API tools faq
paste
Advertisement
paladin316

Docs_110920778b09d04ecca9d0548cfd7752_doc_2019-07-25_07_30.txt

paladin316
Jul 25th, 2019
3,587
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 209.48 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_110920778b09d04ecca9d0548cfd7752.doc"
  7. * File Size: 9613
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "ca80938715ed9886604daf7caeca1e74f1024c7ce070c06ac24140bf59a817a9"
  10. * MD5: "110920778b09d04ecca9d0548cfd7752"
  11. * SHA1: "ab92eeee9262b4877832164b3a4ff5e78bc0c362"
  12. * SHA512: "276d255c013a3198227019c64dbf42a4edcf9d17b26eea1a1b614f04a0b88cb4facff00f8bdfa4ada09ca4052c8246eff473dc5d893b462fbfd5c9604d07e563"
  13. * CRC32: "A089DAA2"
  14. * SSDEEP: "96:rOaHVvL/5lRHvSzd9bPyjtdlmKgS+OyCutJxT6QeLU187NVjb:CCNLRTPSzvqpdk0ccQeLTNVjb"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2080"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 337 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  41. "Details":
  42.  
  43. "IP": "52.109.20.1:443"
  44.  
  45.  
  46. "IP": "23.60.72.96:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "104.109.236.22:443"
  53.  
  54.  
  55. "IP": "184.28.188.193:80"
  56.  
  57.  
  58. "IP": "72.21.91.29:80"
  59.  
  60.  
  61. "IP": "184.28.188.192:80"
  62.  
  63.  
  64. "IP": "52.109.2.18:443"
  65.  
  66.  
  67. "IP": "104.18.25.243:80"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  73. "Details":
  74.  
  75. "ioc": "chevronaccent.glox"
  76.  
  77.  
  78. "ioc": "ontent.inf"
  79.  
  80.  
  81. "ioc": "architecture.glox"
  82.  
  83.  
  84. "ioc": "turabian.xsl"
  85.  
  86.  
  87. "ioc": "set.dotx"
  88.  
  89.  
  90. "ioc": "rame.glox"
  91.  
  92.  
  93. "ioc": "adial.glox"
  94.  
  95.  
  96. "ioc": "gostname.xsl"
  97.  
  98.  
  99. "ioc": "ist.glox"
  100.  
  101.  
  102. "ioc": "iso690.xsl"
  103.  
  104.  
  105. "ioc": "mlaseventheditionofficeonline.xsl"
  106.  
  107.  
  108. "ioc": "chicago.xsl"
  109.  
  110.  
  111. "ioc": "sist02.xsl"
  112.  
  113.  
  114. "ioc": "harvardanglia2008officeonline.xsl"
  115.  
  116.  
  117. "ioc": "rocess.glox"
  118.  
  119.  
  120. "ioc": "gosttitle.xsl"
  121.  
  122.  
  123. "ioc": "ext.glox"
  124.  
  125.  
  126. "ioc": "iso690nmerical.xsl"
  127.  
  128.  
  129. "ioc": "content.inf"
  130.  
  131.  
  132. "ioc": "iew.thmx"
  133.  
  134.  
  135. "ioc": "nline.xsl"
  136.  
  137.  
  138. "ioc": "quations.dotx"
  139.  
  140.  
  141. "ioc": "ieee2006officeonline.xsl"
  142.  
  143.  
  144. "ioc": "e.gu"
  145.  
  146.  
  147. "ioc": "anded.thmx"
  148.  
  149.  
  150. "ioc": "rings.glox"
  151.  
  152.  
  153. "ioc": "ccent.glox"
  154.  
  155.  
  156. "ioc": "pictureorgchart.glox"
  157.  
  158.  
  159. "ioc": "asis.thmx"
  160.  
  161.  
  162. "ioc": "rid.glox"
  163.  
  164.  
  165. "ioc": "..3b"
  166.  
  167.  
  168. "ioc": "eadlines.thmx"
  169.  
  170.  
  171. "ioc": "ividend.thmx"
  172.  
  173.  
  174. "ioc": "rame.thmx"
  175.  
  176.  
  177. "ioc": "ype.thmx"
  178.  
  179.  
  180. "ioc": "etropolitan.thmx"
  181.  
  182.  
  183. "ioc": "arallax.thmx"
  184.  
  185.  
  186. "ioc": "adge.thmx"
  187.  
  188.  
  189. "ioc": "rc.glox"
  190.  
  191.  
  192. "ioc": "uotable.thmx"
  193.  
  194.  
  195. "ioc": "gb.xsl"
  196.  
  197.  
  198. "ioc": "erlin.thmx"
  199.  
  200.  
  201. "ioc": "rop.thmx"
  202.  
  203.  
  204. "ioc": "ircuit.thmx"
  205.  
  206.  
  207. "ioc": "g.n9"
  208.  
  209.  
  210. "ioc": "eathered.thmx"
  211.  
  212.  
  213. "ioc": "vent.thmx"
  214.  
  215.  
  216. "ioc": "esh.thmx"
  217.  
  218.  
  219. "ioc": "late.thmx"
  220.  
  221.  
  222. "ioc": "amask.thmx"
  223.  
  224.  
  225. "ioc": "rail.thmx"
  226.  
  227.  
  228.  
  229.  
  230. "Description": "Performs some HTTP requests",
  231. "Details":
  232.  
  233. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  234.  
  235.  
  236. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  237.  
  238.  
  239.  
  240.  
  241. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  242. "Details":
  243.  
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x019q\\xcd\\x03\\x81\\xb9\"\\x87\r\\xb5\\x19q\\xfa\\x06\\x84\\xd9\\xb1\\xd2\\xac\\x19?s\\xaf\\x9dr=\\x8b\\x93\\xee\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245.  
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7^\\xbf^\\xf0\\xa6\\x835\\xd2w\\x04\\x19\\xa1z\\x9f\\xfc\\xba\\xaak\\x89\\xbc\\xfa\\xf9w\\xaf\\xc7(\\xfc\\xc2\\x0e\\xcf\\x06\\xa2a\\xaa\\x91\\xf7\\x80d\\x08\\xae\n\\xd4t|$\\x1c\\xb9\\xa1\\x13\\xbe\\xd4\\x95\\xf7\\xbe3#8\\x0e\\xe5\\xee\\x9fbt\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9bz\\x15\\x89\\x1f2\\xc3*h\\xb8\\x98\\xb29\\x81\\x02\\xb5\\x1ac\\xaa`q-\\xa7\\xdf=\\x9a\\xb8f\\xd3\\xea\\x80\\xc7\\xed<v\\xe5\\xeb\\xbfye\\xc5\\xa9\\xe1>\\xee/ox"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb3\\x86\\x7f\\x8es8\\x18k\n\\xf3gq\\xac\\x11\\xc3 \\xbeyx\\xddj9\\xa7y\\x1b\\x99\\xec\\x86u<j\\xaf2\\xd0\\x9e\\x89\\x1cs\\xcb\\xd2\\xcd\\xdc\\xba>~\td\\xb6i\\x95\\x9d\rse\\x7f\\x84;\\xfco\\xc2\\xde\\xc0\\xdco\\xe3\\xde\\xe5\\x88\\x03\\xe8/\\x87\\x1a\\xf7v\\x19\\x93wz<&\\xael\\x9bxx\\xbc\\x16\"\\x08\\x82\\x04\\xb5\\x8d\\xc2\\xd0^\\x13\\x83\\x9f9jcjnp9fsc4\\xd5\\x8f:\\xc5b\\xd7_5\\x96)\\x0ey\\xfb\\x96\\xa7\\x08\\xf1\\x1c\\xcb)4\\xc0\\xfenb\\xcd+\\xdb\\xd1p\\x97\\xa0w-o-\\xf6\\xda\\xf5k\\xce\\xd0a\\xe0\\x0c\\x95\\xc6\\xc4\\x95\\x88\\x06o\\xe6\\xed\\xaa\\x90\\xfa\\xfe\\x91o\\xcek\\xd4(x\\xb53\\xa73\\x8awv\\x9d\\xbfp\\x13u\\xaf\\x1c\\x80\\xd9\\xa4\\xf5\\xff\\x12\\xe3ve\\xd8a\\x83\\x10\\x18\\x8a\\xaf\\x15\\x04\\x90so\\xd1\\xc0$\\x88\\x9bq7g\\x80\\x1b\\xc4\\xa8\\x9c\\xa44\\x9cr\\xa7\\xd2,\\xc1g\\xfav\\xebv\\x07\\x91\\xdc\\x7f\\xb5\\xa7\\x95\\xf1\\x9e\\x9dl*"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xdc\\x03\\xe9\\xf4;%\\x85?nos5\\xcdzf\\xaf\n42#\\xbe\\xb3e\\xe3j\\xd4\\x1f\\x93\\xb6\\x01\\xb6\\xe3\\x8a\\x9b\\x10\\xce6\\x10\\xf0\\x02\\xa8\\xacxb\\xedm\\xce\\x13\\xaf\\xd8\\xa2\\x88\\xa7\\x0b5\n\\x05\\xbd\\x99\\xbcl~\\xc4\r\\xd1\\xccaptt3y\\x03\\x81\\x03\\xc8k\\x08\\xfehs>l\\xfe(\\x82\\x05g\\x80\\x9e\\xd4lx\\xa3wb\\xe5.j\\xef\\xcan\\xce\\xd8\\xd9\\xd7z,\\xf9\\x92(\\x17vo\r\\x90v\\xe8\"\\x19q1(\\x94\\xa0\\xb5\\xc7\\xebo\\xb8kj\\xe9p\\xdb\\x91\\x0f\\xe3\\xd9npn\\xaf\\x14\\xe8\\xe5^\\xa2\\xa7ev\\x0fb\\xcb6\\x96\\xa3a\\x83\\x96\\x9f\\x942\\xc6\\xcc\\xed\\xd7;\\xb0x?ds\\xb4\r\\x9f=\\x087\\x8c;\\x88r\\xfc\\x8eu\t\\x97\\x9e\\x1ez\\x9d02\\x9b\\x11\\xb0\\xe8\\x13\\xd5\\x94\\x86\\x85qb\\xb2&\\x9b\\xab\\x8f;t\\xc7\\x97\\xaf\\xd0\\xa9\\xae\\x84\\x88\\xeb\\xc5w3\\xff\\x9a\\x89\\x17\\xa32\\xa3\\xdd|\\xc1\\x16#;\\x95k`\\xca\\xeb\\x0b\\xf2h\\xc9\\x14\\xc4"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x019q\\xcfs\\x0f5\\x85\t\\xdd\\x95_\\x16\\xfc\\x9c\\xbd\\x8a\\x88\\xd5\\x9d\\xd6\\xd0\\xb2\\xd5n\\xd30k\\xd64.\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\xc1\\xf2\\xf7\\xcdp\\x95\\xdf3\\x8fg8\\x00\\xda\\xe3\\xbey\\xf5ny\\x9e\\xd8\\xc9\\x89j\\xca\\xfa%\\xf0i\nj\\xf5\\xca\\xf6f\\x9d\\xf2\\xdf\\x8e\\x00\\xc6m1\\xa3\\x18\\x1b\\x0f\\x18y\\xf6\\xd42\\x0ble\\x18`\\x19$-\\xa4#e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&^(\\x17\\xec\th\\xa1\\xf3\\xb9e\\xe8\\xd7\\xf3\\x8e\\xb9fo\\xda\\x10,\\x14di h\\xa0\\x11\\xacyt!\\x0c\\xe8|\\xbblzc\\x0c\\x1am\\x8d\\xf8\\xf4\""
