API tools faq
paste
paladin316

RTF_03dd9f3019550169a008b940b684fdea_doc_2019-07-25_09_30.txt

paladin316
Jul 25th, 2019
2,335
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 189.83 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Msoffice"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_03dd9f3019550169a008b940b684fdea.doc"
  7. * File Size: 8510
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "1ac54e8c38c07efa41efdb8db3b520ee2fc76b1659bb48b1f66a996f6c59dda3"
  10. * MD5: "03dd9f3019550169a008b940b684fdea"
  11. * SHA1: "93d8444b6e2ca5dba1236e13f06089aea262669c"
  12. * SHA512: "a6370c278b28656a3120a25139ccc212ef67e0c55ddc3bc794cce426ba5e1705edade808d029e0ef4fc3fbb80431c96b3a1a58b453b61ebd33c38a9664328aef"
  13. * CRC32: "04D0D695"
  14. * SSDEEP: "96:1B56v+FdqoeUt4MkGb8GojM6ZVAt9m9Ia4y2xjFnnORzVX4FVC:3E+/qoP4MkGQM6ZVqFnORzyA"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2636"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 293 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  41. "Details":
  42.  
  43. "IP": "52.109.20.1:443"
  44.  
  45.  
  46. "IP": "92.123.51.45:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "104.18.24.243:80"
  53.  
  54.  
  55. "IP": "23.38.126.36:443"
  56.  
  57.  
  58. "IP": "72.21.91.29:80"
  59.  
  60.  
  61. "IP": "184.28.188.192:80"
  62.  
  63.  
  64. "IP": "52.109.2.18:443"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  70. "Details":
  71.  
  72. "ioc": "quations.dotx"
  73.  
  74.  
  75. "ioc": "ontent.inf"
  76.  
  77.  
  78. "ioc": "rid.glox"
  79.  
  80.  
  81. "ioc": "..3b"
  82.  
  83.  
  84. "ioc": "ist.glox"
  85.  
  86.  
  87. "ioc": "sist02.xsl"
  88.  
  89.  
  90. "ioc": "gb.xsl"
  91.  
  92.  
  93. "ioc": "rings.glox"
  94.  
  95.  
  96. "ioc": "rame.glox"
  97.  
  98.  
  99. "ioc": "rc.glox"
  100.  
  101.  
  102. "ioc": "iso690nmerical.xsl"
  103.  
  104.  
  105. "ioc": "architecture.glox"
  106.  
  107.  
  108. "ioc": "rocess.glox"
  109.  
  110.  
  111. "ioc": "ccent.glox"
  112.  
  113.  
  114. "ioc": "iso690.xsl"
  115.  
  116.  
  117. "ioc": "ext.glox"
  118.  
  119.  
  120. "ioc": "harvardanglia2008officeonline.xsl"
  121.  
  122.  
  123. "ioc": "pictureorgchart.glox"
  124.  
  125.  
  126. "ioc": "chicago.xsl"
  127.  
  128.  
  129. "ioc": "ieee2006officeonline.xsl"
  130.  
  131.  
  132. "ioc": "e.gu"
  133.  
  134.  
  135. "ioc": "adial.glox"
  136.  
  137.  
  138. "ioc": "gostname.xsl"
  139.  
  140.  
  141. "ioc": "mlaseventheditionofficeonline.xsl"
  142.  
  143.  
  144. "ioc": "turabian.xsl"
  145.  
  146.  
  147. "ioc": "anded.thmx"
  148.  
  149.  
  150. "ioc": "content.inf"
  151.  
  152.  
  153. "ioc": "gosttitle.xsl"
  154.  
  155.  
  156. "ioc": "ividend.thmx"
  157.  
  158.  
  159. "ioc": "chevronaccent.glox"
  160.  
  161.  
  162. "ioc": "iew.thmx"
  163.  
  164.  
  165. "ioc": "rame.thmx"
  166.  
  167.  
  168. "ioc": "etropolitan.thmx"
  169.  
  170.  
  171. "ioc": "arallax.thmx"
  172.  
  173.  
  174. "ioc": "nline.xsl"
  175.  
  176.  
  177. "ioc": "set.dotx"
  178.  
  179.  
  180. "ioc": "adge.thmx"
  181.  
  182.  
  183. "ioc": "ype.thmx"
  184.  
  185.  
  186. "ioc": "eadlines.thmx"
  187.  
  188.  
  189. "ioc": "asis.thmx"
  190.  
  191.  
  192. "ioc": "uotable.thmx"
  193.  
  194.  
  195. "ioc": "rop.thmx"
  196.  
  197.  
  198. "ioc": "erlin.thmx"
  199.  
  200.  
  201. "ioc": "avon.thmx"
  202.  
  203.  
  204. "ioc": "late.thmx"
  205.  
  206.  
  207. "ioc": "amask.thmx"
  208.  
  209.  
  210. "ioc": "vent.thmx"
  211.  
  212.  
  213. "ioc": "roplet.thmx"
  214.  
  215.  
  216. "ioc": "ircuit.thmx"
  217.  
  218.  
  219. "ioc": "g.n9"
  220.  
  221.  
  222. "ioc": "eathered.thmx"
  223.  
  224.  
  225. "ioc": "esh.thmx"
  226.  
  227.  
  228. "ioc": "rail.thmx"
  229.  
  230.  
  231.  
  232.  
  233. "Description": "Performs some HTTP requests",
  234. "Details":
  235.  
  236. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  237.  
  238.  
  239. "url": "http://mxzyw.com/wordpress/wp-content/plugins/123-giuo/chiji/cjayyy.exe"
  240.  
  241.  
  242. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  243.  
  244.  
  245.  
  246.  
  247. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  248. "Details":
  249.  
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x019m\\xe8\\x15\\xaa\\x86\\xf8\\xbe\\xed\\xc3,\\x1e\\x10\\xf9j\\x19\\xffm\\xae\\xea?\\x91\\x98\\x8c\\xbbb\\xc36\\xecs\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\xf9\\xb1\\x1c\\xe9b\\xc1\\x9c\\xdd\\xf3c\r-\\x14\\x1b\\xd1\\x88\\xe4\\x92\\xf2\\xa6\\xe4\\x07\\x18\\xdd\\xdf\\x1b\\x1d\\xad\\x9496\\x08\\x18\\x1c\\x05\\x9f\\xf4\\xe0\\xf3\\xa6i\\x90\\x7f\\x85\\xc3\\xfd\\xf2\\x0br\\xc5\\xb7\\x8bx\"\\xc0\\xf6\\xd9\\x7f!\\xf6\\xe6x\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c\\xe1\\xfc\\xc9\\xe5)\\x1c5\\xa7\\x17\\xa3\\x83\\x15\\xd6(og\\xaft\\x80k)ol\\x13\\xd9j\\x16\\xe6\\xb8%\\x1b\\x06>m\\xb2\\xcd\\xbd\\xde\\xf86*\\x1b\\x8b3~t\\xe3"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfd\\x0b\\x03b8\\xe8in\\xeb\\xff\\x04\\x07\\xbb\\x7f\\x8e@-\\xb5\\xcf\\xf9\\x97\\xef\\xac\\x05a\\xb4?\\x15\\x0flz\t\\x8cr\\xa3\\x88\\xc7\\x1b\t\\x0f\\xd01\\xf8\\x89'\\xf5\\x0c'\\x9bw\\xce\\x85\\x83\\x1a7\\x1f\\x92m\\xb7\\x17\\xe6\\xa3;\\xf58z\\xd1l\\xe6\\xe2\\x82\\xb8~\\xba\\x0b\\xff\t?\\xada^\\x01w\\xc8p\\xf5\\x9do\\xf9\\x03\\xab\\xe2\\xdff\\x8c\\xe5\\x9bk\\x98\\xffe\\xa3\\x03m\\xa2\\x8e!+\\xe5xu\\x06\t\\xf7#@$5\\x08\n\\x87o\\xb4c\\x90\\xf8u48\\xda\\x02c\\x08\\xc3\\xf2\\x1f\\xed\\x15\\x05\\x9d\\xd1\\xa1\\xb3\\x16\\xe1\\xc6\\xa9\\x9d\\x03\\x0f\\x00ux\\x94\\xab\\\\xf7\\x7f.^\\xa4\\xfe\\xbb\\xba\\x91\\xbc\\xb0\\xb4\\xb6\"v\\xf9\\x96\\xe7\\xff7dc\\xa6\\x14>\\xd2\\x1d2eloy-\\x8d\\x9e\\xd9quww\\xdf\\xac\\xd4\to\\xc2i\\xf6*oq\\xf0l\\xf4\\x06>\\xb7\\xb9\\xd1~\\x91\\xf1\\x84\\xcem\\xa6s\\x97\t\\x05\\x0f\\xd4\\x1e'w\\xc6\\x91+\\xfa\\x19?w\\xc8\\xa8)u`6\\xedm"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 2hk\\xbb\\xd0\\xca\\x9f\\xf4\\x03\\xb4\\xd6p\\x99\\xa58)\\xb7@\\x93?|\\xd0\\xcac\\xbbft%\\xf9\\xec\\xd4\\xa7\\xe1\\x80~r\\xfe\\x87\\x16!\\x04\\xe2\\xfb\\xc8\\xa6h\\xeb\\xe8\\x80c\\x00\\x0b\\x15\\x9ae\\x9b#sq\\x1d\\xa2\\x0f\\x9c0\\xde\\xc9_\\xe4\\x7f\\xdb\\xe2\\xac\\xd6s\\x8e=\\xfec\\xe3qh\\x04\\x80\\xa0<bp\\xf8\\x08\\x1dy\\xca\\xe81\\xbe\\x83\\xc1\\x1d\\xf4\\xa2>\\xcd\\x15\\x9d5i\\x83<\\x11\\x8d\\xe6\\xc3\\xc1\\x97\\xa2@\\x1bo\\xf6\\xfd\\xeb\\x86\\x07;\\xb0d\\xe7\\xf4m\\xbb\\xb50=6\\xd3\\xae5\\xbd\\xc1\\xb2\\x8e\\x8bim\\xda\\x14\\xb0\\xfe\\xdd\\x8d\\x1e\\xa5c\\xf0\\x0ee#\\xb0\\xb2y\\x9c\"\\x98\\xcd#\\x04\\xf7l\\x0c\\x05^\\\\x06\\xd5w\\x13\\xec\\xc0qzw\\x82\\x96\\xfc\\xa9\\x16n\\x9e\\x0c\\xe1\\xcf\\xb7\\x14\\xc9\\xab\\x0b\\xa56\\xear\\x93=\\xad\\x1c4\\x1b\t\\xfd\\xab\\x04\\x94l\\x11\\x05/\\x1c\\x1a\\xb9r\\xeb\\xee5\\xf8\\xca\\xfb\\xe6\\x88\\xf3\\xf9\\xa1\\xe3z\\xa4\\xcf\\xde\\x0b\\x8fb_j\\x80f\\xffc\\xeb\\xa0iod"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x019m\\xea\\xd5i\\xbf\\xd8\\xa7\\x90:.\\x8c\\x15\\xf6\\xb2k4hl\\xeb@\\xc4\\xbd\\xdb\\x19\\x15\\x19(\\xe5\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\x1c\\x0c`o\\x08gj\\x1b\\x13np\\xb8=d\\xf9\\xca\\xefw\\xa6^\\xedn\\xf3\\x96!\\xfba\\x00x5\\x9a\\x83\n\\x0b\\x19\\xe7\\x01)\\xa4q\\xf4\\xc6gv\\x0cx\\xf3\\xe3\\x17\n$\\xbf\\xf8\\xfa\\x81\\xfd\\x86\\x8bwu\\xd2\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0fx\\x97\\xbc\\xbd\\xf5\\x03r\\x96\\xf8\\xf0\\x7f\\\\xc2\\x81`og\\x95\\xeaf\\x88\\x1bn#\\x94\\x8f\\xfe:\\xa8\\x92v\\xdb>f\\xaebf\\xd2\\xb0n\\xfd\\x1e\\xea\\x97\\xbav\n"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p3\\xd0f-\\xd4\\x15:l\\x8b\\x86\\x12\\xded\\x85u%\\xbf\\xaf\\xe8$-j8\\x0e\\xb7\\x9a\\x96\\xf6?p\\xcd|\\x95\\x06\\xb8\\xc3\\x89-\\xff\\xc6\\xaf4\\x04\\x10\\x8b\ri\\xe9\\xde/\\xa7h\\xe4\\x0cn\\xe7h9-4m7b\\xeci\\x7f\\xcdv\\x13\\xdae\\xfek:v)b3d^\\x87\\xbd\\x82\\xb2l\\x90\\x86\\x1cob\\x08v`\\x8a\\x18a`\\x89`\\x8bq\\x12\\xbfp\\x06wv\\xeb\\xfae\\x11\\x1f\\x86rvk2\\x1a\\x7f\\xe6\\xd3\n\\xd7\\xe8\\xf7\\xfe\\xb1f\\xd7\\xb0ej\\x91\\xe1\\x10\\xcc\\x89\\x95\\xef\\x04\\x86%\\xd0\\xd4\\xb5ozl\\xb9f\\xf5mo\\xd8\\xdd\\xc9p\\xfe=\\xe3b\\x1e?\\xaez\\x9f\\xb6y\\x9cu\\xb0d6\\x18\\x15\\xaer\\x03dy!