\xeb%|\\xe2(\\xee\\xcd\\xbfb\\xaa+e\\x19\\^3\\xf1=\\xca\\xa8 :z\\x0c\\xadn\\xed\\xdd\\x12\\x9d\\x9b\\xaf\\xde\\x1d\\x93\n\\xbd\\\\x83"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xf2\\xeb\\xc6%m\\\\x06o\r6\\x90\\xf0otnpu/\\x02,\\xda\\xfc\\xce6\\xd9\\x86qxh\\x04m*\\x19;\\xd7\\xae\\xbdt\\xbc\\xdc\\xf4h\\xe0&jg\\xe4\\xa5\\x1c\n\\x12~\\xb7\\xc7b\\x1fx\\x94b\\xcf3\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e_.\\x94\\x05\\x94\\x13\\x19\\xf9\\x07\\xe8\\xb6ix\\xff\\xe7h\\xac7\\xa3s+\\x87e\\xbc\\x07\\x89\\xf0\\x84\\xee(z\\x19d;\\xd5#\\x16h\\xf9\\x03\\xeb\\xc42ey>"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\x16\\x8a\\xc5u\\xb2jb\\xcc\\xd5\\x8a\\xc0(l\\x7f\\xdd&\\xad\\x90%(x\\x14\\xa8\\xc5\\x1acmq\\x14i\"k\\x98\tz\\x10\\x94\\xe5\\x04\\xde\\x9f6iz\\xe8x\\xd5n:xs\\x15\\xa3\\x1a\\x02fy\\xcd\\x01\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!\\xa0w\\xe1\\x1d\\xc1~h\\x8c\\xf0\\x059b\\xba\\xafysof<\\xfd\\xf0\\x81\\xa8\\x92\\xc5/m'\\xcc\\xc6\\x05%\\x85\\xd0\\x144\\xdf\\x96\\xb6>\\xd6'm\\xe8\\x1dl"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x9c\\xdb\\x19\\x9c\\xe4\\x82\\x84\\x87\\xe2\\x84\\x07\\xd0\\x1d\\xbbk<\\xee\\xd3db\\xcf\\x93\\x07\\x9d\\x1d\\xfc\\xcb\\xbd\\x04\\xacw\\xa4\\xcc\\xba\\x06j\\xfa\\x17hh\\x0cs1\\xa8\\xf2\\xd5\\xbc@\\xccw\\xf5\\xbe,\\x07\\xc1\\xb8&\t\\xc4\\x17ya\\x99\t\\x14\\x95\\xce\\x1a\\x12\\x9c\\xf8\\xf2\\xc3\\x1e\\xc4\\x11\\xf1\\xe2%\\xf1/\\xa8\\x8d\\xbb\\xb9\\x97^\\xfd\\xe3\\xf1uv\\x88\\xaa&\\xac\\xff\\x82\\x10o\\x1at\\xcd\\x82\\xbc\\xd7\\xfd1j:\\xe5\\xb9b\\xca\\xd9\\x14\\x9b\\x07\\x83\\x8d\\xba\\xca\\xce_\\\"|\\xb7\\xa0\\xf7\\x1e\\xe6\\x19\\xe3\\xc4tw\\xf2\\x15\\xda\\xa2\\xe8\\xe7\\xbe\\xd4\\xa14\\x8ea\\x1dp\\xb9\\xd2\\xd1@\\xe0\\xe7\\xca=\\xde\\xc3|\\x16\\xf1\\xe7\\x89rw \\xcb\\x92\th\\x8cx/\\xe9a\\xe4\\xd3x\\xa3\\xcd\\xb4z\\xf3@\\xa7\\x80\\xf9\\x88e\\x11\\xe4tq\n\\xcdvl\\xa1\\x94d/\\x8b\\x1ch\\xb0\\x00\\xc9j\\x89s\\xd0\\xb3\\xd8\\xa2\\xa7\\x83\\xa3\\xd8\\xd8\\xe2\\xe2\\xbdb\\xc1\\xc4\\xc4b\\x02\\x1b\\xd2w\\x9306\\x89\\xaf#zm\\x8f"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa25\\xd0\\x87m\\x11\\xd8\\x9d\\x01je\\xc0)\\xdd\\xae\\x9cq<\\xacdu\\x9f\\xca\\xe9\\x8f\\xce%\\x92s\\x9e\\xf6f\\x87\\xe1^\\x12\\xf0\\x19p\\xb7\\xc7\\xbft\\xb8\\x8f\\xf6\\xaaw7`(\\xb7v\\xfck\\x12\\x07\"\\xe8\\xb8\\x17\\xc8_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14\\xd1\\xa1h\\\\xaeh<\\x1b\\x9b\\xd4\\x99\\xa4\\xbb\\xe7e\\x02\\x9c\\xe3p\\xd0_\\x1d\\xc2\\xc0\\xa6\rwa\\xe6kes0h\\xe6\\xb3<\\xe9\\xcb\\xcb\\x81\\x1d^\\x89\\xcd\\x88"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x96:^p\\xe3g\\xcbua;\\xe3\\x062o\\x94i\\xa1\\xe7\\xbd\\xfb\\xae\\xcb\\xc5\\xd9\\x8ew\\xf7 \\x86f\\xbe'tw\\xdc\\x15\\xa7 yo\\x0c\\xcdn\\xb5\\xe6\"\\x1c\\x9e*\\x92)ae~\\xcc\\xde\\xb7\\xe1\\xb5\\x05\\xfesn\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x97n\\x96=/\\xa5\\x8c\\xdfji)y\\x02s\\x90\\xbc\\xf2\\xc8\\xf3\\xae=y\\xef\\x11\\xf9<z\\xd6\\x1f\\x0b>\\x186\\xf7\\x04e\\\"\\x96q\\x9a7\\xc4\t\\x0b\\xc1f"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h'\\x0c\\xd9\\x9c\\xf3r_\\x1e\\xf7\\xa4\\x8e5\\xc8\\xff\\xff?\\xea\\x81\\x01\\xa9b\\xd6\\xa9\r\\xae\\x07o\\xb4l\\x11\\xfb\\xea:&yv(on\\xbe@\\xfd\\xfd\\x80\\x00<\\xea\\xf6\\xa2\\xcf\\xd55\\xcf\\xc0\\x19k\n.m\\xec\\xef\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x150l\\xb6\\xde\\x9f\\xc5\\xdd\\xb4\\x85m\\xfb\\x91u\\x86~~\\x00w\\xe0\\xab\\xb9\\xe4z\\xc8\\x14u<x\\xae\\xcc\\x97\\x07\\xaf\\x17\\x1fm\\xe3!ow7\n\\xf9ob\\x9f\\xa8"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xa5\\xbew0s\\xeb\\x1b\\xd5\\xb3\\xd3\\x15\\x95e\\xb6\\xbd+.\\xbe\\xc89\\x8b\\x0b\\x81e%\\xc55\\xda0z\\xa3\\xf7\\xc6\\x13\\xb0\\xdbn\\xf7\\x04\\x8bz\\xe3\\x94jn\\x86\\x17\\xaa\\xf1t\\x96\\xaa\\xc8\\xa2\\xfa0\\xbe\\xcas\\x12g\\xa1o\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2arwyu:\\xb5\\xfe\\x93k\\x1e\\x81\\x8d\\xf6\\xe8\\x9d\\x19\\x89\\xa4ho\\xb9\\xdbq\\xd8\\xd3d8~'\\xacz\\xa3\\xcb\\x08\\xa9?\\xc3 \\xc4bi\\xc8\\x1eed"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5h%,\\x8a!'\\x97\\x8bdc\\x01\\x90d\tg\\xbf\\xb3\\xe2\\xe4\\x1f\\xd6\\x8fq\\xb3z\\xa0\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5j3i\\x081\\xc6mq\\xd8nk/\\xe0\\x8atn8&\\xe2x\\xa3\\xc4.\\xb7\\xb6*w\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5%\\xbd\\xae\\xddhrc$\\x99\\x9aqo\\xb1b\\x83\\xb8\\xd8\\x19\\xe26\\x0b\\xda\\x8c\\x16\\xc1\\xe3\\xdd\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xa0\\xfb.u\n\\x87\\xa2>(\\x11\t\\xb4%7\\xe7el\\x9f%\\xe2\\x8f\\xa8\\x82;\\x90\\x1bvd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5i\\xde\\xee\\xc8\\xea\\xb9\\xcb\\xc1\\x8a'\\xcb\\x96s4\\xe5|.\\x96\\xe6\\x92\\xe1\\x05\\xa9p\\x0f~\\xb0\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xe2\\xea:\\x97d\\xd5\\x01\\xdf<\\x18\\x81\\x9e\\xba\\x10\\xab)k\\xf9\\x8d,\\xf8\\xf4\\xb3\\xda\\x93\\x85\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5v\\x17\\x90\\x80p\\xc8\\xee\\xda\\xdb\\x86-2!\\x84v\\x10\\x8b\"\\xcd\rz\\xeb\\xc4\\x97\\x8ej\\x8f(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5^\\x02\\xc2q\\xef\\xe0rd22_\\xdem\\x00-\\xc9\\x9dl\\xf7\\xa6\\x1ca\\x9e!\\xc5\\x8f\\x9b2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5x\\x865\\xd4+;\\x11\\xc6\\xf7\\xd8\\x1b^\\x1e\\xc5\\xd9\\xe9\\xd5\\xbc\\xc2\\x07\\xc9r6\\x03\\xb8>\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xc5\\x83\\xed\\xa7\\xfe;\\xfbn\\x86h$p\\x1a\\x12\\xfd\\x01\\x01x*\\xd4ccv\\x18\\x99tj\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3^\\xf2\\xfa\\xd2\\x05\\x82\\xaa\\xcd\\xf1\\xeaw)\\xf0a\\xb00i\\x08\\x95\\xb1\\x86\\xe7b\\xb6\\xadt^\\xa3\\x03\\xad*\\x8a\\x0fh&px\\xde>\\xe4\\x0b\\x1a\\x15skwv\\x1a\\x8a\\x02u\\x8f\\xf5\\x03\\xe2\\xe9\\x87\\xbd6\\x80h\\x83\\xb4#\\xb1+cn;\\xc1m\\xe3\\xa6\\x0b\\xfeh\\x96\\xa9\\x18\\xe4i\\xf3\\xccv\\xdb\\x03\\xf1\\xed\\x98w\\xb4v\\xa0\\xc1\\xa20\\xb3\\xc2h\\xa8\\x10w\\xad\\xb8\\x0e\\xdb\\xda\\xaf\\xc4\\xe3\\x16\\x8e\\x13\\xd5/\\xe6a\\xe5<;\\xd9\\x8d\\xbc\\xaedc(\\xd1\\x1e\\x95m\\x17\\xcb\\xce\\x1a\\x88s\\xb9\\xb9^\\x8e\\x14\\xc2\\xb2\\xc7\\xbd\\xf9\n\\xeb\\x8fbr\\xf3/\\xf8\\xabi\\x84\\xe2bv_l;\\xe4\\xb94\\xaf\\x84\\xe75e1\\xf3oo\\x92=\\xcd\\xd9\\xf0\\x83\\xadc'\\xa0x\\x9ec\\xf0-\\x98.wu8\\xcd\\x08\\xdc\\xbc\\xb3\\x93\\xccy\\xd3\\xd3\\x9fl\\x8f\\xcaa5\\xc4xmbnzj\\xd1\\x90\\x00\\xf6\\x8c\\xec\\xfe\\xcf\\x82\\x884\\x80\\xfa\\xfd\\xaa\\x91\\x1c(\\xcd\\x86\\xb6\\xbd\\x06ss\\x9d\\x1bu\\x1b"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5b\\xa2\\x1c\\x8es.\\xc2f\\xfd \\x06\\xdd\\xb5z\\xd7sk\\xd5:\\xe0\\x08\\xf4\\x90+g\\xd5n\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xf05n\\xc5\\x1e\\x8e\\xab_e\\xa9\\xf6\\xcbb1w\\xaaz<3\\xe3\\xb8\\xc1*\\xc3\\x1e\\xda\\xec\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf57\\xa9\\x04\\x7f\\x19\\x87\\x97\\xf3k\\xc8\\xd8\\xebu\\xe1\\x06(i\\xa3@\\xd2\"^\\xaa\\x16\\xe27n\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xd9\\x89h\\x06r\\x94\\x7f\\xa3s\\xa2v\\xd1\\xba\\x90\\xf2\\x86!\\xfb7\\x93\\xc9\\xe5\\x86y\\x9a\\xb1\\x1f\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xd6\\x16\\xdf\\x06\\x8e\\xb9\\xab\\x03\\xb8j\\xfe,zm\\xa6\\xf6r\\xfb\\xb8\\xf4\\xdc\\x86w\\xfa\\x0cw\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x1d\\xceap_\\xed\\x89\\x80g_2\\xae\\xeb0\\xf2\\xfd\\xfa \\xb9q\\xff\\xafl\\xf7\r0\\xd1\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcb\\x1d\\x12\\xe6 \\xab7\\xe8s\\xd1;lp^\\xfc\\xf8g\\xd3\\xcc\\xed\\xb3cv s\\xb7\\x8d\\x0bhx*ff\\xf3\\x9e\\xf4\\x86\\x02\\xac\\x16*\\xb1\\xb2\\x9f\\x8d\\x99.=\\xee\\x1a\\x1f\\x87nqb\\x92k\\x84ac`\\xc2\\x8f\\x8c\\xdf5\\xa4\\xe0\\xe39\\x8c \\x88\\x8d\\x06\\xd0\\x18uqh\\xa3\\xf0\\xbd\\xe7\\x91\\x19\\xf2\\xddy\\x07\\x8f\\xe4\\xd7\\x84\\x10\\x01\\xc6\\xdf\t\\xcc\n\\x11'\\x19\\xf0\\xc2=jg@\\xbbo\\xa2h\\xc1z\\x83*\\x86\\xcf\\x0b\\xb7#\\x9b\\x07\\x1c\\xea\\xd7\\x97\\xbe\\xc7j$'fg\\xabxkl\\xec6v\\xf4\\xae6\\xcac\\xa89\\xcf\\x8e\\x92`\\x0ej\\xc0ke\\xe5\\x88\\x8c\\xe9v\\x97\\xd8d_\\x95\\x04,\\x15b\\x06\\x8c\\xa1\\x18\\xf5\\xdb\\xd7\\x89\\x85\\x87\\xa9_\\xeb~\\x15\\x04t\\x8c\\x9b,k9\\xdf\\xb6\\xc9\\xba\\xb5\\xf9\\xf1\\xd5\\xb6\\x8c\\xb4\\xe9\\x94xwmz\\x9d\\x9e4\\xd9\\xb5\\x97\\xf2l\\x04\\x14m\\xea?\\x8b\\xbed0\\x0f!_^\\x12\\x0fzyq\\x1b\\xf0\"\\xf0\\x86\\x89\\xcb\\xac\\xd6a"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xd0\\xd4b=\\x18\\xb7#t\\xb1\\xc4/\\xd9\\xcf\\x97\\xad\\xa8e\\x19\\xc5\\xdd\\x00f.wy\\xa6\\xe3\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1fx\\xab:t!0\\x0bl fc\\x9d8\\xca\\xf4\\xc0\\x1f\\x97n\\x1fp\\xb9\\xda\\xd2\\x1b)(\\x18f\\x0cn\\xd6m\\xd2#\\x9e(3\\xcf\\x10\\xbe\\xf7f\\xc3\\xee\\x95\\xc1\\xdc\\xdfvd\\x97\\x97qz\\xf0\\xe1\\xf0s`wzl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\x03i\\xf4#\\x88?\\x13\\x05\\xa3\\xd2\\xf1y|2\\x1e\\xf5\\x01\\xd2\\xb1mr\\xef\\xa6r\\x8f\\xe1\\xbbe$gk\\x8b\\xf3a5h\\x9e\\xc0\\x14$\\xf3r9\\xc90d\\xd7"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6\\xc3/~x\\xfd>cu\\x12$do\\x11-c#\\x0c\\xd1\\xfd\\x05p\\x97\\x1a\\xe6i\\x7f\\xd2mu<\\xfcz\\xb1\\xbd\\xc4p7\\xc4\\xc2\\xaa\\xcd\\xa6r\\xac\\x19mj\\x03\\xc9\\xdc\\xca\\xf8\\x99*\\xad@y\\xa1\\x1e\\x92\\x96o\\xd2\\x1b\\\\xd0\\xa9\\-c\\xf2\\xca\\xd9\\xec$\\x8f\\x88\\xef\\xfawk\\x02\n\\x986\\x80c\\xa9\\xe6\\xab*j\\xe4\\xc3\\x12o\\xb9\\xba\\xd3\\x80;_\\x16d7q\\x85\\xd0\n\\x1c\\x9c\\x83%'\\xf1zp,@|\"\\x1c\\x97\\x04\\x16\\x02\\xd2\\xce\\xc2m\\xdce\\#\\xfb\\xeb\\xfb\\x16r\\x85.\\x8c\\x87!\\x98x\\xb26\\xf2b\\x13#\\x08\\xe9\\xb3\\x94\\\\xac\\x95o\\xc0\\x9f\\x94\\x9by6\\x89\\x98\\x15o\\x95\\x7f\\xa3\\xd06h\\xb3n\\xb8\\xf5\\x8fd\\xa1\\x1e\\xe5e\\x8a^z\\xcaf\\xafp\\xbd01\\x08\\x948\\xed\\x1b\\xbdi\\xe7c<\\xaa\\x91\\xb8\\x9e\\xd6\\xc7\\x82-\\xbfp\\x84\\xd9.g5o^.\\x07^2p\\x9bt\\xba\\xd6\\xd8uy\\xd8\\x05\\xd7a\\xac77\\xfe\\xc5\\xd6"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xaf\\xc2\\xff\\xf7\\xa1\\xc5\\x056%\\xc2nuk\\xaa\\xdd\\x8f\\xb2\\xab~y\\xfdj\\xaf\\xd1aa\\xf4\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf50\\x81\\xb5f\\x877o0\\xed\\xe2\\xf5\\x9e+\\xbc\\xaa\\xac/4\\x82i\\xcb-\\xe7\\xa9\\xfb\\x1b\\x1es\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xca\\x0f\\xceo\\x1cwc\\xb9p\\x1b\\xb3au\"\\x94\\\\xab\\xb1lm\\xe1\\x15h\\x15\\x89\\xf3\\xe7#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5kc\\xbe\\xec;\\x1f\\x9d\\xa9\\x10\\x88u\\x03\\x14|\\xc1:\\x08\\xa4\\xbaq\\x9dd\\xc8\\x14\\xe0\\xeaz\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\xb8\\xad\\xe2\\x064;\\xafq\\x0eec\\xfcawj\\xc3\\xe6\\xcd\\x8a\\xd1\\xed*\\x03i,\\xfbx\\x81\\xba\\xe5ny\\xd1\\xf8\\xcd\\x93\\xfb\\xe2\\xf3l\\xee\\x812\\x9d;\\xfa\\x8b\\xb3\\xfb\\xe6p\\xd3\\xff\"\\xba'`?\\xb3a\\xa1\\xa6\\xcc\\xa7b?\\xb13\\x14r#unm\\xd7\\xc4\\xfb\\xd3\\xb5\\x87\\x83\\xb9lx\\xb1\\xc4\\xac\\xbc\\x19\\x93\\x97yyd\\x96\\xa5\\xe6\\xed\\xe4\\xfb\\x98lr\\x8a\\x96\\x00\\xcav\\x17\t\\xeb\\xc2~6\\xc8\\x0eew\\x8b\\xc4\\x1b\\xd51\\xa1\\xcf\\xd6uog\\x1b\\x96\\xed\\x8a~z\\xf2\\xc4\\xa3\\x86\\x13\\xa3\\xe6\\xfcv\\x08<\\x89\\xed\\x07\\x14/\\x9c\\x9e\\x9f\\xc8\\xb8\\xfc\\xbf7\\xba\\x18\\x81\\xc0h\\x95\\xff|\\xf1v\\xf9\\xd8\\x11\\xea\\xdd\\xabcx\\xc0\\xb9\\x95\\xb4\\xfd^b\\x18t\\xa0\\x00a\\x0c\\x13\\x95\\x8f\\xdcx\\xf5\\xb5d\\xd0\\x1e\\x88\\x0f\\xa3\\x1b\\xd0\\x9d !\\xd3\\xb4\\xca?\\xae\\x93\\xa6\\x00u\\xf07\\xa3s9a\\x8c\\xa0\\x8c\\xdch\\xa5\\xc4\\xc2\\xfb\\xdfj(\\xf3\\xfdh\\xf6\\xc8!fe\\xda\\xb4!"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1_<\\x128\\x16j\\x02\\xc7\\x83k\\x8c\\xba\\xf26\\xf2\\xeb\\x92n\\x07&-\\xcb\\xae\\x85\\xb4\\xc5 \\xab\\x145\\x01\\x80\\xa0\\xa4\\xb7\\x0cr7<\\xce\\x8a\\xc9\\x00\\xd2\\xdb\\xcd\\xdd\\\\x1c.\\xc5\\xd5'\\xfd\\x1f\\xd6<\\xee\\xf7d\\xcf\\x1f\n\\xad\\x1b\\x03!m\\x1d\\xf5bn)\\x17\\xcdq\\xa9\\x03d\\xe1\\x83a\\x11?\\xb8k\\xf8qu.\\xd7\\x07\\xad\\xa7q\\xe4\\xdf\\xe8\\x05\\x1a,\\x1d\\xb1\t\\xed\\xccz\\x1e\\x02\\xeb\\xd8\\xb0\\xef\\xba\\xb1\\xcc\\x17\\xdd\\x9c\\xcfmo\\xdas`\\x06\\x18e\t\\x11\\xdc<\\xc5\\xb9\\xf5\\xd06\\x13\\xf9\\xe6d\\xf2\\xa9\\x1f\\xfb\\xc7w9n\\xe3\\xebe#\\xc6\\xd1\\xd6\\xc5\\xeev\\x9f\\xb9\\xe69\\x180\\x04\\xc9\\xc2\\xc1\\x90\\xb7\\x03\\xdb\\x8e\\x84\\xc3\\x07s'\\x0c7t\\xf0g\\xc8x\\xedw\\x02\\x93%\\xd8\\x0b\\xb3\\x0b\\x9ct;t\\x86\\xccc\\xe4h&x>z\"\\x0b@o\n\\xe8\\x04x\\x00\\x1e%1y\\xfeo\\xc6y@\\xacv\\xe6s\\xd3\\xef\\xc9f(\\x11\\xf3m\\x83\\x91\\xb5\\xa5v\\x1e\\x01v\""