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf3\\x1a\\x90g2\r\\xbb\\xf6\\xbe\\xfa\\xcc\\xbb\\xb1e\\xb3\\xd0\\x1f\\xde7\\xd7\\xd7(\\x04e\\xf2\\x08\\x15h\\xe0\\xed^\\x14\\x1c\\x04\\xa0vx\\xd7%t\\xfa\\x9b)\\xf3\\xe0\\x83\\x1aj\\xe7\\xc9*\t\"%j0jm\\x17\\x0e\\x02\\xb1i\\xf0\\xc9\\xe6|\\x9f\\xb0lr\\xaf\\x80\\x163\\xd5\\xc8,\\xe3o\\x8dp~\\x0b\\x05@\\x80\\xfd\\x0f_\\x08\\xc3\\xc3\\xde0csq\\xf6\\xe9\\xb77()\\xf6g\"\\x8a\\x91\\xa6\\x8dg(c\\x86\\x8c\\x13\\x95\\xd0\\x89\\xfa@\\x02kl\\xc3\\xda\n\\x0c\\xda=\\x02\\x1e\\xf0\\x05\\xfa\\x9bss\\xd0<\\xfb\\xe8\\xc4*\\x0c\\x8f\\xb9\\xfc\\xec\\xd1\\xd7\\x01\\xb8 \\x17\\xdc^l*\re\\xb1\\xf1\\x98d\\xbf\\xaa\\x18w\\x07\\xc6\\xe1\\x92\\xe6\\xaa\\x1e\\xfa\\xc5\\xa1\\xe5l\\xc7l\\xa6a\\xca\\x0c\\xba\\xa2\\xfd^1mw\\xe8\\x99\\xee\\xcb\\xed\\xd5\\xeefqc\\x95\\x1faq\\x0e3\\xb3\\x06mx\\xc1p|q\\x9as\\xb7\\xcb\\xf4k6;\\xc5\\x80ovb\\x04\\x96i\\x12\\xa3\\xa3\\x08\\xc6@\\x04\\x0e\"*e\\xa8\\x90\\x82"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x019q\\xd1\\xbd\\xf41iy\\x9d\\x048\\xe6\\xd7da\\x19xcmlm\\x1e\\xf0\\xe5g;\\x9e\\xad\\xa9!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2\\xd0\\x99\\xc0+\\xc3p\\xd6\\xe7<\\xf5\\xb6\\x9d\\x1c\\x9d\\xfb/\\x84j\\xc8\\xbd\\x04f\\xa6t\\xbb\\xc9b\\x87a\\xd5>w\\xff$\\xe8,$whx\\x82\\xc4\\xff\\xediyq\\xdd\\xd9\\xcc\\xe9\\x1473\\xf7\\xd9\\xc2\\xe5\\x10`z9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x86\\xffz\\xeb*\\xae\\x8cz\\xe5f3\\x8a)\\x86y\\xdbgm\\xd7\\xbce\\x9e\\xcd\\xa5w#\\x89.\\x9b\\xd8\\xd5\\xdf\\xdf\\xa7\\xca\\xe7\\xa9\\x91\\xe02\\xb5\\xf0\\xa5zb"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pj`\\xd7lw\\xac\\xd5\\x9d\\x1f:\\xaa\\xdb\\xa6\\xd0^\\x04n\\xb3l\\x83\\x9c\\xa0\\xed\\x906\\xb1$\\x89\\x18\\x8dp\\xdb\\xef0<\\x84+\\xdds\\x0c\\x03\\xf8\\xf0\\x86\\x05\\xc9\\xa2\\x91\\x08\\x1da\\xbb\\xd0\\xb1\\x0f\\xb7\\x1b\\xcb/\\x7fjl\\xe3x\\x98tj\\xbd\\xf8u4q\\xac\\x10\\x02\\xf1d\\x81/y\\xa3\\xd2\\xdf\r\\x16>\\x8c\\x9fd\\xbe\\x86\\x1a>\\xec\\x02\\x14\\\\xb1\\xe2\\xb4\\xf3\\xe7\\x91?\t\\xafzr\\x83s^\\xc2\\xa8g=\\\\xec\\x88\\x1a\\xb4\\xa9\\xd6\\xf2\\x84t\\xd6x\\xd2\\x9a(d\\xfar\\x92\\xbc;\\xaay\\x97\\xf6@\\xdbn\\xf4\\x15\\x8a\\x15\\x9cl\\x8b\\xd4e\r#\nq\\x14\\x98\\xed\\xc2\\xf6\\xc1c\\x98\\x89~u\\x7f\\xd4\\xdf\\xa5=\\x8b!k\\xb6 \\x97\\x8c,\\xaf\t\\xcb\\xa3\\xc0\\xf4\\xf8\\xa7\n\\xe0\\xa0\\x99\\xfd|>\\-i\\xd2\\x1c\\xbd)\\xfd>a\\x03\\xaf\\xcdec?z\\x0c\\x10t\\xc8y\\x96\\xa5f\\x9a6\\xc5\\xbc\\x13^\\xb9\\xa1\\xd2\t\\x85\\xded\\x9e\\xbf\\xc5'#|0\\xbe\\xc9u\\xda\\xc0p\\xe7"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x92p\\xafmthi\\x1b!\\x1b=\\xb9f\\xbd\\x9b\\x14!\\x97r\\xc7\ray\\x0c\\x04\\xb1\\x9ec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xe2w\\xdav\\xd8)?\\x8b\\x94\\xc3|\\x85\\xdb\\xc2)@\\x84\\x07\\xd9\\xdc\\x86\\x90,^\\x01\\xa3\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1p\\x94x\\xb2r\\xe6b\\xbd\\xfe\\xc9cs\\xf1?\\x1cb\\x8cr\\x1c\\xf6o-\\xf3\\xbd-\\x9e\\xae\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x1a\\x95\\xf0\\x81\\xe4\\xeczwjp\\x15_\\x85\\x1b\\xa9\\xc3\\xf6>\\xed\\xfd\\xa1\\x16\\xd6m\\xe9\\xdf,\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x88|_\\xf4\\x14\\xb5\\xb6\\x80\\x17q\\xc2d\"\\x82\\x03gp_p\\x18+\\xaa\\x03)i\\x8eq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1j\\x95\\xde`\\x8a\\x95\\xb3\\x9e\\xd7fagks\\xda\\xcd\\xf0\\xea\\xcdw 6\\xf4\\xca\\xbek\\x1b\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1j\\x1ao\\xdc/\\x1d~\\xfa\\x87sf\\x91\\x12v\\xe1\\x8f\\xaa\\xdd\\x02q\\xa3\\x8e\\xc3j\\x18n2\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x00\\xc8\\x83\\xccku8\\xaf\\x11\\x15\\xd1g\\xcf\\xae\\x0b\\x95\\xb8b2?\\xac%\\x10\\x11\\xb2\\xed\\xa4\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xdc\\xba\\xc2\t\\xe7<?\\x00\\x04*\\x06\\xb26\\x9e\\xd75\\x83\\xe7%\\x91fb&*k\\x0ew\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x15*\\xf3/b\\xd3\\x966q\\xdc7\\xb9k\\x87\\x8a\\xb5l$\\x8a\\x92\\xb0\\xbcy\\x1b\\xc3\\xdbk%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x14\\x86|,\\x84\\xaa5\\xc2\\xa1-\\xa6\\x03\\x94h\\x04\t\\xbb\\xf4lw\\x10\\x1c2\\x90\\xc8\\x8d\\x97e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xe1\\x1fd\\xe0\\x00\\xaf\\xa6?\\xd2\\xec\\xe0\r\\x88\\xc4\\xcd\\xb5/\\x1b?\\xff\\xd8\\x95a\\xfd2\\x9a%\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1`\\xbf*k\\x1c\\xd7\\x06#\\xb9p\\x87\\xf55\\xd6\\xda\\x15:t\\x02r\\xd8p\\x10sbr0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1x\\x9f\\xa7\\xcdy\\x8f\\xbbe6s\\xb0\t\\x82\\x82u\\xadk\\xaf\\x84o%\\x9el\\xa3\\xc8\\x86\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xb9\\xce1\\x93\\x02\\xb5\\xfe!\\x89^\\x98\\xf0\\xb9e\\xa5\\xd7|\\x06\\x8b\\xae\\xd7\\xf7\\xe1\\xe8\\xca\\x02\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xcf\\xd2\\xdaq\\x99\\x8e\\xder\\xea\\xc6+k6 \\xe5 \\xe6\\x1c\\xe4\\x82\\xbf\\x9c\\x16-!\\xa6\\x90t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x96\\xc9\\xb5\\xa6\\x02\\x95.\\xecn\\xd2 \\xde\r\\xcfp\\xde77d=\\x1f\\xc7\\x8e)\\xb4\\xac\\xc4\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1m\\xfe\n\\x8fdv\\xed\\xf1u,\\xa3\\x18\\x11\\x91e\\x03e\\xc0m\\xa6\\xf4o\\xf7\\x91\\x90pd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd15k\\xc9\\xcd\\xdb\\xd7\\x98\\x14\\xfd\\x1c\\xfd \\xe5s\\xd2\\xfd\\xd9yhk\\x17\\xc7t \t\\x12\\xb6t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1(5\\xff\\x14\\x1d\\xb1o\\xb6\\xf1\\xfb\\xf24^\\xb1\\xd4,\\xa7\\x15bv'\\xe9\\x9d\\x8e\\x829\\xeb\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x83$\\xe1g\\xeb\\xce\\xa0\\xf9\\x19\\xfe\\x9e\\xd8w\\xa3\\xd7/\\x1e\r\\xa4\\x0f%:rqf\\x08\\xec\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xb4af\\x879.c\\xaf\\xde\\xc3\\x16\\x8d\\xc4\\x82\\xf3%\\x80\\x1ej\\x14|r\\xf1\\xd0s\\xc2|\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1a\\xb3\\xa7\\x03q\\xc8\\x00\\x98ka#s\\xee1\\xea\\xfc\\xab\\x1bu*\\xf8w\\xc4\\x9d\\xcd#\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\x06\\xc5\\x81q\\xfd4\\xb6\\x07^m\\x97\\\\x86\\x13t.