\\x9b\\x17\\xadz\\xc1\\x9f\\x9c\\;\\xda\\xd0\\xc0\\xa6\\x9f\\xef~\\xb9/e\\x11\\xa33\\xbcp\\xcae\\xa0\\x7fe%\\xcc\\xd9\\xf6\\xbf\\xe8\\x89\\xf6%%og\\xc4g\\x97\\xe2j~a\\xf4\\xea\\xa6j\\xbe\\xc4\t\n\\x84\\xbd\\x98\\xda\\xccr\\x8c\\xa5\\xd9\\x9dg"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x019m\\xecw\\xc5\\xf2\\xde\\xe0\\xe5n\\x03.\\x\\xa0\\xc48\\xb8\\xe5i+ng\\x98\\xaa\\xd6\\xa1\\xd4\\xaai\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xfa\\xa8\\xa7\\x93'\\xcf\\xe3hs\\xda0\\x8bb\\xa1\r6\\xf6\\x87\\xd2\\x9d\\x8e\\x17\\xfa\\x02\\xb4\\xd0_\\x02\\x05o\\xd0f\\xa4\\x1d\\xc1\\x9a\\x04\\x80\\x8a\\x0c\\x14l\\x87\\xe6\\xec@b\\x14\\xfcu|\\xfa\\xd2\\x9a\\xd1#p\\xa9\\xcc\\xa8@i\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\xe9\\xd3\\xce\ty\\xa7\\xbe\\x1c\\xae\\x96\\xb8\\x84lir\\x19\\x16\\xd7\\xbe\\xbe\\xae\\xc3\\xfbwp\\x1d\\x8a\\xb0r_\\x01ky\\x17~\\x1c\\xc2\\xa1\\x00\\xe2\\xbd\\x9e\\x95\\xc87"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa8\\xe6\\xb68m:\\x8c\\xc4\\x80t\\xc8\\x16\\xaa\\xd7w\\xb2qox\"$2\\xdah\\x80\\xed\\xef\\x07\\x9d\\xd4\\xba\\xc8?\\xf9\\x9c\\x18\\x04\\xc7vu\\xcdu\\x17\\xe5\\x8a\\xda\\x8b\\xaf\\xd6\\xa2\\xc1h\\xf0\\xf6l\\x8b\\xa0n\\x8d\\x0er\\x8e\\x15(\\x8cby\\xc3\\xc2(m\\x15fu#mw\\xd7\\xa0\\x97y&\\x89cm\\x92\\xa1\\xb0\\x1c.\\xc7\\xee\\xad\\xab\\x05t$\\xb3\\x0b\\xf1\\x84\\x95i\\x0bzxj\t7\r\\xdc_\\xb8\\xfa\\xad\\xd9x\\x1bsa\\xb4%\\x84\\xc7h\\x84\\xc1~\\xdck:a\\xf7\\x999\\xa5\\x8f\\xa5\\xee \\xb5\\xec\\x9f<o\\x9a\\xbd\\x8e\\xcc\\xd4\\x07\\xccc\\x8de\\xa4\\xb4\\xda\\xfd\\x0fz\\x01n\\xb5\\x9e-iv\\x16&\\x15j\\x9a\\x11\\xcd\\xd6\\x1a\\xc1fu\\x18\\x1cql\\xa2\\xe6*\\xbc8 7r\\xaaf\\x98\\xec\\x02\\x8d\\xaa\\xd1\\x97\\x9a\\x1f\\x03\\xa6\r\\x12\t\\xb5q)\\xa8\\x99\\xef\\xba\\xed\\x80is^\\xacse3\\xfe\\x95b\\x9b\\xdf\\xfa\\x9d\\xd5\\x18`\\x1bn\\xdd\\xb8\\x03\\xcah\\x9ew(\\x1c\\xb3\\xd0"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec&\\xe21\\xe3\\x99\\xbf\\x89\\x15\\xaf\\x00\\x86$\\xd2wn0il\\xefc\\$\\x17\\x93~_?\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xc8\\xcak\\xe9\\xad\\x0e%\\x1e\\xa9x\\x0c\\xeb\\x84sw\\xe5h`\\x82\\xf0\t=\\xfe\\xde\\x93\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x92o)\\xb5\\xa1\\xf2\\xeej,e\\x0b\\xc5\\xa1\\xbe\\x15\\xa5\\xcb\\x8f\\x1c\\xdd\\x87\\xed\\x1d3\\xf1p\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xecu\\x0b\\x05\\xd8w\\xf6i\\xb4\\xa9\\xad\\x0eho|\\x88\\xec8\\x94\\xf2\\xea\\x13\\xb2f\\xf2x\\x10\\x89\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xeca\\xa5\\x7f\\xb9xh\\xa5\\x15jw\\x1a\\xb8wt\\xd7:\\x9c:\\xa7\nf\\xd9\\x1e\\xc1q\\xd0\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xac\\x13)i\\xe2\\xe6\\xa2\\x1e\\x95g\\xc5 \\x91\\x1ee\\xc4\\x0c\\xcb\\xda\\x88w\\xc6\\xe5\\xeao9\t\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xc2\\x86h\\x08!\\x0f\\xe7\\x93sy\\x94w\\xd04\\x1d\\xa9y\\x08\\x7f\\xd4\\x04x\\xe8o(sp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec&w\\x99\\xf7\\xd9\\xdbm\\x1f\\xc9s\\x85\\xfd(\\x92l\\x0e:\\xc6\\xbe\\x08\\xc1\\xb7\\x8a\\xb1n`\\xfc\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xe2~\\xfaf\\x90\\x14\\x1bi\r\\x08\\xdf\\x14\\x9dk\\x88\\x14\\xc2\\xc1k\\xa3\\x0b \\\\x17$\\x83\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xe9oz\\xa8\\x1c\\xf2v5bz\\xfb\\xe1\\xeb\\xa7y\\x1a\\xa0|\\x80\\xee\\x98\\xf8\"\\xa7*z\\x84\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xff*\\x02\\xafyq\\xc0e\\xe7\\x9d\\xa9\\x0b\\xd8\\xf3\\xd2\\x1e\\xb5\\xcd\\xb1\\x8a\\x981n\\xffzt\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x03\\xadf\\x96c\\x17\\xbd\\xc6\\x9am\\xf6\\x9b\\xe0h\\xc3i4\\x1e%\\xf9\\xca\\x95\\xc7\\xdc\\x03vo\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xecf\\xf7f\\xf5jd_d\\xeet\\xafpx\\xc5\\xf6-\\xe0\\x03\\x1apa\\x92\\x01k \\xb9i\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xecoi\\xdf\\x19/pn.d\\xa9<d\\xffs\\x08\\xe7h\\x0f5h\\x87\\xe6\\xd5g\\x82\\xad\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec0\\xcf\\xad#\\xb6g\\xb3\\xe4~\\xf3\\xc3_\\xce\\xbe\\xa7u\\x00\\xe1\\x8e\\x0f\\xf0a^\\xe7o\\x9d\\x13\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x90o\\xf0\\x1a\\xb5\\xd7|s\\x99\\xcd\\xaf\\xcdt\\x9a\\x14\\xbb\\xe3\\x07\\xb5\\x87w\\xce\\xc3\\xe3\\x9f\\xbc\\xcf.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x8d\\x1c\\x1b\\xf4\\xf87^\\x00#\\xc8p\\xbf\\xdc\\xed\\x81\\xa1\\x98k\\xc7iy\\xeb\\xd12\\xd0,b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x02\\xba\\xc8\\x8d130v)\\x16\\xd3\\xd6\\xe0df\\xb6i\\xb1\\x7fu\\x8f\\x86\"\\xf6d\\xd2m\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x05t\\xd6\\xfd\\x1a\\xcd\\xfa9\\x92\\xec\\xb8\\xeb\t\\x85k\\xe8\\xe4\\xf5\\xa0\\xe0\\xb7\\xaf\\x11\\x1c\\xe2\\x00\\x03\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xfe4\\xf9\\xb6\\xad\\xc3^\\xaezrad!b\\xe6~\\xc6\\xbb\\x9d\\xe9\\xd9\\x01`\\xa3\\xcfx\\x17\"\\xe7\\x054\\xefb\\xaf\\xbc\\xcd-\\xfd\\xc3s\\x15q\\x1c\\xad!>l\\xe8\\x88\\x97u\\xb8\\xb1f\\xbfx\\xe2\\xdb\\xf3\\xfb6\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8\\x0f\\xadx\"\\xe5j\\xa7\\xa4\\x8djyp\\xc0#r\\xbf\\x96\\x17\\x06k$\\xe2#\\xd5ju\\xad\\xce\\x11ux7\\xa0\\x07\\xe5\\x0c1oja\\x87$\\xe02\\xb9\\x1b"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xf2n\\x81\\xa2\\xb17\\xd8y(\\x88\\xf3\\xf6\\x88~y\\xa0\"\\xe1\\x1ez\\x19\\xcdo\\xe0%\\xeb\\x9dewi\\xdb\\xa9\\xeeo\\x85c#n\\xa4\\xe5\n+w\\xf7)\\xd9\\x85\\x86\\x8d\\xc0s\\x1d\\x00_d\\x08>\\x1f\\x80g\\x90\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xd4\\xf7\\xa9\\xf4\\x14grc\\x8f\\xf4\\x84\\xb1\\x9f\\xfb#\\x84\\xda\\x85\\x95^\\xad\\x0f\\xe1rm\\xcd,xy\\xe7\\xb0\\xde\\x95\\x93\\xe4\\x91\\x1a\\x08\\x16f\\xf4\\x99\\xd2b\\xc6\\xb4\\xef"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xadyc\\xaet#\\xb1\\x8cm\\xec\\x19\\x93\\xbc\\xb5\\xc3\\xad2\\xd3\\xb8xd\\x04c\\xd6\\xb02jl\\xff\\x019p\\x86\\xff0\\xd9`\\xe5\\xf6m1\\x83\\xe1\\xa9\\x1aa\\xcf\\xda\\xd6f\\xaa\\xde\\xf8\\xb8j#\\xe0s\"\\xdb\\xb7j\\x9c\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\x0c\\xe7\\x99<\\x0b\\xc7=\\x93)\\x87vf8\\xd1\\x04f\\xe2\\xe97d\\xf4\\x882\\x9a\ng\"\\x9f\\x04\\xa2\\x92\\x8f\\xd0\\xaf1i'\\xda5\\x82t\\xb7\\xafhk1\\x85"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\x03l\\xb2\\x8d\\xd3\\x079\\x92\\x0c?\\xc6e\\xd9nb\\xb0o\\x1b-b\\xb2)\\xd5&\\xbd\\xe4s\\\\x9fq\\xbd\\xd0cxx.\\x02\\x11\\xbe\\xc6\\xa8r)\\xdf\\xf7\\x8d!\\x85\\x9f4\\xec\\x06\\x02\\xbd7\\xf5\\x1d\t\\xec\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccbc\\xce\\xbem\\xe1\\x8f\\x1c\\xcf`\\x8d8\\x9cc\\x07v\\x02ix`\\x02\\x83;3\\x06`2>v&\\x1e=4\\xa6\\xf4\\xa4p\\xcax<\\xe4z\\xbf\\x9e\\xf6\\x1br"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2\\x15j/\\xcel_\\x8cz\\xb5\\x99\\x05r\\x86#8e\\xb6\\x18\\xb3\\x80\\xd6\\xde?\\xbd\\x88\\xc4:\\xc4\\xe4\\xfb\\xcd\\xa7g\\xbc3\\x99\\xd9\\xdfb\\xc5\\x17s\\x13d\\xe4if\\x81\\x9c\\xe4\\xe1z`\\xb7\\x91*\\xa4\\x82o\\xb7n\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\xbe\":\\x85x\\xa7v9\\xdf\\xf3\\cr\\xdc\\xd6h\\xc0\\xea\\xfa\\xe0(\\xe6t\\x06\\x82w\\x859<\\x81c\\x951\\x84\\x88?5\\xe9\\xc5o\\xe2\\xdah\\xb4\\x120j"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\xb3=\\xcc\\xb9\\xfe\\x0b\\xc4\\x91\\x14\\xc2\\xda'\\xcc\\x9a\\xb5\\x19\\xd7\\x15\\x0c\\xb8\\xa0\\xbd3z\\xb8t\\xafx\\xf0\\x8b\\xba\\x8d\\xd7\\xa2\\xe4\\x82d\\xd4l<*\\xc6r\\xfa\\x81dm\\xaby\\xdbxo%\";\\xd4\\xa7l\\xd8i7h\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"7e\\xfc\\xa1r\\xc4\\xb46sq+\\x86\\x1e\\xf6s\\xb9\\x1ck*\\x11-\\x9c0\\x9e\\xd3e\\xbf\\x06\\xad\\xf2\\xd1t\\xb5\\x07\\xeb\\xc5\\x1c\\xd4f\\x18\\xd9\\xa9\\xa7\n^\\xc7."