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x9f\\x06\\x1b\\xc1\\x1d\\xffh\\xe9\\xd93\\xaa\\xd8\\x97=/\\x10\\xfc\\xf2p\"\\xcc e\\x9d\\x00\\xa43(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5j\\xb3\\x94\\x11\\xc5\\xa2a\\x84i\\xb9\\xc5\\xb8\\xfb\\xb5\\x00~\\xe3x9\\xae\\xd29g\\xa5\\x00f\\xfc\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xad\\x97\\xc3s\\xee\\xbe\\x98\\x84^\\xa0\\xc2\\x88\"6>\\xc5-\\x84\\xc6\\xf5\\x1b\\x8c\\x97\\xc02v\\x0b\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x8f\\xae\\x18\\x96l7r\\x0bv\\\\xad\\x89\\x8b\\x9c\\x87\\xf7\\xef\\x0f\\xabu!\\xe5\\xb5\\xe9d\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xa9\\xd1\\xa4z\\x18\\x8ct(_\\x0c$\\xc2\\xba^\\x11o\\xe6\\xa00\\x82\\xcf\\xd9b\\xde\\xac\\xee\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xe2y\\xaa\\x8f\\xd3\\x1bq\\xef?\\xbc=\\xbcj\\xa6*=& \\x172?2\\xf5s\\x90qd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\x99 e\\xf7_\\x02s:l\\x14\\xfd\\xef,8\\xfa\\xa7x\\xfa\\xca\\x9f\\x1f\\x89x\\xa1\\x0e\\xf5d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\x0b\\xae\\x08\ny\\xfb\\x9a\\x1c~7~\\xb5\\xf2\\xc4\\xcb\\xfc\\xc1\\xa2\\x92)r\\xe1\\x8f\\x13k\\xe4\\xcc\\xaa\\xc5\\xa6\\x149e\\x1e)v\\x04\\x8f hz2\\xd3\\x05\\x1e\\x91\\xb5\\x14tine\\x14\\x13\\xfe\\x92\\xcd\\x15\\xc8\\xf6\\xa7\\xad\\xcd\\x81e\\x88$e\\xb4\\xaf\\xc4\\xe2\\xeb)\\xb51z\\xa5*.\\x93\\xa7j\\x96\\xf1u\\xa4\\xc1\\xdfj$o\\xaf1r\\x83\\x13hr\\x859\\xb7tg\\xbf\\xd4\\x19ra\r\\xe3\\x88\\\\x019\\x1e\\xd4\\xc9\\xbe%\\xea\\x9c\\xef~\\x97\\xf1\\x9b\\x8a`\\xb8p\\xb8\\xfa \\x99\\xa8t\\x14k/\\x96\\xba\\xc5\\x1a7\\xb8\\x9d\\xd5\\xe5\\x056\\x0f\\x11\\xf8\\xab>\\xe1\\x84\\xcfd\\x0e\\x03\\x13gb\\xb7\\xb5\\xa5\\x89s\\xc4\\x89\\xc0\\xe7cmd\\xe7\\xae\\x90sb\\x13\\x88\tn;\\xc6\\x03\\xa24\\xc7\\x12hy~f\\xc8\\xeas\\xa4j\\xc8\\x94l\\x01\\x19u\\xcam\\xf6\\x80\\x1b\\x12ef\\xb2\\xfb=u\\xda\\xd8\\xe4dj\\x1b*\\x01o\\xf2|\\xeb\\xc4t\\x86\\xb9\\x802\\xaeq\\x7f\\xda\\x14\\xcc:\\xc1"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf5\\xdd<\\xf3\\xe5\\x99\\x11\\x02\\xb5\\xc0f\\xa3aq\\x1d\ry\\x1a\\xdf\\x0e\\x94\\xcb\\x8c\\x98\\xf8\\xaf.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xed\\xde3g\\xda\\xa15\\xbe\\x83\\xcd\\xc8_\\xd4\\xb3q\\x1c\\xc8m\\x99|#\\x08!\\xa8\\x8f\\xa6\r\\x7fl\\xcfs\\xf7v\\xfa=1w\\xe6\\xc2\\x10m7)\\xa9\\x0b\\xf6d\\x9aj\\xb8\\xdb`\\x89>\\xc3t\\xe5\\xf4\\x18vv+fop\\x0c\\xb7pu\\x12\\x18\\x04\\xa1\\xf3\\xc5\\x17wi\\xc2\\xd7,\\xf5\\xcc\\xec1on\\x8e\\xa2\\xc9e\\x1f\\x0b\\xf3\\x1d\\x88\\x88\\xc0v\\x1b2 \\x917@\\xa5\\xd7\\xe6\\xfbh\\xec\\xb4\\x14\\xef\\x81\\xeb\\xb7=\\x10y\n\\x07\\x94k\\xac\\x1bo7z\\x0b\\xb0\\xf8x\\xd8+\\x8c&\\xb0\\xc52k\\xbb4\\xab\\xe5d\\xfelag`\\x03\\x16_\\xcd\\x99k\\xe3\\xf9\\xf7\\xc8\\x90\\xc9(\\xf0\\x10\\xf3\\x8ax\\xb14\\x1epc\\xe0@v9r\\xb7\\xab\\xba\\x10\\xc0\\xe9j\\x80j\\xd4\\xd7\"\\xc89\\xd4`\\xa8\\xf5u\\x11\\x13\\xf5\\x97\\xb7~\\xbf-\\xdcib\\x04\\xdb\\xbe\\xb1\\xf8\\x81&\\x9b\\xdb\\x03\\xf9m\\x80\\xdd\\x1b\\xea\\xfb5\r\\xd4\\xd2\\xfe\\xc7mj\\xb0eb\t\\x04\\x01h\\xe4e\\x19qz\\xef\\xa4"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a7\\xdb\\x8c\\xdc\\x8e\\xbc\\x93\\xe9\\x9d\\xb9\\xaa\\xa8*\\x96\\xef\\xd5(k\\xec\\x91\\xc2o b\\x0c\\xb4\\xb5x\\xdd\\xca\\xbac\\xfb\\x00\\xe9\\xf9tdu\\x05\\xef\\x8f/\\x01i\\xda6\\x88#ymk>z`\\xa5\\xa5\\xfds\\x84w\\xd8\\xf4\\xe9m\\x1b\\x86\\xfd\\xfb^\\x97zl\\xdc\\x0e6\\xb6)g\\xde\\xf1#ula\\xd6#:\\xc8\\xe1\\xcfv\\xce\\x112z\\x83\\xe4\\x1a\\xa7\\xac/\\x16\\xebd\\x10\\xd9\\xb6\\xdb\\x97\"h\\x17\\x04\\x12s6ed\\x94\\xeb~\\xa5\\x1e\\xd1\\xfa\\xcd&\\xa9_0\\x05\\x8dk\\xb46\\xcc`d\\x895\\x19\\xd9gh0\\x90\\xe8\\xff\\xd9s\\xc6\\x0c\\xe8u\\xaa\\xa4\\xd1j\\xda\\x18e=\\xc6l\t\\xb3\\xff\\x96\\xbc\\x10\\xf2\\xf4\\xff\\x7fqn\\xa9\\x03\\xca\\xfd-\\xcc\\xc8\\x93d\\xe2;\\x1ep\\x15\\x05\\x83r3\\x8b\\x02\\xc1\\x82\\xbb\\xeb\\xc55q3\\x11\\xdc\\\\xaba\\xc6\\xcbl\\x0b+\r\\x8cz\\x11\\xcc;\\x88\\xe4\\xe6r\\xc4\\x89\\x91\\xc8\\xb7m\\x9e%\\xcde+1\\xaaz\\xe2u\\xac\\xbc\\xceh\\xdcc\\x1a"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\xf6\\x98\\xde6z\\x9dd\\xea\\xf4l\\xda\\xc2\\xaed!j\\x98\\xce^t\\xe5o\\xa3\\x06x\\xac\\x0c=\\xe4j*\\xfd\\xd5\\xa0\\x08c\\xf1l\t%\\x83\\xf2\\xd5\\x19-\\x10b\\xa3\\xfc\\xac\\xd6\\x03\\x04qi\\xdd\\xff2z\\xaa\\x94\\xdbo\\xccp\\x0c\\x92\\xb7\\xdd\\x90\\x97v2\\xd5\\x17w\\x19\\xa0\\x96\\xe3f\\x83-%=q\\xb7(\\x0f\\x07\\xdewlo\\x9f4\\xfe\\x96\\xc7\\xc1&\\xa4p\\xc9w\\xf4\\xb0\\xb7\\x84\\xb5_\\xd9h\\xf6t\\xb8\\xfe\\xba\\xcec\\xbbl\\xc1<\\xe6\\x9d\\xfd\\xdc9\\xe9\\xc36\\x9a\\xb7e\\xcd\\xa5\\x9b\\x911ymx\\xa4\\xe4\\x83x|\\x86\\xa4\\xbc\\xc8\\x1fn\\xcfd\\x8b\\xf2\\xefg`\\xd8\\xed\\xff52\\x93\\x12t\\xcd\\x00\\xed%\\x95\\x01\\x15:\\x03oz\\xeek?\\x0cabl\\xc8<9\\xcci\\xe6\\x84\\xde\\x14\\x01\\xcb\\xd6!\\xc4\\xf9\\xa7\\xf9\\xd0\\x9a\\xacn\\x03\\xc7r\\xee\\x05\\xeb\\x9a:\\x02i\\xb8\\x96\\x8e\\xb0\\x16\\x9a\\x98/4\\xa2\\x8a\\x9a.6\\xdd\\xe1h\\xe0y\\x93\\xcc\\xa6kh|z\\xa2\\xbd"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\x16\\xcc\\xad\\xe7\\xc0kp\\x9b\\xe9\\xd1_yhi/ \\x05\\x12\\xec\\xa1\\xa6h\\x82\\xc0\\xfd\\x04id#\\x1f\\xdc\\xd6\\x83\\xd8\\xcb\\xa85?\\x06\\x7f9m\\x89~\\x7fl\\x00\\x8f%\\xc9q\\xabt\\xa7\\x81\\xe0\\x9e\\xf2j\\xb8\\xa4<\\xe2o\\x92\\xb0``ia\\x819\\x1b+b\\x05\\xbd\\xa4\\xa7)\\xfd\\xd3\\xce\\xcf\\xe6\\x8a:\\xcc\\xa9\\xbd\\xa2\\xfa\\x976\\x92uq\\xf2\\xd9\\xdb\\x8c\\xf5o\\x15c\\x8f\\xaf8\\xff\\xd9\\x0fny\\x9b\\xa2\\x1f4\\xd0\\xbc\\xc3\\x7f\\xaae\\xdf\\xfb)\\xb6wp\\x91\\x9b\\xccr\\xca\\xb1\\xe1\\x97lh\\x12\\x82\r1y\\xa55\\x07\\xd4\\xb5\\xeet\\x13\\xee\\xba\\x92\\xb7\\xbd\\xbat\\xa6\\x90\\x7f\\xfe\\xff\\xfa\\xa8\\xef\rh\\xfaf\\xc7\\x14c\\xf7\\xb2\\xd7wt\\x9d\\xd5\\xc4\\xb2\\x11\\x83\\xb9\\xf1fn\\x94\\xdb\\xb5\\xf3\\x7f\\xb8<p\\x15k\\xfb7\\x06dk\\xc3\\xed0\\xf0se\\xa2t\\xbd\\xa0\\xad\\x97\\x04xs`~zsx;\\xf3a\\x9f\\xf0\\x84\\xc8\\xb6\\xe7t\\x08fl\\x88s\\xcd "
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d$p\\xdb<\\xd5\\xdf\\x08f\\x8e\\xd8\\xd6\\x9d +\\xf8ll,\\xa0\\xbc\\xe8\\xe18\\xfa\\xc6\\xc1\\xe2\\xb1om.\\xa1\\xfb\\xae6\\x17\\xb87\\xcb\\x83\\x1f\\xd5;\\xaa\\xcb\\xbd\\xe2 \\xce\\xba8\\xe6\\x9f\\x86\\xd0bw/\\x05`^\\xbd\\xed\\xef\\xe3~\\x9e#%x+\\xe1\\xd2\\xad\\x19\\xda\\xa5\\x13n\\x1bz\\xa6\\xf7h\\xd5\\xbcml\\x97r\\xcb\\xd3u\\x1c\\xff\\x953vr\\xcb\\x0bf\\x9e\\x90\t=\\x01\\x86\\x86\\x88\\x1c^\\xefq1\n\\xdc\\xcf\\x0e\\x02b\\xf5\\xd1!\\x95z\\xe4\\x9c+\\xb8hl\\x18\tih\\x81\\xb2\\xb6\\x15\\x9au\\x91\\x91o#\\x8eri&\\x02g\\xe4\\xeb#u9mk\\xb5h*zy9\\xde\\xe0zn\\x91\\xe0\\xb7\\xd2\\xaay\\x85t\\xde+\\xf6\\xcd\\xf3bq\\xd3\\xad\\xd3\\xa7d\\x94\\xb6\\x86\\xad\\xc3\\x9c\\xa3\\xcb\\xf6t\\x0f@\\xdb\\x16\\xc4p\\x97z\\x99g\\xf6\\xee\\xe5\\xbdde<\\xb2z\\x9b\\x9f\\xf3\\xa5\\xbe\\x08_\t\\x07\\xaeu\\xc4\\xb8\\xe0\\x82\\x01_-'h\\xf8nkb\\x80h"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\x05f\\x98\\xfd\\xde\\xf9\\x9fqy\\x19\\x05l\\x8b\\xb8\\xb5\\xd4=\\xf5 w\\xb1b3\\xea\\x13\\x89^\\xd0\\x95\\x9b\\x92\\xe6\\xd23\\xa7z\\xa8@\\x06\\x15\\x7f\\x04\\xf20\\xbc\\x86\\x13\\x96\\x1f6\\xcd\\xedf\\xe2\\xf0\\xf7u\\x7f\\xe6\\x07\\xbb\\x932\\x06q<\\xc6:\\xd8\\xf1j\\x127\\xebr\\xba\\x95h\\xba\\xdb\\x8e\\xecum\\x133\\xf5.\\x14\\xbc\\x17\\xdfz.\\xc5a?\\xa5^\\x1f\\xa31\\x9e\\x18\\xb8\\xbf_\\xcf\\xc5\\xc3\\x7f\\x88\\xads\\xfav\\xf8m \\xd7\\xe9<h\\xc2\\xb9|\\xb7\\x8c\\xbaw\\xa4\\xf1\\xf5za\\xb5\r\\xf3\\xbbz\\xb8\\xa4\\xb7\\x01dh\\xdd\\xca\\x14\\xab8\\x87,\\x97\\x1dd\\xbe\\xc5w\\xb2\\x1ebm\\x83\\x03\\xeb\\xe2\\x84\\xab\\x9e\n\\x8f>\\x9c*^<\\x84\\xb3h'5\\x1a\\xce\\xd7\\x1bi\\x8a\\x9c-\\xdf\\xacp\\xaf,\\xa7*\\xe0q\\x14\\x1a0\\x83l*o?\\xfb\\xec\\xd6&\\xabr7\\x130\\x96\\xc6\\xf9y%l\\xb9\\xd5kp\\x9f\\xe6\\'\\xb1?\\xec\\xae\\x98\\xd8\\x8f\\xb4\\x8b\\x11\\xa6\\xcb\\x86\\xaa"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2d\\xbf\\xf0nax\\x06k\\x1a\\x88\\xa7*\\xbf\\xd7\\xba\\xd0-\\x96~\\x8b\\xaf\\x82\\x1b\\x82\\xd5%\\x10u\\xef\\x10\\x87mk\\xa6\\xf8\\x0b+?\\x0b\\xa6\\x11\\xa7\\xcdh\\xbc\\l\\xce\\x1ee\\x8a~\\xd8\\x97\\x9b\\xfc\\x03b\\xf7\\x81\\xb4\\x84(\\xf7f\\x84\\x05\\xd1\\xb5\\xf0\\xb8@\\xafg\\x7f\\x19\\xe1`y\\xfc\\x04\\xf6\\xa3\"\\x1f\\xee>xzq\r\\xf5\\xbfc=\\x8c\\xfd\n \\xee\\xb8\\x0b\\x18x\\xab\\xd8\\xac\\xa95k7\\xcc\\xc0\\x0c\\xbac\\xcfz`\\x7f3uzj\\xe2a\\x11`\\xc2\\x9d\\xb9\\xbc\\xc7\\xab|nq+\\xc2.m\\x8a\\xba\\x13\\xffp\\xe6_\\xb1p\\xc8\\x87\\xd9\\xe8\\xc5d\\xed\\x84\\xf4\\xec\\xbd\\x8cg\\xbf\\xfd\\xbe\\xb4\\x14\r\\xa8\\x7f\\xe1\\xd9\\xf5\\x91y\\xf0_\\xf4\\x9c\\xb0m\\xe5\\xc1#f\\xe8\\xca\\xff!\\x04\\x86\\x9efj\\x80\\xd4\\x1f&\\xdd\\xe2#\\xbe\t\\xd5\\xb2\\xc7rg:;\\x14\\xa5.\\xb6<w)(\\xe7\\xbd-\\xad\n\\xcb\\xd4\\xced\\xa2\\x07\\xabo\\xa79lv\\x97\\x05|\\x9e^\\x17\\xd5\\x1aw'\\xe9\\xab"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe5c\\xf5\\x1d=j\\xa2\\x14\\x97=u\\xeb\\xf7\\xa2\\xf7t\\x1f\\xfe^\\xbb\\xa9ni,y\\xd4p\\x9cm\\xf2'\\x9d\\xa8\\x10\\xfesf\\xe8#\\xae\\x17n@gz\\x84fc\\xb9\\x84r\\x9d\\xe8\\xfbh\\xc6>\\xb0\\xf7\\xc5?z\\xf6\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\x12w\\xdfx\\x8b\\xa4\\x1c\\x8e\\xbb\\x89\\xdd2\\xb4\\xd9\\xc0\\x9d\\xbco\\\\xe0\\xec\\xf4\\x11b\\xd0\\xf6b\\x96\\x18%\\x10*\\xb9\\xf3\\xac\\xd4d\\x1eb\\xf5\\xde0ds\\xaf\\x1b\\xda"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90(m\\xbb\\xe8\\xad\\xee\\xa8ot(i\\x8c>\\xd6y\\x16\n\\x8b,\\[email protected]\\xc6z\\xa3(\\xc1\\xbb\\x04j\\x84/.\\xc6\\xc5\\x8fz\\x17\\xd3\\xa0\\xf7v\\x0bd\\x9c\\x1d\\x01\\xb4\\x94\\xe5\\xcf\\xb9\\xb1\\xc8v\\x80h\\x19\\xcbi\\x17\\x93\"\\xa8\\x7f\\x14>eky\\xe0\\xc3\\x9c\\xf8\\xcf\\xba\\xc1,\\x1e\\xf8d\\xc5\\xee\\x8d\\xff\\x99s\\xd1o4\\xa7\\xe9\\xa3\\xe8a\\x9e2e\\x99\\xe6\\xac\\xfb\\x9a\\xbf\\xec=\\xc0\\xc5a\\x93`j\\xe3\\xca\\xb8%\\xab*|\\xff\\xe2\\x92\\x1f\\xae\\x97j\\xa6\\x189\\x80\\x10\\x89\\xcf\\xe5q\\x1b\\x91\\x0b9\\xc6\\xf1\\xab\\xf5\\x1brw\\xdf\\x88p\\x1a\\xf4\\xedr\\xcej&r\n\\xcb\\x82!i\\x1e\\x19h\\xa7g\\xe7\\xb3h\\xc4\\x12\\xb6p\\xd4\\xab\\xf6a\\x17ie\\xf5\\xe3\\x95\\x8b\\xd3\\x8b\\x96\\x11x\\x9ey\\xd7\\xed\\x16\tqq\\x05\\x83\\xee\\x92k\\x9e^>6\\xdd\\x07\\xf5\\xc1;iw\\x7f@\\xa2\\xfa\\x9a\\x01\\x14;\\xa4\\x9d\\x01\\x12\\x82t\\xbc\\x1f\\xff\\xc0\\x80h\\xc7\\xc71<l\\x7f\\xc0\\xf3zal"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe\\xb5\\xe3\\xd2r\\xe2\"o\\x8b+\\x85$)\\x89b'\\xa4\\xe1\\xfb\\xba\\xa7\\xe3\\xaa\\xa7\\x87\\xd3)aw\\xc2\\xedm\\xb6\\xb7tp\\x1fq\\x1f\\x15\\xbap\\xb1w1\\x16u\\x8a\\xed)\\x9d0`\\xf7\\x94\\x1dy\\xc6\\xa0\\xa2\\xf5&=\\x85\\xb7\\xdc~\\xaf\\xec\\xb6&\\xfa#j\\xb0ks\\xe8\\xde\\x86%u\\xed\\xf9\\xbe\\xed\\x7f\\xa0)\\xd0\\x91q7\\x0e\\xe51\\x17\\xd6\\x97t\\x11r\\xbc\\xc4\\xff\\xd1\\x91\\x9a\\xb4)\\x81\\xce\\xcd2e\\xa3lm\\xec\\x83\\xf0\\x8d\\x1afwp\\y\\xcf\\xef\t!&\\xbak\\xb4\\xc0@\n\\xbaw\\xd6\\xc7,\\x16\\x82\\x84\\x86\\xf3pak\\xff\\xefxp\\x98#kj\\x8d4\\x84<\\x02\\xeaj\\xfa\\x9d\\xc69j\\xe4\\x80w\\x08%08\\x89\\xdf\\xb9\\x89\\x01\\xb0\\xf0\\xad\\xe5-\\xc0\\x94\\x89s\\x9e\\xc1\\xb8\\x82&\\x01r\\x89\\xcby\\x0f\\xcf\\x13\\x86\\x98\\xb0\\xd5\\x94\\xb9\\x8cd\\xf5\\xb4\\xdb\\x04\\xcda\\xce\\xa10\\x19\\xcb2\\x8b\\xc3\\x1b\\xb2\\x84e\\xa3\\x82(\\xbf\\x87\\x15q\\x11\\xee?\\xba\\x1e\\xb2\\xdf"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa-\\xd4\r\\x16\\x08\\xa1\\x18\\xe5\\xaf0dq3\\xba4\\x8bo\\xf9\\x910\\x96\\xc2=\\x7f\\x8b\\x8eh7\\xe0w\\x06\\xc2\\xba6g\\xaey8fa\\x8bgv\\xc4\\x1b_g\\x0f\\xf2\\xef\\x1dd\\x88\\x97\\x1ale\\x1cd\\xae3d\\xb5\\x0et\\x93\\xc1\\xa2\\x90\\xa4\\x85\\x16z\\xd6\\x89\\x05\\xb1\\xcf(v\\xce+?h31\\x9d\\xf3z\\xd5\\xfbo\\xc4x\\x93\\x998\\xe1\\xc8+\\xe8.sa\\xf2\\x12\\xa3|9z\\x8e\\xb9vx\\xc3\\xb9v(\\xe4\\x99pq\t\\x1e\\xca\\xb9r<#m\t\\x9e&'&\\x04s\\xebvsq\\x85\\6\\xc6l\\x95\\x1f\\xe8\\xe0\\xbd\\x88\\x98(p\\xe0\\x12l\\xe7c\\xfdm\\xe2\\xbc\\xf3\\x90\\xf7\\x12\\xa5i%\\xa0)\\x17u\\x97^n\\xe1pv\\xca\\xa0\\x8e\\xae\\x1ap\\xb3:\\xb3\\x1d_h\\x18o\\xc4\\xa7\\xf0\\xc9q\\xf2\\xca\\x14ol\\x88\\xde\\x04\\xde\\x99\\x85\\xd5c\\x0bm\\x8dx\\xfcy\\x1c\\xe4\\xea\\xa8\\xfaz\\xc1krz\\xfd\\x8b>q\\x99jun\\xec\\x03\\k^\\xd3\\xec+w\\x1b\\xfb"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2\\xd9!\\xd5(\\xa6\\x9cu:\\xcd\\xda>j\\xd9\\xca\\x9etyq\\xd4\\x19f\\x1f(\\xc5kz\\xe9$\\x91%-\\xf1b\\xba+\\x84\\xadcq\\xf8\\xfei\\x88\"\\xc3\\xef\\x80`\\x8d\\xd7c\\xa77u\\x94i\\xec\\xcc#j\\x11\\x12\\xf5\\x81\\x16k\\xf4i/\\xb2\\x9c^`\n\\x00\\x14\\xf0\\xed\\x0c\\x99\\x16\\xb8\\xc6.se\\xa6\\xaen\\xb6\\x14\\x0b\\xd0f\\x12\\x9c\\xebk\\x7f\\xe5\\xeaug\\xa1%\\x08\\xda\\xbd\\xdd\\xef\\xd0\\xa0\\x1aa\\x86\\xe8e\\xb5\\xfc\\xe8)\\xbe\\x18*p\\x92\\xe8x\\x18r\\x8c\\x98\\xe5=+:\\xa3zd\\xab\\xe9\\xac\\x97\\xac\\xb6\\xd2yg\\xe4\\xe0\\x8f\\xbb\\xb9\\x05:\\x0f1\\xf0\\xb9\\xb0.\\xe2\\xc8=g\\xc9\\x0c\\xc7\\x93%\\x91\\x02\\xa7k1\\xff\\x02s\\xa96\\xd3\\x9132$\\xf5s\\x12e\\xe1et\\x86\\x94y\\xffv\\x90\\xb4\\x1e\\x81\\x81=\\x81\\xc5\\xf7sg\\xcbo1\\x11\\x0e\\xe9:s\\xd2.\\x8d\\x94*\n\\x03.l\t\\x9c\\xd8f~\\x811\\xdc_>\\xce\\x15h\\x0cox\\xb58=8k\\xe5"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f?\\xd5(\\xe4d<\\x16\\xc9,\\x9ex\\x8dn#\\xb5\\xa2\\x14d\\xa4\\xe1%\\x93vk\\x11\\x0c\r\\x85_\\xeb\\x1b\\x03c\t%k\n\\xde\\xb5\\x11\\x93\\x9d9\\x8f;1\\x8fo7$\\x97!\\x1f\\x96g\\xd3c\\xbb\\x1d\\x01\\x80\\x9d\\x07\\x11\\x0e\\xa9\\xc1#zy\\x1c_\\xf3\\xc6\\xb6\\x92\n\\x0f@\\xb0o\\xc6\\x9d\\x13\\xb4s\\xb48\\xd5w\\x12.