\\x07\\xfd\\x92<\\xa0$\\x07g\\xc0\\x83\\x93-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xdb\\xd1\\xf0a\\xcfh\\x00\\xab\\xc7\\xfer\\xa3g\\xb9?w\\xd1\\xca\\xe43f\\xfad\\xe2\\xda:\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1\\xafk\\xc4#z\\xce\\xff\\xc96/\\x8a@\\x04\\x9cj\\xbf\\x84\\xb5\\xaab\\xbcf\\xb09\\xa2\\x86\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xc2+\\x88,\\x9d\\xe8\\xd5\\xbf\\xb6nu.\\xe4\\xbed\\x9c\\xee\\x93\\xd0\\xfb\\x0b\\x80+\\xb27-\\x86e\\x11\\xc6\\x12\\xbcm\\xfb\\x8c\\xc7zm<i\\xf9\\x88q\\xa7(\\x7f?\\x9au\\xc0\\xc3\\xe9>\\xd6\\xdc\\xabz\\x93\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*=u\\xfd\\xefj\\x17\\xa3w\\x04\\xa5~p\\x0b\\x89\\x9c\\xa3\\xdbad@\r\\x13g\\x16\\xf8k\\xc1\\x0b\\xe0\\xcc\\x1f\\xef\\xdf\\xe8\\x8c\\xb2\\x1fg\\xa4\\xab*a\\xa6sa-<"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1l\\x89n\\xa0fi\\xfai\\xc9|\\xea*\\x14~\\x8e9\\x9b\\xb9 n1\\xe3\\xc6d(\\xff\\xcc\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\xcf*47\\xe0\\x95\\xe8\\xf5:tt\\xcb\\xe4m'\\xc8\\xc0g\\x9a\\x1dy\\xdf?\\xf8\\xea\t\\xb6\\xe1\\x90\\x16$26\\x93\\xbe\\xac\\xb9bm\\x9f\\x8e\\xe8,\\x89\\xf4\\xfa\\x01\\xc1\\xd9\\xdc\\x97ml'%\\xc3\\xde6\\xb9\\xcc\\xb3\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2\\x83ea\\xb4\\xfa\\xf8\\x1d\\xb7~\\x94n\\x84\\xdb\\xd6\\x05*\\xa8\\x0f\\xddc\\xe8\\xe3e\\xcdo\ta\\x02\\x92@\\x18s\\xce\\xf0\\x83\\x9d\\xc5\\xceb\\xb0\\xd9\\x92jw(e"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd1x\\x07pd\\xda\\x93+fie\\xf8\\x1d\\x9bjw9t_\\xd7\\x1d\\xfau#\\x0e\\xb0?\\xe5r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\xeb\\xb4\\x11s\\xdd\\xfd\\xce\\x84\\xcaf0p12u\\xd9n\\xafj\\xb3t\\x82#\\xf3\\x02\\xac\\xaa\\xd7\\xcc\\xa0s\\xa2,\\xddg\\xb7i\\x11\\xe1\\x0f\\x1d\\x94+\\x13\\x9f\\xc2y\\x0b:8l\\xf6y\\xd1\\xb4\\xed\\xa2\\xe4%\\xc4na\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8a\\xa6+\\x1c\\xb6\\xf9\\x18\\xe7y\\x8a\\xf3\\x80\\x9c\\xfa\\x06\\xda\\xe4l\\xcf\\xa9~\\xd3-\\xa5n\\xcd\\xae/ob8u\\xdb*j\\x8c \\x12\\xacd \\xe9\t\\x102\\x9a<\\xd5"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`y\\xb1\\x0b6.\\xac\\xc7w\\x98:w\\x8d\\xe9\\x0b5\\x02q\\xf4;\\x15a:\\xc6j\\x0et:c\\x96\\xcbl\r\\xfff|\\xae\\xf6\\x07`y\\xa6\\xac\\x10%\\xa8*\\xfa\\xd0\\x0b\\xb4&\\x88+my\\xe9\\xa9\\xba\\x86\\xfe\r%\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xc9\\xe4\\xe8\\x13\\xcc=\\xe0\\xa3\\x8e\\\\x1d\\xa2h\\xc1\\xf9a:\t\\xd3\\xd4j*\\x8db\\xbd1\\x91\\x02\\xd9\\xadm_\\x16\\xd8%\\xee\\x03w\\xc1\\xd7\\xa1\\xf9&\\x94\\xe0\\x91\\x0e"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xbdv\\x0b\\xa0\\xe8\\xea\\xb3\\xc4\\xcf\\x8f\\x16m\\x00\\x9c\\xc9\\x15\\xcchh+\\xb6\\x0e\\x11.\\xa9\\x84\\x8e\\xc9t\\xb7\\xfd\nu\\x07\\xbe\\xe06\\x1b\\xedw6\\x83\\xcal\\x15\\x98f\\x82#k\\xf6+,\\xa7\\xcb\\\\xa9\\xc6\\xb3\\xe1t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\n\\x1a1\\x10\\x9b\\xdf+\\x82q\\xca\\x03\\xd4\\x10\\xcb\\xab\\xca2\\xdf \\x84\\x1b\\xef\rf\\xd2\\x1a\\x17'\\xd2bv\\xee\\xd0\\x84q\t#\\x99\\x85\\xfe\\x1f\\x10z7"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\x0epp\\xd4\\x98\\x06a\\x97d\\x12\\x7f\\x84\\x84\\xd8\\xdb7\\xef\\xb6\\xf9\\xa67\\xcb\\xa7n\\x17l\\x95\\x93\\xecp\\xa5\\x1bk\\x1f\\xca0:\\xb3\\xcb\\x83\\xf9\\xe6<i\\xb8\\x8b\\xe8z\\xe4\\xd3w\\xb1\\x8dm\t\\x81v\\x0f\\xd4*\\x08\\xeby\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf36p\\xca?\\xd3\\xa1\\?\\xa1f\\xc4\\x1av\\x12\\xb1n\\x87nv@\\xeaf,\\xfc\\x0e\\xa5\\xa0|:\\x17\\xe7\\xe0\\x9f\\xb9\\xf6\\x01\\xe9>z\\x0c\\xc0i3\\xaf\\x0b\""
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xef\\xf9\\xec=st'9b\\xc8rr\\xa2\\x84\\xdf\\xe6\\xd8\\x94\\xff\\x87s\\x07\\xee\\xff\\xd9jl\\x87\to\\xea\\xd6\\x90k\\xa2)\\xf6\\x90\\xb7\\xd8e\\xbdt<\\x9b-\\x18\\xc6%2\\xe5\\x97\\xd5\\x02\\xd5x\\xd1f\\xe3\\xeao\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xa1j\\xa3b*\\xad\\xcevr\\x8c\\x8b\\xc7mv\\x8d\\x8ad\\x16f\\x1e\\x14\\xe1^\\xca\\xac\\xbc\\xbb\\xefg\\xb2\\xc1\\x86(\\xf5\\xd0,\\x0b\\xf7\\x91\"\\x03g\\x1e:\\xf2"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdah@\\x8f\\x03\\xa3.l\\x80-yv\\xfa\\x10\\xf1f\\x14+\\x1a*b\\xfdt\\xac\\xe8\\xa7y\\xb2\\xd4as\\xb4\\x8di\\xac\\xe2\\xb6\\xcf1\\xd4\\\\xa3/+\\xd2\\x97\\x87\\xc9\\xef\\xf0\\x87\\xe7d\\xcdg4\\x7f\\x16s\\x82f\\xa5\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8\\xb7bc@\\x8b\\xd0x)\\x8bjntq\\x9b\\xc3&22\\xc4\\x0eh\\xf5\\xee2\\xb9\\xce\\x83\\x94`\\xfd\\x18|\\x85\\xb3\\x9f@ \\xf0\\xc5\\xb7m5\\xe6fg\\xda"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xdc\\x8b\\xc4\\x96x\\xc5\\xe05\\x01f\\xd7o\\x0bc\\xa3aqm2\\xff<\\xcdex\\xc8\\xe8lle\\xeeh\\xd8\\x9e\\xd2\\x8e\\x97b\\xcc\\x85\\x9bt\\xed\\x97<\\xcf\\xbb\\xf8\\xdc\\x8f\\x1d\\xd4\\xa9\\xb3\\xea\\xaa*\\x9d\\xcf\\x9d\\x0f\\xaf\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\\v\\xb1>\\xc7\\x9c\\xf0\\x95\\x8b\\x11q\\x9c\\xee\\x8aeks\\x83\\xa7\\xee\\xac\\xc1)\\x9d\\xe7p\\xa6~\\xd4\\x1fd\\x90\\xa5n\\xa4\\xe5\\xc4\\xcf\\xb4xt\\xa2\\xb6x\\xab"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8dp\\x8a\\x1b\\xd9\\x91\\x00h\\x80\\x9df/\\xce\\x9b\\xb3\\xba8\\xff\\xdc\\x87f\\xfb\\xeah\\x89\\x95\\xee\\xa9\\xcd\\x9el\\xa9\\xfa\\\\x8a\\x9d\\x1a\\\te\\x0e\\xfa\\xa9-\\xd00t\\x0e\\x9a\\xe3mx\\x9eh\"l\\xcdre\\x1en\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\xe4\\x0c\\xb0z\\x81\\x90\\xed\\xd6\\x98\\xb3ht\\x85\\xab\\xce\\xe7\\xce+\\xeb\\xba\\xac\\x1a\\xa7\\xb4\\xdd\\x90\\xbb\\xb4\\x93u\\xa1\\xf5\\xd4\\xf9\\xe8z\\xa3=\\x828:/59\\x862\\xcf"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0.\\x196\\xbdkg\\x08^\\xb5\\xcb\\xda\\xaa\\xdf\\xc0\\x10\\xbfo\\xe0\\xe7j\\xd4\\xee\\xe6\\xe1\\x9cy(j\\xa2\\xfa\\xbfsj\\xed\\x80`\\xa6\\x0c8s\\xa1\\x8e\\xee\\xad\\x1f\\xbfnyyu6el>\\xb7\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\xfc\\x99\\xbd\\x1f\\xc1\\x02\\xfe\\x9aw~\\xc5\\xa3\\x17\\xa3k\\x06\\x1ao\\xc0\\x1ab4\\xb9@\\xcdc\\xfa\\xbc\\x85<\\xce\\-u\\xe3\\xb3\rpx\\p\\x91\\xa5\\xc4c|\\x10"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\x91\\xa2\\xeb\\x1f\nv\\xf7\\xfbf=\\xe5\\x1e\\xd3\\x83\\xf5u\\xe1\\xcd\\x9f\\xfa\\x83s~8\\x16\\xcd\\xf7bn\\xe9\\xc0x\\x8d\\xef\\xda\\x8a\\x07\\x83\\x9d\\xd5\\xc4+\\xdc\\xa6\\x02:\\xb9t1n\\x01\\x8a\\xcdn\\x97&<\\xb3:\\xaf\\x13\t\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&\\x97\\xbb\\x7f\\xea\\xb5\\x0cg\\x86\\xc4l\\x12e\\x9a\\xc4\\xb9\\xa12,cm\\x97\\x01\\xd6\\xea\\x86(\\xa2>lo\\xc8\\x07s\\xf3y\\xa6\\xf3\\x89\\xfa\\xa9:\\xd3t8\\x83t\n"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04nf\\x96dt@\\xa4\\xf6u\\xb7\\x87\\x91\\xae\\xed\\xa7\\xe84l\\x01@\\x1cf\\xea\\x00\\x9d\\x97c\\xf2^\\xc5w8a\n\\xeftl\\xfb|\nf\\xc2\\x0e\\xc7\\x0f.