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf78b\\xb0o\\x8b\\x92\\x01\\xf35\\\\x0c\r\\xe3\\xc9\\x13\\x18 \\xeb\\xf1cnb\\x82\\xd2\\xf4\\xea\\x94\\xa3\\xa4\\xe4\\x14\\x99\\xe7\\xa4\\xe0j\\x8b/\\xed\\xda\\x9d\\xd2\\xbe\\x96\\x02\\xc0yl\\x9a\\xbc\\xd60\\xf8\\xbb:\\x88n+\\x9a%\\xaf\\x08\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x0c\\x82\\xee\\xda\\xf0\\xb8\\x0en\\x882\\xab\\x1b\\xdc\\xa2\\x16|\\xd1w\\x8f\\xe7*\\xf6\\xd1\\x93\\xea&\\xd5mzl\\xf1;b\\x1f<\\xc8\\xc8\\x15\\x07s\\x01\\x13\\xcf\\xa7\\x84\\xce\\xe2"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\x89\\xb0o\\x1bw\\xfd\\xb8g\\xe1\\xb0\\xf1\\xb2c\\xf6\\x7f\\x92\\x9b\\xa1\\xff\\x99c\rr\t\\x838o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xecyw\\xf4\\xe9hq,zd\\x8c\\xf1\\xdea0&\\xc3/'\\xc4 \\x94\\x19\\xd2\\x90h\\xb0\\xea\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xeciy\\x938\\xe6\\xd3\\xb2\\xa9be\\xaf<\\x01w\\xda\\xfa!\\x96\\x04\\xfa\\xf8\\x04\\x91\\x14\\x03\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xbb\\x7f\\xda!u\\x83\\x0e:\\xad\\x913/\\xc3\\xa2\\xce\\x0c\\xa4q>\\x1c\\xa1\n\\xe4\\xe3\\xf3\\xd3\\xe2\\xe3\\xbd\\xb9\\x03\\x97\\x1f\\xec\\xfb\\xa4\\x1f\\x98n#\\xae+2:ft\\xd8\\x16r\r\\xb8\\x0b\n\\xbes\\x80s\\xcd?\\xcd\\xc05\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xca\\xc0\\xc5\\x876\"\\xdc\\xdf\\x8b\\xa7 b\\xea\\xbc\\x8f\\xb4\\x94\\xba\\xde\\xa6\\xb9\\xce\\xdc)\\x95\\xe3\\x89\\xf7\\xce\\x01\\x0f\\x89\\x90\\xe1y\\xf5v\\xb4\\xd5\\xc3\\xf3@\\x1a\\x84\\x0e"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xec\\xbf\\xe0\\xa9\\xa3\\xfd\\xfdw\\xb5\\x11x?o)a\\x9e\\x1c\\x129\\xe5\\x0e3`\\x01q\\x03\\x18;\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2\\x02\\xf0/\\x112b\\xf2\\xf2\\xfc\\xa7\\x01fk\\xd4\\x85\\xc0\\x1c\\x06\"\\x01#\\xcb\\x89>\\xeald\\x1c\\x17\\xbb\\x1d\\x9a\\xc3\\xec\\x7f\\xf5y\rl\\x94atc\\xe1\\x0b\\xee \\x9b\\xae\\x81\\x16\\x8d\\x00=q?\\x03\\-2\\xa1m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeek\\x87\\x0f\\xea\\xce\\x01t\\x0cq\\xa5l\\x83\\xecuw\\x08g\n\\xe2\\xfd\\xcc\\xbb\\xc7 \\xfd\\xbe\\xe3+<#\\xe4$s(m\\xb2t\\x1e\\x19\\x0e\\x1b\\xc92\\x0b\\x99"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ngc\\xa1\\x0cqo&\\xf2\\xb7t\\xf5\\xa3\\xee\\xf8@t\\xd9\\xde\"\\x9b\\xc1\\xa0fn\\xb1t\\xa1'\\xd04\\xf5f\\xadqh\\xac\\xe7m\\xb6\\xcbl\\x18\\xb1v\\xb9\\x14pl\\xea\\xfe\\xf3v\\xb5\\xedu\\x8d|du\\x05\\xb4\\x92\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"\\xebl\\x1ft\\xc0\\x01\\xa3\\xee'\\x19\\x8ff$\\x91\\x97u\\x94\\x9d>\\x97\\x0eh\\xa5\\x07%\\xcc\\x86\\xda,\\\\x85\\x11\\x15\\xfd\\xcd\\x82\\xa6\\xd3\\xe8\\x8e\"\\x83\\x8d\\x88x6"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\x12j\\xdb\\xbbw\\xf8\\xfb\\xcf\\x96h\\x8d\\xc9\\x90'*\\xd6\\xc8\\xf9\\xa8\\xe3\\x98q\\xdcp\\xc0m><\\xe6\\xd8-\\x050\\xd1\\xd9w\\xd7\\x9e\\xa4u\\xf3y\\x82\\xb2,\\xd65\\x0f\\xd5\\x12\\x1cr\\x8a\\xba\\xdb\\x0c\\x94ib\\x0bq\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\xe1\\xd8\\xf2\\xe4%\\xffb\\xa2\\x83\\x89\\xf7\\xeb5\\xdb\\x1d\\x9ao\\xa0\\xcdc\\xd5c,\\xcegm\\xec\\xb7\\xe3fcu\\x14\\x8b^\\xd9\\xa8\\x08\\xff \\xdc\\xce\\xa4-\\xa9zx"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc3p\\xca\t\\x90\\x82k4\\xc9\\xd69\\xa1\\xedr\\xb1\\xd5\\xf1\\x9d\\xf8\\xdc\\xc3\\xa2\\xed\\x82!\\xa1\\xbb\\\\xab\\x0etq>\\xb29\\xa4\\xf1!\\x93k\\x08\\xb5c\\xc8d\\xe2sd\\xe3k\\xff\\x11@^u\\xf4\\x13\\x0e\\x86\\xc3m\\xa2\\xdf\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbej`\\xd9o\\xc2bber\\x94\\xc30v\\xb6\\xf5\\x14\\xca\\xe0\\xba\\x16\\x05g&\\xb4\\x8a\\xc4\\x86\\xe9\\x8c\\xcb\\xa1b?|\\xbd\\x1e\\x9b~t\\xda\\xbc\\xa7\\xaf\\x85\\xdc\\xfa"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xa4\\xa6\\xb9(\\xe2./\\x12\\x15\\xc4r'\\xc9\\x8e\\xba\\xb6 @\\xf0\\xa1\\x8c\\x1d;+k\\xeb\\xd9\\x9a\\x1eq+\\xe8\n\\xd2\\xfc\\x07\\xc4\\xa6\\x00b\\xea\\xd0\\x05\\x8b\n\\xa8\\x90\\xd4#rd\\xad\\x9c\\xe7\\x01\\xab\\x99u\\x8f\\x9f:\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x9b\\xa0\\\\x86ad\\xbcak\\xb2\\xd8\\x19\\xbf\\xb0dm\\xb5\\x1a*\\x89\\xf3\\x17\\xf8s\\xbaq\\xdf\\xec\\x9a'\\xd2\\xcfs\\x0bz\\x05\\xb1\\xd5\\xb7\\x1a\\xb1\\x01\\x91;\\xfb\\xaa"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>bge\\xc7>\\xa4\\xca\\xc4\\xaf\\x00g\\x14\\xe1\\xab-+#q%\\x976\\xb4d\\xdb\\xdc\\x80\\xdck\\xe9\\x15d+5xdc`\\xeb8\\x03\\xd0\\xed.\\x8f\\xd8\\xf9\\xa2x\\xb4\\x9ak\\xb4\\xfaw\\x06\\xe6\\xd8\\xc5c\\xf1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-s\\xec\\xa7h?,a:sq\\xf8\\x00\\x06\\xc7f\\xa3jlq\\xaa\\x92%\\xfd\\xbb~\\xaa/\\xc1\\x9e\\x00\\xc4a\n\\x90\\x1d\\xcb=\\xb7\\xd5)\\xb3c\\x1f\\x10pk"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x0413\\xac\\xa3\\xbd\\xc0\\xdc\\x05\\xf9m\\xc4!\\xfc\\xe2\\x9et\\x04l\\x1df;\\x80\\x84^x\r\\xd5\\xbbn\\x14\\xa4<h\\x94\\x9e\\xf3<>\\xc2\\x86&\\xf70\\,\\xb1\\xf0\\x14\\xb2\\xe01\\x1a\\x95\\x1ah\\xe5\\x8dn1e\\x88\\x9e \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x1c\\xb2!\\x19\\xacv8q\\xc0\\xdc\\xd9d\\xef\\x80\\xc8i\\xf0\\xa62\\xb0\\x13\\xa8\\xff\\x9f\\xact<0jc\\xa2\\x15\\xb1y\\xc2\\x16o%\\x13hn\\xffip\\xbb\\x93\\xcb"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\xac\\xe1\\x0b0\\xa3\\xbe\\xe2`\\xdfi\\x8e\\x92\\xfd\\x7fvq\\xb0\\xdf\\x01\\xd2i\\x97\\xcc\\xc7\\xa1\\xe7y\\xea\\x85q\ny\\x9a\\xb3\\xa9\t\\xd9\\xab\\xc2\\xc2&\n7\\xef\\xae9\\x80\\x01\\xe4\\xb3\\xe7\\x8c\\xed\\xc4\\xc8\\x0b\\xd14\\x98o\\x14\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009\\xea\\xb0l\\x1c\\x7f\\xfa@\\x15\\x8d\\xc4\\x83\\x9dw\\xf3\\xdf?\\xd8\\x16f\\xc1\\xc4\\xfe\\xfc\\xf9\\xf3h\\x11\\xc4\\xe6\t\\xa1\\x7f\"\\xec\\xcdn;\\xf4\\xff\\xb1\\x17s\\x92\\xb1.\\xcc\\xad"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e_*\\x9ced\\xa2b\\x87\\xb8\\xf9\\xed\\xac#&6\\\\xe5\\xb1\\x85\\x1f4\\x97\\xbb\\x88\\x9eo\\xa3t\\xd4\\xaa\\xcf\\xf3_\\xa7=*\\xc8\\x7f%\\x99\\xdc\\xc9\\xf8:eo\\xbb\\x8ems\\xf0\\xbf\\xf4\\xff\\x01\\xc2wk\\x9d@\\x10\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x7f\\xcf\\x89\\xb3uy\\xa76\\xb6\\x9e\\x90\\x8d\\xae\\xe5\\x8b\\x14\\x9c6!u\\xaa\\xe6\\xc1l\\x93\\x10\\xceg\\x1fq\\xfa\\xa5ke\\x7f\\xcbb\\x84\\xabe\\x80\\x0f\\xf0\\xa8\t\\x9e"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xab\\xa5\\xf0k\\x80\\xd8\\xa7)8:h\\xa1r\\xc1\\xf7\\x1d(\\x95\\xbf\\xd0\\x7f\\x14\\xd0\\x95\\xcep6\\x1a\\xa2\\x86\\xad\\xb7\\x86 \\x1b\\xdc\\xfe\\x81ia\\xad\\x10isw\\xa6\\xed\\xa9\\x11k\\x87\\xa7\\xb9\\xe3kx\\xa6\\x8e\\x98v\\xccs.\\x19vfp\\xc7\\x8d2n\\xe7@\\x89\\x1b=\\xb6\\x04g\\xfd\\xfd\\x11\\xd9\\x89\\xf3\\xe3\\x98\\x19\\xa4\\xe2\\xd5\\x0b\\x82gj\\xaf\\xb8\\x98\\x1f\\x13\\x9c\\xc6\\xec\\xf7\\xf7\\x10\\x11\\x10tz\\x0e\\xba\\xff=\\x84\\xca\\xf0\\xff\\xae\\xc0b\\x0f\\xcb\\x13yg\\x0b\\x84\\xfe\r'q\\xad\\x8e\\xfd\\xba\\x1c\\x19s\\x16o\\xcb\\x1b\\x9a\\xa6@\\x98\\x94\\xea\\x9bw5:s\\xea\\xff\\xfcj\\xcb\\x97\\xf9\\xd7y\\xa4\\x08-\\x15e\\x01\r\\x93\\xc3\\xcao\\xd7\\xa8\\xdd\\xd9\\xd1l\\xee\\xfa\\x0ey\\xfeb\\xe5\\xde\\xddf\\xd0\\xfe\\x91\\x85\\xd3lu\\x08\\x04\\xe6\\x8d\\xcc\\xca\\xb24p\\xd0\\x14\\xb8e\\xfd\\xa1\\x04\\xa3\\x83\\xce\\xe1\r\\xdb\\x15\\x03!\\x84\\x9b\\xc6\\x84!`v\\xf1\\xb5\\x16\\x14\\x9b\\x19'\\xc2\\xde\\xcb\\xe1kx"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\xcd\\x06|e\\x90\\xf6\\xd4\\xd7s\\xefx\\xa2\\\\x9d\\x90#z\\x04#\\x90\\xfb\\x84v\\xb8\\xd1\\xe9gv\\xc8?\\xcc\\x05\\xf9\\x88$\\xd2f\\xa1\\x04s,\\xb1\\xadv\nd\\x80\\x04)\\x04=\\x8b\\xf7%#\\xbc\\xb1\\xc2\\xd1\\x84\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3@\\x8f\\xd0\\xc1\\xca\\x9d\\x0b\\xcf\\xf3\t\\xcdg> \\xb8i\\x89\\x82\\xb6\\xacy\\xf39\\xf34h\\xfb\\x1bv\\x1d\\xd6\\\\x16\\x87h\\xe2e\\xd1/k\\xbe\\xbam|\\x07\\xd5\\xa4"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xed\\xd8\\x93\\xd2\\xb7\\x9a\\x04\\x05u)j\\xdbv\\x9e\\x834\\x1fl\\xbe\\xd8\\xe3\\x1da\\x05\\xa35\\xb3\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xed\\x95\\x82\\xcc\\xf2o#muf4\\xc1u\\x1e\\xbc\\x18\\x08\\xb3\\xc5\\xd4z)\\x07\\xf5i=o\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xedx\\x17\\x90m\\xce\\xaf\\xb7c\\xd9\\x04\\x9b\\x93\\xb3\\xb3\\x8a\\x82j\\x9c\\xc4\\x89\\xb1\\x8a\\x1d\\x14v6\\x8ae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xed\r`enh\\xc4\\xae\\xeb\\xf7`\\xf3\tz@\\xb2\\x06\\xd9\\xces\\\\xdc\\xd6(d\\x97s\\x9b\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xed\\x178\\xc1\\xba\\xf1\\xcc\\x0b\\xae\\xbf\\xa8\\xb5\\xde6\\x9c\\xdd\\xec\\xeb\"_+\\x83:?ev/\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019m\\xed\\x98\\xb3\\x99\\xf5\"x\\xe6oy&t\\x91\\xbdb\\\\xc3j\\xbei\\xef|\\xd8tm9\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xbf\\xfdh\\xdd\\x18\\xb8\\xd9\\x08\\x85\\xb2\\xe0w\\x84|\\xeau\\xf8\\xd7*k\\x05\\x1e\\x1fw\\xf6\\x15des\\x8er/\\xcc8>p\\x86\\xa9+\\xf1\\xbb<+p\\xce\\xae\\xd91\\xbf\\xba)\"\\x8c\\xf0p\tf\\x02d~\\xda\\xd7?