\\xd1\\xec\\x8f\\xadk\\x0exv\\x9c\\xcb\\xa0\\xa9\\x03 (w\\x0f\\xef&\\x88\\x80_\\xb0\\xf4p\\xfa\\xa9\\x8f\\xfdl\\x98\\xd14n\\x00\\x83\\xc3\\x81\\x9f\\x87\\xb1\\x86<\\x11hu\\xd4\\xdb\\x02\\xd5r\\x08\\x82\\xb9e\\xd8\\xc5ymy\\x04~p\\x0e\\xb3qq@\\xec\\xc6\\xd6-\\xdc<h\\xc0@\\x7f\\xcf\\xe9\\xbes\\xf8$\\x05o\\xb6\\xa9\\xbf\\xc4\\xef\\x19\\x04n-\\xf8\\xca\\x113\\x89\\xeeyd\\xd6d)e\\x1e?\\xac\\x0bc81=\\xa2\\xed4x\\x1a\\x8d\\x17\\x95_h\\x15\\xee\\xaf\\x9f\\xf4az\\xb5\\xdcp\\xd7\\x85b\\x17\\x96\\xd0e\\xbb\\x18\\x9f\"\\x8d\\xa0 qn\\xcd*\\xa5\\xf4cm<"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!w\\x105\\xe8'\\x9f\\xe6\\xda\n\\xc8\\xa7i\\xbf\\xddm\\xa0\\xe8\\xf6\\xcd\\x11>\\x1fp\\x84p.\\x89\\x17\\xed\\x0b\\xb0j\\xd2\\xbcp\\x0e\\x86\\xe4=\\xdd\\&\\x0e\\xd3\\x84!\\x19\\xfd\\x89r<\\xe3\\xf0z\\xf9\\xc5_\\xf9\\xad\\x00\\xe8\\xcb\\x9d\\x0fr\\xdd\\x90\\x8ax\\x05\\x00\\x16\\xfa\\xe3\\x1c\\x88)\\xe6\\xc5\\xa4%\\x0f\\xdbz\tz\\xaf\\xe2\\x84d\\xe5\\xfeb\\xd6\\x97^\\x0c\\xd1\\x18\\x9e\\x1e'v\\x8e6cl\\xbb\\xd4b\\xe3\\xce\\xc6\\xfb\\xcd\\x83\\\\x99\\xc3\\xda\\xb1d\\xc6\\xb0\\xab\\x1e\\x8b\\xcb\\xba\\xf4\\xa8\\x84,\\xdc\\x90\\s9z\\xa2\\xb5\\x0b x=\\xca_\\xb52\\xe1s\\xc7;\\xbf>zi\\xb9`oh\\xc9\\x9c\\xfb\\xa0fg-\\x08\\x8ar\\xdb@b\\xe1\\xd0.k\\x1a<\\xbfl\\x85`h\"\\x1d\\xcb\\x98s|&=h2k\\xa3j\\x93e\\x93a\\xf7\\xa8bunh\\xa1\\x93\\xd5q\\xaa\\x96\\xd4\\xfb\\xee\\x1c\\x9cc\\x10l\\xfa\\xcer\\xfc\"\\xf9m\\xb2\\xec\\xdb~\\xa4\\x00\\xfa\\x11\\x0b\\x0ff\\x8f\\x13oz\\x7f\\\\x83"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\xef\\xe1a?\\xb4\\x1dm\\xf9z\\xf2\\xf0\\xfb\\xde\\x8bp3\\xbam\\xb7\\xb4\\xda\\xbc\\xeb\\x94\\xea_\\x9b\\xd0\\x86\\xdb\\x0b-\\xc6?\\xf0p@\\xea\\x84\\xc2\\x05`j f\\xc3\\xe8i\\xa9e_\\xdf\\x14\\x97%\"\\x1aa\\xbb\\xdd~\\xd8\\xeb\\xa9\\x13\\x81\\xf0#@\\xaa^\\x83vp1\\xfa\\x16\\xd8\\x97i\\xd7\\xc5\\xe6\\x86\\xa0q\\xd3\\xb8&$\\xac\\xe1j\\xca\\x96<\\xb6\\xa3\\xd3\\xa1<\\xd4\\x1ason!\\x9b@n\\xe4\\xaf\\xd1\\x1b\\xafz|\\x91\\x9a\\x92i\\x1dp\\xeda\\xae\\xe8\\xc2\\x00\\xfbh\\xcd\\xe0\\xc6\\xc4\\xe2'i\\x9bhu\\xf1\\xe7\\xab\\xa5p\\x1f\\xe2\\xec\\x03\\x13\\x83k\\xae\\xefw\\xa1\\x9e\\x07\\xcb\\xce\\xff1o\\xaa\\xc8iy\\xb5;\\xfe\\xa5\\xd0\\x1bt\\x83\\xfd\\x00h\\x8ao\\xf2\\xf2\\xbf5a\\xe6\\x01\\xe1\\xb5\\x8b\\xb1snf\\xa1\\x1c\\xb1\\xdf\\x1d\\xb3\\x8d\\x8a%\\xec\\xe0#\\xfd\\x03\\xe4\\xc0\\xe7\\xab\\x7f\\xb3*\\xc7*\\xee8\\xa7\\xbf\\xe1w\\x83?h\\x8ez\\x13\\x9b\\xdee\\xc1o\\xc84+\\xa1'\\xb5\\xbe\\xf5 @\\x1ay"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1a\\xfej<h\\x81s\\x0c\\xaf\\x07\\x10!y\\x0b1\\xf1\\x172\\xff\\xb2\\x14\\xbe\\xd0\\xfc\\xa5\\xa8\\x18\\x05\\x89\\x049!y/\\x8d=\\x9f\\x90z\\xffx\\x0e\\xebqktl\\x9a\\xe1b\\xb8n\\xa6\\xc5rv\\xfds\\x15\\x9e\\xba\\x1a\ts\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\xe5ee_\\xa5\\x12\\x1a:\\x86,\\x91&\\xa4 d\\xb3h\\xf0\\xc2\\x8a\\xb5\\x1d\\x83\\xa6\\x83\\x97q\\xd8\\xa9#h\\xe0\\xe1g\t\\xf6i\\x8a\\xe1\\x9bqe7b\\x9dz"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1ce\\x15\\xb2\\xd5\\x99\\xc4(\\x96v\\xba\\x1fz\\xec\\x9dy\\xd2n\\x8e\\xdaw\\xf5\\x00\\xde!\\xa0r\\xf1\\xe3\\x8dp\\xfe\\x1a\\xb84\\xae%\\xbfy\\xcd\\xa9t\\xa8\\x80s\\x04\\xfc\\x8b\n\\xa7e\\x9a\\xec\\xa5f\\xb6\\x06\\x1f\\x1e\\x8d\\x85\\xcc\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m.\\xc7\\xa8\\xb8ne\\x87/\\xa1zn\\xc7lx\\x1f\\xfa&\\\\xe7g\\xd9\\\\xcc/\\xa8&\\xe84\\x98\\x0fe\\xe9\\xe48\\x9ah1\\x16\\xacy\\xb4\\xce\\x80^\\x86\\xbf"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\xcd\\x0b\\xec\\xc6\\x9b3b\\xcf\\x03n\\x1c\\x89\\x03\\xd2:\\x96\\x06\\xb6\\x94\\xc7p8\\xec\\x943\\xc3\\xe1\\xb0\\xfex'\\xb8q)\\xa1\\x03\\xfbse\\xfc\\xf2\\xb8|yx/\\x91\\xfa\\x86u\\x12\\x1ea=\\x82\\xad\\x04\\xdfpyk\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\xf7\\xdbn\\x87c\\xf4\\xf56gk`\\xe8ny\\x1e\\x16\\xe3\\x0f\\x9bd\\xa4\\xd1\\xfc\n\\xd8\\xd0\\xf0@\\xfc\\x82\\xee\\x87\\xd8jq\\x7f\\xf1rsn\\xd4\\x8a\\xa2\\xf1qe\\xd6"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4'\\xf2\\x0f\\xe7v\\xc2|v\\xaez\\xfb\\xa4\\xc1\\xd2\\x1d=\"9^\\xd2\\xba\\xcb\\xdfqe\\x1b\\xa3\\xbb\\x9f\\xa7o=\\x11\\xd0\\x01\\xd7i\\xb2\\x89\\x97\\xf3\\xfc\\x04a\\xe7\\xe7#\\xab\\xd0@\\x0bd8\\xf04x~\\xf7gixee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\x9c\\xc0\\x15|\\x02\\xfe\\x8f\\xb5\\xba\\x89n\\xc7\\x08;\\xb8\\xea\\xa586xkg\\xcab\\xa8\\x1f\\xf2\\xa5\\x0e\\xa0z\\x7f\\x11\\x18'e\\x84\\xe2\\xd1\\x84sa\\x82*`m\\xe7"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0bt\\xdc\\xa6\\x10\\x87\\xed+\\xb3l\\xa6\\xa9\\x90\\xa1\\xc1(.y|\\x85c\\xd0\\xa4thh\\xd0\\x8d\\xb8\\x08\\x05\\xa3\\xec\\xfe\\xd0s\\xfcr\\x87\\xc6\\x9a\\x8d\\x0ei\\xd8\\xec\\xd1tp\\xfc'\\xc2\\xa6\\xe3\\xc2y\\xe8\\x8e)v\\x97*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x1f\\x10\\xb8\\x08\\xbe\\xc1\\xf0\\xc5|ai\\x0c3\\x0e\\xab\\x1f\\xc6\\x17x\\x89k!k\\x8ek\\x7fm\\xbe\\xec\\xa6\\xab\\xfd\\xa7h6\\xa7l\\xec\\xfb\\xd4\\x05\\xa7eglj"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xca\\x8f\\x9dh\\xc2\\xe0\\xc75\\x90~\\xd3\\x1f\\x97\\xc1\\xf5\\x8b\\xe6\\xf2\\x9f\\x06\\xae4a\\xf5\\xc0\\xc7\\x99+k|\\x81\\xc5n\\xaf\\xf2e\\xe3p\\xb3z\\xccn9id8\\xac\\xe3\\x9c8\\x17\\x89.|\\x1bd3(\\x8c\\x0b\\xd5\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d \\xd7\\xdc\\xa4h\\x96nb\\xb2\\x1c\\xfd\\xcc\\x93\\x13\\xe6?\\xbb~b\\xca6\\xec\\xb4\\x94w\\xae\\xaa/m\\x17\\xee\\x9e\\xfa\\xa5\\x13\\x98j\\x0c\\xd8\\a(\\xdb\\x12\\x1d"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04dup\\xd2/p\\xb6\\x9e:\\xfa\\xad1\nh'\\xe6\\xc7=\\xf7\\xd7\t\\xc9nog\\x1e\\x85\\xe0\\xc4s\\xcc\\xc5\\xf1\\xbc#\\x94\\x02\\xa3h\\xe8\\xeb\\xd6\\x82f:&\\xe8woq\\x8a\\xc1<a\\x00.\\xf2\\x7f\\xc1\\xban\\xe8\\x16\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xe5\\x7f\\xc4\\x88\\x07\\x89\\xb7\\xce\\\\xec\\xd4\\xfd\\x12\\xf1\\x0fb\\xb3b\\xc0\\xf5\\x0e\\xf2\\xdf-\\xd4, h,\\x9fn\\xf8\\xea\\x18*;#\\x0c\\x96\\xc6ngr\\x9c\\x8f\\x1d\\x14"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83a\\x07\\xa3\\xd1wxh\\x01\rz\\xcc\\xb3\\x02\\xb8\\xfa\\xe9\\x7f\\xee\\x7f\\xc6\\xb6\\xf6\\x15\\xce\\xd2a\\xae\\xd0\\x17\\x15\\xad+6=a\\xf9lc\\xba3\\xab\\xeeu\\x83:\\xa6us\\x03s\\x92\\xf4\\xdb\\xcd\\xa1\\xe5v\\x9b\\xb3\\xcf\\x0c\\xcc\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\x93\\x03\\xa9\\xc3\\xaa\\xb2\\x06k\\xcfuh\\xc6u\\xd4m\\x8am\\xd0\\xba\\x8e\\x80\\xf47\\xbcb\\x1f\\x92m\\x9en\\xd7\\x10\\xba\\xb4\\x927\\xa8\\x87.\\x05\\xce#\\xf9\\x97\\x0f\\xf8"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xa3\\x87\\xd8a\\xdb1\\x17ow\\x11\\x02\\xc4\\xe6i\\xcet\\xd1+\\xe1\\x8bz\\xb8\\x19\\xf1i\\x81\\xb2af*~\\xdd\\x89v8\\x9d\rly\\xa7\\xa0\\xe0\\xca\\xcbc\\xd6\\xd7\\x18\\xa7\\x10\\xf6l\\x8bl\\xacw\\x95\\xfc\\x93y\\xcd\\xf6\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xeeat\\x14\\xe2\\x01'\\xa4\\xf1\\xcf\\x9f\\x07s,\\xfe\\xe3\\xcf\\xe8\\xbd\\xafo\\xe8\na\\xdff\\xede_d\\xde\\xd1\\x0e\\xe8\\xa3*\\xaf\\x80\\xcdc\\xb2\\xe1\\xc3\\xc79\\x81#"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xc8*\\xce\\x8bp\\xb7i\\xc3j\\x1e\\x9d\\x1b\\xb5\\x15\\xebf2\\xa1\\xb6\\xf0\\x87\\xaf\\xb3j\\xc0u\\xac\\xb4\\xb8\\x16g\\x93\\xed\\xcc)\\xca\\xfc\\xbd3g\\xf9lc/\\xe7\\x07v\\xc3\\x9d\\x893\\x19\\xbc\\xdf\\xc3\\xfe_\\xd9\\xb7x`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^\\xc0-w:\\x04\\xa0f\\x94\n\\x0f\\x95\\x03\\xc9\\x88|\\xf74y\\x01v\\xa3%\\xf2'g\\xa4c\\x8a\\x98*\\x9a#\\x9e\\xd2\\xdem\\xf7\\xe75\\xd7j|q\\xc4/\\xbd"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1\\x0c.m\\xdd|\\xf0z*b\\xb9\\xffi\\xf7\\xf1\\xb4\\x80\\xf5a\\x9cy\\xe6\\x97\\xeey\\x86\\xd4\\xae\\x12\\x19\\xb7\\xaf\\x86\\xdbe\\x7f\\x8d\\x8f`\\xf9\\xfayx\\xbce\\xc1\\xb4b\\xc6o\\xa4tkc\\xe8:\\x18\\x05\\xf8\\x95\\x15\\xb6i\\x1a\\x8bm\\xe6\\x8c\\xeb\\xae\\xf3jrtm\\xed:\\x9c\\xf8\\xbf\\xd0q\\xa7n\\xd3o\\x9bd\\x17\\x836\\xdct\\xe7\\xbcm\\xe3\\x1a \\xba)2\\xf7\\x1fb;\\x990\\xede\\xa7$b\\xf9a1t\\xabp7\\xa5k\\x0c\\x9bc\\x9fe\\xf1\\x01zb\\x96\\x10j\\xed)\\xab\\x7f\\xbf^\\xe1\\xf9\\xb2\\o\t\\xdf\"\\xc3\\x91\\xd6\\x89\\xe0\\x81\\x9as\\x18\\x98iec;\\xecdnh);\\xe8 \\x02\\x04\\xf0i=!\\x1e\\x9d\\xc3g9\\xcan!k\\xf5\\x12-\\xc9\\xffj\\x19\\xa6\\x9bv \\xde\\xb6o\\xe1-\\x00\\xc2\\x16\\x03\\x07q\\xe1\\x07\\x9d\\xec\\xc6\\xff\\x9d\\xcfq\\xaf\\x02\\xee\\x1evyn\\xc5 \\xaf\\xe8\\xf4\\xf3|\\x0c\\xcc\\xb2\\xdb\\xf7\\xc1\\x89\\xab\\x9f8\\xdb\\x19=\\xbe&p\\xe2\\xf7\\xb7"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xff\\xf9kp\\x88r\\xac\\x11\\x8d\\xdb\\x18+g/5\\xfe9\\x15+\\xc4\\x81\\xfd\\xcem\\x18\\xac\\xdb>\\xff\\x8d\\x80r\\x91?\\xcdl\\xe0\\xe5qs6\\xe1\\x07\\x18\\x1d\\x9c\\xa4\\x1bu\\xc9n\\xa3\\xb2>\\xe5\\x1a'\\xf4\\xcc\\xfe\\xc3\\x91c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1\\xdb,g(\\x19\\xe9#\\xa9\\xd9@\\x1d\\xe4>:\\x9b\\xdc\\x14\\xba\\xcc\\xae-\\x8d\tj~\\xa7\\xe8\\xdev^n~\rh\\x9c\\x92\\xa7\\x8d\\x15\\x7f?\\x06\\xc1\\x94\\xf5\\xb5o"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1fd\\xa7\\xec\\xa7h\\xad\\x03\\xc9\\xac\\xef3q\\x1d\\x07\\xe6\\xe0z\\x0e=\\x02(g\\x97\\xe2\\xae\\x94\"\\xde\\xd8\\xe5\\xd30\\xb6de\\x8au\\x95\\x9c\\x00\\x04\\xcbf\\x05\\xa4\\xc4\\xa2\\xa3\\x0f\\xaa\\xf2&\\x94x\\xaa\\x91\\xbc\\x18\\xe7\\x1e><\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\x1aw\\x8a~\\x04\\x004i\\xb5g\\xac\\xf2\\xa0$ah?\\xeeq@\\xc3\\xd9$/k8.\\xcb\\xedn\\xdf\\xfe\\x86\\xc7\\x10\\x01d6d\\xe3g\\xbd\\xbf\\x855\\xcd`"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xe9/\\x9fe\\x88\\x85\\x93\\x19\\xea|\\xca\\xeb\\x99ov\\x00o\\xdd^:\\xe6&\\x10\\x10)9\\xba%7\\x13\\x1c`\\x84\\xccl\\x18u\\xc4\\xf1>\\xc2\\xd5h\\x1br\\x19\\xcf\\xa9q\\xa1f#\\xfc\\xd0\\xb5z\\x0b\\xfc\\xe5y\\x03\\x9f\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\xebj\\xc8\\x94v\\x8fof\\xdf\\x93\\xaf\\xc3\\xc4\\x93\\x99s\\x8e\\xa7\\x0c8\\x01\\xd4\\xc4\\xbd\\x0f\\xc3\\x05m\\x0fl\\xb1\\xad\\x8dm\\xa0\\x0e\\xc6\\xbadu\\x86\\x05\\x86\\x06\\xf9eu"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1a\\xe4qf\\xd1\\x18c\\x93\\xda\t\\x87l\\xc8\\x04\\xc5\\xc9nw\\xc8\\xe9\\xd1\\x11\\xcbi\\x818e\\xfb\\xe6`\\x06\\xc1m\\x1f\\xc15\\x05\\x1d\\x9c>\\x8c\\x16h\\xd1>uw\\x8f\\xa1)sh)\\xb2\\xcf\\xdcl\\x85\\x1be\\x0bw\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9th\\x1b\\x87~\\xa3x\\xb3\\x8e/\\xc9?\\x94~\\xb5)\\xaf\\xdc\\xbejw\\x9b\\xf2\\xafrylp9\n~\\xfb\\x8a\r@\\x06\\x0b\\x17\\xd5t\\x8f\\xf5\\x8ey\\xf4\\xe6\n"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xf7\\xe0\\xd1+^\\xc1\\x84\\xbc1\\xfc \\xb3gd\\x93c\\xa47\\xb5|\\xb5\\xed\\xc1\\xc9x\\x18t\\xe6_x\\xb8|\\xc4*\\x82r\\xa0fko>\\xa14\\xba4\\xd1\\xe7\\xad\\xb3\\x81\\xe1y\\xc5sy\\x9c\\x86\\xd9o\\x01\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xf0\\x85\\x1c\\xd4j\\x1ckf\\x9b\\xe8\n\\x13\\x91sr\\xe5b\\xbe\\xfc\\xb9\\xcb\\xad\\x85g\\xa3\\xfb\\xef\\x15y\\x0ef\\x9cb~\\x07,1\\xdb\\xc1\\xf3\\x80\\xf5\\x15/\\xdd"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\x8fl\\xab\\x1f\\x8bf\\xc6okk\\xb7\\xdf\\xeb\\x11\\x89\\xa6\\xf0\\x19\\x14\\xd9\\x8f\\xd3\\x8e\\xd5\\xcco\\xa2\\x1a\\xcc\\x05\\xd4pm\\x9bf\\x07\\x92\\xb6\\x99\\xc8)m\\x03\\s\\xc6\\x89r\\x08\\xe4\\xbf\\x9f\\xd9\\xf2\\xc4&f+\\xd9\\xc8\\xa0\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ew\\x8b\\x7f\\x13\\xd2:\\xf2\\xc6\\xc4\\xa4\\x01\\x17\\xea\\xb2\\xa9\\xe3\\xf6\\xdb\\x7f\\xe5\\xcf\\xff\\x87\\xeag\\x900q\\xc9\\x8c6\\\\xf4\\xd7\\xb1\\xe7\\x84\\xf7\\x84\\xd9|\\x15\\x1a\\x04\\x8e"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^\\xa3-\\x0e\\xf1\\x91v\\xd7&\\xb9\\x89\\xaa\\xe5c*\\xcc\\x16jz\\xb7\\x0ep\\x10\\x8bu\\x87\\xf5\\x886\\x92\\x8cn\\x8c\\x9c-\"\\x9bp\\x18\\x9b\\xfe\\xaacn\\xd1hp\\xa1\\xf2)59\\xc8\\xa7\\x13\\xaa\\xc5o\\xaa\\xbc\\x87\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\x10\\xb4\\xfd\\xe0`ym\\x15\\xdf(b\\xb6\\xa6`\\xd9\\x84\\x82\\xf7\\xd4\\xa8\\x12\\xf3\\x0cx\\xb9\\xc5\\xe14\\x8e\\xa24\\xf3\\xc4l\\xecd\\xb6\\xdc\\xc3\\xec\\x94\\xc7"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\xd1\\xa1$\\xdewu\\x8e\\xd8\\xe2<^\\x9ccl\\x1bl\\x15\\x16\\xce\\xa0\\xda\\xcax\\xc0v4\\xba\\x93\\xa2\\xdc\\xa3\\x14\\x02\\xf9/\\x9d\\xf5\\xcf|\\xb3|\\xe38\\xe5\\xbc-\\x8bsp\\x1d\\xab;\\xb5\\xa9\\xe24\\xa2\\xa9\\x8f-\\x0b\\xb85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008k\\xae5/\\xe4j@>\\x14yt\\xfdr\\xb8\\x14\\x83\\x11\\xcao~f\\x98\\x06\\xec\\xaa\\x13\\x8dj\\x89o\\xfd0\\xc5\\xfa\\x9cm\\x1e\\x8e\\xf5\\x05\\x07\\xf5\\xe4\\xc8\\x1f\\x10"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5;%2\\x9b#$g\\xa3\\xaa\\x9bj\\xcfg\\fd\\xa4f\\x86\\x15\\x1c\"\\xde\\xef\\xec\\xe0\\x8e\\xa7av@q!p\\x17\\xa7\\xdd\\x16\\xe9\\xd0\\x82\\xd5>j\\xc3i\\x10\\xe5\\xc1\\xa0y\\x1f\\xdf\\xa57i\\x87$\\x81q\\xaads\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xe0\\xfe\\x0b\\xf0\\xa30\\x8c\\x06\\xd0v\\xc5\\xfc\\x1b\\x06\\x01w\\xba\\xeeyc\\x1e\\xa2\\xe29\r'\"tk`\\xbe\\xfe\\xbd\\xa2o\\x08\\xd7\\xb751\\xfb\\x987~,_\\x1b"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xdd\\x9ec8\\x0by.