\\xea\\x98\\x08*w\\xdb|\\x00\\x8a\\x8e7k\\xe0\\xe7\\xcef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8a\\x94\\xfah\\xef@\\xa2zhqv\\xcb`e\\x1c\\x819\\x17\\xdd\\x82\\xce\\x18\\x8a\\x9c\\xe7\"\\xc1\\xe5\t\t\\xa6\\xf1@\\x12p\\xc2\\xcc\\xfe/j\\x9cmo\\xe1\\x03\\x8d\\xa8b"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7m\\x80\\x84\\xa3y\\xca\\xccd\\x96\\x07\n\\x0ftw\\xc8\\x01\\x87\\xde\\xb8\\x88\\x02>fq@\\xeab\"\\xdd\\xb1ja\\xfec\\xcfwg\\xdc\\x8d\\xa16\\xd3\\x98\\xeah\\xed\\xc40c.\\xe2\\xa4?\\xcaq*\\x15o\\x98\\xfe&\\x1b\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1b\\xa8ue\\x1b%\\\t\\xcb\\xdcyq\\xa6qd\\xde\\x8f\\xae\\xb9#\n\\x00g\n\\xe8\\xfe\\xb7y\\xd8\\xadrp\\xba\\x1d$\\xcc\\xd9\\xc3\\x96\\x15\\xc6w;h\\xceb\\xf0\\xed"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3\\x00\\xb4x\\x11\\xcbg\\x11\\xa2\\x8f\\xe6w%\\xeb\\xf4n\\xd3\\xee\\x07\\xf2\\x85\\xdd\\x04=\\xde\\x10\\xd3g\\x89\\x1d9\\x98u\\xe3\\xce\\xb0\\xbct\\xaf\\xe3\\xdc\\xf6\\xb3m\\xdd\\x06\\xc8$\\xaezx_\\xf3\\xf6\\x14\\xb7\\xc9\\xdd\\xa3\\x81ig\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\x19ed\\xcb\r\\xc8\\x16:\\x00&\\xbf\\xbe\\xfe\\xa9\\x84\\xdfh\\xb3\\x12g\\x01_\\xd5$z\\xbf\\xd852t\\xf7&\\xa5\\x02\\xf0v\\xa9vr\\xe9mpy\\xcd\\x93\\x8d"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xd0\\x9epaw \\xf2\\xfe\\xf3\\xeb\\x19y\\x18\\xe9>\\x14\\xb8\\xbd\ro\\x18\\x99\\x03\\xddv\\xd6h\\xee\\xfc\\x8a\\xe4\\x9ac%v7s\\xd1\\xe0\\x0e\\xf8qi\\x9dtj=\\xee\\xf1(\\xc2\\xe5\\xd7\\xd4\\xcex:\\x1e\\xf3\\xf4#\\xa6\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdc\\x15\\x8c\\xce\\xcd\\x1c\\x91\\xb9\\x99\\x0b\\xc9\\xe3\\x93\\xbf\\xd8\\xbc\\xd8<\\x13.\\x03\\xf8\\x96\\xdcdc\\xc1\\xb3ip;y\\x11\\xf9e\\xd2\\xcb\\x9a7\\xb6\\x9fn\\xe0>\\xa5\\xd2'\\xb0"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\xbf\\xb8\"=\\x82\\x9c-\\x91\\xe5\\xbb3.\\x13fjq\\x86l_\\x96\\xc2:;g\\x95=t\\xeb\\xcd\\x96\\x8a\\x12\\xa7l\\xe1\\xde\\x7f\\x88\\xef*\\xf8\\xb6\\xcf\\x17\\xf6bo\\x06\\xc8\\x0b\\x1b\\xbe8\\x81\\xda\\xdf\\xec\\x96\\x1e\\xfc\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\x0b\\x08\\x8c\\xd6\\\\x97\\xcd\r\\x9c\\xc0\\xc2u\\x8a\\xa6\\xcd\\xfa;\\xbeyp\\xae\\xbf9p\\x8f\\x96\\xa8\\xfaz\\x1c.\\xc8\\x011\\xe2\\xe2\\xdb*\\xa0l\\xa7l\\x95\\xb3"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\x87\\x87\r\\xcdy\\xc7\\x94\\xd1&@\\xd2\\xe6\\xd5\\xb8\\xea\\xb8\\x8a\\xdc3b+\\x12\\x0e8\\xd9\\xb5\\x1c\\xe3\\xa1c\\xfem\\x16\\xc21\\xebl\\xffmpx\\xb3f\\xc2\\xa9\\x91\\xab\\xdet\\x92\\xed\\x06\\x0e$\\xba!;\\x02\\xb3%\\xfft\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xea.\\x03\\xde\\x87\\xba#f=\\x03\\x9da\\xbd\\xdf\\x18\\xba!r\\x05\\xa3ag\\xbc\\xc9m\\x036f\\xe5shx\\xb8n\\xa0\\xa7+y`\\xf3.\\x9a\\xe3\\x9f0\\x82"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19/<\\x00\\xba\\xf1\\xf4\\x85\\xd3\\xbd\\xa5\\x8b\\x18\\xb5\\xb7\\x1b\\x07\\x14\\xd2&\\x01ie\\xec\\xaay\\x00`\\x18\\x07\\xdd\\xf7\\xcd\\x1e:\\xe7\\xc2^\\xe7>\\xfd,@\\x88\\xa9\\xd4\\x82\\xe3d\\x12\\xc0\n\\xb7\\x18\\xbe\\x86\\xbf\\x86\\xeei\\x14\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bg\\xc5\\xf3\\xf1\\xdep\\x15\\x10\\xdc\\x83\\xd9k\\x99\\xaa\\x07\\xc2\\x0c\\x08\\xf7g\\x1dx\\xc5u\\xc8\\xb5e\\xd8\\x9c\\xaf\\xd5h\\xf9\\xd8\\xf4\\x8a#`\\xf1\\x10\\xd9\\x8e\\xa3\\xcd|\\xde"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\x97e\\xad\\xb7cgm\\x16g:%\\xb8\\xa8\\x0e\\xd4\\x97\\x0fl\\x10r\\x1d\\x84~\\xeeta^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\xc2\\x10\\x96\\xabp?\\x95s\\x81wf.\\xf0\\x8a@\\xed\\xd3\\x1f\\xa6\\xec\\xa1\\xf9\\x1d\\xc1\\xb7\\xa6\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\x92\\xee\\xf4\\xc2\\xcc\\xcb\\xb3?\\x0c\\xa0\\x14@\\xcc\\x930c)\\x16@>\\xc7\\xbd\n\\x94\\x1b\\x8d\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.1\\xa7\\xed\\xfd\\xa8\\xd9\\xf8\\x8cey:\\x8d\\xd9d\\xaet\\xee^w2\\xac8v\\x01\\xf5\\x12\\x00h\\x9f\\xbc\\xee\\xaf~\\xa9\\xb3\\xf4~w\re\\xa6r\\x87\\x98:,\\xfb\\xa3ba\\xe6\\x9dw\\xb0\\xb82\\x9c\\xbc\\xe2\t\\xcc\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\x8c\\xa31\\xe1\\xc2y\\xb1\\x8fv\\x12d^\\x8f\\x0e/9@\\x06\\x952m?\\x82\\x80\\xf8m\\x93*\\xa6\\xc5u\\xdcm\\x7fb\\x18\\xf0\\xb3\\xd2a\\xb8\\x1b\\x06\\x90r"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdep\\xc1\\xf0*m\\x88\\xa0\\x1d\\x0e\\xc5wdu\\x7f\\x9d:\\x00\\xbe\\xc4p\\x1c\\xc0f\\x9e\\x91\\xf1glv\\x1d\\x81v\\x89o\\x89\\x8b\\xa2\\x8a\\x81d\\xa7s\\x8e\\x97\\xdc2i\\x7f\\x7fw\\xc6\\\\x08\\xc3=\\xf4\\xdf0o\\xccs\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;\\xee\\xce\\x9d\\x99j\\x0f\\x0c\\xe2\\xba\\xb1\ra\\xe3\\xc1\\xbecjl\\x82\\xb5\\x8b\\xbd\\xf1g\\x04\\x11a\\xae\\xb5~\\xc1\\x01\\xea\\xccq\\xfek\\xbc,d\\x8b\\xa1\\xa1\\xbf0<\\x91"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2<\\xbdb\\xa0\\x97\\x05\\x03\\xf2\\x9a\\xdb>'p4w#\"x\\xeb\\x9b\\x10\\xdf\\x0e\\x18y\\xb1\\xba\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97\\xa3j\\x91c\\xe7\\xcaa\\xc1\\x19w\\x19c\\x0fi\\x12\\xa7\\xb7%8\\xec\\xb1\\xaf\\x1c!\\x16\\xb2\n).\\xb08\\xce\\xbe\\xe9#\\xd0\\xa9r\\xb4\\xc5\\x05\\x01\\\\xb3\\x82\\xc2\\xe9\\xee*\\x1e\\xd3\\xae~\\x8a\\x03ju\\x87`\\x9b\\xf5z\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc6\\xc2a\\xa0zup\\x1e\\x80\\xe5_\\x04@\\x9f\\xca\\xc7\\x9c-\\x07\\xf0%q\\x04\\x96\\xd1\\x9b\\xa7\\x95\\xc1\\xc6;i\\xb0i\\xb4\\xbe`\\xf7e\\xaf'u\\xe2\\x95\\xf6;z\\xb8"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xd4ym!\\x19\\xbb\\xc4\\xeeh\\xe2'4\\xcf\\xa6\\t@\\x8aq\\xe90\\xcd\\x01w\\x1c\\xa2\\x16|\\x84\\xf0fb\\xb4\\xeb-\\xcf4\\xe2xn6\\xa4<kz\\xc7\\x07\\x12;q<\\x02\\xe0\\x92f~\\xdfe\\xd0\\x82\\xf9\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(\\xd3=\\xe1fj\\x04x @\\x80\\xb1_m\\xd3\\xc8$\\x8a\\x8brb(0\\xd4\\xe2\\x02@\\x17<5\\xd5\\xcc\\x0cf\\x8b\\xe0a,\\x0c\r\\xf3\\x1b\\xb2\\x7f\\xf0q\\x86b"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\s\\xe0\\xd7\\xc7\\xc5n\\xce\\x7f\\x074de\\xf1t\\xb2)\\xa6c\\xf3fy\\x91\\xa9\\xc1w\\xfe\\xabi\n/?