\\xb2lv\\xc7\\x17\\xf5k\\x91\\x83\\xc5\\xaf\\xb3\\x9a\\x9d\\x18\\xbd\\x1c\\xe9\\x18x\\xd0w\\x9e\\x18\\xf19\\xc2\\xe7\\xa2p'\\xdczs$\\xc4\\xad\\xa2\\x11\\xda\\x99\\x1c\\xa8\\x01)\\xd4\\x13d\\xa92>4p\\xa0\\x9c\\xa9\\xea\\x19\\x8c\\x12\\xd8a\\xc4w\\xad\\x13_i\\xa6\\xbeu\\x1az\\x98v\\x8f\\x17\\xf1/o#\\xed\\xe9+\\xbe\\xed\\x18\\xe5\n\\xbc\\x0fnfi\\x14\\xa1\\xfc\\xe9\nr&ez\\x01=\\x1du\\xd5n\\xa9\\x1d\\x03\\x0fr\\x8c\\x01\\xb4v\\xd0\\x01\\xda\\x14\\xe3j\\xa1\\xe9\\xe7\\x05\\xe6\\xa7=\\xfe\\xc3\\xf6\\xafu\\xeb\\xe1\\x0etna\\xf7\\xfcg\\xb2\\xaf\\xaa\\x83;\\xc7\\\\xa3t\\x12\\x8f\\xcc\\xddo\\x84\\xb7d\\xc1\\xb1\n \\xf8\\x96\\xc7\\xe1\\xc6$_\\x12\\x14e\\x86m\\x88\\x9aj\\x9d\\xe7"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ta-\\x96\\x95m\\x8c3t&\\xe1a\\xd9\\xc9\\xc9\\x9b34\\x1d0\\xd8\\xbf_\\xbaq\t\\xc4\\xa2f\\xa0c\\xcf\\x82\\xee\\xd5;\\xe5\\xda\\x03\\xeb)g \\x951\\x13\\xd7k\\xe4l\\x8d\\xb9tnc#i\\xbfj\\x91t56(\\xec\\x8cm^m\\xe5,<\\x1f/\\xe7\\xc01\\xc4m\n\\xe9el\\x07\\x8b5\\xdf\\xc3\\xdf\\xee\\x02\\xf1\\xaa\\xd5\\xd5\\xec\\x07h\\xb8c\\xc27\\xf2\\xff\\xbal\\x7f\\x8d\\xfe\\x0e\\xe5-8\\x92\\xef\\x1c4\\x00\\x07lj\\xa3^\\x94\\xf1\\\\x983\\xf5\\xd2\\x18/\\xeb\\xb5\\x84\\x95\\xc9mz\\xfcz\\xe7\\xc15\\xfddrvj-\\xdb~\\xeapk4r\\x16k\\xd9\\xde`\\xc8\\x85\\x85\\xf0v7\\x88\\xb4r\\x90\n\\xbf\\xa7\\xb9\n\\xbd&b\\xb0\\xff\\xac\\xab\\xb85\\x1d\\x12s\\\\xe3s\\xc8\\x9a\\x96$w\\xfd\\x91\\xca\\x9a\\xd5\\xcbt\t\\xaf'\\xa82\\xb73nl\"z\\xc95\\x9e|v\\xcc$\\xd5s\\xdd\\x90\\xbb\\x11^\\x9c\\xa4\\x06\\x97\\xc4\\xaa<w\\xa2\\xd4 \\xa2|\\x8c\\x02ts"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xa7\\xac\\xfbw|7\\x1ez\\xef\\x9co\\xbf\\xba\\xb5\\xd59v\\x04\\x98\\xb2\\x8fs\\xf7\\x07\\xb4z.\\x86\\xd9\\xc0\\x94\\xe3\\x9e6o\\xb8\\xbf\\aa\\xc1`z\\x7f\\xdb\\x97\\x86\\xd7qe\\xbc\\xe5\\x00\\xd3,\\x9c\\xda\\x94\\xab\\xd7\\xfc\\x90\\x82\\xa2\\xa6^n\\xea\\x13\\x03$\\x81wc\n\\x9c\\x15:\\x89k\\xf0_\\xd9\\x11\\x19\\xaf`\\xebx\\x82`d\\x93\\xbe$+\\x1e$g\\x8b\\x91g\\x8a\\xbe\\x0e\\xef\\xbcu\\x8c\\xcag\\x147\\x91y\\xb0e\\xe72\\x03\\xdbj\\xd3\\x88\\xfe\\x8c\\xcd\\x05\\x06\\x84\\x86\\xb3f\\x00\\xbb'c6\\xb7o7\\x91\\xb9\\xdb8\\xe3\\xec=\\x12\\x159\\x87\\xba\\xe0\\xca\\x8f\\xcd'm\\x00\\xf8\\xc2?\\x99\\x98t\\x946\\xa0\\x9f\\xa3\\xd6d\\x8b\\x12h\\x0e\\xd8\\xd5\\xfa\\xab\\xd5\\xc2\\xe5\\xbb\\x97\\x99\\x16&k\\x15\\xeb\\\\xe1\\xc3\\x98\\x06\\xee\\xa1\\x88\\x8e\\xc0re?p:\\\\xe7a?\\x91\\xdd\\x8b\\x86\\xe5\\xb9\\x016:\\xe14\\x01\\x07\\x82\\x97\\x813kt\\x87\\xb8\\xf2\\x95\\x87\\x1cp\\x05\\xf0b\\x1e\\x83z\\xb8e\\x96\\x89"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xbde\\x13\\xf3\\xa9\\x9bmzh\\xff0\\x89\\x7f7\\xc0\\xc9\\xc3\\xf7\\xc83b\\xf5\\x0f\\xbbe\\x8d\\x8a\\xc2s\\u\\x15\n\\x1ds\r\\xb3\\x84/\\xa7\\xae\\xb7gqch\\x07\\xf2\\x84d\\xb1i\\xcb\\x08\\xdf\\x1d\\x0c@\\xe1\\xf0\\xebo\\xe6d\\x98\\x8ae\\xcb\\xa3\\x838v\\xa1\\x0fe\\xd3\\xe8\\x98\\x0f~.\\xcde\\xea\\x9a\\x1a\\xad<\\xec\\xe1\\x0b\\xd7\\xd8^\\xb6q\\xe0)\\xd2\\x07;g\\xe3\\x0c\\x92\\x10\\x83\\xbb\\xac\\xf7\\x1e\\xfe$\\x8c|\\xb3\\xd2j?r\\xa1a\\xce2>4a\\x0e\\xd7#1mr9\\xd7\\xa5)\\xd6~\\xc2\\x04oh\\xa9a\\xef\\x95cm\\x03\\xa17\\x0c5\\x0b\\xd4\\xf1\\x06\\x87s\\xb5\\x82\\x1c(gr\\xb1\\xad\\xc9\\xdf\\x1b4\\xd4-(e\\xe5\\xd5d\\xde\\x02v\\xff\\x9e\\xe6\\x8d\\xb5\\x0b\\x9e\\xf1\\xd2\\xff1\\xb3\\xcb+\\x99\\x81\\xc8\\xa1\\xa4k\\xc6\\xc82)\\x94\\x14\\x1e\\xb7v\\xe0b\\xe5i\\x03\\xed\\xb9'\\xc4&\\x97\\xc2\\xf0\\x92\\xeea\\xc3\\x9c\n.c\\\\x15\\xdd=\\xedeb$\\xc8s\\x1d\\x0f\\xff\\xd4(\\x1b"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\xd04\\xf5\\xe6\\xfa'\\xd5@\\xd4\\x85\\xcd(wh\\xa6js\\xe4\\x961#lvt\\xd9ojv\\x88\\x9fp\\x88r\\xa7\\x9b_\\x1ec\\xf0k2\\xcb:\\xbd\\x0b\\xd6\\x87\\xc8\\x12\\x1a<\\xf2\\xeb\rt\\xe9s\\xd1\\xfa\\x1f\\xf8\\xc0\\xc5\\x84\\x16d\\xce\\x99.\\xe0\\x1a\\xa9\\x1c|\\xffu)\\xe8q\\x84\\x01!\\xb7vj\\xaf\\xc5\"x\\xa8\\xf2:i\\x01r\\xffh\\xb0\\xe1\\xca\\xe0\\x9cm\\x0e\\xc0\\xdc\\xbb!$\\x07\\x13\\x12\\xa8\\xd5\\xd8\\xcd\\xbc\t\\x14\\x1c\\xb5\\xe2of\\xe9\\xa0\\x89h\\xa3\\\\x7f\\xde\\x97\\xd4o(\\xf3\\x9f\\x17p\\x8b\\\\x1c\\x81\\xf2\\xfe\\xf7\\x84\\x0f\\xa01\\xa2\\x9b\\xe8\\x8a\\x1b=3y\\x82y\\x06'j1f\\x98\\xb4j\ns\\x96\\xeb\\xa7d\\xaf\\xc2;\\xf9v\\x04\\xd0,9k\\x9eq\\x99\\xe7\\xd8p<))b\\x82jz\\x9f\\xe9\\x1d\\xd4\\xaa8\\x02\\x80b_\\x9a-\\xeb\\x98\\xda%\\xfa\\xd9\\x1f\\xc1ol\\xd3d\\xf1\\xb3n\\x1e\\x90)u\\xe8\\xc9\\xb4\\xa8z\\xa8?7\\xb0\\xf4\\xd1\\x84\\xf3j\\x19\\xf3\\xa3\\xc5\\xca"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\\xc0tsjdg\\xa28\\x9f/\\xe5\\xf5t\"_\\xa6\\xf8\\xc6\\x1a\\x04\\xec\t~\\x83\\x02\\x94\\xe7q\\x9c\\xb7\\x8a)\\xf1\\xa7\\xe6\\xacd\\xeb\\x9f\\x04*g\\xb1\\xd6\\x80=\\x86h\\xd8-\r\\x8f\\x18\\xce(\\xb35\\x95\\xdb\\xd0\\x8fq\\x1a\\xfd@\\x80\\xd6/\\xd2d\\x90\\xe0<\\xe6o\\x9c\\xb9\\x86j\\xe9\\x00\\xb3:x\\x91\\x01\\xf5\\x07\\xfd\\xcea\\xcd\\x91\\xa0\\xb4+\\x0bb\\xbfu7\\xd5\\xe3\\x88g\\x1b\\x86u\\xb3f\\xd7\tu\\x923\\xbd\\xac\\xd9\\x9e\\xa52\\x1f\\xca:\\x07hz/\\x947\\xd6\\x05\\xe2\\xcbq\\xbf4\\x85\\x1f\\x18\n\\x86\\x0bp\\xff1\\xddfe\\xd8\\xd0\\xfd\\xd5\\xd3\\x84\\xd77\\xf6\\xe4-)d\\x14\\x9d\\xb5b\n5\\xd2\\x01#~\\xe0\\xdfw\\x85 \\x18\\xa0\\x19#/\\xf8i\\x00\\xb6\\xfe\\xba1\\xb12ay\\xdb()i7\\xfc\\xf1g\\xfb\"\\xf2\\x0e\\x95\\x00\\xc5r4xf\\x9c?m_)\\xfe\\x04\\x1a\\x14\\xdc\\xecwk\\x03\\xcaa8\\x83;\\x8ae\\xbb\\xbd\\xb0\\x8a\\xf4\\x0euz\\x80\\xb2\\xe6"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c\\xe9a\\xe5\\xc5\\xf1\\xfc\\x0f\\xfb\\xcd\\xa2\\x93\\x81\\x0f/uh\\xe2\\xc2o\\x87\\xe5gq\\x8e\"o<\\x1a\\x9e\\xca\\x03\\x94mj~\\xf9\\xf4\\xdf~\\x08x\\xe4\\x8d\\x99p\\xb0 b\\x11\\xbfp!\\x9c\\xb0\\xd0\\x01\\x1c2mg\\xd3\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91\\xe8y\\xb5\\x13\\xd5a\\xab\\xe4\\xf7\\xab\\x11n\\x80\\x8c\\x9e\\xd3l\\xa96\\x89\\xf0\\x84\\x029\\xaf\\xa5|;\\x0e\\xee4\\x17#?\\x0f#\\x16\\x90\\xd0$\\xbe\\xff\\xf8\\xef\\x0fw\\xba"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xfe\\xce\\xcb\\x86\\xa3\\xce\\xce\\^\\xa1\\xe5\\x98\\xf3\\x00\\xa8\\xf0ux0\\xa1\\x0b\\xfe\\xf7\r7\\xa1\\x89u\\xbb\\x80\\xb7qx\\xc3\\x00\\x8e\\\\xc7\\xfa\\x94\\xf9\\xa3\t\\x9e7\\x14\\xb1\\xb8\\xd9\\x82i\\x86\\xd0i_x\\x87\\xc3\\xa2\\x00/\\xac\\xba\\xcdn\n\\x1f\\xca\\xf8u\\x98\\x19\\x85\\xf1\\xb0h\\x0f\\x9b@\\xe4 \\xd1\\x9e\\x8a\\xd0\\x98\\xf3\\xbc\\xf5\\x14\\x9a7sb\\xa9\\xe1\\xe4z\\xe14\\xa2&\\xd5\\xa9\\x9a\\xfa\\xf2\\x0e\\\\x96\\x042(\t\\x18\\xd22ryz\\x0c\\x03\\xecw\\xa0\\xe8\\x06\\x9bk\\x8euu\\xc8ra\\xe2'z\\xa9\\xed\\xfd,\\x9d\\xbc\\xb8\\x9b\\x1c!n\\xf1\\x82\\xbb\\x91\\xde\t\"\\xd3k\\xed\\x06kv\\xe1\\xb8\\xcf\\xc0z\\x18z\\xaf\n#\\x86v\\xb1\\xff\\x13z\\xcc\\x0bq\\xc9\\xb0z\\xbfk\\x85\\x13n\\xca\\x9e5\\xac\\xbb7\\x07\\x94\n\\x85\\xe9\\xc01i\\x02\\x9c\\x12\n\\x8e\\x02\\xda\\xa2\\xfa=\\x16\\x03\\x98s\\xa9\\xeed\\xf8+|\\xcf3s\\xe2\\xb7!\\xb0%\\x02\\xba\\xd6)\\xe1\\xc9|\\xaa\\x1c\\xfe7"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043/$b\\xd0b\\xc12\\xe9\\x8ds\\x8b\"\\xb9=\\xc5v\\xb7\\xe7\\xaf\"\\xcc\\x10d\\xd1\\x9d\\xee3\\x98\\xac\\xce\\xd1\\x805j\\xc4\\x08y\\xd2\\x95k\\xbe\\x9a\\xc6yg\\xecc_\\xc4\\xf5\\xb4da\\x0c!\\xc0\\xc47\\x80^~j\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\x9f\\x025_9<a&\\x86r\\x8c\\xae\\xa9\\xfb\\x00\\xeav\\x00w'\\xc6ll<\\x9f\\xac\\xb4\\x15bn\\x8b\\x99e\\xecw\\x82'z`\\xc8n\\x1f\\x1c\\x15\\xeak"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6e\\xd2\\xcb\\xe9-\\xff\\xa7\\xbaa\\x15\\x1e\\xe7d\\xa5\\xfe\\xb9k\\xc6\\xd3#\\x1f!\\xcc>\\x15\\x84\\xfef\\xb1\\x97\\xe5\\xf2\\xd3\\x97e\\x04\\x01\\x02j\\xe7\\x9a\\x99\\x06\\x17\\xbe\\xcd\\xc3<bi\\xbd\\x889\\x0cd\\x04\\x0b\\x96\\x14\\xb9\\xf3\\xbc\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\x08\\x90\\x0c\\x7f|\\xd6:6\\x96c\\xee\\xf7i)\\xe0b4\\xeb\\x9f\\x08\\x96y\\x12q\\x89\\xa8i\\xb4\\xec%t\\xd3\\x8d\\xa7\\xf8\\xb80\\xfd\\xd8\"\\x93\\xe3\\x11\\xc6\\x0f7"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\xa4\\x04!\\x81\\x03\\x8a\\xce\\x9d\\xbb\\xc2\\xc3'j\\x93\\\\x18$\\xa2lwi\\x8at\\xa7i\\xaaq\\xbd\\x9d3\\x8d\\xa3\\xcce\\xf4\\x0f\\x02@\\x8f\\x04\\x19\\xe5\\xa5^\\x84t9x\\xe1\\x80\\x9a\\x0f\\x17\\x8c\\x858\\xf6g\\xad\\xd6\\xdf\\x1a\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\xdci\\xdf%\\xa6l(.\\x0b:\\x84\\xe6\\x9f#\\x87g\\xac\\xfb\\x08\\xd0.\\x05\\xac\\xe4am\\x95\\xde=qd\\x1c\\xd7\\x8d\\xf1\\x0f?\\xbc\\x9c<\\xe1\\x92\\xe2\\x04\\xe4\\x8e"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xef\\xaaj\\xab*\\xb6l1\\x04\\xf5\\x00\\xdc`\\x8a\\x86\\xf7\\xce\\x0b(\\xfa.\\xf6z\\xcc\\xf4q\\xf8\\x08\\xf7z\\xc8b\\xe8\\x96\\xcd\\xc2wvbn-1;\\xc9\\x07\\x1e\\xdf\\x90cn\\xb5\\xdd\\xe2r\\xe3\\x1d\\xe9\\x0b1y\\\\x83\\xdc7\\xfdx\\x04\\xb6;\\x1d\\x1f\\xda\\xf0\\x91k\\x12\\x0f\\x00\\x96\\xb0\\xb3\\xbew\\xc4y\\x959\\xe9/ \\x1d\\xf6:\\x97\\xc1\\x0e\\x91\\xa8\\xcbrw\\x80h\reh:\\x8b\\xba\\xadh\\xf6\\x8ce\\x00\\x00\\xe1\\xd6\\xca\\xa8\\xf8p\\x83\\xb7j\\xe4%\\x05\\xb6=9\\x83\\xa3\\xf7\\x93\\xd2er9\\x94\\xc8jfl\\xf1^.\\xa5\\xa9kz\\xea\\x073\\xc7\ry\\x01\\xa4g\\xbeq\\x10\\xbdf\"\n\\xb9\\xcdv\\xb2\\x90t\\x1ev\\xe6x\\xedw_\\xd4\\x99\\x0f\\x1f\\x03\\xbe\\xa6xg\\x1b\\xc0\\x1b!\n\\x95e\\x16\\xd7\\x85.