\\x96e\\x92\\xa9\\x9a\\xdb7\\x11\\xdau5\\xd3g&\\xdd\\x0f\\xeak\\xcbp\\xef\\xe0\\xe2@\\xb4\"2?p\"<\\xe1\\xe7\\xb3v\\xa4\\x93\\xfb!t\\xf8v\\xa9\\xd0\\xf1\\x02b\\xae\\xd2g\\x97y\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02r\\xeet\\xed\\xde.\t\\x02q6\\xcdg\\xf8^z\\xc6\\x04\\xd7\\x85\\x89\\xfbhhhs\\x9b\\x9dc\\x9c\\xdd\\xfc\\xa8\\x177\\x12\n\\x171\\xf7<\\xdf\\xcfl\\\\x81ka"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x0f\\x1d\\x04\\xe4h\\xc4\r\\xedo\\x02n\\xa8wmw\\x801a\\x16:,\\\\x1b:,\\xbf/w<\\xef\\xc1z\\x19\\xbb-\\xf8\\x84\\xce/\\xfa\\x10\\x93s\\x1d \\xe6\\x95\\x07\\xaf\\x14\\xa7\\xc4z-*\\xe1\\x0b\\xe6\\xa1\\xe0\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\x1d\\xf0\\xbdla\\xe8\\x0f\\xeaj\\xa1`\\x0f\t\\x98\\xd3\\x87\\x14\\xb9\\xf6\\x0ft\\xfd\\x92\\x1e\\xfe\\xcd\\xdamx\\xd97m\\xb4\\xad\\xe3o,/\\xe1\\xd7.\\xf8\\xfcn\\xf2\\x13"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\xa6\\xd2m\\xf7\\xd1\\x12\\x0f!.?\\xc4\\x9fy\\x00=\";k9\\xfb!\\xbb\\xf0\\x99$/6r\\xc0\\xea\\xa7u<t\\x14\\x00\\x92\\xaa\\xa0\\x87\\x0f\\x1f\\xf7\\x96\\x10\\x1e-b\\xdc\\xa0a\\xc8z\\xadwk\\xd8\\xf4\\xcd\"<\\xa0_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb:\\xcf_\\x1b\\xb1\\x90\\xc8\\x07w\\xf2u\\x9c\\xb6j\\x0c\\xdf\\xd2\\xd5_!\\xa2z\\x90\\xf8\\xadf\\xfa\\xd0\\xe1\\xf9\\xb5\\x19\\xce\\xaewd\\x15\\x0bf\\x1e\\x1b\\xa5\\xd6s\\x0b\\x19\\xd9"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xd8\\x81\\xb3\\xda\\x15l\\xe0\\xd5,\\x82\\xa8\\xb1\\xf0\\x0e\\x04f2\\xe0\\x02v\\x96\\xa7o7\\xe1sl**q\\xa4\\xf0<d\\xa7\\xe7\\x83\\x0f\"\\xbb\\x94\\xef\\xca\\x00\\xda'\\x06<\\x19\\x1c\n\\xabhru\\xf6\\xc1\\xa1\\xf1r\\xb2\\xced\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000swl\\x1ck\\x08\\xc65\\x86g\\xc6\\xf3\\xd2\\xe8nww\\xdb\\xf4\\xd6)f4\\xec\\xebe\\xfb\\x9c\\x8d\\xb8\"\\xdf\\xbbs\\x13\\xd8,\\x0c\\x80\\xe2\\xb5\\x0c\\xf7\\x0e\\x19"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\xcc\\xff)h\\xcb\\xf3\\xcb\\x10\\x0c\\x83\\xfb6\\x81\\x12\\x8d\\x11?\\xc57xn|d\\x94\\xe6\\xd46d\n\\xa0\\x86.\\xbb*d>\\xbfs\\xa2\\xbar\\xbd\\x8e\\xd1\\xa4n1*#\\xe9\\x81\\xe4\\xc8y?*\n\\xc9ek\\xd2z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zx\\xe4\\x04\\xae\\xf9\\xd1p\\x95\\x8cwvfhm\\x03y\\xe0\\xc4w\\xb8|8\\xc5\\x14\\x1e\\xbbf\\xabe\\xc8\\x9a\\x7f\\x1b\\x96\\xfe\\xda\\xdb\\x9f\\xe7a5m\\x9d\\x8bs\\xfb$"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xd0\\x14\\xcf\\xe5\\xb3\\x88\\xf3\\xb9\\xc7euo?\\xf0\\x9e\\xc3\\xf0\\x99\\xebj-c\\x12\\xb3'\\xb4\\xcd\\xb4\\x81'\\x87q\\xcc\\xd3'\\xbf\\x16u\\x13\\xd0\\x8f6\"\\x00\\x1dm@*b7\\xc8\\x85\\xb8\\x99\\x97>\\xf6\\xb0\\x8b\\xc0\\xd8\\xad\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xda\\xa4j\\xd5\\x9b\\xf9\\xc9\\xae\\x03\\xff\\xff\\x8b\\xf6z\\xfb\\x8dp\\xafb\\xb1\\xb8v\\\\xec\\xff\\xa9\\x0cq\\x9a+t\\xc8\\xc1\\xe6\\x1c\\xce\\xa1\\xbaj\\x9a\\x99l(\\x96k\\xec&"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xf8\\xb6\\xa1\\xe5\\xa47m\\xb7s\\x91\\xd5\\xab+s\\xe9\\xb6f\\x02dw\\xb1\\x90\\x8a\\x1f\\x90:\\x01\\xa2\\xe1/\\xe8+\\x19\\xa8\\x11=\\x07\\xe6\\x1c\\x96p\\x19yy\\xc1wt\\x96\\xf5-jzo\\xea+\\xdc\\x04\\xb3)@g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x94\\x91\nw\\xeab\\x05\\x05\\xc3\\xca\\x80\\xfd\\xbe\\x16\\xdf\\xcd\\xcd\\xde@5\\x0f^\"\\x9ca\"\\xc2\\xachmk\\xfe\\x84\\xd0\\xc1\\x16k\\x15bq\\x82ie\\xe4\\x9e\\xc4\\xe0j"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xb2\\x84\\xd63)\\x0e\\x0fe\t\\xdd\\xb1\n\\xd0;\\xfe\\xbf\\x88\\x86\\xf3#\\xcf\\x8a\\xfd\\xa2u\\x08h\\xba\\xe4\\xf4\\x9a9\\xbc\\xffnb\\xa3f?\\xdad_(.p\\xfd\\xa8x7\\x90e\\xdc\\x8aen\\xdf\\xe68\\xf2\\x99\\x9eud\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xfc\\x97\\x9b(\\x99-\\xc7\\xc9\\x8b\\xbbr $+\\x15?\\xe3o\\x0fx\\xa0>g\\xc8l\\xb4\\x97\\x10\\xcej\\xce\\xcc\\x01\\xef8\\x93\\xdc\\x06\\xa4\\xdd?2i\\xa4\\x12\\xaa"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\"$%,\\xc01\\xf4_\\xcd\\xc1\\x0e\\xb1\\x05\\x17qv^^\\xab\\x99m\\xa5m\\xb1\\x03'm\\\\xc3\\xde\\xbeb\\xe4s\\x06\\xa0_\\x1c\\x89\\x11\\xf9\\x9d\\x83\\x05\\xd3xe\\xa2c\\x86\\xbe\\xe7(c)~\\xcf%\\xb70\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000po\\x86\\xc6w4\\xf0\\x84\\xa8$\\xef3\\x94o\\xe1ii\\xd7b\\x1ad\\xe6^\\xb6hd\\xb4kz\\xab\\x999!\\x00o\\xfa\\x1fy\\xeb\\xf5\\xb2\\xbc\\xb1\\x06\\xd2w\\x08"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xd6\\x81\\xfe\\xed!<r\\x13\\xff\\x0b\\xefa\\xcf\\xb3\\xa1\\x912\\xf2\\x82\\xe7\\xc2c\\x93\\xd6/\\xcd\\x1a\\xad@\\x13$\\xed%$\\x8e\\x16\\x95\\xdc\\x85\\x9e\\x1b\\xac59\\x8f\\xfdb\\xdc\\xcb\\xd7\\xb3\\x15\\x8f\\xf8\\xdf?<g\\x1e\\x8f\\xa0^a\\x0e#\\xc5\\x88\\x88q\\xfb\\xbf$\\xa7% 3\\x0e\\x0c\\x18u\\x1b\\xfb\\xf5e\\x01na\\x94\\xfcoe`\\xe0\\xd4eg\\x10a\\x18\\xe3\\xcc\\x9e\\xcc6\\xc8\\x8a-\\xf8mfu\\xfb\\x91\\x93_\\xaf\\x97i!\\xba\\x0c\\x98\\%\\x0bj\\xec\\x9c`\\x80g.\\xc3\\x99\\xd1\\x91\\xca\\xfeuz# <f\\xb1\\xf5\\x8c\\xf8va*\\xab\\xa1\\xaa\\xea\\xfa\\xba\\xa5\\xca\\xb1\rs\\xb63\\xae\\xe4\\xea\r.i4p\\xc9\\x19d\\xfes\\xda=\\xc5\\xe5p<\\xa0\\xacm\\xf1\\xae\\xf1\\xe0x\\xf4\\x9b,\\xe4\\x9c$\\xe0wq\\xf9\\xfb\\x10\\xeahw\\\\xb4a\\x91\\xb7j)\\x03\\xed=%!\\xc6po\\x93\n\\xd6\\xfc\\x91j\\xe7\\x03h=\\x9e8\\xbf#\\xf6\\xb0\\xce\\xff\\xcd&\\x0eh\\xe7\\xa3\\xb4\\x0e\\xcb"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf6\\xec\\xf0\\xb1\\xa8ni?w\\xadb\\xd5y\\xff'\\x14b\\xe4\\xbf\\xba\\xe4\\x921q\\x08\\x02\\x88\\x13\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf60\\xcd\\x15\\xf3\\xbf\\xd2w\\xb4\"\rt\\xf1\\x85\\x11a\\x02f\\xd4c\\xf4\\xdc\\xcd\\xa5\\xd3\\x80\\x7fq\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf6\\x96\\x93\"\\xfe>u\\x85\\xf4j\\xcc\\x0b\\xaa6\\xb91w\\x92\\xb0u\\xed\\x878\\xc6\\xb3\\xd3\\xabn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xbc4u\\xa0&*\\\\xc9\\x84\\xd2,\\xbe\\xc2\\xf7\\xc5k\\xac\\x8egl\\x99\\x02\\xd2\\xd98\\x91\\x90\\xd0\\xf2g\\xad#\\x1bdo6\\xe6\\xfba\\xaee\\xf8v\\xe9&~\\x97\\x15\\xfd\\x11<gblu\\xd1\\x98&\\xa7\\xbf\\xa02ay\\xbe\\x06*\\x08\\xa1\\xfbd\\xe0(z\\xd1\\xc6\\xb3\\xeart)\\x06i/y9\\x8b9\\xe9q\\x0e\\xaf&\\x15j\\xf4\\xfa\\x7f!g\\xbf\\xcd\\xbf9n\\xca\\xbd\\xb0\\xa1\\xfd\\x8d\\xd7*<\\xdb\\x0fi\\xc8\\xfc\\xa8\\x1a\\xb4\\x8f\\x0e\\xb6o\\x81yd\\x02\\x16\\x95tn\\x0c\\x9a\\xd9\\xc5\\xbfq\\xae\\xe8\\xabi\\xd1ug\\x88r\\xe69s~\\x07\\xb0<2 \\x95\\xa8\\xb4\\xae%\\xc5,\\x1e(;\r\\xbb\\\r\\xae\\x0e\\xe2\\xca\\xd7y\\xb7\\xba\\xf8$7\\xca\\xec\\x9d\\xed)\\xaa\\x9e\\xc6@\\xa3(\\xaa\\xf9\\x97\\x90wf*\\x98\\xd0\\x8cx\\xa32w\"\\x1e\\x8d\\x1c35)\\xe2\\xb5y\\xdc\\xc0\\xd1\\x81\\x7f\\x05y+\\xfca\\xc9\\xfa-s\r\\xcc\\x9cu\\xdb\\xc1\\x9d\\xa2\\x96\\xd1\\x92/\n"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xa7/i\\x94p-\\xd0\\xcay-\\x96-\\xf18\\x1eq\\xd9\\xc4?p\\xe06\\x89\\x9d\\xfb\r\\xe6v\\xc9dn*z\\xaf\\x91d\\xe0p\\xd5k\\xc8\\xdd\\xe5\\xfe\\x94d1rlq\\x1fscu\\xd2y\\xa3\\x87\\x12\\xc2\\xc0\\xef\\xadg\\xbaz\\x84\\xa1\\xc7q\\xccrf*\\x06f\\x95\\xe7\\xf5\\xc1pn\\xaf\\xd2\\x02\\xaf)cs\\xa4\\xe2\\xc2$\\xa7\\xe59\\xdee%v\\x00\\xf0 \\xb1\\x94\\xa9w/\\x97q>r?n\\xa9\\xea\\xb8\\xd1f\\x0c\\xac\\x91\\x8csp\\xe3z\\xa6c\\xc5ik\\x11|\\xee\\xcb\\xf9`\\xa4m\\x10\\xed|\\xa4\\x14y6cd\\xf0h\\x19r\\xa5\\x02`\\xaa\\xb5\\x7f\\x03\\xb9\\xa6e\\x03\\x81%\\x8e/h\\x18\\xfcr\\x95q\\xa7m5\\x7f\\xb6\\xfb\\xa5\\xd9\"\\xc3\\xeey\\x82\\xd0r\\x94\\xfd\\xfc\\xbep\\x98#\\x84v\\x13\\xf4\\x81\\x00\\xa1\\x80\\xbd\\xd1\\xda\\x8f\\xf0\\xc1\\xcc\\xcbr'\\xba*\\xb1\\x12\\xe5a\\x01\\x90\\x9d\\xd4\\xde\\x8b\\x12\\xc0\\xfb\\xc5\\x1b\\xce\\xdaal\\x93f\\xec\\xee\\x87\\xcb\\x11\\xf9\\xa2/(\\x00"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc2\\xa9:\\x8b\\xb3\\x0be\\xd8(\\x8b\\xef\\xcb\\x91b@c\\x00\\xc3*\"5\\xf3\\xa4\\xafk\\x89p\\x05n\\xab\\x1ep\\xc9tbb1\\xc8\\xb1\n\\xd7\\xf5j\\xa35\\xbb\\xe9\\xad\\xb9'\tc\\x8c\\x84\\xa9\\xbaz\\xef\\xa2\\x83\\xb0^\\xd4\\xc5%\\x95u\\x9e6\\x9cw&>\\xc8nm\\x82d\\xf5\\xaf\t)\\xbb\\xa6\\x89r\\xc1t\\x8c\\x00\\xa5\\x13v\r\\xd7\\x85\\xa9\\xf0\\xcax\\x05\\xc5\\xd1o\\xcfr\\xaa\\x82\\x9e\\xd98?\\xb8\\x1fyy\\xf0\\xdd\\xbf\\xa7\\xf8\\x8e%wat\\xb0\\xfap\\x1a\\xe5c\n\\xc5\\xc9\\xc3\\xd2;\\xc6\\xc4\\xd3\\xf5o1\\x01\\xd4u\\xc7\\xbfag#&\\x86c\\xe8<\\x888\\xd9\\x92\\xed'\\x88:\\x98pc\\x96\\x16\\x13c\\xf7a\\x8c\\x8d\\xaek++\\xd2u>c\\xfc\\xe6\\x02\\xff\\xfd$\\xde|\\x19g\\x19\\x0fs\\x14\\x8e(?\\xf8a1ij0@?\\xca\\x9f\\xb6\\x03\ts\\xe3\\xd9\\xee\\xd4h\\x92\\xfc~\\x97\\xe8\\xc9y\\x07\\x02\\xb7\\xca(\\xe8(\\xb18\\x927\\x8c\\x03\\xfc!\\x0e\\xb6\\xee\\xbd9m\\x0b"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\x0fox\\xd2\\xackc\\xe6\\xd2\\x1a\\x16\\x1c\\x17 \\x8f\\xe6\"\\xc3k_\\xe7\\xcc\\x9a\\xd6j\\x93\\x90u,\\xd3dfq7f\\x94\\xbe\\x0c?\\x11\"\\xb0\\xf7\\xba\\xb9t^\\xf1\\x95-x\\x1c\\x8eo\\x11d\\xc3jc\\xba\\xa8#\\xb4\\xd5\\x94\\xec\\xb8\\xe1\\xbe\\xb3b\\xb8q\\xe2b\\xe2\\xbb\\xce\\xb5\\xb7\\xa5\\xf9jm\\x03\\x86\\xffi\\x83\\x89\\xf9w\\x05\\xf8\\x91\\x1bb\\xa9\\xd7\\xc2d\\xba\\x0e\\xa9wg\\xcac\\xf2\\x10\\xc9\\x1ca<\\xfe=\\xa0e\\x0f-a\\xee\\xa6\\x04p>\\x03\\xee\\xbe\\xb5+\\xcf\\xfe\\xa6\\x1ai9g\\xa1\\x18\\x1f\\xf6,\\xb8\\xb2l>g\\x15\\xa9jb\\x0b\\xce^`ck\\x86e\\x94\\xbdl\\x8e\\xd4\\xe8\\x16*$\\xb7$\\xff;\\xea\\xa3\\xdc\\x1da\")n'\\xa4\\xe2\\x13\\x07m\\xa3's\\x97\\xd1\\x94g\t\\xe5s\\x9f\\x18\\xfdn~e\\x11\\x83\\x0c\\x97<\\x8e\\x9f\\xba\\x08\\x08g~c9%\\xcd!plu\\xc4ul(\\xca\\x0e\\x92\\xe4\\xb3\\xfcoc\\xc0\\x82\\x8c8\\xb8&g0\\xedi?"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb0\\xe24\\xa4\\x11\\x9d\\x89\\xd9\\xb2\\x89x\\x06\\x84k**\\x7f\\xe3\\xf8\\xde\\xf4\\x16\\xc9\\xb9a\\x81g\\x15\\xf7\\x1f@\\x80\\xd2fe\\x1f\\xaf\\x11\\x16\\x167i\\xd3\\xbf\\x83\\x95\\x0fck\n\\xe5\\xb0\\x06#z\\xf4p\\x07\\xcce4\\x84\\xef\\xff\\x7f\\x1d\\xe0o)\\xa9zv\\x1f\\xd0\\xb3\\x03\\x83i&\\x12\\xf6\\xd5\\xbd7\\xb9k\\x13y\\xeb\\xfd\\x13<\\x1b\\x91\\x85\\xb0;\\xb2<\r'3\\xe2\\xb9\\x08\\xbc\\x80\\xefi&\\xa7$\\xdc\\xb9l\\xc9\\xc9\\x91\\xc1\\x80%\\xe4rp@y\\x0e\\xabz\\xa3r>\\x8c\\xda\r\\xf2f\\x9d\\x80\\x16vy?8\\x12xk\\xc9h\\xf6\\x82\\xd6p7-\\xba\\x0fqc6\\xac)\tt\\xee\\xe8\\x18\\x1avc\\xa9\\x9b.\\x93\\xca\\x1f\\xf1\\x8b\\xe28\\x9b~\\xa4\\x08\\xff\\x0c\\xaav\\x97.z*n\\xcc3\\xf1\\x94\\xa6\\x8c\\x80dy\\xbch\\xc0s-a?\\x137w\\x94\\xeci\\xd3\\x0b\\xdfhy\\x94\\xd2\\xb2\\x94\\xb4%id\\x8ea\\xe2\\xbe\\x127\\x87l\\xd7\\xe4\\x8e\\x89\\x10m;\\xee\\x0b\\x87\\xa3\\xbf"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x11\\x8av\\xc1\\xa86\\xefm\n\\x96\\xe4|\\xc4\\xb6\\xb5\\xac\\xcf\\xe7\"\\x94)\\xeb\\x1e\\xd2m\\xecu\\xc9\t\\xd6\\xff\\xfb\\x89k4x\\xaf\\xd4\\xc9\\x08m\\x80\\xac\\x95\\xe4\\xe7\\x07\\x89\\xfb\\x13\\x83<;m\\xe7\\xb2\\x02\\xcf4x\\xa5\\x8e\\xac0\\xc1\\xe9\\x12\\x18\\x14\\x1a1\\x0f%<\\xf2\\xde\\xe7\\xa3wgp\\x07v\\\\xbb\\x81\\xc7\\xf2g\\xc9yv\\xec\\xf6vyy\\xce\\x9c\\x07&&\\xd6$\\xe0y\\x83\\xfd\\xb62\\xf2\\xe4\\xe4\\xbe\\xe1\\x13\\xdd\\xe6d\\xae\\x08\\xd9\\xd1\\xf1\\xadf\\x1c\\xfd\\xee\\x13\\xc1\t\\xf2\\xa7\\xef\\xa1\\x9a\\xf2e\\xe5\\x81d\\xe3\\xb5/\\xec5\\x0e*tr\\xd6\\xcb\\xfdv1\\x16\\xac\\x93\n\\x88+\\xc2\\x92\\xd4\\x06_\\xac\\xb9\\xca\\xf7\\xb6\\xad\\x1d\\xee \\xac\\xb6\\x0c\t\\x94\\xca\\xa2\\xa9*\\xaa/gz-*\\xe8\\x84\\xaa\\x12k\\xf2ujo\\x16\\xde\\x94\\x1e\\xeb\\xbc\\x1f\\x89\\xf7\\xa5z\\x86\\x82\\x14\\xe0\\xd5\\x94\\x14\\xf5\\xf2h\\x8a/\\xe8\\x8c\\xc0\\xcbt\\x93s\\xa7\\xcb\\x8fh=\\xbb\\xc1\t78vi\\x19\\xcd"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7\\x15\\xfe\\x8al$\\x82|\\x19\\x9d\\x97\\xf5\\x86\\xdb\\xca\\xb69\\xb3\\xfa%\\x14\\xf9\\x94d=\\xbf\\x91c\\x94$7;\\x86g\\xbbq\\xbe~\\x9f\\x96\\xe8\\xca\\xb6\\x9c\\xed\\xa0j\\xfd\ng\\x8d\\xa1\\x9a1\\xaa\\xef\rp\\x10\\x04\\xba\\xb2\\xb5\\xa2c\\xdf\\xd9\tx5u\\xc3\\xd2\\xf0\\xc9x\\xa5)\\x13\\xed\\xea\\x023\\x1dg\\x88\\x81c\\x98\\xac\\xa0/w7@\\xd0<\\xd6\\xdel@\\xa1lmd\\xb0i\\x7fjx\\xb3\\xd9i\\x07\\xfcq\\x0f\\x06\\xe4\\xe0\\x00z<\\xbcv?dc\\x9a\\xd5\\x96\\xdd\\xd0\\xf9ay\\xc2u\\x19'-\\xaa\\xbb\\xb8\\x1f\\x19\\xef\\xbb\\xb5\\xfd\\xcf\\xb8y\\xd1\\xda7\\xe2\\xbc\\xb9\\x80z\\xf4\\x17/\\x94\\xc0\\xe5n\\x10 \\xc7=`\\x9dr\\xa9c0\\xe1du?y\\xea\\xfe\\xbe\\xdeip\\xaf\\xebw\\xce.+'\\x08\\xed\\x1c3\\xe5x\\x84\\xfd?\\xe9\\xe6$\\xba\\xb6f\\xcbh\\x89\\xe2e\\xa0b\\x96\\x0f\\xd3\\x9b\\x16r\\x03k\\xb9\\x01\\x8d\\x87\\xfb\\x08k\\x0c\\xbej\\xe7\\x93p\\xc9k2n?"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4\\x9d\\xbbz\\xe0w\\xf2k\\x83>l\\xfexn\\xfea\\x12\\xb85\\xdb\\x99\\x9e\\x8a \\xc9\\x1f\\xd0\\x19b\\xcc\\x8dr\\xe3\\x97r\\xa1:\\x98\\x7f\\xce\\x86\\xa4\\x08c\\xde\\xd3\\xf3`z\\xde\\x89\\x1f\\x8c\\xb02\\x86\\x18\\xf9\\xf5b\\x9d\\xdae\\x9c\\x04k\\xb6\\xe7\\xd0\\xe9\\x91\\xd7nig\\x1b\\xe8\\xaa\\xc5\\xb4\\xbfue\\x07\\x03\\x8e7\\x0f\\xfbn\\xf2)\\xd8g\\xbe:\\xac\\x173(c\\x86\\x0f\\x98\\xba\ng\\xb0j1e\\x87v\\xf2\\x90e\\x8c\\x0f\\xa0\\x92>s$\\x03\\xbe\\xbfs\\x87\\xf44\\xc9\\xb4\\x91o\\x95\\x825;\\xcfp<\\x94p\\x03\\x8f#\\xebsm\\xb1\\xb0g\\x1ba\\x11e\\x13!