(m\\xcb\\xfdh\\x18\"\\xd7\\xdb\\x98\\x89l\t\\xc7\\xeb\\xd6doa\\xf7\\xca+\\xdb6\\xf2\\xd8\\xbfe*n\n\\x9a\\x1b\n\\xd4\\x1e\\xabv\\xfer\\x96\\x06\\xf3\\x87\\xcf\\xe4\\x16\r\\x88\\x8c\\x94\\x1al\\xe2\\x90\\x92u\\xa3 \\x95*\\xe0\\xb7\\xe2\\x1ex0 x\\x9bwk\\x96\\xe2\\xbe\\xe2\\x7f\\xa82 \\x88\\xa2\\xb7\\xf0\\xc1\\xbc&\\xfac\\xd4\\x00a\\xc4\\xef\\x02\\xb1(5<#ner\\s\\xf6\\xc8\\x94\\xc0i\\xa9\\x95\\xe4b\\xc2\\xb6\\xacd\\xe1\\xa2\\x0e&)#\\xb9yq\\x84\\xb6v\\xf9\\x0c\\x99*\\x9bm\\x8e*\\x90\\x87\\xc9x!\\xd5q\\xe6\\x98\\x96\\xd4\\xac.\\x90\\xad\\xdc\\xef!\\xac\\xcc\\x8e\\xd9\\xd8j\\x84z\\xbcz\\xc1\\xcd\\x97\\xa5fu%2bf0p\\xad\\x1d\\xf8wl\\xca\\x15\\xea\\xccj*\\x05\\xefa\\xd4ll\\x8fd\\xe6\\xa1\\x08\\xcd\\x94x\\xca\\xe9br\\xb7v\\xd4#v&)"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s%\\x84\\xf0*\\x85\\x1e\\x13l\\x87\\xea\\xd1\\xee~\\xd3\\xab\\xb1t\\xf0\\xce\\xf9\\x8b\\x08\\xfash\\x9e\\x89\\x8d#\\xeen\\xe7\\xee>\\xae\\x143h\\x81oa\\xc8\\x03\\xcc\\xc7\\xe1\\xf77\\x9a\\x8e\\xbf\\x82\\xc8#\\xbf\\xb2_eoj\\x8bj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\x1ay\\xf4\\xd2\\x96\\x8a\\x97\\x86\\xd2\\x96\\xce\\x146)\\xd0t\\x16i\\xe7\\xe8\nm%\\xd9\\xfa>\\x0f\\xd5\\xfb%\\xeai\\xc6\\x8f\\xa7\\x9e4y\\x90\t\\xb5\\xb0@\\xc3\\x7f\\x8c\\xa2"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\x95\\xb6\\xf0\\x8df%\ni\\xcc\\xf2\\xaa\\x05\\xd1\\xac\\x17\\xc5\\x0c\\xfddg\\xeed\\x12\\x9c\\xe0\\xa0\\x95\\xe1\\x7f\\xfe\\xc0\\x86\\xa6#\\xb5i@\\xb0\\xb4/\\xed-\\x9e\\x1f\\x1f\\xfa\\xef^\\x96\\xedc6 u\\xfb\\x8c\\xc4\\xb4\\x1b\\xe1y\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\x98t\\x1cg8\\xdb4\\xd3&=\\xa9\\xfe@\\x86\\xdar\\xe7\\xcff\\xdcw%ft\\x1c\\x16\\xf0v\\x08\\x9e\\x9a\\x1f\\xa8\\x8fc\\x8d\\x14e\\xf4\\xfc\\xdb\\xfc&e2\\x16"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf\\xe9\\xa3\\xb7\\xb1\\xe7\\xee\\xba\\x9a\\xb1\\x13\\xfc\\xd7\\x11\\xa7\\xa2\\x8f\\xf3*\\x9fv\\xa2\\x1cb\\x00m\\xbe\\xfb\\x1b\\xe2\\x89y\\x0e\\x92\\xb1\\x9b\\xa7\\xb7k\\x94\\x8f\\x98\\xa0\\xee\\x1cnc\\xe8\\x89^\\x98\\xd9\\x04hf\"xu3\\xeb\\xbb?y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4t\\x01w\\xf6-(\\xed\\xd4\\x18\\xb7o\\x0e\\x85\\x84\\xbe\\xc5\\x0cw\\xf0\\xef\\x13\\xf6\\xcc\\xef\\xf0\\x7f\\xdd\\x18o\\xa3\\xb9\\x00mj\\xb7\\xf3s\\xbfaw\\x13`\\xf3/l\\x19\\x83"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86\\xe1\\x92\\xb4\\xe0\\xb7(\\xcb\\xda=r\\xc1\\xbbq\\xf7\\x15\\x9e\\x0b\\xfb\\xac\\xc5\\xd5\\xf6\\xaa\\x08\\x04s\\xec6v\\xf7\\xb4\\x8e\\xc4$\\x8a\\xb8n\\x8e1\\xb4\\x8at\\xc5,\\xb3\\xd3\\xee~le;k'h\\x8c\\xb7\\x90\\xa6oj\\xb9\\xd8\\xc0\\xef\\xf0~7\\x98\\xdbuq\\xa4\\xce\\xfc\\x86\\x1d\\x11\\a\\xab\\x9a#\\x05\\x18\\xd4\\xa7n\\x00\\x9b\\xdb\\xfe(\\xfbta\\xc3!\\xdf\\xc7j\\x10\\x10e\\xb9ek\\x0c\\x07;\\x06\\x10\\xae\\x99\\x87\\x86\\x9f\\xc5!\\x9dt\\xe2\\xc9\\xdf\\x0c\\xc1\\x06ka\\x11<r2\\x94\\x7f\\xe5\\x00\r\\x0f6\\xe1\\x9d\\xe7\\xdd\\xc4\\xdfwy\\xaa(\\xb0\\xbfc\\xf8\\xc5e\\xdd\\xc2\\xb0\\xd4\\xbc\\xe85/+\\xd1\\xd1\\xbd,l\\xc7\\xb7fpu\t\\xc7w\\xb2\\x83\\xf4\\xa90\\xaa\\x12\\xfb\\x88\\x1b?\\x8c&u\\x98\\xd6\\xa8\\xb6\\x18\\xa5v\\x01\\xe7b\\\\x9ae\\xb9\\xac\\xd9\\xdd\\xb3\\xab\\xe9\\xce\\xb7*\\xd9\\xe1\\x9f\\xb0\\xd9\\xca\\xdc+\\xc6\\xb2\\xc8-\\x01\\xd9\\xc1d\\xe0\\xe5c`\\x8d\\xe4ec*\\x81x\\xe9\\x01"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\x96w\\xf2\\x08\\xf5a;\\x15\\x1a\\xf4f)i@\\xe2e\\x96\\xb2\\xa7\\x1e\\xd4/\\xe1u4.v\\x92\\xd3v\\x13^3e\\x81#;\\xb3c\\xf1\nm\\xa2\\x15\\xca\\xfd\\x04\\xb1\\xff\\x1ef\\xd9\\xb3\\x0b&\\xf2\\xeb\\x8b\\xc4m\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\x7f\\x92\\xee\\xd9\\xda\\xd0r\\xeb$\\x94\\x985\\xdc\\x08\\xe4\\x86\\xdd_\\xb0\\x81\\x85\\x8c=y\\x0e\\xf8\\x1b\\xd3\\xa9\\xd8u\\x16w\\xc3\\xe9\\xa8\\xe4\\xdev\\xfenxd\\xb2\\x9b\\x1bj"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2,r\\xcc!w\\x0b\\xab\\xfd*\\x9cl\\x12_\\xb9\\xe1\\x1b\\xc3\\x92bnv\\xb5\\xf0e\\xe6\\xc5\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\xeeq\\xa8n#\\xbb`\\xc5\\x16\\x8f#fa\\xbd\\xd1\\xea\\xe7 \\x14\\xa3v\\xbc\\xe9\\xf7m\\xb0\\xe5o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xc0#tbc\\xda\\xb8\\xf4\\xb5\\x8c\\xa6\\xee\\xb7\\xf3\\xfd\\xbd\\xdcx\\xdep\\xcb\\x04\\xde\\x04\\xd6\\xa2\\x901d\\xc0+\\x82\\xe7\\x8fg\\x84\\x82\\x80/\"\\xd8\\xdak>\n\\xfd\\xc5\\xba\\x1e&\\xc6\\xfc\\x0c\\xe1\\xfb\\xd7i'j\\x1b\\x03\\xec\\x9a\\x1a\\xfe\\xef\\x8e\\xe4\\xe9\\xd3\\xf0\\x8a\\x04\\xfe\\x05\\xc0\\x9b\\xa6\\x99\\x86%\\xb2\\x87/\\xa7\\x98j^\\xf2\\xde\\x9e\\xc9osuvo\\xfd\\x87\\xfe\t\\x81\\xbe\\xd0\\xc2\\xb9*\\xada\\xb6\\x0f\\xf0j\n\\x0e\\x02k\\x83\\xd6\\xc8r\\x7f\\xff\\x05\\xe8\\xdfn/\\xbb-\\x95\\xf6>e\\xa7?\\x06!(\\xf6\\xb0\\xa8\\xbf\\x88\\xd4\\xf0\\x14\\xd5gz\\xc3lo\\xdb<\\xc4:\\x1b0\\xbc\\xb2\\xb1\\x8b\\xe3\\x89|\\xe7r\\x8f$g.\\xa0\\xc4\\xc6m2v\\x91\\xcd\\x1c\\x05\\xb1~\\x87ayh;\\xce\\x0b\\x8e\\x85_\\x1c\n\\xbc3\\x06jt\\x02\\xc3ie7\\x00\n\\x15\\xfe1\\xfa\\x1b\\x84\\xee\\xf7\\x8c\\x92m\\xee\\x81p\\xeab\\x044rq1\\xe5e_\\x04\\xfdt\\xc4\\xec\\xa6\\xaa\\x81\\xff\\xe3&c"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xec\\x13\\xe0d\\xb6x\\xd1 \\xa8\\x14\\xd6q\\x1a\\x16\\xf6e\\xf1w\\xd9\\xf8?\\xb6i\\xb4\\xb1\\xf8\\xc1v.\\x9c\\xb5\\xbd\\xfa\\x072\\x86\\xab\\xeb\\xf9/\\x81r\\xfc\\x81\\xe0\\xca(\\x9c\\xd1;_&\\x06\\x9dao\n\\xa4\\xa54=\\xd9\\x97\\x08\\x90\\x14\\xce|\\xf4\\xb8\\x0b\\xf8\\xd6s\\x9ff\\xc0\\x12\\x12d)\\x0e(h\\xdf\\x93v\\x00\\x1f\\x82s\\xe5\\xf5\\x97\\x17\\xcd;t\\x1btgg\\xe6$\\x81\t\\xff\\xe2\\xb8\\x8d\\xb9\\xf0\\x9c3\\x8f\\xfe4p\\xca\\x11\\xff\\x87s\\x12o\\x1d\\x8d\\xd6d\\xf5h\\xbc5/_\\xb9\\xb6\\xa1\\x04x\r\\x8e\\x1d\\xe5\\x12\\x83\\xbc\\x81.\\x9d$#\\x95\\xdf\\xad\\xf0\\x9b\\xf0o\\xfe\nf|:\\x8c\\xaa\\xbb\\xa7\\xae\\xc1c\\xb9w\\xd1\\xb6\\xac\\xb0u\\xe3\\xeea\\xecp\\x8b\\x14\\xa1\\x8cg\\x1a\\xe9\\x17\\xc7\\xb1\\xfa;\\xf6\\x93!\\xda;\\xb8\\xf3\\xae\\xff\\xe9u:;\\x054\\x12\\xb7*e\\x08\\xc1\\x8d:\\xcay5\\x8d\\x18n\\x11\\xafr\\x15\\xee\\x132\\xe5fqmt\\x82a\\x80op"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xbb\\xf1i\\xf5\\x83\\x1e5\\xe4aba\\xa6\\xa9;z\\xa3\\xfe\\x8bv\\xfd\\xac\\x92\\xf9cw\\xec\\x9c\\x08q\\xd8l\\xd6\\x00\\xb2\\x84\\xff\\x19t\\xb7\\x000\\xf8ni8\\xf6\\xde`\\x7fc\\xcd\\xcc\\xd5\\xe7b\\xb7e\\xf51l\\xf5\\xf2\\x80\\xdd\\xa1\\x9f\\x8c\\x9b\\xed#^7\\xb4\\x8c\\x8c\\xa2\\x9ct\\xbd\\xc8\\xd0\\x90\\xc8\\xc45\\xda\\xc1\\xa4r\\x89b\\xb0\\xc2\\x96\\xc0\\xe8)\\x1aw _,\\x07\\xba+-y\\xdez\\xa4\\xa1\\xcc\\xe8\\x82\\xbf4\\xfa\\xdd\\x0fe\\xb4\\xda\\x9e\\xde\\xc5\\xb3\\x99\\xa6\\x08\\x15\\xd25(0\\x8f+f\\x11\\x964\"\\xf7m\\xffo\\x04\\x0c7\\x05\\xb6e\\xfc\\xff\\xccwk>\\x04s\\xad\\x8f\\xe9)\\x9b\\xc1-$\\xcfvc\\x03>\\xe1\\xe8\\xba\\xeb=\\xc1\\x1cx1\\xd4^\\x8fbx\\x08y\\xad9\\x9b|\\x070\\x0e\\x8e\\xb1\\xa6\\x1bsz\\xd9\\xa3\\xcd\\xda\\xf6\\xdf(t\\xb8\\\\x03\\xef\\xa3(\\xb5p\\xf4_\\x9e\\xceh\\xeb\\x804\\xafp'f\\x10p\\x80\\xc8\\xd8\\xc87t\\x00\\xd3\\x9f\\xfb\\xf6\\xa9\\xc8\\xbb"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\x03e\\xba\\xfc-\\xb2\\xb9\\x1c2\\xca\\xf9f\\xf0\\x7f4\\xd5\\xdfj\\xa8\\x1f\\x86\\xe5r\\xfb5\\xad7\\xbfe:\\x9d\\xfdt\\xf2`i\\xa4i\\xa6\\xa0\\x92\\x16u\\x8cnr\\xb0\\x1d$w\\x9dnv\\xa5\\xf4\t?