\\xc1\\x085\\x063\\xc7\\x84\\x84,\\xa9\\x9cj\\xb5;\n\\xf1\\xcbnd\\xec\\x9d<\\xb3\\xe3\\x15u!a8\\xcb\\x0e\\x9b\\xa9\\xa5m\\xa1\\xa4\\xe8\\xff\\x1f\\xf3\\xa5m\\xc1\\xd1m"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\xd3\\xa6\\xcb\\x9aoq\\x85tcy\\x80\\xa3\\xb5x\\x85\\x06\\xc4\\x92\\xb4\\x13w\\xff\\xde8a\\xe3'\\xdd9\\xb1.v\\xc6\\xb1\\x7fot\\xa8\\x8e~\\x01\\x0b\\xc1\\xf7d\\xa9\\xbed9y\\xe5b\\xc3\\xd8\\x16\\xba\\xda\\xc4f\\xbf\\x06\\xba\\x0cn\\\\x0ft\\xb3 q\\x04,r\\x89st>\\xcb\\x98,\\x89<\\xa4b$y\\xa2\\xcef#3\\xed\\xef:i\\x9f\\xcej\\xfaf\\xb2\\xdai)fz-\\x97c\\xcf%\\xd0\\xcd\\xb8i\\x89%q\\xed\\x14rd\\x96\\x8c\\xf4\\xd8\\xe1\\xe2`\\xa7\\x94f\\x84\\xcc\\xce\\xac\\xd3\\x1ddr\\xb5\\xf28a\\xdbq\\x81@\\xde\\xfe\\xeb'\\xd7\\x16l2$\\xf8\\x80\\x9a\\x9b-\\x87,\\xbe\\xdd\\xdc\\xf1\\x7f\\xbb\\xe0\\xcc\\x81\\x81v\\x89\\x18n\\xe5\\xe4\\xad\\xe8\"\\x9anasc\\x0b!\\xf5?\\xbe\\x08g\\xf6\\xf6\\xaba\\xf4a/\\x0fk\\xbe\\x13\\x94\"/g%\\xa1|\\xa9\\x10\\xab\\x1da\\xda\\xf9\\xf1z\\x11\\xae\rzg:\\xbd|\\x84\\x99u\\xd5\\x8c\\xda\\xeb\\x14i\\x16o\\xa7\\x08\\xedt\\xd2"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7o\\xcd\\x0f\\xc6\\x99x\\x16\\x9b\\xe2\\xd26\\x19qh\\x12\\xe9\\x1c\\xba\\xbc\\x00\\x9b\\xed\\xd2\\xd5\\xbc\\xba\\xee\\x9b\"\\xfa\\x89\\x0e~\\x1a\\x12\n_\\xe3\\xd9\\xa1\\xf9$\\x90mc\\xebl\\x01w\\x04`=p\\x10\\x9b \\x05j\\x15rg52\\xd5\\xff\\x9fsywj\\xbbx_\\xe6\\x87\\xbb\\xbe\\xbb|\\xdau\\xcb^h\\x8d\\xe5\\xf9\\xd9+\\xea\\x17y\\x96\\xf5\\xcfp\\xca\\x12\\xc7\\xf5\\xe4,my\\x7f.n\\xd4\\xb2\\x03\\x11\\x14'\\xc8\\xde\\xc8\\xfa\\x95\\xa7\t0\\xbd\\xe2\\xd9i>\\xe6w\\x854\\xbbw\\xec\\x96vyhq\t&\\xbcs\\xc3o\\xa1\\xacn%\\x9dek\\xe7\\x98j\\xbe\\xf9\\x11 ll\\x9f\\xb2\\x12`\\xf7kby\\x9e\\x8f\\xa8\\xc4nu\\xc4\\x10e<m\\xa5\\x8dk\\x88\\xaa\\x17\\xe7j\\xe3i\\xa2\\xbd\\xa5&=\\xc5t\\xbf\\xe5\\xda\\x14\\xc0?\"\\x7f\\xfc\\xb05y\\xf3\\xc3\\xeb\\xae\\x19\\x02\\x9e\\xfda\\xfc\\xbe\\x07\\x15ls4\\xcefl\\xf6\\xdc\\x83i\\xd9\\xb8\\xe0\\xa2>t\"\\xb2mr\\x98%\\xbb\\xe0\\xd1"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xc6\\xc0\\xbe!\t\\x08>\\x99a\\xe33\\xb1\\xd7\\xf6k\\xcd\\x02\\xe5\\xc1\\x9f\\x89;\\xa5\\xc5\\x87\\x87\n\\xd8\\xdc\\xb2\\xa8\\xc7\\xd0\\xb90/\\x93\\x9b\\xc0\\xe6\\xfb\\xaeu\\xcb\\xa5\\xa6\\x84\\xa6\\xa3\\xa3i\\xaf's\\x14\\xd3j\\x95m\\xc7\\xb4\\xbd\\xfe\\xb4\\xd6\\x96\\x05@p\\x12\\x92\\xf5\\x9e\\xf6d\\xa3\\xfa\\x9f\\x16\\xa8\\xeb\\x04\\x8d\\xfc\\xb2$9\\xea\\xf1\\xfd\\x99\\x9d^\n\\x82\\xbb9k\\xea\\x01\\xdf\\xde\\x96\\xd0r!jl\\x1e\\xabg\\xf1(\\x12\\xe2\\x12u\\x83\\xab\\xdd\\xf1\\xcb\\xf0\\xe2\\xa9\\x91#\\xaa1\\x93\\xd4\\xef\\xec\\x88\\xed\\x0b\\x07d\\x8c\\xcbk\\x7f;:c\\xe23\r\\xefw\\xbalj\\x97\\xa6\\xa7p\\x1f\\xc7\\x11\\xd6\\xbc\\x9c\\xd9\\xb2\\x91\\xce\\xe2\\x06 \\xb1\\xd5\\xaa\\x87\"\\x98\\x0b\\x8c\\xb5q\\x82\\x8d\\xb6\\xc5\\xd8e\\xd1 \\xe8\\xc9\\xd9\\xfe\\xc4\\xe5\\x14\\x98\\xf4\\xeb\\xc5\\xa8\\xaah\\x04\\xb3\\xf9\\xc2w\\xe3z\\x93\\xf7\\x04i(\\xefcnq\\xfc?f\\xcdop\\x07\\xf7\\xeag\\x13b\\x7f\\xb4\n9\\xfa\\xb0\\xc1\\xf0\\xdd\\xf2<\\xd9r,\\xf2t"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xdd\\xb7h\\x13/\\xc6\\x01\\x9f\\xea\\x1a\\xe2\\xb9\\x88v\\x1afw\\xcd\\xc07\\x8f`z\\xb8\\xcd\\xbc6:^r\\x18l\\xb5\\x97/\\x11hg\\x04i\\x1f'\\xfcv\\x9b\\xa9;\\xc3u\\xce\\x81\\xbclv\\x97\\xe6\\xb6\\x9e~r\\xe6^\\xdc\\xa0u\\x9b\\xe6\\xa7\\x83\\xf7*\\xea&\\xe1\\xf5\\%5e\\xdd\\x14\\x98^\\x9e\\xd5\\x9e\\xa7i\\xae\\x93\\xe6h9\\x8f\\x08\\xf6\\xcd\\x16*\\xd5:e*f\"\\x9a\\xe0\\x08p\\xcd\\x02#\\x13\\xd2\\x13)\\xe5\\x05\\xb8q7\\x9c\\xb3b\\xce\\x8dkey\\xb3b\\xc8q>\\xd72a\\xa6f\\x90j.\\xf7y\\xa0\\xdd\\xc1\\xeb\\xa6\\x13\\x15\\xd7\\xbb\\xef\\xdf\"p\\x1b\\x80\\xdcn\\x93\ti\\x87\\x16\\x11\\x83\\xa5\\xffh\\x97\\x99\\xb6\\x9dg\\xc1\\xd8\\x8e\r\\x05\\x8a\\x12\\xae\\xd5\\x03o\\xeb\\xc2f\\xf5\\x9d\\xd7\\xcd\\xdc\\x8di\\x97\\xb9<\\x8e\\xdfr`\\x8f\\x98r.\\xf9\\xed\\x02\\xd3\\xe4\\xd5\\x8ec\\xfdw\\xaf\\xdd\\xd6\\x98\\xfd\\x8fi\\x1e\\xf9l\\x11u\\xf9\\x1b\\xf2\\xae\\xcfxm$g,\\x84z\\x1c"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa73\\xcd\\xb4t\\xb2xcdk\\xed=7\\xeeo\\x81\\xaa\\xf2q\r\\xe8\\xba\\x8e\\x01\\xce\\x1d\\xe5dq\\xf3\r\\xbf\\xe8\\xc6k\\x19\\xbc\\x968\\xf3\\xe49/\\xc7\\x04\\x93\\x184.\\xc2x\\xfd\\xb6\\x92\\xe7\\x8f\\xa5\\xb8\\xa1\\xa4'@+\\xa4\ro\\xe9\\x8d\\xb0\\x8f\\xb1n5\\x1a\\xd5\\x9ab\\x07\\xa2\\xf3\\xc8y\\xd8qs\\xa0\\x9b~\\xa3\\x1c\\x93\\xd0\\xc6\\xdav\\xd6<\\xc6\\x90i\\xfc\t\\x99;\\xb2\\xcd\\xb33+q\\x93\\x14qp\\xe9s\\xc6\\xb2s\\xda\\x18\\xaf\\xf2\\xd8z\\xe3\\xa8lev\\xd2wf\\x8fz5\\x10\\xd6\\xb5\\xecjr\\xb9vb\\x9f\\xca\\x89n\\xc0\\xfd\\xfco\\xb1\\xb3\\xc3!o7\\xa4\\xda$\\xca\\x13\\x95\\x12$\\xdbz\\x8c\\xc2\\xd8\\xa1\\x0e\\xf7\\xc6\\x84\\xef\\xaf\\x8a\\xd2\\xa6t^\\xb4x\\x05\\xb8;\\xf4\\xc3j0\\x85\\xc1l\\xb3\\xaf;g\\xce\\xd8)^x\\x907\\xb0\\xa7\\xe3\\xbau6\\xb9e\\x14h\\xe7\\x1as\\xc7\\x8e\t\\xa2\\x92\\xaf\\x9c\\xccg\\x83<\\xbf\\x96\\xf5\\xe81\\xc6*\\xfe\\xa7\\xec\\xae\\xc5)\\x92\\x14\\x8dz"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2n\\xf3\\xc9^\\x97\\x142\\x0b\\xf6s\\xe4\\xdb\\xd4\\x15\\xa7\\xfa\\xdd\\xaa;\\x8cx\\x89\\xf5\\xdfjk\\x13\\xf0\\xc3\\x1f\\x81f\\x97\\xdc\\xfb\\x92ka`\\x7f\\xb9\\xa0bu\\x02\\xc7\\x94v\\x1fm\\x08.\\xd0\\x0b\\xd6\\xa3%\\x16j\\xab\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8\\xa2\\xff\\xb6v|\\xdd\\xecm\\xed\\xf8\\xbb\\x83h\\x17\\xac-w\\xdd\\xc8\\x95l\\xc2\\x9a\\xbdz\\xc5\\xb1\\x17\n\\x82_<\\xf3\\xf82\\x9c\\xb1\\xfa\\xc0\\xf6k/\\x9f\\x10\\xf4"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19\\x876\\xba\\xee\\x0b&\\x06\"3\\xf1\\x03\\xf3\\x00\\x16k#daim\\xf9dm\\x0b;\\xacz\\xc9j\\xcc\\x0c\\x14\\xbc\\x8a\\xf1\\x97\\xfd\\xff\\xc2\\xdd\\x88d\\xedxs\\xb4\\xcd\\xc7\\xaf\\xdd\\xf8\\x0b\\x81\\xb1f\\xefm\\x96t\\xd0\\xc3\\x03di\\xca\\xd4v,r\\x1c\\x90\\xea\\xc0\\x1c\\xbd\\xe0!\\x96\\x07\\x85\\xc2\\xb52a\\x1d\\xe0\\xb2\\xf7\\xda\\xbf\\xc3\\xa2?sq\\x11 \\x9e\\xfa\\xbe/\\xa5\\x1d\\x1dv\\xa1\\x0c\\x9a\\xf7\\x85r\\x04\\xad\\xdd<t\\x8d\\xda;\\x1a\\x93&\\x11\\xe0\\xcb\\x83e\\x13*\\x0c\\xd9\\xab\\x85\\xf2\\x95\\x1b\\xd1e\\x90\\x17v\\xe50\\xb1\\xdbc\\x15\\xb2\\xe1\\x86\\xd5\\xa0x\\x9e\\xe7$\\xf2\\x99\\xb6\\x81\\x01,\\x83\\xce\\xcag\\xb2a5~\\x92&\\x90\\x95\\xa8\\xf3\\x03\\x19;>\\xeb\\xc5d\\x86\\xfe\\x1b\\xc1t\\xe1\\x07b\\xa0\\xd7\\x1f0*\\xe8\\xc8\\x85\\x11\\xbd)\\xf2\\xe6\\x1f\\x8ej\\xae\\xb6\\xa5\\xf4\\xa4\\xb4\\xd6>\\xcd\\xa6k\\xec\\x18\\x0c\\x92ii\\xd6\\xb8\\x8d`0\\x00\\xf7\\xd5\\xfd\\xc7\n\\x96\\xdc\\x84\\xe7\\x89h\\xfbt\\xf2b\\xdam"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xcc\\x93\\x1d!q\\x93u\\xef6,\\x17\\x11\\xc5z\\xe1\\xcb&\\xbddpog?os\\x80\\x9b^2gv\\xcf\\x84\\x0b\\x0e<i\\xd6#\\xa7r\\xe0h\\x89qz\\xa6\\xbe\\x8f\\xe1\\x1ag\\xb4\\x85\\xee\\xf3m$;\\x91\\xf6y\\x8b\n\\xeb\\x87>\\xf90\\xc3\\x1e\\x8cn\\xef\\x86\\xd6\\xcc7\\x99\\x08\\x1b\\xa9\\x84\\xcf\\xdb2\\x17g1\\x9d\\x13o\\x7f\\xa1\\xacn\\xf7o\\x86\\xcao\\x17\\xa1j\\x14\\xc3\\xc1\\xb3vi\\xe0ka^\\x9a\\xfe\\x9c\\xed\\xdc\\x05wtp\\x1c\\xa4\\xbcw\\xe6\\x8ex&\\x96\\xe1\\xaa\\x9f\\xc4\\xe1\\\\xcd\\x15\\x80\\xa3\\xb2\\xd6~\\xb0#\\x04\\xb1p5\\xb4^\\x9c\\xf5\\xd4\\xbcl\\xd7\tj\\x0e\\x13\\xa0\\x03\\xa8|\\\\xb87\\xfe\\xa5\\xa9! \\xfc\\xca\\x9a\\xa7\\xd1\\x92\\xf87^\\x08\\x997q\\xf90\\x0b\\xad\\x85\\xa2y\\x15\\xbb(\\x02\\x0b&=8b\\x03\\xb4\\xdac\\xdf\\x11\\x9b\\xc4\\xc0\\x10,4\\xe3\\x90k\\xcb\\x82\\xd6#\\xc5r\\xd3\\xed\\xbd\\xa9%\\x05x\\xb8\\xf2j\\xa5\\x155\\x19\\x06\\x82\\xf6-\\xf5wp>\\x80"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\x87\\x99s\\xd9\\xef?!%\\xcfr\\&\\xd7\\xec\\xd4\\xc2\\x82z\\x1b\\x02\\xebd\\xfd/$\\xd6\\x830\\x07\\xf6\\x95\\xe3\\x07\\x13\\x19\\x85\\xd2\rq\\xec\\xf4p_h8\\xad\\x95\\x81\\xaa#\\xafd\\xba\\xc8\\x12\\x92\\xa5\\xa9\\xcf?\\x14/#\\x0c\\xb0\\x1d\\x9cl\\xea\\x00v\\xfay\\x05\\xdd\\x1ez\\xc8\\xb2bf\\xe6\\xa9\\xe3\\x89n\\x88\\xc2\\xa2z0yp<\\xdec\\x94z\\x04y>j\\xe6\n\\x87e\\x9e$t-\\x05\\xf9;\\xe4\\x1f\\xe1\\x8e\\xcc\\x8en\\xef\\xbb\\xb1`d\\x8e\\xa1\\xd5k\\xb7\\x0f/\\xc7\\xc4n\\x9c\\xa1\\xda\\xea+l9\\xc6?\\x92+\\xbf\\x83k\\xae\\x99\\xbc\\x94\\xb7\\xd9\\xff\\xcf\\xb8n\\x93\\x14\\xee\\xbd\\xc2\\x9eb\\xd2?\\xd9\\xe9j\\xba\\xc5\\xd5mgeh3\\x99\\xcap\\x87c\\xdd/\\xae\\xce\\x95\\xee4\\xb1\\xea\\x88\\x0cd\\xde\\xc3\\xbb\\xab)\\xb5(\\x97<\\xce\\xa6a\\xb5\\xd2\\xaa\\xcd\\x9e\\xe9\\x9d\\x0b\\xe5(\n\\xf1slq\\x84\\xf9\\x82\\xa2\\xbdg\\x15\\xf6\\xc2$\\xc2:\\x8d\"\\x93\\xa2air\\xa7\\x00"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\xb4h\\xdc\\xeat=\\xdap\\x11\\xad\\xbb\\xb1\\xee^\\x08\\xb4!\\xb4.