\\xda\\xc6\\xfc\\xca\t\\x95\\xff\\xbbr\\xa6;\\x16\\xd4\\xe5\\xe3\\x08:\\xe7*\\xfavt\\xb60\\x94\\xcb\\x92c\\x12s\\xb6s:\\xcf~y\\xf7\\xdes\\xd05\\xc1\\xc1\\x17)\\x1ch*z\\x83\\x062=\\x00:\\x91p\\xb6b\\xcb\\x92\\x81\\xbe\\xf6\\xb0)\\x16o1\\xd9)\\xd4\\x1a\\x05\\x8e\\xc8\\x864\\xc8\\xc5\\x81%\\x86\\xe0\\xac\\x8al"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\xf4\\xe8\\x02h\\x7fo\\xbe\\x80\\xec\\x8f\\xff\\xfc\\xeeh\\x01\\x0b\\x14\\xff<a\\xb9\\x91\\x00\\xa5\\x96>\\xd0\\x80\\x06\\xe6\\xc6\\xf8\\x0f)\\xdb\\xf4\\x89\\x92q\\xd1\\xf3\\xc9\\xbbzwxl\\xfe\\xd7\\xa3\"r\\xab\\xa8\\xde\\x0e\\x93\\x0f-ky\\xfbh\\xed\\x9e\t&:l|5\\xcd\\x7f\\xa2\\xfa\\x99iss0\\x08\tf\\x85f\\xdcm\\xdf\\xa1\\xd4\\x8b\\x1ag\\x86>.\\xe58\\x92/\\xb7\\xb2\\xee\\xcev\\x839\\xc2ya_\\xe2ff\\x01\\x14\\x1b\\x1d\\x0eq\\x84\\xa7\\xc00\\xcf\\x18=\\xf8\\xe2\\xfd\\x97j\\xb3\\x96\\x11o\\xf7i:\\x80^\t\\xbe\\xe2l\\xf5\\x1c\\x8f\\x03\\x9e\\x80i\\x89^gy\\xd7(\\x92\\x0c,z\\xfd\\x95\\x92\\xde|i\\x96\\xc8\\x1di\\x81\\xce\\x84\\xfa\\xc8\\xf1\\x8b'.*\\xa8p\"\\xc9h\\x8a\\x81\\xc1\\xc8\\xa1\\x8aj\\xf7\\x8c.s\\x92\\xd3\\xb3\\xd2tt\\x07\\xc5i\ri\\xab\\xb2\\x8b:\\x9b\\x8b\\x8a\\x93 \\xd6\\xe8uz\\x7f\\xc0~d\\xfev\\xafu\\xae\\x1d\\xe7\\xd7\\x89\\xf9\\xb2\\xf0\\xdb\\xa8af\\x8d\\x9f\\xa4e\\xf3\\xbf"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xf7b?\\x1c\\xd5\\xa1\\xc7\\xa0\\x83d\\xb9\\xa3\\x8c\\xfa\\x14 \\xac'\\xeb\\xaf$\\xa9 cr\\x89\\x0f\\xc2\\xea\\xd0\\xad/\\xeaw\\xb9\\xd0\\xbb\\x05\\xec\\xfe\\x8a\\xe1\\xcbz_\\x14\\xf9\\xff\\xde\\xb9\\x1e\\xe3ow\\xff\\xdc\\xaa\n%\\x87\\xbcj\\x18\\x956\\x89\\xa9!l\\xc7\\xa9d\\x0f\\xb4\\x9bs\\xa1\\xc0\\xf4\\x85\\x19i-\t\\xa1v,!r\\xb9\\xa8x\\xad\\x1c\\x90a\\xe8#\\xbfp\\xaew\\x98\\x0b\\x88\\xe0\\xc7\\xe3`\\xd7\\x13.\\xf8\\x94\\xf4\\x93b8\\x9d\\x05\\x80\\xe0\\x86z\\xa3\\x8e\\xbe\\x1a\\x84\\xfd4\\xd8\\x14^;\\xd4\\x10\\x0e\\xc1\\xb3n\\x95\\xa4\\xf5\n\\x1d\\xf3\\x87\t!#\\xdf1&z\\xa9\\xc5\\xcf\\x9c\t\\xe0z\\x87\\xff\\xf1\\\\xc6\\x0cu\\xa03wj\\xb3/\\x8b\\xb1\\xc3\\xceo\\x8c\\xd7\\xfa\\xbe\\xf5\\xf5l;9*nw\\xa1\\x96d\\xf0c\\xd9ey\\xd8g\\x9b\\xe2\\xfd\\xffd\\xb3i\\xc3y\\xafj\\xe66em\\x8ao\\x87\\xc6\\x86p5\\x95\\x7f\\xff\\xb0\\x0c>im\\x95\\x0e\\x13+\\xed\\xe7p*-\\xa8\\x9b\\x0cz\\x0c"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00.\\xec.\\xc3\\x99!\\xc1*h\\x8a\\x86\\xf20\n\\x89\\xf9;\\xc1\\xd4_\\xafn\\xd6&\\x1c\\x0ebw\\xb0w\\x18\\xa7\\xec\\x88o@yq$c\\x9e /\\xba-\\xa2h\\xe7#w\\xd6\\xab\\xf2\\x8cz)\\xafh\\x00f\\x1cy\\x00\\x9d\\xe4\\x94\\x82\\xb3\\xea\\xaf\\xc8+\\x02s\\xfe\\xb9\r\\xdf2\\xae\\%\\xa6.\\xb89\\x85\\xc7\\x1dn\\xd0\\x89in\\xecg?\\x13\\xfa\\x04\\x83\\xa2`\\xf8wg,\\x07\\xa6s\\xea\\xc0\\xf3c\\x0b_t\\x9eba=\\xff\\xe33.-\\x99ls\\xaa\\x07\\xbb\\x98#\\x86>\\xaa\\x95\\xeb\\xe6\\x8a,\\x1da\\xa7;mv\\x9d\\xbft\\x8e\\xf4i`\\xa8\\xb9\\xf0\\x86~\\r\\xfe\\xdf\\x85ve\\x93\\xa3\\xd5q9\\xdfd59\\x80lp\\x98\\xae\\xd2=\\xe0|\\xeas\\x17j\\xd4\\x96\\xadp\\xa2:\"\\x1b\\x1a\\xdf\\xf5!\\xb98\\xf7l\"\\xd0\\xb9zm\\xdby\\xdfn$\\x92+\\xb8\\x11azg\\xe2\\xa6\\x86\\x9ey\\xc9^\\x84\\xb2\\xa2\\x82\\x1dm\\xc8\\x8ae\\xfes -;j"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\xa9\\xc6ziy\\x88\\x84s$\\x9f\\xc3\\x89\\x08\\x88\"\\xb1\\xa7ipl\\x8ey\\xe7\\xdacb\\xc9g\\x1d\\xd0\\x01\\xe4d,\\xfb3\\xa0\\x99\\x9cr\\xf8\\xf7\\xc6\\x8e@/;\\xd1g\\xd1\\xbb\\xe6w\\x17&\\xf2\\x15\\xc2)\\x1av\\x0c&s/\\xf3\\x9b%j\\xfa\\xa6h\\xfa\\xd9\"\\x97\\x12\\xffs\\x9b\t\\xad\\xfe+.\\xc5\\xa0\\x1e\\xe5c\\xcbk\\x91\\x1f\\xa8\\xf0.3\\xdf\\xc6\\xf3\\xc7\\xbd\\xa6\\x9as\\xf1\\xecf\\x14(t\\x14,\\xb8\\x1a\\x895\n\\xe0^\\x99f\\x8d9\\xd6&\\x9f\\xeed\\xdc\\xca\\xc3\\xf1\\xd6\\x87\\xda\\x9d\\xe4\\x0e\\xb7\\xfd\\x7f\\xd4\\xc0\\xae/\\x97\\x1d\\xe6\\x8e\\xc1i\\x16q?\\xddrg\\xd3~\tqq;\\xb0\\x81\\xcb-\\xf2\\xc8m)s\\xb7\\xc4\\x1a\\x90\\xbb2\\x01\\xf2\\xb4\\x12\\x8a\\x1a\\x16\\xedg\\xe4\\xff\\xac\\xb1j\\x9f\\xba\\xe2\\xe4pa=\\xfb\\x00\\x06n\\xb6\\x8e\\xda\\x08\\xf06i\\x82!\\xc1\\x00l\\x80\r\\x91\\xd5go(\\x14m\\xd2\\x038\\xd8\\xa5d\\x17\\x8c\\xd5ry\\xdb~\\xd0ap\\xffkm"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\xbc\\xdd\\xed\\xdbxu\\x01\\x0e\\xb3q\\x00\\x0b+\\x1b(\\x9e\\xe1\\xdchcmk\\x17dr\\x0ec\\xa2\\x16\\xa2d@\\xb3\\xe4r\\xc7k:z\\x85\\xcf\\xd8,\\xa7\\xe8\\xb4x\\xf2\\x9ejq\\x8eb\\x1f&\\x17\\xc7j\\x05)\\xe5w\\x9a\\xe5't\\xe5\\xb8\\xf4z\\xc1\\x8ac:\\x8ca\\xaa\td@\\xbf\\xbd\\xa1y\\xe9g\\x8e\\xef\\xa2)j\\xc9\\xb7\\x97\\xb4gk>6y\\xfap\\x19\\xdci\\x8d\\xc8u:\\x8b*\\xe3q\\xf5*pz'\\xd3q<\\xc6a\\x94n\\x05\\x97\\x11\\xc7\\x95\\xf4yq\\xef\\x84\\xea\\xc0z3\\x1b\\xaf\\xf46m\\xed\\xc7\\x896x\"\\xbe\\x06f\\xe9/\\xc4\\x99&f\\x0b\\xc2,\\x0e\\x92s\\xe7\\xe8\\xbc\\x9b\\x03\\x9f\\xfc\\xa6\\xce\\x95\\xf0\\xae<\\xae\\xcf\\x91\\x92>\\xea\\xd4\\xb9\\x85\\x9a\\x08\\x1fl\\x8b\\x83\\xe0*\\xde\\x08\\xd5ws!\\xcb\\xd7\\x159\\x1d6\\xbcq\\xb2\\x01\\xaf\\xadgm\\x00\\xf3\\xd8\\x03\\xad\tcj\\x15\\x12,7\\xe47\\xc0\\xed\\xdb\\xfc+\\xd3d\\xe9e\\x8f\r\\xccu\\x1d\\x06=\\xbc\\x8e\\w"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xfa\\x02=\\xb6i\\xd8l)\\x0c\\xa3\\xc0\\x1b\\xb5\nm\\xe3t\\xa3\\xc0\\xf4'\\x15\\xd8\\xfc\\xbb\\xca\\xe1\\x18\\x9d\\xee\\xa2\\xa0j\\x12b\\x17v\\x8f\\xd3\\x97\\xd3\\xba\\xd88\\xf9e\\xd0gj\"u\\xe7\\xf9\\xfa`\\x87d\\xeav\t\\xa8\\xef\\xf3i<\\xf4(\\xea\\x9a\\xfd\\xfb\\x18e\\xb5`\\xbe\\xe9\\xb7\\xa3\\xfbe\\xa5\\xf9<\\x10\\xceu\\xa9rqg\\x03g\\xfe\\xc9\\xd6buy\\xf5\\xe3\\xecx\\x8a9cw\\x0c\\x01\\xf3\\xfc\\x1d\\xb3\\xe5\\x96\\x9fw\\x94\\x01\\xe5\\xa7f\\xa8\\x88\\xb5\\xd9\\xe7z\\x80\\x8f\\xa3\\xe0\\j\\x1c\\x9d>\\xfb\\x8f\\x0f\\xdc\\x83\\xf2\\x8e\\xbd\\x8b\\x18\\x90\\x12\\xe5\\xeda\\x84\\xb1&\\xce\\xd4|\\xb8<\\x12a\rv#.yml\\xfc\\xd58\\xf9z\\xdf\\xe2\\xf5\\xf0\\x95$w\\xf4\\xa2\\x14\\xa5\\xc1\\xe3,=k^$!\\xde\\xffb\\xc3\\xea\\x19&\\x00\\xb4\\x8a\\xcb\\xb3\\x13\\x19\\x19\\x89\\xe3\\xdc)\\x9bpy\\x9c\\x04ljs\\xfc\\x1f=\\xf9\\xe8\\xc92\\xef|\\xa4vy\\x97e\nz\\xe8bq\\x82\\xe9\\x83\\x14\\x95o\\x1b;m"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\x8c\\x08@t\\xd9+\\x0e:\\x05\\xb5|ond\\xba`\\x12\\xf4!e\\xc1\\x8c\\x14\\xb2\\xae\\x82c\\x85@\\x96\\xd3\\xb0\\xb3z\\x15\\xfe\\xfe)$\\x02\\xc1\"\\xe0\\xe3z\\x0b\\x81\\x99\\x8cvv\\x8c\\x18\\xbb\\xbcm\\xb3\\x97\"&\\xb1\\xadj<\\xdf.\\xd4\\x80\\xca\\x0b\\xf6\\x881vk\\xb2i\\xa9.\\xbc\\xeb1\\xa2\\xa5\\xfe\\xb0\\xd6\\x8b\\xb4j\\xa0\\xa4\\x9a%l\\xba\\x99oz\\x18\\xb3\\xc6\\xd0k\\xd1;,x\\x0fb\\x82\\xa0\\xbe>\\xe2\\xc7l\\xd8/\\x0c\\x16h\\xfa:_\\x1ftwo04ta\\xf2f\\x05\\xa0\\x10\\xedd\\x1c\\x84\\xe8u\\x9e\\xb9\\xe7\\xc4\\xf5j\\x84\\x10\\x85'\\xd0\\xc2\\xcd\\x01s\\xccy\\xb6\\x93\\x84\\xfe\\xf2\\xa0\\xb0&=\\x90\\xab\\xdb\\x18y\\x95k\\xb1\\xdfj\\xd0\\x9f\\x13\\xd4 \\xb9\\xdc\\x89-\\x1f$\\xb8\n\\xda\\xa3ai\\xf0\\xbdxm\\x94\\x9f8\\xce\\xdb\\x83&/0\\xa8\\x01\\xe3\\x15s\\x8c\\x96\\x10\\xa0\\xd5\\x14\\xe3\t=\\x02(\\xb0\\xac\\t`\\xeaq\\xf7|vu\\xa9\\x06\\\\x19\\x0b\\xad\\xe0t\\x9bw"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0d\\x91ti!\\x99k\\x07e\\xfat\\x13vy\\xado\\xa5\\x1dfk1\\xf4\\x9a\\x85=\\xbc\\x0c\\x9e\\x004\\xa2\\xc5\\x1a:n\\xa7\\x0e\\xc7\\xa6\\xa9c\\xd2|\\x80\\xa1<@\\xc4\\x10yk\\x0er)\\xef\\xac\\x03w\\xf2\\xb5\\x15\\xa9z\\x9c\\x0f;\\x11or\\x18\\x05\\x9albb.\\x90\\x82\\x0e\\x00f\\x17y\\xc2\\xd1\\x9a\\x92x\\xcev\\xe1\\xe2\\x18qi%46\\xbekjs\\xcfi\\xf6\\x94#n\\x03b\\xf8^\\x1e\\xc34y\\xabz\\x85b`y\\xff\\x08\\x93\\xc1\\xe1o\\xa9\\x14w\"\\x17\\xa7d58\\x96x:\\xd9\\xaf\\x9do\\xfc(\\xdd\\xa9\\xd4\\xe9\\xa2\\xe0\\xcdp\\x11\\x0c\\x90\\xe4\\x971\\xcb\\x9f\\xaa\\x94\\x92\\xa5g\\xe0*nj\\xd8`\\\\x16\\x82\"\\xf2\\x83z\\xe0=\\xc2\\x8e\tj\\xd4i1\\xf5l\\xcfz\\xc0\\x01\\xa2\\x07zk~3\\xf5\\xb5\\x83\\xe1\\xf9\\xf9\\xbf\\xeb\\x9a\\xb8\\x88n\\xda\\xf8\\xcb\\xd4\\xc8\\x1d\\x85\\xedc\\x0fd\\xfdj\\xa0\\x8e\"\\xc4n|\\xee$\\xadv\\x1f\\xd0.\\xf9\\x7fx\\xe1\\xf15"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\xd5\\x18`\\xdd\\x8e\\x06\\xe2\\x154\\x97\\xd2\\x072\\xe8s\\xf0t\\x83\\x9b\\\\x8b18\\xc7\\xeb\\xec\\x87\\x11\\xca\\x90o\\xbf\\xfe\\xda\\xb8_\\xe0 $\\xc9\\x84td\\xb5\\xd0\\xb3\\x83e\\xe11\\x0e\\xb9;\\\\xfd\\xb3*\\x8d\n\\xa9\\xd2(\\x03>|o\\xfd.\\x1d\\x8f\\x84h\\x88e.8\\xe9\\xc2>(\\xe5f\\xbd=t\\xef\\xf5o\\xa2\\xa6\\xfa\\x12\\x994\\x8exsq\\x85\\xa4\\xa4\\xfd\\xca\\xf4!-\\x0fe\\x87o \\xe1\\x0b\\xa0cpi\\x0b\\x82\\xfdi*\\xa5k\ra\\x13\\xf5\\xe1\\x87*\\x8a'\\x17\r'$d\\xf9k\\xa8\n\\x83\\x04-c%\\x8d\\x92\\xddd#\\xa3;\\x0b\\x90=\\xc5\\x1c\\x08nqqx\\xbf\\x7f\\xe1h\\xbe\\x00s>1&\\xf8\\xa1\\x99\\xb3\\xbe\\xfe&\\xbckm3\\x9c\\xf6al6z\\xb2l\\xd0\\x1es\\x82\\xbb\\x93\\xea<3\\xf4\\x19\\xdb\\xdb\\x85d\\xa1p4*d.\\x90\\xaf\n7\\xbe\\xac\\x1fk\\xe7\\xc4\\x8f\\xed\\x88\\xc2\\xfe&\tnsz\\x80;\\xad0\r\\xfb\t\\xc0\\xa79\\xc8\\x06`"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe\\xf8\\xd678\\xf9<\\x84u\\xe2\\xd1\\xa3\\xbe\\x86p\\x97q\\xca\\x0b\\xf9\\xd8d\\xfew\\xbbn\\x99\\x95\\xbb\\x98\\xcf\\xb6\\xbb\\xf8\\xf0\\xe5m\\xca\\xd6\\xd6\\xaa\\xc4^o-\\x0cp\\x9d\\xa1l\\x83\\xb5\\xf5nc\\xe0\\x89\\xfc\\xd4\\x9a\\x8f\\xbc5g1\\xea\\xe8/\\xa9\\xd1\\xa9\\xc7\\x18\\x9d\\xec\\xcbz\\xd6\\xda!\\x9bs\\x90\\x82\\xcd\\xb9t\\\\xff\\xcf\\x1el \\xbb\\xeap\\x16w\\xd3\\xf1\\x14\\x17\\x8cpe\\x94,\\xce\\xee\\x8d\\xa1\\x9a&\\x00\\xb8u\\xd1s\\xde\\xd2\\x9b\\x06\\x197g|k;\\xa3q\\xfc!\\xe3\\xab\\x94:rj\\xb6q\\xfd\\x19b\\xf8\\xa5\\xac@\\xf6\\xc2\\xd6x<<\\x87\\x84\\x1e\\xea\\xecq\\xf8\\xca\\xd7\\xd8o\\x0frz\\xd3\\xb8\\x98z\\x1a\\x1cw\\xc9\\xf4\\xc8\\xb19*\\x85\\xff\\xb4\\x8d\\xe0\\x87\\x89_\\x8e\\xb5\\x1d\\x83\\xcf\\xc3\\x05\\x9b\\xc03\\x9e\\x9f\\x8f\\x84\\x95f\\xa7\\xf4qz\\xd4\\xfbf\\x83\\xdbi\\x1c\\xb4\\xf6\\xf2\\x1f\\xa4d\\xf5\\xb5\\xfb\\x8c\\xe4\\xdd\\xf3\\x83\\xe1\\xfc\\xef\\x8ej\\x96fr\\xdd|?\\xa2\\xb4\\xe0\\xee/d\\xd2ke"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010sv\\x8f\\xd1\\xec \\xbai\\xd0\\x11\\xf44a/\\xf9\\x8d\\x13\\xee\\xd1\\xf9=\\xfe\\xf7\\xe9b`\\xc1\\x93\\xbd2s\\\\x1c=hi\\xc4\\x86\\xcb\\xf6\\xee\\xe7x\\x9c|\\x7fk\t\\x05 \\x96m\\xf2si\\x8b\\xa7\\x89\\xbb\\x87\\xaf\\x03\\xd2\\xa7\\x82\\x85-\\x19\\xd9'\\xcfa\\xe2\\x1bl\\xae\\xf0\\xa4b\\xc1w(\\x89\\x86hey2\\xda \\xa3c$\\xf2\\xa7(\\x8a\\xae)\\x0c'\\xcb\\x1f\\xd8;y\\x93\\xb5u\\xbe\\xd4t\\xe2\\x01k\\xcd/6\\x9d\\x83\\x92d#3\\xa5\\x1d>\\x9b\\xf6x\\x96\\xf7l\\x91'\\xafyk4\\xb6\\x92\\xd0\\x9c\\xd3\\xa5n\\xab\\xbc_*%p\\x8b\\x80\\xc9\\xbe@6\\x8f\\xec\\xcb\\xa8\\x92\\xb22\\x98\\x0e,\\x00l\\x1d\\xd4^\\xbfr\\xa2\\xac5\\xd5=\\x1c\\x034=\\x93.\\xf8\\xfb\\xfc\\x94\\x9a\\x98h\\x8e\\x19*\\x9d\\xaa\\xf3\\xc3%`\\x9e \\x0b\\xc3\\x12$x^\\x96\\x8a\\xd4\\xa6\\xbdt\\xe7ooh\\x80\\xb4\\xd8\\xfa@\t\\xd7\\x13\\xea\\x93o\r\\xbc\\x9f\\xf2\\xf2c\\xd9\\xc0\\xcc\\x0c?\\xaa;\\xe6*\\xeb\\xe5\\x06"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\x90\\x98\\xb3\\x81\\xd3\\x03cy,\\x1b\\x9a\\xdas\\xdd\\x190\\xc3\\xf2(\\xab\\xc8\\xc7\\xc1\\xc7\\x82\\x14\\xa2\\x1c\\x00\\xce\\xa7\\x89s\\x17\\xffv\n\\x82\\xb1\\x96\\x110\\xf1/\\xdc\\x84\\xd0\\xce\\xc2w\\xa1\\xa7\\x9ed9/!\\xe9,\\xee>\\xb6\\x18?\\x85\\x10,h\\x92\\xe7\\x9ffd\\x00y4!\\xa4\\xc8\\x02\\xff\\xd1\\xcd\\x9by\\xb4\\x05\\xb6\\x96m\\xb5\\x83#\\xcc;\\xe0m\\xba\\x1e\\x18\\xb7t\\x87\t\\x892\\x97\\xf0\\xe9q\\x90\\xb2e\\xad\\x11\\xad\\xd5\\x13\\xfen\\xfc#\\x81m\\xf9\\x8ar0\\xb5\\x8d!f\\xda\\xe1\\xbd\\x96c\\xba\"\\xf9\\x12\\43gtxn\\xed\\xfe\\xda\\x07\\xc0%0\\x08>\\xd6\\xc2\\xb5o\\x8fmd?\\xfet\\x86\\x13\\xa4\\xcc\\xd9\\x90\\xd5d\\xc90h\\x0fq\\xad\\xe3\\xa6\\x8fe\\xd9= %\\xf2b\\x88.j\\x1d\\xcd\\xfaso\\xe0\\x00p\\x05\\xa0s<\\x04\\x9a\\xcepr\\x86\\x11\\x89c\\x7ff\\x8ao\\x00\\x17\\xa8<\\x86\\xc5\\xc0\\xff\\xbb\\xb8\\xd0\\xb3\\xfa\\xcf\"\\x81\\x19\\x96j~\\x9c\\xbd\\x81\\xc3\\xff\\xeb\\xa1s"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\ty|\\x16@\\xd6\\x80\\xad~j\\x10\\xcc\\x8c\\x81\\x12\\xdf\\x93\\xf12\\xbe\\x01#>z\\xfd\\xc7f\\x80\\xf5z\\xde\\x9a\\xdd\\x02\\x81\\xbf\\xf3l\\x80g\"\\xc5\\x9e=c\\xdf\\xc5\\x10q\\xb2?t\\xd9.4\\x9as\\x83\\x824\\xc19cd\\xb2\\xfc!\\x8e\\x03\\xa9\\xcf\\xf1\\xf0\\x15\\x9f\\xb7\\xc4\\xf9\\x14\\xa0\\xbf\\xbf4\\x05+8\\x93\\x06\\xe9=+\\xae(9\\xc4\\x90z\\xecmm\\xc7\\x8f\\x93\\xcaa\\xf5\\xe3\\xacd3\\xcc2hb~\\x85\\x13\\x14\\xc1m94\\xdd\\x8a\"x\\x9c`\\xa1\\xb8u\\xd7\\xa8\\x12\\x9c\\x00j\\x7fpxh\\x806yw\\xd7iq\\xc1n+\\x9a\\x15)7:p\\xb2\\x81\\xe9\\x93<=\\x04\\xda\r\\xa9\\xe4\\xc3\\x1cb\\x14n\\x85?l\\xd7m\\x82\\x10\\x87\\xad\\xe8\\xa5^y\\xe1\\x13\\xb81\\xcf9\\x8dt\\x8f\r\\xdc\\x03\\x9a\\xd0/\r\\xa9\\xe9\\x0e\\xa9\\x10\\x0c\\x1au\\xd7<@l\\\\x9c\\x9f\\xb4an0\\x02a\\x90/j\\x11\\x0e\\x0f\\x95\\x8a\\xf6f\\xa6\\x90\\xbf\\xa9\\x95u\\xe5\\xecr\\xc8\\x13kbb"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\x96\\x86\n4\\x80\\x8b6\\xc8\\xf6g\\xe8\\xd67\\xb6\\xed\\xddjx|\\xd2\\xcb\\xecj\\xb3\\x8eb\\x8f\\xb1d\\xe9=\\xd9\\x98a\\x18\\x89\\xf4\\xfe\\xcd\\x7f\\x84\\xbb\\xba\\xc8l\\x1d\\xf0\\xc4\\xea\\xc5\\xc1\\xad\\xc37z\\xd4\\xbdg-\\xc5\\xec\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x99\\xe0y=k\\xddk\\xd4\\x9f\\xdc\\xbb\\xff?