\\x1ec\\xf5|\\xe7\\xcd3f\\xf7)f\\xf1\\xad\\xf6\\xe4l\\x1c\\xb8-9k;\\xae\\xc8\\xffk\\x85'\\xd5^\\x0fg\"\\xcbm\\xde\\xfd'<q\\x9e\\xd4\\xab\\xa03#\\xb4^~vj\\xbb\\x0cs\\xcb\\x10\\xa1q\\xc0\\x1bnx\\xc2\\xafe\\x90b\\xac\\xd2\\xacvmwn\\xfe\\x029'^\\xd2\\x9f\\x8a=\\x84$q\\x9f\\xb6\\xba\\x17es\\xce\\x01\\xdem\\xb65\\x17plb\\x89.\\x01\\xc4\\xa5\\x1c\\x8a\\x86@>\\x98\r\\xca\\xd8\\xe0b6\\x86\\xdd\\xd7\\xac3\\x827\\xc2f\\x0c\\xaa\\xdf\\xb1\\xb6\\x1f\\xdd\\xda q\\xcdi\\xbdk\\xb1\\xadh\\xe9\\x0cj\\x8e\\xec\\xce1\\xaf\\xb6\\xb8g\\x07\\xa7)\\xa5\\x05v\\xbd\\x80m9\\x9dru7\\xbc\\xc7h*n\\xb2\\xd4@h-\\xe2^\\xa9\\xef\\x89n\\x17fa-"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2+b\\xd2\\xca@\\xefq\\xc0\\xa3\\xc3~\\xb5\\xdc\\xf9\\x8a\\x18\\xd8\\xf9zo\\xce\\x93\\xc2\\xf2\\xe0&\\xe7\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2l\\xeb\\xb6\\x04\\xc2\\x06\\x1c\\xce\\x80\\xb5\\xeco\\x9e\\x80.\\xa7\\xf2m\\xcbn ^a\\xf2\\xf4\\x8dm\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r;\\xda\\xc4d^\\xc0\\x04xa/b\t>\\xa3mb,\\x8c\\xca\\x00\\xdb\\xd6\t&'\\x8dl\\x1c\\x98f\\xdd\\xdehw\\x02\\\\xc9\\x9a\rq\\xffm$\\x02\\xd6\\xf5\\x94j9`5\\x98\\xed\\x06\\xb9s\\x17\\xd7\\xaf\\x84\\xa5\n\\x13\\xa7\\xd7\\xa8\\xe0\\xcbp9\\xbd^\\xd67\\xcc\\xccvg\\x9axhx\\xa5\\xb3\\xac\\x02\\x1aq#\nm\\xc7\\x85\\x01;\\xd1\\\\xbf1\\x97\\x103\\xf8\\x19\\x8ci\\xdd\\x1b\\xe7\\xda8opn\\x13\\xb9\\xc7wa\\xca\\xee\\xdb\\x02\\xf6\\xd5\\xae\\xee\\xbb=\\xbe\\xfc\\xf5)\\xce\\xc4\\xa1$s\\xab\\x85\\x12\\xc9\\x1d\\xb1w\\xab\\xf0\\x13w\\xe9\\xdd\\xad6\\xd5nv\\xcfe\\xf6b\\xfa\\xb8\\xc2l\\x8c\\xf1\\x03\\xd3rz\\x04\\xbcye\\x08\\xb5\\x1c\\xcdd\\xb8x\\xdf\\xaf\\xd5\\x94\\x8e!\\x0b\\xe6\\xa6\\x95\\xea\\x92\\x13\\xbc\\x16z\\xe1\\xa0\\x1a.\\x9ef|\\xddo\\xb5\\xcd\\x87\\xc20\\x8c\\xb8~=\\x16\r@!n\\x9ds2\\xb8fo&n\\x8f\\xce\\x0f\\xb9\\xeb\\xf8\\xfc\\x8d\\xf9\\x03=z\\xf7\\xf4\\xe3\\x1c(\\xf0\t"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x92\\x16\\xc7v\\xaa:\\xd9\\xca\\x833\\xcep\\xfc\\xc0\\xd7g\r\\xf4\\x01\\xa8\\xd8\\x9dl\\xaa\\x81\\\\x18\\xb5\\x9e\\xcbm\\xb3\\xfb\\x028\\xe8i\\x88c\\x9c-\\xc4\\x06x\\xa0\\xb8t\\xd0\\xab\\x96\\x8de\\x00\\xcf\\x82\\xd6k\\xdfa\\xb8f=\\xbd\\x05.\\xb9\\xc9k>r\\x98\\x8f\\x83\\x93w\\x87\\xe67\\xf0\\x0b\\x92\\x0c\\xac+\\x8dde\\xb9$\\xc7/\\x15u\\xd7eor\\xed\\x9c\\xc22^\\xe0r2\\x0fm$\\xce\\xb7+9o\\xc3\\x1c's\\xac\\xabb\\xae\\xa0e10\\xb0z\\x9f-\r\\xbc\\xdf\\x00e\\xdf\\xf3q\\xe0!\\x05po\\xa9oj@qu\\xb2\\xde\\xb1\\x95o\\xd4\\xb6i\\x0b\\x90c\\x80\\x18\\xf3\\xe0\\xf6\\xc17\\xe9\\x1ds\\xf9\\xb7\\x9f\\xd4\\x92d\\xd6p\\xbcc\\xa9,\\x16\\xf5\\xcf\\x9e\\x02\\xf3\\x88w\\xces\\xe0\\xbb\\xbc\\xc8\\xa9\\xbd\\xd4\\xbf\\xe2\\xd4=l\\x96\\x9c-\\xbcz;\\x97\\xd9un'\\xd7i\\xdd\\x86&5o\\xf2\\x84\\x9f\\x10#m&b6b4\\xfdy%k\\xb6~\\xd32\\xc9j\\xa7\n\\x8fo\\x1c\\xb5\\xcb5\\x89"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\t\\x02w\\x1a\\xd9f\\x90\\xfbd.\\xec\\x04\\x15\\x9e\\x13l\\xf2\\x9c\\x85\\x84\\xe4\\xb8\\x1c\\x15\\x1a\\xa7\t\\xc6\\x0f%\\x94\\xa9\\x02\\xd9\\x9coz\\xc4\\xbe\\xf3\\x8a\\x86\\x82\\xba\\x98\\xea\\xf9dzyga`\\x08\\xe2\\x906f\\x1e\\xa2id`\\x93\\xdb:\\x90\\x91\\xd2s\\x93km\\x97\t\\x867|x\\x84\\x8a8\\x8c~\\xf5\\xfb\\xde\\x8by\\xb2b%\\x9c_\\x85\\x12\\xa5\\x98\\x9a\\xb1\\xda\\xd9fe\\x0f\\xd3\\xef`\\xb1\\xda\\x02\\x17\\xeb\\x1b\\x87t\\xea:e\\x9c\\xdfu^\\xa2\\x90h~`1\\xcaif\\x16t\\xba?\"\\xda\\xbb\\xe4\\x08m\\\\xee\\xedqr\\xea\\x84\\xd54p\\xe3\\xe0\\xff$\\x7f\\xc6v+\\xef0\\xb4\\x00\\x99\\xe8e\\x9e\\x9a\\xf2>\\xfc\\xa4\\x1e\\x14\\xb39:w\\x8f\\xeed\\xcfe\\xa3&\\xb3!\\xa8\\x19\\x16\\xa3\\x7f\\xe2\\x04\\x9d\\x02\\xcd\\xb8\\xe8\\x93h\\xf3k\\x81dl.&\\x9a\\x92\\x97|\\x01k\\x97|?\\xf7k\\^\\xb5\\xac\\xc8\\x02\\x84\\x1b\\xde\\xe0\\xc4\\x8a\\x93\\x95k^\\xae\\x9e\\xb6(\\xf3\\xea\\x14;\\xd1r"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xea\\xfd\\xc8\\xfbf\\xf6\\xdb\\xe9\\xa5\\x0f\\xa0\\x18\\xed\\x93\\x8a\\x11&\\x05\\x8e\\xaf\\xdb\\xa8\\xf3\\xc3\\x17\\xe6\\x8d\\xd3e\\x07\\x8d\\xac\\x9f\\x03yife\\xcf5l\\xe8a\\xe2\\xb4\\x96\\x92\\xe5\\x1f\\x07\\xc0\\x9f|\\x8d\\x8e\\xa1c\\x89n;`\\x1f\\x16\\xca\\x99\\xad\\xc6<_\\x16\\x91\\xb1\\xd7\\xadll\\x85\\xe6\\x0b\\xd9\\x1a\\xe5\\\\xf4\\x95\t\\xd4\\x99\\x80b\\x9b`5\\x84@?\\x15\\xf5\\xf9\\xca\\x9fu\\xf0v71\\xaf\\x80\\xb3\\x85\\xfa *\\x9c\\x03\\xcf\\x0f<\\xd0a\\x95\\x8d\\xbac\\x04\\x84**#\\x16u^@;y5o\\x88m\\xc8\\xc9\\xc0\\x94\\xdb\\xfe\\xde\\xd9\\x11\\x8fq\\x08\\x89\\x05\\xcd\\x97%\\x1e\\x06y\\x1a\\x9a\\xc5\\xbf\\xee\\xac\\xc3w\\x92\\x93\\x15|\\xff\\x8c\\x14\\xech\\xd6\\x04\\x7f5\\xef\\xdd%\\xc1\\x97\\xe4d\\x83j\\x9e<\\x80\\xbe\"k\\xe6wk\\x8f\\xa5\\xdd#\\xaf\\xe3z9kh\\x9c\\xc2sz$\\xf8\\xe3\\x16\\xc1\\xd4p\\xb8kj\\xe9\\x9d\\xdd\\x944p\\x8bq!f:\\xf2\n\\x9ej(h\\x84\\x19\\x06p\\x96,"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\x85q(\\xc4\\x1c\\xb3\\xaf\\xcb\\xc7\\x923`\\x87\\x1b\\xbc\\x11\\xeez\\x9c\\x08\\xbd\\xd6\\xf1\\x88v3\\xafz\\xf0r\\x06\\xfb\\x92)d\\xc8\\xc1)js\\xd6\\xe4\\x98,\\xfd\\xc8q \\xf4\\x85-\\xa7pb\\x01\\q`\\x9d|\\x7f\\xab\\xd4\\xbah\\xea!\\xed-\\xc9\\xa9\\xbe\\xe6\\x0c\\xe6\\xc9\\xc2s\\x86q\\xf1k\\xe2\\x94u\\x1d)b\\x9d\\x0e/\\xb6n;_\\xc41\\xb9\\xddu\\x0b\\x9cob\\xfb0%\\xb3i<\\x13h\\x86\\x11\r\\xc2\\xab\\xaay\\xbe3\\xe8\\xbe/\\xa4l|.\\xbf4\\x90\\xe0\\x90?\\xef6\\xd5\\x91\\x92\\x1e3\\xdd\\xc0\\xa2\\x1c\\xad\\xcb\\x1df\n\\x0b\\x10m\\xe6\\xea\\xfa\\x13\\x1a&u\\xf6n)\\xc5+\\x13\\x0ff\\x9a\\xee$yz2\\xa0b\\xa67\\x17\\x89\\x8f\\x04\\xeb\"\\xe7\\x93y\\xa51c\\xc9\\x93h%\\x18\\x14w\\xca\\x82\\xc3\\xac\\xb4fl\\x18\\xfb\\xc2\\x0c7\\xa9 't\\xac7\\xc7f\\xe8\\xa8\\x8dek\\xdba\\x0b\\xe4r\"\\xe8\\x16\\xa8s\\x86+nc\\xf6up\\xfb\\x13\\x0b<\t3\\xf0\\xcb"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xceu\\x05\\x88-s\\xb9\\xf0d\\x990j\\x82\\xe32\\xcb>8\\xd2\\xce\\x1e\\xbc\\x1f\\x8d*\\xc7\\x9da&%\\x06\\7z\\xed\\xe1\\xecq#\\x81\nf\\xea\\x83\\xd8r\\x1cl\\xa1gds\\xd6g\\xab!\\x10\\x91k\\xeb\\xc7\\xf1\\xd3\\x0esxvm\\xd2\"\\xed\\xc2s`\\xb8xm\\x05\\xdc\\xd3\\xd6\\xdb\\xef\\xac\\xe5\\xcb\\x9ak\\xf5\\x8b\\xe4\\xecn\\xcaw\\x02\\x9f\\x81\\xb6i\\xa6'\\x92\\x999\\xa7r~!\\xf9l\\xac\\xe4$\\x15\\xb4pb\\xedv\\x0b%\\x12\\x10\\xf3\\x8et\\xe8\\xcd\\x0b\\7\\xce\\x86\\xb6\\xa5'q\\x06\\xd8s\\xebh\\x94hr7`7t\\xa9~3t\\x8e\\xd0\\xbd\\xf8\\x94\\xf6vxjl\\x10\\x18\\xa6\\xfbm\\xbc:\\xd8\\x1b\\x0e\\xaei#\\x92u'h\\xe8(^\\x0e\\x9f\\x15w\\xf1l~\\xa8\\xe9w\\xfaf\\x03`@6\\xee\\xd0q9\\x9d#\\xa16\\x1a~4u\\xd3\\xc4\\xc4sp\\xe8\\xe9\\x99.\n\\x9b\\xb5\\x0f\\xd9\\x02\\xb3r|7\\xc6c\\xac\\xcd\\x14\\xa4\\x92\\xcay\\xb0s\nk8\\x99\\xeax"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xc1\\xef\\xe3\\x19'\\x91\\xbe\\xcf\\xc7b3\\xaeo-\\xa7\\xb7\\x1a\\xdfa\\x15\\xfbdge\\xf0a<\\xcd\\x82\\x91\\xe1(|\\xff\\xcfoh\\x13\\xa2\\x04o\\xc0\\xc0\\xc6\\xe9\\x1b\\x07\\xbd\\x8d!\\x06\\xe9>\\x06\\x1e\\xb4\\xf0\\x13\\xf55\\x9a)\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x13\\xd8\\xa8\\xad\\x0b\\xc5\\xf6\\xd0vt\\xae\\x1a\\xb9t\\xe9\\x05\\xb3i\\xc9\\x1b\\x9d\\xf8\\xc8\\xf99c\\xc8.k\\xfcg\\xab_\r\\xd2\\x8c\\x15\\xa3p\\xea\\xd1\\x93\\x90l\\xf5\\xa8("