\\xb8\\x98\\x94\n\\xb2kv\\x0f\\xee\\xb2\\xfcl\\x05\\x8f\\xb6\\x9d~\\xff\\x846\\x04\\xde\\xe1\\x8b\\xe9\\x91\\x01\\xe4\\xe6\\xb0\\xdc\\xb6p\\xea\\x05\\xd7\\xc3n\\xa6k\\x8a\\x14\\xd0o\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\xeb_\\x0b\\x15:\\xd6\t\\xbf>#\\x18z\\x82\\xef\\x0e\\xde\\xc3\\x01\\xf5;\\xffj\\xd5\\xb2)\\xe9w\\x9c4wxx^\\xf2\\xec\\x13\\x07vj5\\x1c\\x1f\\x9a\\\\xdan\\xed"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xff\\x11w\\xfc\\x89\\x18q#\\xe1#p\\xa6\\x7f\\xf7\\xa9\\x9f\\xd5\\x08\\xe3\\xb9osr\\xc2\\xd2\\xb7e\t\\xc6\\x1a\\xc2h\\xa6\\x06\\xc5\\xc8u\\x87`\\xef\\xc5z<\\x04\\xed\\xa1\\xc3\\xcb\\x1a\\xbcs\\x10\\xf2r\\xe3\\xd5\\x98*\\xb7,7\\x9cm\\xc8-\\xc9\\xbb/\\xf1\\x97\\xf1\\xb8\\x0f\\xf8\\x1f\\xe2q\\xc5n2\\x1c=\\x98\\x89\\x17o\\xcb\\x10\\x1bo\\xa8\\x98\\xa5\\x94\\x16\\x11h\\xbb<9\\x16\\x19\\x1a\\xee\\xf5;\\xb9\\x13\\x8ft\\x1e\\xe5\\x02q\\xbe\\xef'\\xf3\\xb7\\x027\"ko|\\xb8\\x1a\\x02\\x11u\\xea\\xa5\\x12\\x9c\\x93kj;\\x9e\\xc5\\x19\\xd7\\x90nt\\x9e\\xec*\\\\x90r\\xce\\xae\t\\x1f\\xa5\\x96`\\x0f\\xed\\x18\\xfbw!r3k@\\xf2z\\xa9\\xf7?u\\xdcm\r\\xac\\xfa\\xd8\\xc7\\xf5\\xf9\\xc6\\x8d\\xe8zm\\x9e\\xd0'\\xc9i7^h\\xd5\\xdfu\\xfe\\xa1d\\x82\\xadh5\\xe4-h\\xc2\\x99\\x04\\x927\\xd1_@\\xdd\\x83;m\\xa2\\xbe~$\\xff\\x95\\x94\\x84\\xf8a4\\x0e\\x93\\x12d\\x0e\\x80\\xad\\xec&\\xb8mtw!\\xf3g"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d\\xdfh\\xfe\\x9a\\x923\\x04\\x96\\x84\\xf3\\xd4x\\xb4\\xece\\x9e|\\x14\\x87b4z=/\\x7fp\\xfd\t\\x88\\xbe\\xf9\\xc0-\\xfd\\xb1\\x0e=\\xf5\\x1fw%\\xd7\\x9c\\xa0\\xaco\\xb0\\xcbx\\x0796\\x197\\x0b\\xff\\x9dv\\x05\\x82/\\x06\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xcc\\xa1\\x8b\\x9a^\\xc0\\xdev\\x83\\x86k\\xce\\xf7\\xb2\\xbd\\x97\\x8c\\\\xed-\\xe3\\xb7\\xad\\x11\\x88\\xdc\\xb0\\xe4@\\x02\\x80e\\xcf\\xfc\\x8f\\xea\\xb8\\xed\\x0c\\x00\\x0egn\\xfa)\\x16\\xe0"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17\\xfc\"\\xd8\\x12h@j\\xccs\\xb3-\\xba\\x12u\\x87\\x83\\xc7\\xdf\\xb1\\x1f\\x02\\xbakg\\x04i\\x1a\\x1ck\\x9a\\xeffe\\xa7g\\x80\\x80\\x0e\\xff\\xbd\\x13$\\xfc\\x97,\\x1a`!\\xfd\r\\xce3\\x8d\\xa8\\x98\\x17\\xeb7\\xaeu\\xad$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c7\\xef$2jj\\xf7mq\\xf4\"\\xd9r\\xe1\\x89\\xf4\\xb1\\xba\\xdcl\\xd0\\xac?$7ze\\x85g\\x13\\xd03\\xab\\x9d\\xd9fg\\xdds\\xc5\\xa5\\xd8\\x94hf\\xcb<"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u \\xc5\\x1e\\xbf\\xf0v\\xf4\\x1f\\xfc,ly\\x1a\\xa9l\\xc4w\\xb2udm)m\\x18\\xe2\\xe1\\x1f*,\\xb75\\xc3\\xdd+\\xe0l\\x91\\\\xe7\\xca\\x1e2/j\\xa6\\xa6-\\xe7\\xe1\\xdd\\x08\n\\x1f\\xd8\\x1a\\x9b\\x12\\x07\\xbc\\xba)*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd\\xfe d\\xfc\\x8f\\xeb\\xc5\\xfe\\xdajg\\x82\\x8eo\\xbb\\x06\\xecqy\\x0eml9i\\x90\\xc9\\x8d\\xec\\x82\\x99\\xb5\\x99~\\xfc\\x89\\x04d\\xddx%-\\`\\x86\\x17\\xa2\\x00"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\xc1\\x91\\x92 \\x89x\\xbc\\x15\\x8du?\\x95\\xe1\\xa9u\\xe1\\x82e\\xd0\\xee\\xef\t\\xdfoj\\xe3\\xaby\\xde\\xc2g\\xdd4\\xb5k\\xac\\xc1\\x92q\\x8at5\\x94\\xa3\\xef\\x17\\xd5\\x8f\\xcdx\\xde\\xdd\\xfa\\xf5\\x07\\x88a\\xcc\\xc9e@h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8\\x154iak\\x9e?\\x9d\\\\xe10<\\xd0`=\\xe3\\xcfw\\x06\\x15\\xfc\\x0f\\xfe\\x00k\\xe8\\x1f\\xb5a\\xf0f\\xab\\x87\\x8ei\\x11c\\xf8!\\xfe\\xee\\xc9p2\\xaa\\xfd0"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xcf\\x8f:wt\\e\\x1f\\xe5\\x8c\\x03t\\xea\r\\xa1\n\\xbe1\\xb3x\\x03\\xd6\\xa93\\xaa\"\\x0c\t\\xcc\\xa2\\xbb\\x1e\\xa3\\xd4\\xf2\\xc7\\x85\\xfa\\xdf\\xd8\\xf6r&\\xf7z\\xe9n\\xc5\\x88j\\xb7\\x1a4\\xd8\\x8e\\xc9k\\xb8\\x91\\xee\\xeb\\xa7\\xf9'\n\\x07\\xd4\\xd3\\x05\\x83_v\\xd6*\\\\x17\\x90\\xff\\xcf\\xb0\\xc0\\xfa\\x05\\xb9x\\xfb\\\\xcd\\xe1w\\x12\\xab\\x82.\\x946\\xdff\\xa3\\xf0\\xd8\\x9d\\xbd\\x1c\\x95\\xa9\\xf2\\x14\\xea\\\\xca\\xc8\\x88i\\xe1\\xf5\\xe1\\xe8\\x9a\\xd4)\\xa7'*`v\\xe4\\xd9b\\xe5\\x9dn l$\\x16\\x19\\xe15\\xb8\\x80\\xaaq_\"\\x81\\xb9x\\x86x;\\x1d\\xfd\\x87\\x15,\\xca\\xc2\\xde\\xc8\\xec\\x91x\\xb70\\x17%\\x9df2\\x90\\xe5\\xf9&\\xa1p'\\x84\\x8b|\\xcd`9\\xe0\t\\xf7\\x1d\\xb7;u@r\\xc7\\xa9\\xd7b\\xc4\\x9c\\xf4\\x85\\xc9\\x0e\\xa3\\xae\\xd4y\\xbb\\xac8\\x8b\\xc6p\\x0cf\\xe7\\xcb\\xa9b\\xb9h\\xd6/f\\x8c\\x01\\xce\\xf2\\xda?\\xcf\\x85<\\xe9\\xce9\\xdf\\xfe\\xc9\\xfa\\x03\\x1b\\xcd\\x11\\xc7ax\\xf3\r\\xd1g"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xde\\x15\\xb5f\\x91\t\\xa0\\xb4\\xbc\\x9c$\\x91\\xd1p\\xa0x\\x0fx\\xbcez\\xcf\\x01\\xa0\\xf7\\x96t\\x03\\x0b\\x8b'\\x9a\\xf8\\xbf\\xa2f\\x1c\\xc7\\xc7v\\x88\\x10/\\x9f\\xec\\xf9\\xa0>\\xb9#\\xa5\\x03g\\xb2'\\xf6\\xf0\\x17\\x0e\\xae\\xcf\\xcf\\xff\\xb0\\xd0\\xf8\\xc1\\xdb\\x07d\\x93\\x8d\\xa8\\x13\\x96\\xda\\xa0\\xa1\\xeep\\x12\\xe9\\xe1\\x84\\xde\\x83\\x87.\\xc0\\xdd\\xad\\x98\\xed\\xf8\\xf0ht\\xd2\\xd0\\xcf\\xa7\\xa6\\xbb\\xe1\\xf4\\x8e\\x9a\\x83%/\\xbd\\x0e\\xbf\\xc4\\xd5.l\\xf4d*\\x00\\xcf\\x0c\\xc3\\\\xbdn\\xfdoe\\x86h\\x164\\xec\\x83f\\xbf\\x06%b\\xf2\\xf6\\x88\\xc9\\x81\\xfb\\xf2\\x81:\\xa2-\\xc1\\x87\\xc9w\\x9fbr\\xda\\x93\\x13\\xe5\\x1efy\\xfbw\\x84\\xe1!\\x07\\x84\\x00\\x8c\t15\\x1cq\\xae\\x9a\\xa5\\xeb\n\\x9aq\\x9c\\xace\\xc4lc4\n\\x96\\xca\\x042\\x89\\xd8l\\xef\\xd6(\\x92\\xba\\xf3\\x08\\x11\\xca\\xa3\\xf4\r\\x95?_\\xactu\\xa0\\xfbq\\xba\\x9e\\xf0\\xda\\x94\\x15\\xad\\x15!ts\\x15gh\\xada\\xb9"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb59\\x90\\x99l\\xb6!\\x82g\\xf1\\xa2\\xd9\\xb3\\xd3e\\x8b\\x8e\\xa5\\x8e\\xd9q\\xac\\xd1\\x0c|2i6\\xefcy\\xc4\\x01\\xfb\\xb8\\xe2y\\xdfj'\\xfa\\xec\\xb7\\xa5\\xf0\\x82\\xc2\\x95\\x1b\\xa3\\x82\\x8e?\\x00\\xa1\\xff\\x1c\\xba\\xc8\\x16\\x00\\xc6\\x86\\x92 s\\xee\\xaa\\x8f\\xe5i\\x88'\\xa6\\x18\\xd3\\x8d\\xacye\\xb91\\xbc\\xc5m\\x8d\\x08\\\\x87\\xaa_r\\x07\\xb1\\xbb\\xe2\\xd7\\xab\\x19\\xf1m\\xf0:\\x84\\x0f\\xf0\\xf9`5s\\xe1\\xdc\\x9a2 \\xf6d&\\xc7\\x8eii!\\x0e\\x0b\\xb9iz4j\\xb1\\x84\\x15\\xde;\\xbe\\xa5jg\\x0f\\xdd\\x8e\\xf9\\xb2\\xd2\\x16\\x94\\xfb\\x9f\\x1a\\xe7w\n0\\xdc\\xb9o\\xdb5\\x9b\\x99\\xac\\xf2h\\x8c\\xc0x3l\\xbew\\xcf^k\\x85s!\\xbeo=\r\r\\x07\\x7fu\\x89\\xbc\\xc3\\x1e\\x16\\x14\\xd7\\xca\\x1c\\x0e\\x83\\xce\\x18\\xfd\\x1c_\\xc2\\x95\\xfeg\\xd9\\x7f\\xde\\xc4\n(2\"\\x950\\x81\th\\x91\\xe9\\xc2\\x13\\x04\\x99i\\xefx\\xe5\\x82\\x04>\\xee\\x0c\\xba\\x8bl7n\\xfa\\xe0\\xa7\\xc3\\xc8\\xf9\\x9d:hq\\x9a"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\x12\\xa1\rkvluym\\x11h\\xee\\xb8\\xa5\\xd9a\\xe4\n\\xd2\\xc0\\xfb\\xf9\\xcb\\x9d7d\\xac\\x9be\\xa0a\\x87a)qj\\x8c\\x05\\xaaey\\xc9|\\x84\\xa3\\xba\\x11\\x036\\x1dc\\x12\\x18\\xa9\\xca\\xbd\\\\xf9g\\x94\\xc4\\xfe^\\xb1\\xce\\x8b\\xb5|\\x82\\xfe\\xf8\\xdd\\xe5c\\xd4\\x17+\\xd0\\xd5\\xe7s\\x8alc\\x0c:\\x82`\\xee\\x1e\\xe5\\xe5i\\x8b\\x82\\x12\\x80\\xfa\\xbbt\\xdd\\xda\\xd9g\\x1d\\xb2\\x0f:\\xdar\\xa5p^\\x9b\\xb0\\xec\\xcfg\\x91*\\xa0\\xf3\\xdc\\x96\\xcc\\x93\\x8b\\xf36\\xead\\x06\\xe6\\x1f\\xc4n\\x94u\\x0eik\\xba=\\x11\\xbc\\xae \\xa1.\\xeei;\\xdb\\xe9\\x82$\\x05\\xc5sj\\x0b^\t\\xeb\\xab;n\\xfb\\x86\tfw\\x04\\xb5\\xac7\\'^\\x18\\xba\"`\\xdbqb9\\x0ff\n\\xde\\x0b\\x8a\\xfcr\\x85\\xf4\\xc9\\xb6\\d\r\\xd3\\x88u8r\\x88x\\xd7\\xcb\\x88\\xfd\\x89\\\n5\\x82_\\xfd\\xc9\\xed\\x04#jsg\\xf5sfs\\xb9x\\xd3\\xbaa^\\xe5nt\\xe5\\xd9"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ou\\xa4 \\x9c\\x97\\x90\\xc3g,f\\xc6\\xbb;\\x0b\\xad\r\\xe0\\x99\\xd20g\\x1f/\\xdac\\xc4\\x19$\\xda\\x9bxf\\xb3\\x1a\\x8d~\\x8a\\xcd\\x91\\xd0\\xbel\\x8dr\\x15\\x1c\\xd2\\xfb\\xb5d5\\x91\\x8e\\xf2\\x85\\x1e\\xf6\\xebe/\\x8d\\xa7\\x93\\x0f\\x04\\x87\\xab#\\xc3\\x95\\x9c' w\\x03q\\xda\\xaa\\x98\\x9a\\xa4b\\xc2k\\x90\\x7f2\\xf8+\\x02\\xb7a\\x97\\xe9\\xa4\\x1f\\xd2\n\\x15\\x00\\xe2\\xc3\\xe5h\\xcf\\xf0\\xd7fy\\x13+|#=\\x94\\xc0m\\xae\\xdbv\\x14\\xb7\\xdfqb\\xb0\\xd7\\x95\\x86@pd\\xe7\\x16r\\x84'<\\xe4\\xe8\\xe8\\x93^k\\xd1\\x02\\xb8\\xdb\\x89\\xc4t\\x16*\\xc4\\x7f\\xe50\\xe1\\xd1\\x0b1\\xc0\\xbbc\\xe3\\x1d\\x03\\x11wiv\\xe3\\x8c\\xff\\x8a\\xc9\r\\x8c\\x9f\\xbe!^\\x0c\\xa2-\\xe4asc9q\\x141i\\xcb\\x04\\xe4\\xa7\\x8d\\xedrx\\xf3wuc\\xb5\\x97\\xa5aj\\xbf\\x99x\\xfbn\\x1cq\\xa4#_\\xfa#3\\xa3y\\x85\\xdag\\x1d=\\x92j\\xd6h\\x8c\\x01\\x88\\xcd\\xae\\xc8\\x84^\\xe6\\x9e;p4\\x06"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xe7\\xb6\\xbd\\x80\\x88_\\xd2\\xa7\t\\xabb.\\xd4\\xed\\xc0)|\\xb1\\xd6+i\\x97s\\x03o\\x08/c\\x87\\x8e\\x07\\x9ae\\x98\\x07n9\\xee\\x11x\\xb1\\xa0\\xc5u\\xbf\\xea\\x02\\xfbw\\xd3\\x97_\\x87\\xe4 \\xaa\\x1c\\xfb\\v\\xdc\\x01<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfab\\x99k\\x939|\\xc8\\xf1\\x1f\\xbd\\xab^\\x96&>\\xb86\\xa2\\xf6w\\xd8\\xc7\\x95\\xd1\\x97\\xd8\\xb0\\xf5\\x08\\xdav\\xbb\\xbe\\xd5\\xf1v\\xbd\\x94\\x16\\x1f\\xb3\\x19\\xb5>z3"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\xe5\\xd2x/\\xa9\\xdf\\x80n\\xab\\xca\\xe7-r\\x920h\\xea\\x8c\\x9f\\xc4\\xbeoe\\xdf\\xd77\\xc7\\x18\\xe0gh\\x1f\\xf2l\\xc9aseo\\xc7\\xe8\\x80s~\\xa9e\\x8c`\\n\\x9f?