\\x16\\x9b\\x13\\x18\\x1c)\\xdf`\\xd4-\\xd5\\xfc,g\\xe2\\xc0\\x18\\x9d>m\\x07?\\x87\\xd2m\\\\xa7\\x97\\x9f\\xfa\\xb0\\xf4\\xc1\\xf0"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\x0f\\xeac\\x9d8\\xb8i\\xab\\x1b\\x84\\xc6\n\\xe1\\xa4\\x02\\x8a\\x0e\\xc6\\xbbplc\\xdd\\xbf\"\\xd4\\x80\\x0bv\\xf2\\x03\\x99\\x1f\\x18\\x0ejln\\x01&*\\xba\\xb822\\xd5\\xbc\\xe0\\x8f\\x1b\\xd6\\xaeoxg*\\xf4\\xdc\\xabsp\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xe4\\xc24\\x87e\\x1bp\\xa0i\\xcf s\\xdd\\x93\\x95\\x87\\xcdw\\xda\\x80\\xcem\\x16\\xd6t\\x86\\xca4\\xcf$\\x15\\x1d:w\\xe9\\xcf\\x84\\x19xlk=l\\x80n8\\xcf"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01'\\xbc\\xf6)\\xba@\\x92\\xc5l\\o\\xce\\xf2t\\xf9\\x81\\xe6\\x06\\xf5\\x8cn\n7\\x1e\\xb4c\\xaa\\x1e&\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01ruz0\\x19\\xaf\\xb4\\xbd\\xa9\\xf4\\x98\\x7fn;0\\xf6n\\xb6,\\xe6%\\xdb\\x8bv\\x8c2\\xf2\\xdf\\xf5\\x00j\\x85\\xbfgd\\xc2\\x08\\x08~\\xe3\\x81\\x907\\xd1`\\xaa\\x83\\xe3\\xbeh\\x14\\x9a\\xf5ve+\\x80\\x8f\\xda\\x86\\xd1i>\\x97\\xa6\\xa1\\xe0\\xf9&cbs\\xc9\\xf2x\\x18\\x81\\xaa\\xb1\\xa9\\xdd\nc\\xb8\\xbdp\\x92$\\xe8\\x90e\\x81\\x91~\\xc7\\xd4x\\xc8\\x11\\xd1\\xb9m\\xbe;~\\xf0\\x92\\xddyz\\x1dl\\xd8dbo\\xdfe\\xe6\\x1f?\\xe3\\xb8\\x87\\xb3\\x1d3\t\\x11r\\x8d\\xafw\\xd72y\\x1e/9\"\\xc4\\x84cdj\\xaa3\\x9e#o\\x93\\x066\\xeb\\x0e:\\x83\\x9b\\x1a\\xc8\\x02\\xb1\\x97\\x83j*\\xf3\\xea\\x90\\xf0\\xa9\\xbc\\xfb:\\xd6\\xd10\\x9c\\xee<?n8\\xdc\\xd2\\x9fv\\x8b\\x9b\\x91\\xe6o$\\xc1\\xccw\\xcem\\xab\\x07\\xc0\\xfei\\xa7\\xf4\\xf3\\x11\\xd7bq\\x14\\x93\\x94\\xdb\\xb7m\\xf1rxy\\x07\\xdb\\xe4\\xce\\xf6\\x86u\\xec\\xf3v<\\xdd\\xbc\\x08\\x97\\x14>\\xc8\\xbe\\x89\\xad\\xe0\\xa9\\x83\\xea91\\xb7"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85\\x05yvh\\xf8&d\\x97\\xd7\\xd8\\x12\\x00\\x8c\\xe6\\xd0-cj\\xe4\\x13\\xbf\\x84\\xe09ae\\xde\\xb3o\\xe0\\x9d\\xd8 \\x1f9\\x13kl\\x8b\\xf3/u\\xea\\xaew\\xdcl\\x99\\x8d\\xc9\\xbe\\xdb\\xb5?\\xdc\\x82*o\\x9b1y\\x0e\\xce\\xdf\\x8c\\xc9|\\xfaj-\\xbb-\\x9a\\xed-y\\xff\\xc2\\x8e\\x10\\xe5\\xa2\\xdbm4pl\\x92\\x8f\\xeb\\x1a\\xcc\\xdd9zyg\\x1bjkx\\xc1\\x86 \\xd9@aj\\x97a\\xd4q\\xf6\\x8e\\x92n\\xf3\\xf29/|i\\xc6\\xe7/t-\\x1d\\xccpx5\\x08\\x03\\xcdw<\\xed\\xaf\\xb8\\x8e\\x1fi\\x85a\\x94w.\\x93p!\\x93\\xed\\x12\\xe2\\xe3+\\xc6\\xa8\\x17c\\xef4\\xc8\\x96\\xbc\\x8f\\x0e.\\xfe1m1\n\\x00\\x918'\\xf31\\x9dd\\xf6yyx\\xf2\\xd2\\xa1/\\x87f\\x0blx\\xa8\\xa6y%\\xe5\t\\x81k\\xcc\\xca\\x94z\\x02\\x1f\\x95o\\xfc\\xdfv9/\\xcc\\xc5\\xe0w\\xb5\\x8a\\xea\\xc2\\xa5xq\\xf4 \\x85_\\xf70\\xa3\\x8a\\xa5\\x13\\xa0\\xd58ui\\xc5\\x0c\"c"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb08\\xcd\\xac\\xba\\x82=96\\xa0wq\n\\xe8\\x85x\\xf1$\\x9e\\x84n\\x80=\\xcf\\x12u\\xeawh\\xe094\\xd6f\\x97\\xdc\\xd7\\xe6\\x19\\xa3\\xaa\\x1ej\\xcf(\\x18)\\x96\\xeer\\x96!ft\\x8d\\xf3\\xb1\\xbb/\\xb2\\xfb\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\x8erg\\x8d\\xb0\\x0c`i\\xcb\\x87\\xe5n\\x03^\\xec\\xd3\\xc5i\\xd3\\xbfc'\\xa1\tx\\xccr\\xcf\\xe6ba\\x85+\\xca(;o\\xdbt\\xa1\\xcd\\xda_\\x9e\\xd7u"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18.\\x8a\\x9d\\xdda;+\\xc1\\x94\\x96 \\xdd\\xe2\\xcd*d\\xab8\\x87\\xa5\\xd6s\\x99\\xe7t\\xa0\\x08n\\~\\xeb\\x9e*d3\\x8f\\xca\\x83\\xf1\\xddz\\xf9\\xaeb\\x8d\\xfe\\xa9\\xc3\\xb2\\x1b\\xa5\\x13\\xe5)\\xa5\\x98bj\\xc3;%sw\\x7f\\xd3\\x95\\xfe*vm\\x18\\x16\\x83\\x08\\xa1\\xf4f \\x94\\x19\\xe0*\\xae\\xbf\\x18\\x17k\t\\x8a\\xb9\\x81\\xdf.?\\xd1\\x06\\xbffm\\xe5\\xae\\xac+\\x89\\xe3me\\xdel3v\\xd2\\xfd\\x01\\x077\\xd7\\x91\\xf6\\xd2m:\\xfa\\x05\\x8a.\\xb6\\xc1/\\xcc\\xe2\\xfc\\xe0\\x19\\x10\\xd3\\xeb\\xb8\\x94\\x082\\xdf\\xbb8\\x0c\\xbb2q\\xab\\xb1sd\\xce=~u\\xf0\\xa0\\xdds/\\xfau\\x93\\x92\\xc0\\xc27zp\\xd9j\t\\xa2p\\x9dup-\\xf4r(3\\xf3i\\x15x#\\x85%\\x9f\\xbd\\xe44\\x97o\\xce\\xbd\\xc0\\xdd\\xa2\\x00g\th\\xce\\xf0\\xe1\\x88:\\xafs^\\xf1u\\x19\\x99\\x9906\\x1f~\\x1b\\x07\r\\xb4\\xf22\\x94\\x18ag\\xef\\xed,i\\x10\\x02\\xc0\\xfe\\xa1d\\xca;"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\xf8;x\\xecq\\xc8w\\\\xbc\\x04\\x12n\\x85\\x1b\"f\\xf8\\xf9a\\xed\\xfb\\xc3%_h\\xfc\\xeec\\x88\\xf0?\\xbe\\xe2\\xf7\\x15\\xf9?& \\xe5\\xde\\xc4\\x87+\\xbfhj^r\\xa4qny\\xcf\\xe6\\xfc\\xc2yk\\xb1d\\x8c\\xd2f\\xf5\\x9f>\\xd9#\r\\x85\\x04\"j\\x1d\\xe9n\\x8b\\xc0\\xf6\\xaf\\xe8\\xc8f\\x979\\xb7\\x89\\xa5\\x90\\xbdv\\x14\\xd1\\xf7lx\\x02\\x1b\\x1a\\x93\\x07\\xfc\\xe7\\xe0,!0%\\xd5\\x07q\\xff\\xf8vkse\\x8d\\x8b\\xfd\\xda\\xc5\\xfc\\x04o\\xc7\\xd4\\xef\\xf9q\\xb6\\xc3\\xbbnz\\xd7\\xbf\\xb92\\x92g=\\xa5\\xb1f\\xcb\\xfb\\xd2\\xf6\\xba$h\\xeb\\xd3\\x9e\\xe1!p\\xf6\\xfa\\xd4\\x13\\x03\\xa4\\x9c\\x17\\x82\\x19\\xa7o\\x12\\x9f\\xc8\\x90\\x8f\\xdf\\xb3|\\xcc\\x83|_\\xca\\x9di@\\xfe\\xc5<\\x1d\\x13\\xac\\xce*\\x9f~t\\x04\\xf8\\xc66q\\x85\\xca\\xddp\\xa2\\xe4q\\xf1n\\xbf\\x932\\x06&\\x86\\x15d\\x88\\xb8\\xc1\\xbe\\xc2\\x8a\\xf7\"\\x90iqou\\xc7\\xca\\x9a\\xa9$\tg\\x1c\\xc5%\\x0b"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x13\\xb5\\xa2\\xef5v\\xc2y7\\x08\\xbd\\x8f\\x7f\\x8d0\\xdf\\xc7\\xab\\xe1'\"g\\xf9\\x0c&\\\\x91f\\\\xb7\\\\xd6\\xa3\\xf7\\xebq\\x01\\x87i\\x8c1\\xdd\\xe2\\xe3\\xe0\\xf3\\xb8\\xecbnr\\xfe~\\xc0\\x15\\x89=\\xa5q=\\x99\\xcdr\\x0c;\\xb4@\\x98d\\xaa\\x17\\xbf\\x0b\\x08<\ry\\x9b\\xea\\xa8\\x9e\\xcd\\x0c9\\x82\\x93r/\\x84\\x95\\xe6\\xf7\\xc8\\xde\"\\x95\\xe4n\\xb2$#\\x057at7\\x0b\\xe6\\xf7\\x10\\x8a\\xbb\\x9d\\xd1\\x0e\\xb7\\xb6\\x86d\\xea6\\x11&\\xb6\\x9e34\\x98\\xdc\\xee\\xd0<h\\x95\\x19\\x19\\x8e\\xb7z7\\x8b\\xd7i\\x14\\xc5?\\x86\\xba-\\x9f1\\xeb\\xef\\xe0\\xbc*\\x92\\x8ctu\\x8d\\x9c(\\xe5qi\\xfb\r?\\xa1\\xde\\xb7\\xb4\\xb5\\xe4\\xa8\\xad\\x97\\x00fz\\xaeiuvo\\xd8\\xe82\\xb7.\\xf6\\xd7\\xf0\\xf8\\xa3jf;\\x8anf\\\\x8f\\x01\\xac\\xe5\\xc3\\x8a7@0\\x87\\x10\\xb0d\\xa7q\\xe0\\xc5\\xf2\\x83\\xcf6\\x88\\x07\\xe3`\\x81\\xe7\\xd8!\\xe3\\x8b\\xae,\\xd1\\x97ff\\x1d!sr\\xb9\\xe4"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\xc4\\x00\\x92\\x00x\\x06$\\x0f0\\x89\\x18~\\x15!tc\\xdbl\\x8d\\x96\\xdat\\xfa-\\xec\\xe5\\xa0\\x1ce,\\xeb\\x9d\\xb6\\xfb\\xc1\\xf2>\\xf5\\xba\\xd1\\xd3\\x92\\xe0\\xf3\\xeb\\x8f\r\\xe2b\\x8a\\xbd\\x83e\\x06\\xd9 \\xe7dv\\x14\\xca\\xf1\\x00em\\xd3b>\\x1ea%v\\xbb\\xd1l?u\\xaav\\x8d;\\xb1p\\xd1\\x03b\\xacu\\xdbm\\xc2k\\xad\\x92\\xe5\\x88l3\\xb6x\\xef+d`\\x1e\\xf1q\\xab\\x01\\xd1\\xc06t\\xb58\\xf4\\x9d6\\x08\\xbaz\\xb5\\x82\\x94\\x07\\xc3\\xab\\x17\\xa2b\\xe5\\xce\\x87\\xaaj\\xeb\\xd3\\xa9\\x942f=\\xcf\\xe8\\xdf\\xd8\\xb5\\xf6\\xa7\\x19b\\xa6\\x12\\xeb\\xd0\\xa0\\x8e\\x8c^xe\\xb8\\x0c\\xd3f\\x07/w\\xe2\\x8bgy^_p\\xff\\xdbl\\xf8b\\x13/\\x99n0\\x8a\\xe6\\x84\\x14\\xe4\\x91u\\x9d9\\x19\\xacu\\x80\\xca\\x84\\xfe\\x85e\\xd6\\xe9\\xff\\x05\\xc6\\x91.;i\\x9c\\x8a\\xfd\\xfb\\xa3\\x90\\xf1\\xf1j\\xa1\\xb9\\x83w\\x11<l\\xab\\xa3m^\\xf2\\xf3\\x18\\x8a\\xca7'\\xda\\xf4\\xd6uf\\xc7\\xf7\\xa8\\xb8y "
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcaf\\xc7\\xf6`\\xdec\\xe9\\xcd\\x81\\xd47\\xd1\\xe4\\xaf+h\\xcas\\xd6, \\x90q\t'c\\x81dmck%\\xe5z\\x9c|:\\xd5\\xa1\\x14\\x0f\\xfc\\x97\\xacd\\x13%j*q\\xe1\\x1c\\x1b\\xe9\\xff?o\\xc0\\xa2\\xbf\\xff\\xfb@\\xe0\\x17\\x91!r\\\\xc0\\x8d\\xa7\\xc7yn>?\\xf7:\\xc6\\xc4r\\x07xap \\xf8l4\\xfc\\x8db\\xec\\x93\\x12\\xc7c\\xe0$\\xa1c\\x08\\xaa\\x934\\x9b\\xb9u\\xb8s\\x1c?\\xd3w\\x0e\\x86\\xff\\x86\\xf7%e\\xfc\\x0f3m\\xb9\\x95\\xe7r\\x12\"y\\x86\\xfch\\x11\\x95\\x877\\xd4\\x0bn\\x8f\\2\\x8f\\xa2\\x7f\\x03\\x89q\\x823\\xb0\\x7f\\xca\t\\xef\\xec\\x15\\xbf\\xf5\\xbd\\x85\\xe4\\xe2\\x82\\xee\\xfc\\xcc\\xbd\\xd9w'6(\\x88\\x05p\\x0cl\\xf91t\\x12+\\xe1\\xf3\\x92\\xbb:\\xdd9`\\xd8\\x1b!\\x910\\x1er1\\x9e\\xfa\\xd6q\\xda4\\xf3\\x86\\x0eg\\xdecz\\xca~\\x92l\\x92\\\\x97\\x10\\xf0.\\xe0z\\xc0\\xcf\\x8f\\xb8\\x9f\\x8f<\\x838\\xf1\\xber\\xab\\x87\\x8a\\^\\xcb'b"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<*\\xb6\\x87x\\x9f\\xe0\\x8d\\xdc\\xa2\\xa6$n\\x12\\xf2)a\\xd1h\\xca\\xe1\\x9f\\xa3.\\xe6\\xcb\\xa0$\\xbd\\x9d\\x0crw\\xaa\\xa3go\\xfb\\x1d\\xbb>\\x8al\\xb7\\xd5\\xcc\\x10\\xc9(\\xe6\\x9e\\xa9\\xd6\\x97?\\\\x8f\\xff\\xb5\\x07\\xb5\\x03\"\\x14\\xd0\\xed\\xc0\\xb4\\xe9\\xe1uxuz\\xe4\\x11d\\x18\\x9b)\\x93\\x1f\\x1ex\\x10\\xf2\\x8bc\\xdc\\x8301\\x9a7\"\\xb8\\xaf\\x0b+am\\xe7\\xab\\xcdo\\xfe\\xe5\\xaa*\\xe7\\xedf\\xfa\\xbf\\xdd\\xda\\x83\\x12\\x03\\xfc\\xeffk^\\xd3\\x8e\\x1d\\xcc\\xe1\\x03*h\\xe1\\xd8\\x92.e\\xa6\\x80\\x95m\\x1a\\x1f\\x13a\\x83\\x11\\x87\\xb4\\xbc\\xe3\\x1b\\xe8\\x9b\\xb0\\x8b\\xf9\\xe1\\xd3\\x18\\xb2l\\x00\\xcb\\xca\\x83n\\xe6\\xedz\\xe7d_\\xd88\\xedkj/\\x86)\\xa6\\xa4!@\\xde\\xa4.\\xad\\x11+\\xa7\\xd8,>\\xa0\\x8a\\xb3(\\xbd?\\x88\\xac\\xc3|\\xe6d\\xb2-@\\xc4lz\\x80\\xb5h(g\\xef\\xca\\x94\\x87\\xa9j(hgte\\x02\\x89\\xa8\\xb7~k>k\\xed\\x18\\xce9>\\xca\\xe9+p\\xf0"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2\\x023\\xf5\\xb2\\xf7\\x14\\xd8\\xc6\\x02$\"\\xf9\\x8f\\x99\\xf7??p\\xa6u\\xf1\\xef\\x918j\"n?\\xa1oe\\xcae\\xcb+\\x8f\\xeeye\n\\xde\\xf9\\xa8\\x9a\\xc4@\\x05\\xf5\\xe3\\xd4n\\x02`kv\\xd8i \\x93\\xaa\\xff\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\xa6\\x03\\xb9\\x1b\\x96\\xdd\\xfb\\x9e\\xb6\\x06v\\xc9h6i\\x11\\xca\\xde\\x00n(pq\\xf8\\x0e\rw\\xb9g\\xebx\\xd2\\x94\\x9c\\xb5\\xcafx9=f\\xd8fi\\x9a\\xbd"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\xfd?\\xf1\r\\x91\\x04\\xba,\\xc7a\\xf3/bi\\x83u\\x1b\\x95\\xae\n\\x8d\\x7f\\xe8\\xe0~j\\xe0j/ric\\xe3k\\xdbx\\xbcc\\xa9\\x81v\\xade\\xe6\\xc5\\x90\\x06\\xd3\\xc3\\x05.\\x13\\xdb\\xae\\xe7n\\xde\\x7f\\x92\\x12\\xf4\\xc1'\\xaf\\xf7i\\xbd\\x83w1\\xf8\\\\xd9\\xc1x\\xfa\\xba\\x15i\\xa4\\x17r6\\x8d:\\xb8\\x82\\xf4\\xe2r\\xae\\x1al\\xf7\\xd1\\x8e\\x88\\x16f\\x167\\xb1x\\xbcx\\xea\\xe8l\\x18\\xe7\\xd3b\\xb2>d\\xe8\\xc9\\xa32id\\xfd\\x9dj\\x06\\xb8\\xcc\\x8a\\xa6\\xfb\\x1b\\xec^d\\\\xd9\\x8e\\xb0\\xce\\xa6q6\\x02\\xd6\\x87kk\\xf9lps0\\xfb\\x98\\xc6\\x8fg2\\xfbl\\xe8\\xa2_ij\r\\x03\\x9ft\\xca\\xbd7\\xca\\xbdz\\xfc\\xabau\\xa0f\\xa2\\xfauu\\x8a\\xfdo5\\xd3g\tw\\xd8b\\xee\\x87x\\x99\\x14v\\xf5w\\xa6\\xf0d\"\r\\xeb\\x8bp\\x8a\\x89\\x8e9\\x88\\xb4\\x04(1+\\xfa\\x02&p\\x9b\\x18f\\xcc\\xb6\t\\xcbg\\xfaf&#h\\x84\\xb0=t3>\\x0c#\\xd6"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\xb1\\xc2i|@\\xee\\xb1\\x91w\\xf5bza\\x13\\xb4d+\\x1d\\xfeaq'o\\x04\\x96kb\\x1c\\\\x04\\xf9\\xede\\x8b\\x0c\\x13t\\xb0\\x01\\x1f\\x81\\xf4(\\x187\\x19\\xebj\\xa6\\x9bj\\xf4\\xc5\\xa3f\\xde\\x81\\x8b9(\\x15\\xba\\x99\\x98\\xdaja3>t\\x98\\xa9%\\xb7t\\xb2\\xfe\\xb6\\x1f\\x1a\\xbf\\xa9\\xb2\\xaf\\x0b\\xdbn\\xacdw\\xd9=\r\\xf1?\\xdd?\\xec03\\x9bi\\xcb\\xc4\\xa7\\x9b\\x03\\x01\\xd2\\x1d\\xb8\\xe0\\\\x92\\\\x8bu\\x1b\\xa3\\x93\\x84\\x9c\\xdf\\xa2\\xf5j\\xe3\t\\x02t\\xcb\\x12\\xf3s\\xcd\\x02)\\xcc\\xd7i\\xf0\\xe4v\\xf9s\\x9b\\x18mt\\x17h$\\xa6=\\x1e\\xcf\\x02h5d\\xfe\\x8dq2'\\xae\\x15\\xde\\xc3\\xa5\\x11\\xd1\\x16\\xb9\\xb5\\x17\\xd02\\xe3\\x1dw\\x9d\\x1b\\x97\\xb47b\\x8c\\xb2\\xf3\r\\xc5_\\x9f`\\xa1\\x90au\\xe5\\xa5\\x8e\\xc6\\x9b\\x8ad<\\x05\\xa6h\\xa3\\xc1:#<)\\x85-o(1a\\xbcl\\xbc\\xed\\x16\\xbe)\\xc4\\xd7a$w\\x8c\\xa4_\\xae9\\xfc\\x92h4#\\x98"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\xd0\\xb8\\x1e\\x0f\\x98k,\\x0f\\xe6\\xf7u\\xbfq?\\x95\\xc7l\\xca\\x13z\\xb3\\xbb\\x0f%\\x9e\\xd4\\x0fm\\xe1\\xb1\\x8c\\xbe\\xf1\\xf1\\xa9j;\\xe9\\x97\\xf6h\\xbf\\x9b~\\x0c\\x0bk\\xd0lu\\xcc\\xa4\\xa8v\\x1b\\x95\\x00\\xaa\\x03\\xec\\xae$/\\xd1\\xfb\\xeeoltr\\x01\\x931\\x91\\xd9\\xf0na\\xab\\x8c\\xb0\\xb5\\x1b\\xf0a\"\"\\x865$*\\xea8\\x1f:\\xd3\\x8eu\\xaf\\x1e\\xba\\xaa\\xba\\x9d\\xe9\\x98\\x06\\x91\\xc3\\c\\xef\\xed\\x85=5\\x16rw\\x9c\\\\xe4d\\xa2\\xf2\\x9fb\\xe8\\xeb\\xa1\\xc3\\x8d\n\\x02\\xdcp\\xd7\n\\xcd\\xcb8\\xe9j\\x7f\\x0e\\x0fu\\xe0@\\x1a\\x91\\xdf\\x1c\\xe2\\xde\\x13\\xa9\\x886)\\xda\\xeb\\x9bx\\x80\\x88\\xa62m\\xb7\\xd2\\x89\\xfc\\xc4si\\x00\\xd2j!\\x97\\xdf\\xb6%g\\x13y\\xeb\\xbe`\\xd8\\x9b\\xfbc\\x88\\xbar1\\xad)t\\x01\\xa9)=\\x80c\\xd7\\x83\\x10\\x88\\x98\\x96\\x8d~\\x81\\xb9\\x16\\x17v\\xb3u\\xdfa\\xeck\\x02h\\x84d\\xa0\\xa1\\x7fi\\xc9\\x08q\\xaav*|\\xe1\\x8b\\x0ez\\xc8\\x15\\xb7md\\xbf\\xa3a\\xf8"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  748.  
  749.  
  750.  
  751.  
  752. "Description": "Creates a hidden or system file",
  753. "Details":
  754.  
  755. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  756.  
  757.  
  758. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  759.  
  760.  
  761.  
  762.  
  763. "Description": "File has been identified by 12 Antiviruses on VirusTotal as malicious",
  764. "Details":
  765.  
  766. "Bkav": "Exploit.Office.Heur"
  767.  
  768.  
  769. "Symantec": "CL.Downloader!gen63"
  770.  
  771.  
  772. "ESET-NOD32": "Win32/Exploit.Agent.SA"
  773.  
  774.  
  775. "Kaspersky": "HEUR:Trojan.MSOffice.SAgent.gen"