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\x1b\\xbf\\xec\t\\xc4\\xbcq\\x05\\xf3\\xc5/\\xf0\\xcc\\xe5\\xa1\\xb5\\xae\\xb3\\x00\\xbc\\xbah\\x01\\x93\\xc3\\xc23\\xa0w\\xd8\\xb9k\\x96nq\\xcc\\x93l\"e)\\xa4\\xf9\\xd7\n\\xc6\\xb7;\\x04:\\xa5\\xfc=dr\\xe3\\xfam\\xb1\\x95\\x0fw\\xc8\\xa9\\xee\\xc9\\xd9\\xc6\\xf5u\\xaf\\x12\\x8f\\x15\\xb3\\xc7\\x0c\\xbd\\x93\\x95\\x1f\\xe1\\x8a\\xa3|\\xff\\xc1\\x9a\\xc7\\x95\\xd0\\xd6\\x81pj\\xbc<\\x04f\\xee\\xaa!\\xde\tc\\xd1\\xe3y\\xd8\\x1b\\xf4gcujwb\\xafv@\\x83\\xa16_w\\xf9\\xa9kvb\\xc0h\\x1f\\x1d\\xcc/2t\\xb0\\xcfieu\\xd5u/\\xba\\xb8\\x83\\x93\\xbfjng\\xb9\\xe3\\x12\\x89\\xb9\\x19\\x02q\\xae#\\x13\\x81n\\xabu\\xe5\\x97\\xa1\\xe4 q>\\x1b\\xf6\\xdff\\xfb\\xc2\\xc1\\x0b\\xd3\\x16\\xc0\\xdf\\x0f\\x08\\x88\\xe1\\xc4\\xfa\\x87a\\x8cct\\xd4\\xf5e'\\x0b\\x90\\xe9y\\x9f\\xfa>\\xc0\\xebm\\xfb\\x1c\\xdcv)\\xdd\\xda3b|\\xab?\\xb4dp\\xd3\\xd1\\xcc\\x98\\xfd\\x8d\\x15\\xc3u\\xbddj\\xf8q 3?\\xee\\x88\\x1b"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bk\\x1d\\x83\\xfc_;$\\xc6s\\xaf\\xe1\\xbe\\xbe\\x8d\\xa1w\\x08a\\x0c\\xcfly\\xc8\\xfe\\x890\\xdc\\x96\\xac.\\x88\\x9et\\x99;\\xb4\\xc8e\\xbf\\xdc*\\x04\\xc1uw0h\\x8e\\xd8\\x1f\\xe4\\xb4\\xeay\\xf8,k\\xb6\\xe4\\x7f\\x11g\\xed7\\xce\\xbc\\x0c\\xc5=\\xbf\\x14\\xb5*\\xb8g\\xeb\\x00\\xe5\\xbb7=\\xb4\\xb43\\xa9z\\xb9\\x93\\xd8\\xaa+\\xac1\\xfe\\x18\r\\xb2\\x87\\xe2;\\xea\\xaa\\xb1\\xe0\\x94 7k\\xdde\\xda\\xfdo\\xa8\\xc9\\x1f\\x8d\\xaf\\x10\\x8d\\x9b\\x91\\xd9\\xd6\\xbe\\x920o/e #\\x89\\xa7\\x1f\\x82\\xa1\\x8f\t\\xd1)i\\x809\\xdcz&k\\xc2\\xa5\\xe1\\xfb<\\xf9\\xe66\\x85z\\xdetn\\xa9`\\x0c\\xe6\\xb2\\x87\\xb1\\x91\\xf9\\x1f\n/\\xe3\\xea|\\xbcl\\xdb\\xa6\\xfe\\x80'\\xfa.\\x92xn\\xb5u\\x9dr\\xa3wm\\x10u\\xa0\r\\x8fb\\xc4\\xf7i5jr\\x1cs\\x0f\\x14\\xd6\\xb2+i^k\\x83>\\xaf\\x82u\\x19\\x16\\xc7\\x03\\xbb\\xb1$lv\\x08\\x18p\\x96\\x1a\\x14x\\xb0u\\x15\\xd3\\x8d\\x06k>\\xc2"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xdd\\xd3\\xe9s~\\x1b\\x96,\\x06%\\x01g\\xe8\\x10\\xb5a\\xb7\\x8f\\xafn\\x16\\xd8\\x05\\xfa\\xeei\\xf0\\xca\\x1c`!/\\x9b\\x8d\\x16yo\\xfe\\xc6\\x99\\xbd\\x14\\xf2\\x1b\\xd8\\xc2\\x95\\\\x13\\xcam\\xac\\xf7!ak?\\xc5vmf\\xe7a\\xbex/p+\\xde\\\\xb9\\x1f<j\\xf8?\\x9e\t|\\x14\\xbbi\\xf2\\x16\\xef?)i\\xdf\\xa7\\xd2as\\x85\\xea\\xe6z-\\x8di\\xbe\\x9fq\\xfdo\\xdd\\xb3\\x80s\\x83\\xff\\xddz\\x08\\xdf\\x8c\\x00\\xf0\\x19\\x10\\x1e \\xfa\\x8e\\x81\\xef\\xd1 \\xcfa\\xbdp\\x8a\\x1e\\x94bq\\xe7\\xaf\\x08\\xf9\\xb7\\x8d\\x98\\xcd\\xf5|n\\x18\\xfb\\x99\\\\x8f\\xa3z\\xef\\x8c\\xea\\xabg\\x7f\\xee\\x01\\x83oy\\xea\\xf4\\xa7q_\\x00\\xf8\\x11%\\xae\\xf8\\x96\\xd8\\xce\\x1a9\\xcc,\\xac\\xf3\\x9dz\\xe3\\xea\\xd4\\xd7\\xa6\\xe5\\xde\\x83b\\xeb,\\xb0\\x99\\xf3d6\\xf9%\\xafb\\xb0z\\xd7\\xe5\\x02\\xca\\xd0\\xee\\x9d\\xc7\\xed0pe\\xbdh\\x8f\\xc6t\\x81\\x87\\x08\\xbe\\x9a4\\xd1+\\x14\\xc4\\xd1zdrz\\x9a24"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ywbd>f+\\xc0\\x1a\\xbe\\xb0\\x15\\xfc\\x00\\\\x0b\\xfbno\t\\xc6\\x18\\xd8b.\\xc6\\xe5fo\\x00\\xa9\\xff\\x06!of\r\\x92t\\xfd\\xf4(um$\\xb2\\xb3\\xd4\\xddz\\x1a\\xf7'8\\xaa\\xf4d%g\\xce\\x93\\x9d\\xdc=~\\xe8y\\xe2u\\xfb:\\xbdv@\\xe6\\x92\\x8e5 8\\x15\\x90\\xe7r\\xd3b5v\\x13\\x1f\\xec2v\\xd0\\x9f\\xf9\\x1f\\xd5\\x03d\\x0c\\xd9b\\x9e\\x82fa\\xee\\xf3\\xe8r\\x9c\\xa5*\n\\x96+|\\xb7\\xbf\\xb6\\x91o\\xee\\x92\\xc8c\\x84r\\xb8y\\xeb-\\x9d\\xb2/\\xeft\\xa9-\\xf4/\\xcf\\x94\\xf4\\x9bm\\xe2\\xcc1y\\xe5s6\\xcc\\xc7\\xca\\xb1\\x19\\xb28\\xac\\x908x\\xe3\\x14=\\xf1\\xea\\xf8\\xce\\xc0\\xec\\xb03\\xf6\\xd6\\x03\\x135\r!\\xec`\\x7fr\\xc2\\x1a\\xd0\\xe1,\\x1c\\x07n\\xe4t\\x0f\\x87\\xf6\\xa83149\\x91.\\xfd\\x85\\xce\\xbci\\xb1\\xf9\\xce\\x1d\\xa4\\xba\\xa3\\xd1\\xf2\\xe3\\xeb\\xec\\x1c`1\\x9a\\x80\r\\x7f\\x11\\xe8\\xf0\\xaatt\\xa9\\xe0+\\xdd8\\x06\\xc5\\x85\\xab\\x0eb"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03w\\x84\\xc9#\\xee-\\xe1v\\xcfy\\xafh@y4c\\x05\\xe5o\\x82f\\x9d\\xe1&\\x9c\\xfe\\x06/\\xc1\\xdf\\xb4\\xd0.\\xa5\\xbe\\xa8\\x00\\x94\\x17\\xc6\roaz\\x1a\\xb8\\x83=\\x01\\xf0\\xd8\\x0e\\xcd\\xad \\xb4\\xa4*\\xc8\\x1fbvi\\x908>\\xa8\\x18\\xfc?\\xaf\\xaa>\\xb3y\\x01\\xd9:\\xaf\\x9e\\xfa\\x8d\\xdc.n\\x93_k7c\\xc5v\\x04\\xf95&\\xf8\\xa4x\\x13\\xf9x\\x89\"\\x12\\xc6\\xb7cqgk;\\xb5\\xaa\\xf8\\xa5\\xf9\\x7f!\\xe6\\xc7r\\xac\\xcd\\xac\\xbf\\xe0\\xb2t`e\\x86\\xf7\\x9f\\x13\\xd2\\xa2\\xcd\\x8e\\xd6\\x83lz\\x02\\xd6>\\xa9e\\x90\\x13\\x94\\x80\\x9ea\\x00\\xf4\\x92\\x1d\\xb4i\\x08\\xc4\\xb6\\xea\\xfe\\xfd\\x8c\\xfd\\xc1\\xd3\\x1cp\\xcd\\xaf\\xbf+\\xa5\\xef+\\xbe\\x12\\xfe\\x94\\x86(j2\\x92\\xb5!\\x1d\\xa9|\\x06\\x9e\\xca\\xa8\\xdf\\xf1\\x1d\\xba~r@$\\xdb\\x80\\x06\\xd8\\xebe\\xc4>\\xf0d\\x8dhsy\\xa1\\xf8\\xdbc\\xa2<\\xbc\\xd0\\xb0\\xa0\\xb1\\xbe\"\\xdf\\x1d\\xec4\\xe1|q\\x89\\xadzs\\xden\\xa5\\x86"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdaj\\xae4\\xf4\\x00\\xb1d1r\\xd5\\x93wzn\\xc5\\xe6\\xd9\\x8b\\xa7\\x91\\xcbe\\xdd'\\xc5\\xa5_h\\xac\\xcd\\xe7\t\\xe22\\x91\\xf8\\xc6\\xe4\\x9b\\xd2\\xedf\\xc5f\\xb7\\x8e$4\\xae\\xef\\x00\r\\xc3x=\\x8a\\xa3`|\\xf1i\\xd4^\\x94\\xde\\x02\n'\\x9f\\x83\\xac\\xd3p\\x9b\\x1e\\x04\\xf3d\\xbex\\xaay\\xd8\\xee\\xf4\\xe4\\xfbx%\\xa7f.\\xda\\x02\\xce:m\\xaa\\xa8`\\xe0\\xe7a\\xc3\\xc8.\\xc2~\\x02\\xe0\\x91\\x86\\x90\\xf7\\x86\\x02\\xd1j\\xca\\x1aukj\\xda\\xa3`\\xd7v\\x19z\\xf2\\xfd\\x15\\xa6\\xc3fpjm\\xa1\\xe3+\\x7f'_\\x86\\xa4\\xccn\\xfb\\x80k\\xbfs\\x7f\\xb9\\xc4\\x05\\x88iy\\xb1l\\xcd'\\xc4\\xf6o\\xfc\\xe3\\x15e\\xe2!u\\x03o\\xeb(pf\\xac\\xc2r_\\;q\\xc5\\x87\\xb2\\x1fd\\x9d\\x11\\xd4\\x16~\\xc3\\x93c\\xed&upg\\x92\\xa7b\\xb7 z\\xa83\\x1e+\\xef\\x9f\\xab\\xa6l\\xd4\\xc2\\xfa\\x1ap\\xe1\\xe2\\xab\\xc9e\\x0f|\\x8b\\x99\\x96q\\xe9):~\\x0b4*j\\xab\\xd5\\xea"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\xd0t\\x8d\\x92~\\xaf\\x82\\xc8^\\x89\\x912h\\x02\\x7f\\x0e\\xcc\\xc7\\xa0\\xcb\\xfd5'\\xa9\\xca!