\\xddo\\xbb\\x12td2*5\\xe7+\\xbf\\xf3d^\\x86\\xb3\\x85 \rfozp6k^\\xafd\\xb3k\\xfc\\x83b\\xd1\\xd6\\x1e\\\\xc5#;\\x14/\\xeek<\\x15va\\x1bi6\\x0b\\xc7\\xf6zv\\xec\\xf5\\x16\\xea\\x02w\\xbb\\x06\\xb4\\xe2\\x00\\x01o m0\\x01\\x0b^\\xc2\\xf8dq\\xcf\\xf4\\xd0<\\xe3\\xfb\\xcf\\x8bk\\xa6\\xc4\\x1co\\xe1\\x04\\xabca\\xcb\\x83\\x02\\x88\\x82u\\x7f\\x92u\\xb0w\\xb0\\x18\\x05\\xf41\\xf7h o@_p\\x8a\\xbc\\x05r\\xad9\\xcepm\\xf1\\xad9\\xac\\xa3\\x83y\\xa6\\xeb\\xdc*\\x8d(\t\\x7f\\xc2\\xf4f|\\xad\\xcd\\xda\\x8d\\x15\\xb8jre\\xfa\\xa0\\xc1rf'\\xce\\xa7%\\xd9@0t\\x15s\\xbd\\x9e@hj1\\x15\\xc5)e\\xd0\\xfc\\x8c\\x04f\\xcc\\xb06z\\xa9\\xbd"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ba?\\xa5\\xe5\\x14\\xa3\\xafi\\x19\\xb5 ;b\\xf7%\\xb6\\x18 \\xe2\\xee\\xb7\\x81\\xd0\\xe3\\xc4e\\xc2\\x86\\xaf\\x9b\\x1d:\\x148@\\x94\\x90>\\xca.3\\xea\\xd7l\\x1ci\\c\\x8f\\xce\\xd0\\xe0(\\xe1\\xa4g\rt\\x8f\\x89\\xf6\\x94\\xe9\\xe4.\\xbf\\xd7h\\xd3\\xd4\\x9afs\\x96m\\x8a\\xd7\\x99\\xf8\\xb3_b\\xd1\\x95\\x85\\xa2r\\xfa\r\\xb0\\xc4\\x11\\x9d\\x93\\x17\\x0f\\x99\\x13<\\xdd\\xcdn\\xb8\\xf7\\xc9\\xe9\\xcd\\xb0\\xba%\\xd2\\xa6i\\x0e\\xebj3\\x1e1\\x9b\\xe3\\x9f\\xf3\\x96\\xf12\\x98=\\xe7\\xe8h\\xbed\\xc9y>\\xa1\\x8a9p\\x14\\x83_\\x03\\x16d<w\\xd9\\x85\\x80i\\xf9jn\\x95\\x8e\\xea\\x9d\\xef\\x0c\\x03\\x9d\\xdeo!\\xb1\\x85\\x98\\xe3\\xed_id@\\xfcb\\x87\\xd3\\x80%\\x8f\t8\\xd4\\x9b?\\x92\\xc3\\xef?\\x08s\\x9e o\\xcc\\x92\\xde\\xae\\x99\\x0e\\xde\\xff\\x84\\xf4y=q\\x86\\xa4\\xeb\\xaed\\xa2\\xde\\xf4#o\\x08e\\xf5\\xdc\\xeb\\xa8zf\\x00\\xde\\xd8\\xdded\\x11\\xe4\\xff\\xdcw\\x83\\xbb\\xe2\\x19r\\xae\\x9b\\xa0"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86\\x1bu\\xcc\\xa2\\xc6\\xcbv\\xc0i\\xca\\xad9\\x1b\\xc8\\x0f\\m'\\x1e\\xefx3\\xae\\xec\\x1c\\xbd\\xe9j\\xe7\\xcf\\xc0s\\x14\\xafs\\x05o\\xd0gj\\xdd,\\x92h v\tfd\\x11!\\x14\\x16\\xad\\xebi\nst\\xa8\\xb6\\x94\\xbc\\xee\\xb22$m\\x90\\xe2\\xd8\\xde+u\\x89\\xb8 1\\xbevx\\xf8 \\xec\\x1c\\x9d\\xa6\\xe8d\\xb2v\\xfd\\xd7\nda\\x02\\x843\\x13\\xa9\\x82a\\xee\\xa3-l\\x1d\\xc7q\\xd8\\x07d\\xd5d\\x80\\xdew$\\xc8b\\xe7\\xddx`\\xfa\\x0f\\x9c\\xfe\\xd9b\\x87\th5\\x0b\\x05\\xf6\\xfb\\xd6>\\xffkbfs?\\xe7\\x9e\\xadu\\xa9\\xe2\\x0f\\xeab\\xa8g\\xdd\\qe\\x05\\xdbg\\xad6\\xb9f\\xd8\"\\xa5\\xa20\\xad\\xbc\\xa4q\\xf4\\xcd\\x13\\xb60\\x9d\\xd1vz\\xe0|\\x89@*o\\x8dcc\\xa5|\\xf0\\xa11z`z\\xeeu\\xfb\\xfcl\\xbc\\xfd\\xf6\\x04\\xa9\\xa6v\\xa7x\\xec)\\xf3\\xdc\\xb5\\x08\\xf3\\x15\\x04to_\\xaa1)e\\xc7_\\xe8\\xe7>y\\x18\\xad\\xf9\\xaf\\x86\\x04\\xff"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\x073\\xf1\\x95\\x99o\\x96\\xcf\\xc8\\x04\\x15<t\\xa1\"\\xa6\\x87v\\x90l\\x98\\x16\\xd4\\xf1\\xe7\\xb0\\xd1bm\rl\\xb7\\xf7\\xf87\\x9b\\x1e\\x0f\\xbazs\\xb8g\\x0f\\xef\\xfb\\xa7\\xaf\\xa3|:q\\xbb%z\\xb7\\xfc\\xd4?\\xa9/bd \\x81\\xe3\\xafm\\xd7o\\xa7&\\xf1~\\x80\\xbdu\\x12\\xeb\\x9a\\x08m\\xbc\\xae\\xcc\\xc6\\xa8\\xe4t\\x87\\xfaf\\xd0@@s\\x96\\x1da\\x18=\\x13\\xa3\\x19#\\x15\\xa1tp\\x0bm\\xf6\\xdck\\xac\\x1cqh\\x97\\x8av\\x90\\x00v\\xe5\\x1bw\\xf4ban\\xabi\\xb4b\\xdc\\xcdle\\x04/i\\xf4\\xe3\\x89t\\xfae&\\xben\\xe7aa\\xae?\\xb7\\xcb\\x9c.\\x88\\x9b\\x8de\rq\\xe1\\x94\\x1a\\xac\\xbc\\xc4\\x1eq\\xf9\\xc0\\xc6~ui\\xde>^\n\\x16\\x99\\x92\\xe7\\x95\\xcc\\xd2_x\\xe1\\xa0\\xe0\\x9e\\x10\\xfb\\x82.\\xbdu\\x0b\\xe0\\xff\\x08;\\xa4\\xda\\xa9s\\x97\\x11\\x8dnb\\x1d\\xa7f\\xcfe\\xe1\\xf2h\\xcdo\\x15h\\xfd\\xbf\\x00v\\x9a\\x82\\xb7\\x13\\x05p>\\x92m\\x17\\x9d\\xef\\xda\\x08\\xf7"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\xa1\\xa4\\x98\\xab\\xc8\\xfc\\x16l\t\\xddz\\xddk\\xbf\\xce\\x9bh\\x87g\\xf2\\xed\\xa6\\x82\\x83h\\x04_8\\x8er\\x10\\xd6\\xa4k.\\xefeb$6bmx\\xd8q\\xcc\\xdc&\\x89\\x9e\t\\xbc\\x9f\\x06\\xeag\\xbf\\xbb\\x1d\\x8au3<\\xc3p\\xde\\xe7p\\xf2\\xbc_\\xc6k\\x0c\\xb3\\xc0\\xdf \\xe2\\xe0hr\\xbe\\xf9\\xf2\\x1e\\xa8\\xe0*\\xb0\\xd0\\x97\\xec\\xf8\twpr\\xd7\\xdb\\x06\\xba\\xeeerh\\xb44u!\\x89\\xb6\\xa253\\xda\\x02 \\xc3\\x90\\xb0h\\xf1\\xbc8\\x11s\\x91\\xf7b\\xea\\x9c\\x86l\\xec\\xf2\\xe9\\x00\\xef\\x9a\\xee\\xae\\x89!\\x0b\\\\x9du`\\x11`+\\xa4\\xe9\\x10\\xa9v>r\\xab\\x90\\x0b\\xc4'\\xefu\\xc1z\\x07\\x91l~*v>u\\x91\\x87:\\xb2\\x0e\\x1bti\\xab\\xed\\x98/\\x9bfg\\xe8\\xdb8\\x84\\x98\\xef\\xfb\\xc8h\\xd3\r@o\\xfc?u\\x97\\xaa_q\\x04\\x1d\\x10#j`w\\xe5\\xb3\\xc1\\x976e \\xb9\\xd0bq\\\\x15\\xca8\\xe6\\xb2\\xd7j0t\\xa26\\xb79\\xaa\\x149\\xee\\x8f\\x92\\x85"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xm\\xd7$\\xee\\xe7\\xbe4\\x1c\\xc9z\\xd4\\x83\\x83\\xe1\\x0c\\x01\\xc5\\xadu\\x00n\\x80e\\x14\\x9a\\x8eo`|\\x10\\x80$\\xef\\xdd\\xfc,\\xcf\\xff>op\\xbe\\xaa\\xd0|\\x10y>z2\\xa4\\x80z\\xc6\\x07a%\\x9c\\x0f!\\xaf$\\x1cv\\x1d\\x01\\xe9\\xbf\n\\x18\\xaeqw)\\xd0\\xd3\\x8b,\\x01\\x12\\xe5;vo\\xd4\\x007z\\xea\\xa1\\xbf\\xdbj\\x9d\\xfa\r7\\x17dh\\x8d\\xc3h|`\"i\\xeang\\xa5\\xe9\\xa9\\x1b\\xe1\\xe1\\x8b^\\xc4x\\xaa\\xaa\\xe9\\x14\\xf3\\xf9\\xca\\xa1\\xfc_\\xd9i\\xab\\l\\xc6y\\x7f\\xae\\x9a\\xce\\xd3)\\xbd\\x83\\x93\\x0f\\xea\\x88\\xac\\xff\\xa1c\\x1cm9\\xc7in:\\x7f\\xb1xl\\xc2\\xd2<\\x13\\\\xb6\\xf0f\\xa6\\xa4/\\x0f\\xdb\\x15\\x88\\xe5\\x85\\xbc\\x10\n\\xb4m\\xe0\\xad\\x87w\\x98\\x15\\x03\\xb2c\\xcd\\xd5\\x84'\\x0b\\xef\\x9fx\\x97e#\\x80$\\xf4\\xa2\\xd3?w\\x0fz\\xe6\\xef!\\xc4n\\xfd\\xfb\\xbfju\\x8cmh,\\x0b\\xd4n\\xb5\\x85\\x1c\\x1d\\xa0\\x9c\\xbaw\\xb7\\xf9r\\xd3r\\xd4~\\x01;<"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x019m\\xfa7\\x8bcz:\\x13\\xce\\xb8\\xaet^t\\xefvq\\xc8\\x0e\\xb6\\x02\\x02\\xec\\xd3(^\\xa8\\xca\\x9f\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00t,;\\xbev\\xacra\\xb38\\xf1\\x18q\\xb0\\x89b\\xa5\\xa5\\x85gb\\xda\\x01\\x96\\x95\\xc2w\\x04\\xdb\\xfb\\xf9zq\\x96l\\xaa\\xca\\x0e\\xa3r\"\\xd8`r\\x8e\\xde\\xa8\\xdf\\x9b\\u:\\xbd\\x91\\xb9\\xb3\\x82\\x86s\"r\\x11\\x1a\\x7f\\xe1\\x11\\x16w\\x86\\xe3\\xcc\\x03\"c'>\\x14\\xf7\\x12\\xd8\\x97\\xd9\\xbcz\\x02c\\xb4y\\x85\\x08\\x00\\xf5\\xfa\\xc3\\xc5\\x17b\\x83u\\xc5\\x052z\\xf7\\x94c\\x84\\xca\\x7f/\\xa2\\xe1\\xa1#\\x88\\xdc\\xf1\\xc5~\\xe9iz\\x9an\\x18\\xec\\xf3%\\x98nd2i\\x16\\xa2gc\\xcc\\xe1\\x11>\\xb6z\\x1a\\x95\\x1b!\\x1f\\x9d\\x8ask\\xdb\\x9c\\xcbt|\\x8c\\xfb\\xc8'\\x1b\\xbfox\\xbe\\xbb#\\xd8!\\x9c\\xdcy;\\x89\\xdff\\xbe\\xcf<\\x14\\x8d\\xc2\\x13\\xbd\\x16e\\xf8y\\xf5n\\xe1c\\x95\\x10(\\xb6\\xd4\\\\x06.\\x08\\xea\t\\xe9\\x0c6\\x17\\x10\\xbc\\xd3\\x9c\\x03e\\x96 \\xddu\\x1b i\\xe2\\x01\\xeb\\xfe\\xd3\\xb1=o\\xcc\\xb0\\xeb\\x14\\x9ed\\xf1\\x83\\xa7\\x96\\xf9\\xa9"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x88\\xf6;\\xfb\\x17\\xe4\\x04\\xe4i\\x83\\x90|~h\\x9ag\\xf0\\x02\\xe8\\x95\\\\x0b\\xee\\x97\\x0f\\x8av\\x12\\xd6\\xe1\\xa1e0t4\r\\xea\\x05\\x95\\:\\xd2*|f\\x9c /\\xd4\\xd6~ph\\xfb\\x92\\xb3\\xd3\\x8d\\x97c\\x9f\\x8ek\\x1ab\\xa5\\xd9\\xc7~qq\\x17o\\xbenw\\xdb8\\x8c\\xc7\\x91\\xcb\\x15\\x00\\xfd\\xe6\\\\x8b\\xfcy\\xce\\x98\\xdcr\\xd8u\\x11tu\\x11\\xdb\\x9e\\xc5k\\x82\\xef\\xda\\xc4\\xf4\\xb8\\x15\\x9e\\x8ed\n\\x8f\\xec\\xaf&\\xd9\\x01\\x08/\\xd7\\xe1.l'\\x85\\x8e\t@\\x89\\xbf\\xf5y\\xc0y\\xbf\\xf2\\x92\\xc61\\xfe9\\xf7,\\x1c\\x8e\\x06\\x9b?\\xd6\\x9e\\xfb?\\xaa\\xd3\r4\\x9a\\xe5\\x91\\x91\\x10\\xe4~\\xa4byed\\xd7\\x86\\xd2#\\xa2\\xca\\xddh\\xf3\\x08\\xbf\\x1b(\\x10\\xa7\\xc8u\\xee34\\xcaz\\x1cs,\\xee:\\xa2\\x02\\x91\\x1e\\x9c?e\\xb2v|\\xf7\\xb6\\xad\\x16\\x93m\\xbd \"\\xe45\\xebb\\x19\\xe5)\\x1d\\x0f\\x99\\xdb:\\x876c\\x17\\x82\\xb6y\\x0e\\x13u\\xb0\\x81z\\xa3\\xa8\\xba1\\xe7"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x17;,a\\xb8\\xf0\\xfa\\x93\\xc5\\xc3\\x8axg\\x0fs\t\\xa6\\xca'?\\xdb\\xe0\\xd4\\x8c\\xf1gxs\\x08\\xb3\\xb5\"\\xb8ne\\x87\\xd7nv\\xd4\\x0b\\x84q8\\xe44\\x9b/\\xc1\\xf0\\xda\\x10\\x83\\x0f\\xa7\\xea\\xf6\\xe7\\x14\\x050\\xc1y\\xfaf1\\xf14zj\\xc3\\x916\\x83\\x9c\\xa8w\\xae\\xb9\\xff\\x01\\x1f\\x853\\xa7^zu3fvo\\x87\\xef\\x04\\xf8\\x92\\xb28\\x08h\\xe8\\xa7\\x00r\\x82\\xdd\\xdc\\x90\\xd9\\xfe.\\xb4h\\xbc\\xc5'\\xe3jo\\x0c\\x91\\x97\\x81\\x08\\xde\\xd9\\xb5 \\x1e\\x11\\xd5\\x8f\\x84\\x8fu\\x9d\\xb0\\x82'k@\\x93\\xde\\xcb\\x1d\\x87\\xca\\xd4\\xf1\\xf1vf,\\xba\\xe7\\xdc\\xb9y\\xd2w'2\\xb2\\x1a.%6w\\xd4\\x13\\xca\\xe1\\x17o\\x8b\\x10\\xba\\xd3,kh\\xa4*m\\xf9'\\xa2-\\x82\\xb3\\xe3\\xbd\\xc4a\\xdde\\xa8o~x\\xdb\\xbf\\x00\\xbe\\xfe#\\x8cdn\\x8c\\xb3\\xaei\\xb4 \\xd3\\xba\\x10l\\xea\\xd7\\x9c\\xec\\xb6\\xbf\\x89w\\xcf\\xberjt\\x93<\\xc8\\xa7\\xcfs\\x03\\xbch\\x8cz"
  560.  
  561.  
  562.  
  563.  
  564. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  565. "Details":
  566.  
  567. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  568.  
  569.  
  570. "McAfee": "Exploit-CVE2017-11882.yx"
  571.  