  776.  
  777.  
  778. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  779.  
  780.  
  781. "Microsoft": "Trojan:Win32/Sonbokli.A!cl"
  782.  
  783.  
  784. "ZoneAlarm": "HEUR:Trojan.MSOffice.SAgent.gen"
  785.  
  786.  
  787. "TACHYON": "Suspicious/RTF.Obfus.Gen.1"
  788.  
  789.  
  790. "Zoner": "Probably W97Obfuscated"
  791.  
  792.  
  793. "Tencent": "Heur.Macro.Generic.Gen.j"
  794.  
  795.  
  796. "Fortinet": "VBA/Agent.8209!tr.dldr"
  797.  
  798.  
  799. "Qihoo-360": "virus.office.qexvmc.1070"
  800.  
  801.  
  802.  
  803.  
  804.  
  805. * Started Service:
  806.  
  807. * Mutexes:
  808. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  809. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  810. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  811. "CicLoadWinStaWinSta0",
  812. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  813. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  814. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  815. "Local\\WinSpl64To32Mutex_1cec0_0_3000",
  816. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  817.  
  818.  
  819. * Modified Files:
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\NetWire_b1d48a8e5aa07f5d85c278410abf79c5.doc",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_b1d48a8e5aa07f5d85c278410abf79c5.doc",
  822. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\13FB2A28.emf",
  823. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSACCCF53D-0D85-413C-8C58-05EAC5051AD6.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFBD12710C-67DF-437C-B117-5B47E6B79C9F.tmp",
  825. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  826. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  827. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  828. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7A76.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7A77.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\34751409.emf",
  832. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\44CE9A76.emf",
  833. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\E58EDBFF.emf",
  834. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\FCFC5F4.emf",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF3B118394796A5742.TMP",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5AA279A2F5481658.TMP",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA49B074614E681B7.TMP",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF5570196113E9E64.TMP",
  839. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\EB404565.emf",
  840. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\54C6C422.emf",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of NetWire_b1d48a8e5aa07f5d85c278410abf79c5.asd",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9C3.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D4.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D5.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D6.tmp",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA34.tmp",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA45.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA56.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA57.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA67.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA69.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA68.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA99.tmp",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBAC9.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBACA.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBADB.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB0A.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB1C.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB0B.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB3C.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB4D.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBBEA.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC0A.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA8.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB8.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCD9.tmp",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD37.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD67.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2DF6AD657CA2C0C8.TMP",
  873. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  874. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC066.tmp",
  876. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC067.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC097.tmp\\pictureorgchart.glox",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC097.tmp\\Content.inf",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D6.tmp\\ConvergingText.glox",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D7.tmp\\CircleProcess.glox",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D6.tmp\\Content.inf",
  883. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  884. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D7.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0F7.tmp\\gostname.xsl",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0F7.tmp\\Content.inf",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1C4.tmp\\VaryingWidthList.glox",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC251.tmp\\rings.glox",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC262.tmp\\harvardanglia2008officeonline.xsl",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC251.tmp\\Content.inf",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2EF.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC262.tmp\\Content.inf",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC300.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC320.tmp\\ThemePictureGrid.glox",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC320.tmp\\Content.inf",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC300.tmp\\Content.inf",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC3BE.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3DE.tmp\\ieee2006officeonline.xsl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EE.tmp\\mlaseventheditionofficeonline.xsl",
  906. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3DE.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  909. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC49B.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EE.tmp\\Content.inf",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AC.tmp\\chevronaccent.glox",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AC.tmp\\Content.inf",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DD.tmp\\gosttitle.xsl",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DC.tmp\\content.inf",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4FD.tmp\\Element design set.dotx",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DC.tmp\\Metropolitan.thmx",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DD.tmp\\Content.inf",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4FD.tmp\\Content.inf",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC5D9.tmp",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6A5.tmp\\HexagonRadial.glox",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC734.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6F4.tmp\\content.inf",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6A5.tmp\\Content.inf",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6F4.tmp\\Frame.thmx",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC792.tmp\\turabian.xsl",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7F1.tmp\\content.inf",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7F1.tmp\\Dividend.thmx",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC821.tmp\\content.inf",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC821.tmp\\Parallax.thmx",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC792.tmp\\Content.inf",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC881.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC851.tmp\\iso690nmerical.xsl",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC882.tmp\\PictureFrame.glox",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC882.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC851.tmp\\Content.inf",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9AC.tmp\\Basis.thmx",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  949. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9AC.tmp\\content.inf",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAB6.tmp\\Headlines.thmx",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAB6.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCCDA.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD29.tmp\\Crop.thmx",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD29.tmp\\Content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD98.tmp",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE7.tmp\\Badge.thmx",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDF7.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE7.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE95.tmp\\content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE95.tmp\\Quotable.thmx",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD404.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD463.tmp\\Berlin.thmx",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD463.tmp\\content.inf",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB217D8EE-60F9-42CE-A8A8-B0528B902F8E.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9B3.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9C4.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA61.tmp\\ThemePictureAccent.glox",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA61.tmp\\Content.inf",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF0.tmp\\APASixthEditionOfficeOnline.xsl",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF1.tmp\\iso690.xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDADF.tmp\\sist02.xsl",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB30.tmp\\Equations.dotx",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB60.tmp\\Insight design set.dotx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF1.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDADF.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB81.tmp\\BracketList.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF0.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB30.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB92.tmp\\chicago.xsl",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB61.tmp\\architecture.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB81.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB61.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB92.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDDB6.tmp",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB60.tmp\\Content.inf",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE44.tmp\\gb.xsl",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE64.tmp\\Circuit.thmx",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE44.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC7EFF8E3-DDE9-4870-AD61-9519A51613B5.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE64.tmp\\content.inf",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFCC.tmp",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDFEC.tmp\\content.inf",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDFEC.tmp\\Droplet.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B9.tmp\\Feathered.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B9.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx"
  1021.  
  1022.  
  1023. * Deleted Files:
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7A76.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7A77.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\44CE9A76.emf",
  1027. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\E58EDBFF.emf",
  1028. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\FCFC5F4.emf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF3B118394796A5742.TMP",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5AA279A2F5481658.TMP",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA49B074614E681B7.TMP",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF5570196113E9E64.TMP",