  572.  
  573. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  574.  
  575.  
  576. "Symantec": "Trojan.Gen.MBT"
  577.  
  578.  
  579. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  580.  
  581.  
  582. "Avast": "Win32:ShellCode Expl"
  583.  
  584.  
  585. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  586.  
  587.  
  588. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  589.  
  590.  
  591. "Tencent": "Win32.Trojan.Autoit.Auto"
  592.  
  593.  
  594. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  595.  
  596.  
  597. "Sophos": "Troj/RtfExp-EQ"
  598.  
  599.  
  600. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  601.  
  602.  
  603. "DrWeb": "Exploit.ShellCode.69"
  604.  
  605.  
  606. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  607.  
  608.  
  609. "FireEye": "Exploit.CVE-2017-11882.Gen"
  610.  
  611.  
  612. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  613.  
  614.  
  615. "Cyren": "CVE-2017-11882.E.gen!Camelot"
  616.  
  617.  
  618. "Avira": "EXP/CVE-2017-11882.Gen"
  619.  
  620.  
  621. "MAX": "malware (ai score=94)"
  622.  
  623.  
  624. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  625.  
  626.  
  627. "Microsoft": "Trojan:O97M/Obfuse.AE"
  628.  
  629.  
  630. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  631.  
  632.  
  633. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  634.  
  635.  
  636. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  637.  
  638.  
  639. "ALYac": "Exploit.CVE-2017-11882.Gen"
  640.  
  641.  
  642. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  643.  
  644.  
  645. "Zoner": "Probably W97NativeOnly"
  646.  
  647.  
  648. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  649.  
  650.  
  651. "Ikarus": "Exploit.CVE-2017-11882"
  652.  
  653.  
  654. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  655.  
  656.  
  657. "AVG": "Win32:ShellCode Expl"
  658.  
  659.  
  660. "Qihoo-360": "virus.exp.21711882.d"
  661.  
  662.  
  663.  
  664.  
  665. "Description": "Created network traffic indicative of malicious activity",
  666. "Details":
  667.  
  668. "signature": "ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious"
  669.  
  670.  
  671.  
  672.  
  673.  
  674. * Started Service:
  675. "osppsvc"
  676.  
  677.  
  678. * Mutexes:
  679. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  680. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  681. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  682. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  683. "CicLoadWinStaWinSta0",
  684. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  685. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  686. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  687. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  688.  
  689.  
  690. * Modified Files:
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_03dd9f3019550169a008b940b684fdea.doc",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_03dd9f3019550169a008b940b684fdea.doc",
  693. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  694. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF5625DB46-67C8-460C-A30A-4A14020C399F.tmp",
  695. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  696. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  697. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  698. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2454.tmp",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2455.tmp",
  701. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28928034-EC99-47AE-9B6E-971879AF28B9.tmp",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\cab329E.tmp",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32A0.tmp",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\cab329F.tmp",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32B0.tmp",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32B1.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C3.tmp",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C2.tmp",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C4.tmp",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F5.tmp",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F7.tmp",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F6.tmp",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F4.tmp",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3308.tmp",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332C.tmp",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332A.tmp",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\cab333C.tmp",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332B.tmp",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3318.tmp",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3319.tmp",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\cab334E.tmp",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\cab334D.tmp",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\cab338E.tmp",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33AE.tmp",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33CE.tmp",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33D0.tmp",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33CF.tmp",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33E1.tmp",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3402.tmp",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33F1.tmp",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3413.tmp",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3433.tmp",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3443.tmp",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3510.tmp",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3678.tmp",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B8.tmp",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36A8.tmp",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37E2.tmp",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\cab38DD.tmp",
  740. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  741. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\cab399A.tmp",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AA4.tmp",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B03.tmp",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B14.tmp",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B63.tmp",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BD1.tmp",
  748. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  749. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D89.tmp",
  751. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D8B.tmp",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3D8A.tmp",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3DBB.tmp",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E77.tmp\\iso690nmerical.xsl",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EB8.tmp\\harvardanglia2008officeonline.xsl",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E77.tmp\\Content.inf",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EB8.tmp\\Content.inf",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EF8.tmp\\content.inf",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F97.tmp",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EE8.tmp\\Headlines.thmx",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB8.tmp\\content.inf",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E97.tmp\\turabian.xsl",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F18.tmp\\content.inf",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EF8.tmp\\Wood_Type.thmx",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F18.tmp\\Frame.thmx",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB8.tmp\\View.thmx",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F48.tmp\\Basis.thmx",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4007.tmp\\Badge.thmx",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4059.tmp\\content.inf",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EE8.tmp\\Content.inf",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4007.tmp\\Content.inf",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F48.tmp\\content.inf",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E97.tmp\\Content.inf",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4038.tmp\\ThemePictureAlternatingAccent.glox",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4059.tmp\\Quotable.thmx",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4017.tmp\\architecture.glox",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4058.tmp\\Crop.thmx",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4232.tmp\\Berlin.thmx",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E2.tmp\\Element design set.dotx",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4221.tmp\\content.inf",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4017.tmp\\Content.inf",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4038.tmp\\Content.inf",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4164.tmp\\content.inf",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E2.tmp\\Content.inf",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42A0.tmp\\APASixthEditionOfficeOnline.xsl",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4164.tmp\\Metropolitan.thmx",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42C0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4221.tmp\\Parallax.thmx",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42C0.tmp\\Content.inf",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42F0.tmp\\CircleProcess.glox",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42F0.tmp\\Content.inf",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42A0.tmp\\Content.inf",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4497.tmp\\ThemePictureGrid.glox",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4564.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4497.tmp\\Content.inf",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4232.tmp\\content.inf",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4515.tmp\\InterconnectedBlockProcess.glox",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4515.tmp\\Content.inf",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4601.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4612.tmp",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46DE.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4058.tmp\\Content.inf",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD475C.tmp\\content.inf",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD475C.tmp\\Savon.thmx",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B07.tmp",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4BB5.tmp",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B65.tmp\\Equations.dotx",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B65.tmp\\Content.inf",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  833. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DF8.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E08.tmp\\content.inf",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E39.tmp\\Feathered.thmx",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E6C.tmp",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E08.tmp\\Damask.thmx",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E3A.tmp\\Circuit.thmx",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E19.tmp\\content.inf",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4C.tmp\\content.inf",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E19.tmp\\Slate.thmx",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4C.tmp\\Main_Event.thmx",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4B.tmp\\content.inf",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4B.tmp\\Droplet.thmx",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5071.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E39.tmp\\Content.inf",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E3A.tmp\\content.inf",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5246.tmp\\TabbedArc.glox",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5246.tmp\\Content.inf",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  852. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  853. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  854. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53AF.tmp\\content.inf",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD546F.tmp\\chicago.xsl",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53AF.tmp\\Mesh.thmx",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545E.tmp\\Insight design set.dotx",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53B0.tmp\\RadialPictureList.glox",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545F.tmp\\VaryingWidthList.glox",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54AF.tmp\\mlaseventheditionofficeonline.xsl",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545F.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53B0.tmp\\Content.inf",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD540F.tmp\\content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54DF.tmp\\content.inf",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD552F.tmp\\ThemePictureAccent.glox",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54FF.tmp\\gostname.xsl",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54DF.tmp\\Dividend.thmx",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD546F.tmp\\Content.inf",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD540F.tmp\\Vapor_Trail.thmx",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54AF.tmp\\Content.inf",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55AE.tmp\\sist02.xsl",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559D.tmp\\iso690.xsl",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD552F.tmp\\Content.inf",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54FF.tmp\\Content.inf",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55ED.tmp\\Banded.thmx",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55FE.tmp\\HexagonRadial.glox",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563F.tmp\\gb.xsl",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD562E.tmp\\ConvergingText.glox",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563E.tmp\\pictureorgchart.glox",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55AE.tmp\\Content.inf",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55FE.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559D.tmp\\Content.inf",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BD.tmp\\TabList.glox",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563E.tmp\\Content.inf",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563F.tmp\\Content.inf",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD562E.tmp\\Content.inf",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BD.tmp\\Content.inf",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD573B.tmp\\ieee2006officeonline.xsl",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55ED.tmp\\content.inf",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5828.tmp\\PictureFrame.glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5848.tmp\\rings.glox",
  898. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  900. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  901. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD573B.tmp\\Content.inf",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5828.tmp\\Content.inf",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579A.tmp\\gosttitle.xsl",
  906. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545E.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5848.tmp\\Content.inf",
  909. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  910. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5897.tmp\\BracketList.glox",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5897.tmp\\Content.inf",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579A.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B38.tmp\\chevronaccent.glox",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B38.tmp\\Content.inf",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  932. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF7D424C3-CCCF-485E-AD8A-BB6FF1A36570.tmp"
  933.  
  934.  
  935. * Deleted Files:
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2454.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2455.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D89.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3D8A.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E77.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E97.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EB8.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EE8.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EF8.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F18.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D8B.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB8.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F48.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3DBB.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4007.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4017.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4038.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4059.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4058.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E77.tmp\\iso690nmerical.xsl",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4164.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4232.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E2.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4221.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42C0.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EB8.tmp\\harvardanglia2008officeonline.xsl",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F7.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42A0.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F18.tmp\\Frame.thmx",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F5.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3678.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42F0.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4497.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4515.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EE8.tmp\\Headlines.thmx",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AA4.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4007.tmp\\Badge.thmx",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BD1.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E97.tmp\\turabian.xsl",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab329F.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD475C.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB8.tmp\\View.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F48.tmp\\Basis.thmx",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab399A.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42C0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4059.tmp\\Quotable.thmx",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B8.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3318.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4017.tmp\\architecture.glox",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4497.tmp\\ThemePictureGrid.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B14.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4515.tmp\\InterconnectedBlockProcess.glox",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F6.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cab338E.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42F0.tmp\\CircleProcess.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3319.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332B.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41E2.tmp\\Element design set.dotx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\cab38DD.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4164.tmp\\Metropolitan.thmx",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36A8.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4038.tmp\\ThemePictureAlternatingAccent.glox",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33AE.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4232.tmp\\Berlin.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EF8.tmp\\Wood_Type.thmx",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37E2.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4058.tmp\\Crop.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B63.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C01.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4221.tmp\\Parallax.thmx",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD42A0.tmp\\APASixthEditionOfficeOnline.xsl",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B03.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B65.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3443.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD475C.tmp\\Savon.thmx",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B65.tmp\\Equations.dotx",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F97.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32B1.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E08.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E39.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E19.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E3A.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4C.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4B.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5246.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E39.tmp\\Feathered.thmx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4BB5.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E19.tmp\\Slate.thmx",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E08.tmp\\Damask.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E3A.tmp\\Circuit.thmx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4601.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4C.tmp\\Main_Event.thmx",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4564.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5246.tmp\\TabbedArc.glox",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E4B.tmp\\Droplet.thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46DE.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53B0.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53AF.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD540F.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545F.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545E.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B07.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54AF.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD546F.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3402.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4612.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54DF.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54FF.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD552F.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55AE.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559D.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55ED.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55FE.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD562E.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563F.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563E.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BD.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD573B.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5828.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579A.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5848.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5897.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545F.tmp\\VaryingWidthList.glox",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54AF.tmp\\mlaseventheditionofficeonline.xsl",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563F.tmp\\gb.xsl",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54FF.tmp\\gostname.xsl",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33E1.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32B0.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\cab333C.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559D.tmp\\iso690.xsl",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54DF.tmp\\Dividend.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BD.tmp\\TabList.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55FE.tmp\\HexagonRadial.glox",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD546F.tmp\\chicago.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33CE.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3413.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3510.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53B0.tmp\\RadialPictureList.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cab329E.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32F4.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33F1.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32A0.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55AE.tmp\\sist02.xsl",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3308.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B38.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD562E.tmp\\ConvergingText.glox",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cab334E.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55ED.tmp\\Banded.thmx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545E.tmp\\Insight design set.dotx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3433.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5071.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD552F.tmp\\ThemePictureAccent.glox",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5828.tmp\\PictureFrame.glox",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332C.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579A.tmp\\gosttitle.xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33D0.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD573B.tmp\\ieee2006officeonline.xsl",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\cab334D.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5848.tmp\\rings.glox",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C4.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53AF.tmp\\Mesh.thmx",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5897.tmp\\BracketList.glox",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B38.tmp\\chevronaccent.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD563E.tmp\\pictureorgchart.glox",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C3.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD540F.tmp\\Vapor_Trail.thmx",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32C2.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DF8.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E6C.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab332A.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_03dd9f3019550169a008b940b684fdea.doc",
  1109. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28928034-EC99-47AE-9B6E-971879AF28B9.tmp",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1111. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF7D424C3-CCCF-485E-AD8A-BB6FF1A36570.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1CE0.tmp.cvr"
  1113.  
  1114.  
  1115. * Modified Registry Keys:
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\,p5",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1932D07",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1932D07\\1932D07",
  1139. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1438. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1443. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1444. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1445. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1750.  
  1751.  
  1752. * Deleted Registry Keys:
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\,p5",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\`*3",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1932D07\\1932D07",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1761.  
  1762.  
  1763. * DNS Communications:
  1764.  
  1765. "type": "A",
  1766. "request": "mxzyw.com",
  1767. "answers":
  1768.  
  1769. "data": "155.138.144.4",
  1770. "type": "A"
  1771.  
  1772.  
  1773.  
  1774.  
  1775.  
  1776. * Domains:
  1777.  
  1778. "ip": "155.138.144.4",
  1779. "domain": "mxzyw.com"
  1780.  
  1781.  
  1782.  
  1783. * Network Communication - ICMP:
  1784.  
  1785. * Network Communication - HTTP:
  1786.  
  1787. "count": 1,
  1788. "body": "",
  1789. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1790. "user-agent": "Microsoft-CryptoAPI/6.1",
  1791. "method": "GET",
  1792. "host": "ocsp.digicert.com",
  1793. "version": "1.1",
  1794. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1795. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1796. "port": 80
  1797.  
  1798.  
  1799. "count": 1,
  1800. "body": "",
  1801. "uri": "http://mxzyw.com/wordpress/wp-content/plugins/123-giuo/chiji/cjayyy.exe",
  1802. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1803. "method": "GET",
  1804. "host": "mxzyw.com",
  1805. "version": "1.1",
  1806. "path": "/wordpress/wp-content/plugins/123-giuo/chiji/cjayyy.exe",
  1807. "data": "GET /wordpress/wp-content/plugins/123-giuo/chiji/cjayyy.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: mxzyw.com\r\nConnection: Keep-Alive\r\n\r\n",
  1808. "port": 80
  1809.  
  1810.  
  1811. "count": 1,
  1812. "body": "",
  1813. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1814. "user-agent": "Microsoft-CryptoAPI/6.1",
  1815. "method": "GET",
  1816. "host": "ocsp.msocsp.com",
  1817. "version": "1.1",
  1818. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1819. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1820. "port": 80
  1821.  
  1822.  
  1823. "count": 8,
  1824. "body": "",
  1825. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1826. "user-agent": "Microsoft-CryptoAPI/6.1",
  1827. "method": "GET",
  1828. "host": "crl.microsoft.com",
  1829. "version": "1.1",
  1830. "path": "/pki/crl/products/microsoftrootcert.crl",
  1831. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1832. "port": 80
  1833.  
  1834.  
  1835. "count": 7,
  1836. "body": "",
  1837. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1838. "user-agent": "Microsoft-CryptoAPI/6.1",
  1839. "method": "GET",
  1840. "host": "crl.microsoft.com",
  1841. "version": "1.1",
  1842. "path": "/pki/crl/products/microsoftrootcert.crl",
  1843. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1844. "port": 80
  1845.  
  1846.  
  1847. "count": 3,
  1848. "body": "",
  1849. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1850. "user-agent": "Microsoft-CryptoAPI/6.1",
  1851. "method": "GET",
  1852. "host": "crl.microsoft.com",
  1853. "version": "1.1",
  1854. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1855. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1856. "port": 80
  1857.  
  1858.  
  1859.  
  1860. * Network Communication - SMTP:
  1861.  
  1862. * Network Communication - Hosts:
  1863.  
  1864. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!