  1033. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1034. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\EB404565.emf",
  1035. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\54C6C422.emf",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of NetWire_b1d48a8e5aa07f5d85c278410abf79c5.asd",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434fn=Wood Type.eftx",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434fn=Wood Type.xml",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434fn=Wood Type.xml",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC066.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC067.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC097.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D6.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D7.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0F7.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC097.tmp\\pictureorgchart.glox",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBBEA.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1C4.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D7.tmp\\CircleProcess.glox",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA57.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0D6.tmp\\ConvergingText.glox",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA68.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC251.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC262.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1C4.tmp\\VaryingWidthList.glox",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA8.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC300.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC320.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC251.tmp\\rings.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD67.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3DE.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EE.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC320.tmp\\ThemePictureGrid.glox",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC262.tmp\\harvardanglia2008officeonline.xsl",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD37.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0F7.tmp\\gostname.xsl",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB4D.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AC.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA34.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DC.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DD.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4FD.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC300.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA45.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AC.tmp\\chevronaccent.glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D6.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6A5.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DD.tmp\\gosttitle.xsl",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3DE.tmp\\ieee2006officeonline.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D5.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6F4.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB1C.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4FD.tmp\\Element design set.dotx",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB8.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC792.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4DC.tmp\\Metropolitan.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2EF.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7F1.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EE.tmp\\mlaseventheditionofficeonline.xsl",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA99.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC821.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC851.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC882.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6F4.tmp\\Frame.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC49B.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9AC.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC792.tmp\\turabian.xsl",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBADB.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6A5.tmp\\HexagonRadial.glox",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC882.tmp\\PictureFrame.glox",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA67.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC0A.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC851.tmp\\iso690nmerical.xsl",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC821.tmp\\Parallax.thmx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7F1.tmp\\Dividend.thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA69.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC5D9.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAB6.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC3BE.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9AC.tmp\\Basis.thmx",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC734.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAB6.tmp\\Headlines.thmx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC881.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD29.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD29.tmp\\Crop.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCCDA.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE7.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE7.tmp\\Badge.thmx",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE95.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD98.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE95.tmp\\Quotable.thmx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDF7.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD463.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD463.tmp\\Berlin.thmx",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD404.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA61.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF0.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF1.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDADF.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB30.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB60.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB61.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB81.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB92.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA61.tmp\\ThemePictureAccent.glox",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSACCCF53D-0D85-413C-8C58-05EAC5051AD6.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCD9.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_b1d48a8e5aa07f5d85c278410abf79c5.doc",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF1.tmp\\iso690.xsl",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9C3.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB92.tmp\\chicago.xsl",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB0A.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB81.tmp\\BracketList.glox",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF0.tmp\\APASixthEditionOfficeOnline.xsl",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA56.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBACA.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB61.tmp\\architecture.glox",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE44.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDADF.tmp\\sist02.xsl",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBAC9.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB30.tmp\\Equations.dotx",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB9D4.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE64.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB3C.tmp",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1173. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC7EFF8E3-DDE9-4870-AD61-9519A51613B5.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB217D8EE-60F9-42CE-A8A8-B0528B902F8E.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE44.tmp\\gb.xsl",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB60.tmp\\Insight design set.dotx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE64.tmp\\Circuit.thmx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB0B.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDFEC.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9B3.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9C4.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B9.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDFEC.tmp\\Droplet.thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B9.tmp\\Feathered.thmx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDDB6.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFCC.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\34751409.emf",
  1188. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\13FB2A28.emf",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR672B.tmp.cvr",
  1190. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFBD12710C-67DF-437C-B117-5B47E6B79C9F.tmp"
  1191.  
  1192.  
  1193. * Modified Registry Keys:
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\1~~",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7E348F",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7E348F\\7E348F",
  1206. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1448. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1449. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1450. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1796. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7E348F\\8FFFF1",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1800. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1817.  
  1818.  
  1819. * Deleted Registry Keys:
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\1~~",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\k(|",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7E348F\\8FFFF1",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7E348F\\7E348F",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1839.  
  1840.  
  1841. * DNS Communications:
  1842.  
  1843. * Domains:
  1844.  
  1845. * Network Communication - ICMP:
  1846.  
  1847. * Network Communication - HTTP:
  1848.  
  1849. "count": 1,
  1850. "body": "",
  1851. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1852. "user-agent": "Microsoft-CryptoAPI/6.1",
  1853. "method": "GET",
  1854. "host": "ocsp.digicert.com",
  1855. "version": "1.1",
  1856. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1857. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1858. "port": 80
  1859.  
  1860.  
  1861. "count": 1,
  1862. "body": "",
  1863. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1864. "user-agent": "Microsoft-CryptoAPI/6.1",
  1865. "method": "GET",
  1866. "host": "ocsp.msocsp.com",
  1867. "version": "1.1",
  1868. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1869. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1870. "port": 80
  1871.  
  1872.  
  1873. "count": 17,
  1874. "body": "",
  1875. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1876. "user-agent": "Microsoft-CryptoAPI/6.1",
  1877. "method": "GET",
  1878. "host": "crl.microsoft.com",
  1879. "version": "1.1",
  1880. "path": "/pki/crl/products/microsoftrootcert.crl",
  1881. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1882. "port": 80
  1883.  
  1884.  
  1885. "count": 1,
  1886. "body": "",
  1887. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1888. "user-agent": "Microsoft-CryptoAPI/6.1",
  1889. "method": "GET",
  1890. "host": "crl.microsoft.com",
  1891. "version": "1.1",
  1892. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1893. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1894. "port": 80
  1895.  
  1896.  
  1897. "count": 2,
  1898. "body": "",
  1899. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1900. "user-agent": "Microsoft-CryptoAPI/6.1",
  1901. "method": "GET",
  1902. "host": "crl.microsoft.com",
  1903. "version": "1.1",
  1904. "path": "/pki/crl/products/microsoftrootcert.crl",
  1905. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1906. "port": 80
  1907.  
  1908.  
  1909.  
  1910. * Network Communication - SMTP:
  1911.  
  1912. * Network Communication - Hosts:
  1913.  
  1914. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!