\\xb80\\xa2c\\xb6!\\xe4%\\x80\\x14\\xa4\\xa5n\\x16\\xadc \\x177\\xc2\\xc9#wt\\x93\\x16x\\xf06r\\xdes\\xcc\\xc1\\xc8\\x02.t\\xd4\\x16k\\x04\\xf9\\xa2(\\x18\\x96\\x14p\\x96\\xf0g\\xbfch\\x13\\xf8\\xab\\xd7\\xb3i&\\x81\\x8ca\\xea\\xfc\\x82\\x80\\x14e~\\xd4\\xf3,\\xee\\xd0g\\xd6\\x18\\xba\\xdeb\\xa2^\\xd9\\x83,\\xcb\\x86_y\\xde\\x08nh\\xcc\\xea\\xde\\xed\\xc8\\xacg\\xed\\xe3\\xe2\\x15^\\xb4\\xedv8c\\xf5i\\x10z\\x1f\\xb7\\x8d@gw\\x8e\\xd6_\\x0b8\\xd2e\\x13\\xb1\\xac\\xb8\\x17\\x01d\\xae)^\\xbe\\x1da2u\\x7f\\x19\\xf8\\x03fs\\xeab\\xbc\\xe1\\x0b4-x\\xf6\\x97vk\\xba\\x02i9\t\\x95<b\\xa0\\x87\\x1b\\xc4\\x1d\\x8af\\xb0\\xa4m\\xd8\\x05\\xba\tu\\xaa\\xdb\\xfef\\x98\\xbc\\xeb\\x0e\\x00\\x03\\x96\\x88\\xb7l\\x87\\x1f\\xccw\\xe3\n\\x93\\xff\\xcd\\x16q)\\xd5\\xeb\\x81\\xb3\\x1a\\xd7\\xf5\\xc7\\xf3\t"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xacqh\r\\xe3q\\xc6\\x00\\xe0g2a\\x14\\xb2\\xf2\\xebalp\\x85\\xd0\\xb3\\xfbw\\xa7k\\xf8j\\xdf!q\\xc1\\xa1\\x82m\\x16\\x97\\xaa\\x1f\\x9es6\\x8b\\x92\\x1c\\xaa\\xbd\\xf4\\xb1\\xdb\\xb4\\xc6\\x02km\\xe5\\xd1f\\x96\\x89s<\\xf2\\x95w\\xa6\\x14\\x7fq\\xdd\\xb3\\x8c\\x1d\\x98\\xe8h5\\x0bi\\xc0;\\xbf5\\xbd\\xad~\\xcck\\xa1\\xc8@\\x0e,.i\\xe2\\xad,\\x03\\xde\\xada\\xa1\\xa8s\r\\x03\\x9a\\xd5\\xe8\\xfc\\xef\\xaf\\xf0\\xa10\\xa84\\xb5n\\x081\\x92\\xea\\x98\\xc9kl\\x1f\\xab\\x82\\xf5 \\xaep0c\\x95\\x0f\\x14\\x91\\x00\\xab\\xa6\\xa1f\\xeb\\x00\\x8do\\x95\\x07\\x7f\\x0cr\\xa4\\xee\\xed\\xcb\\x00\\xca,\\x18\\x1es\\x9fh\\xe7\\x06\\x8e\\x8f^\\x04\\xdc\\x12\\xdb\\x17\\x1b\\x81t\\x8f\\x92>\\x84\\x8ap8f\\x98\\x99&\\xe6(\\xa9g\\xfe\\xbb\\x1e\\xc8v;\\xc2i2\\xe7\\xfd\\x12\\x85`\\xa7a\\xa6\\xe9\\x07\\x14\\x1f\\xe7\\x87\\x93l\\xdd\\xc1\\x9f\\x1e\\x03\\xfd\\xef\\xafb9\\x00q\\xee\\x89\\xc5pv\\xd7\\x96ty\\x9a\\x99\\xad\\x97\\x9e"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xdf\\x86g\\x06\\xa64#\\x10\\xc6 \\xd2 \\xdb\\x08\\x1apm\\xf0b\\xc5\\xa8x\\xbc\\xaas^\\x98\\xc2\\xe7'h\\xebx\\xb0\\xc7m)\\x99\\xee\\xb4`^m\\xf9\\xcc\\xd2\\xack\\x8e\\xedd\\x06\\x85t\\xa5\\x8cl\\xf3\\xf4%\\xd6\\x04\\xfe6\\xd5\\xd0\\x9688\\xea|6&n_g\\x13\\xd6\\x1e\\xbdp\\xf0\\x80\\x0f\\x0bs#\\xe4\\xc4\\xe48\\x9f\"\\x11n\\xbc\\xb3\\x7fo\\x0f\r)\\x04\\xc8 \\x9833j\\xd9kk\\x98\\xe5vo\\xbdae\\xd5\\xfe\\x17g\\x90$\")\\xb7l\\xb8\\xae\\x08\n\\x07|\\x99\\xc7p\\x1a\\xf6\\x1ac\\xde\\xde\\xcb\\x98oi\\xfec^\\xf4/m\\xc4\\xce\\xaa\\x8f\\xcc\\xbc\\xe5\\xb9/\\x81%\\xe7\\xa9\\x885\\xee\\x9d\\xae\\xd2\\x85\\x0c\\xf4b\\xa8\\xe9\\xfbg\\xe6\\xc1t'\\x94,\\xd3\\xc0\\xd8\\x92\\x06\\xe7:fe*\\xcfw\\xc6\\xdam\\xb8x\\xbc$\\xe0\\xe4\\x06\\xb6\\xd2s\\xc9\\xc3\t!\\xaa\\xac2t\\xb8_\\x14\\xd5\\x10\\x9c@\\xf0\\xb0\\xd4\\xb4a\\xc9\\xe4\\x83,\\xd0\\xb6\\xfa;\\x00\\xfb\\xd0s\\x1a\\xca"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x93\\x82\\xe0\\x7f\\xces\\x80\\x90b\\<\\x8e9\\xa3\\xe1o\\xf9p\\x83\\xb2%\\xe8\\x87\\xc13\\xea& \\x91\\x08?\\xa3\\x8b\\xe3\\x0ewb\\x05/\\xc4\\x11r4\\xeal\\xeea\\xaan\\xa7\\xba\\xd8\\xcd3\\xf0v\\xd8\\xbck\\xc6\\xbe\\xd9\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-\\xbc\\xdc\\x1c\\xe6\\xa3\\xea\\x95sal\\xa87\\xdc\\xce.f\\xd6\\xe6g\\xb7\\x87\\xb5\\x0b\\xd9\\x83&@\\x9e\\x8ev\\x0f\\xbd\\xd2\\xb2\\xd8\\xd1\\\\xbf\\x95\\xabm\\xfb<`\\xf7h\\xe5"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\xa3\\xeb\\xb4\\x03\\x93z!\\x03$\\xe3\\xbf\\xeb\\x82\\xb7\\x83\\x1a\\xb2\\xa9\\xa2\\x80\\x1f\\xa1\\xf5\\x16\\x10\\xe9/\\x01\\x9a\\xd0\\x89\\xcd\\xa9q\\x0ch\\xd1+\\x8e\\xf2m\\xf6gx\\xffb@\\xa2m\\xa2\\x0b\\xe3\\xe0\\x93\\xf2\\x7f\\xb9\\x1f\\xe3\\xc8a\\x18\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\xd7\\xa0\\xc6ob\\xefj\\xc7\\x14\\xfd\\xa6\\x84\\xe8i3\\xfa\\xfdq\\xef\r\\xd5\\xfay\\x9fudnqn\\xe8\\xcc@\\x92\\xee.i\\x80:\\xb1\\x82\\xff\\x02<\\x01q\\xae"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\x11\\x88\\xd2\\xe5o.\\x04\\xd7\\x86\\x8c\\xac\\x1a\\xab\\xe3\\x94\\xf3<ll\r\\xb8\\xe6\\xe8z\\xcb\\\\xf9\\x80j\\xd4\\xe3\\xa3)<;\\xc4`\\x9b\\xbac=_\\x1e\\x90\\xb5\\x85\\x08t\\x10\\xa6,\\x12\\xec8d\\x96\\x0frn\\xe5\\x8c\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1-\\xad\\x7f9,\\x99e\\xc2/\\x99y\\xdb\\xa2fx\\x01%\\xdc\\xf5\\xd8\\x9c\\x19\\x87\\xdaf\\x80\\x9a\\x1c\\xc7\\x1c\\x08\"\\x8e\\xdev\\x8fg\\x81md\\x82&\\xfa\\xde#r"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\xbd\\x0f\\xdc\\xbca\\x13<b\\x84\\x1c\\xf5\\x16?\\x18\\xb3\\xde\\xa0\\x0c\\x17\\x88\\x8c*c?i\\x92\\xc2\\xbc5\\xf2\\xbf\\x1a\\xd4n\\xa1\\x0e\\xdf\\x99\\x8a\\xdaf\\xc8\\x82\\xd7\\x86\\xf17\\xd7\\xae\\xc84\\xc9\\xfe\\xed\\\\x89wd\\xbc\\x141@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x1bb\\xca\\xc2\\xad\\x12\\xcb\\xd7|\\xc5\\xd48\\xb2\\x9dz0\\x03\\x1f\\x92s\\xf1\\x08\\x02\\x14\\x91o\\x88\\x1c\\x82\t\\xd6\\x0f3\\x94l\\x80\\xf0\\x92\\xe7\\x9c\\xab.\\x80\\xb3\\x91\\xc6"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab|\\xb9v3\\xf9s\\xb3\\xb2\\x1f\\x16\\xa7\\xb1\\xb3|b\\x10\\xf7\\xd9\\xe6\\x1eo\\xcd\\x80\\xaf\\xf4e^-\\xa7\\xbd \\x8b\\xcf\\xcdh\\x06\\x89\\x17&\\xf0\\x0c\\xcc\\xe8vz\\xb0\\xe2\\xc1\\xf2i\\xb6,\\x94\\x8b\\xb0\\x90\\xb7\\x80\\x96\\x9c\\xa3\"\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfd\\xba\\xa6\\xc2\\xc5\\xc8\\x8bc\\xbe\\xfe\\x1b\\xf5\\xcf\\xe9`\\x84\\xaa\\xd4\\xfahm\\xaev\\xacv/\\xe7e\\xd9\\x18\\xee,\\x04\\x88\\xa2:\\x14\\x1c\\xc15\\x9a\\x13xr^\\x88\\xe6"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x169\\x8b--\\xd3\\x94\\x97\\xcf\\x9c\\x06vl\\xa6\\xf44\\x8eo\\x86yp\\xccs4\\xfe\\x11\\xd5&\\xd0!n\nk\\x03,\\x14\\x7f\\x1a\\x0b\\xa2\\xc8h\\xa4\\x89(ye\\x80\\xc1ku=z:\\x81\\xc3\\xa5\\xa7\\xc3\\xc8|a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xc4m\\x06v\\x94s\\xf9t\\xbef<p\\xf7o\\x93\\xc9\\xcc+\\xc5\\xd9\\xee\\xb2\\xfa\\xc5n\\xbb~ig\\xc5\\xca<\\xa6\\xf1 \\xf7\\xb2\\x00,\\x06-\\xb3\\xfe\\xe7dx"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9qe\\x81\\xa4\\xd6^x\\x1d\\x1e\\x133\\xc47g\\xc2\\xddd\\x0en\\xc5x;\\xe8q\\xb4\\x03|^\\xdb\\x90s|.\\xe7\\x07\\x11\\xbb\\xaf7\\x93=\\x94#\\x02\\xfd\\xee7e\\x19e_\\xf4\\x16\\xb9\\x16\\xcdj7\\xcc\\xf9\\xba\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xea\\x8d\\xb7bl\\xed \\x13\\xe7\\xc7rd\\xa2\\x87\\x1c\\xb1\\xe3\\xdf\\x96\\x93eb\\x97\\xeb\\xdb\\xc3u\\xc3>\\x84<\\xa8lb\\x83\\xdb\\xa4\\xbd\\xc3\\x15\\x06c\\x0b\\xdd\\xf1\\x0f\\x9e"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb*\\xcf\\x80\\x7f\\x0f\\x19\\x80\\xe0qfov^\\x17\\xe8\r\\xb5\\xe0)e9\\x9e\\x1a\\xb1\\x7fvu7\\x1b\\xcdcn\\xcc|<g\\x8d\\xf6s\\x81&s\\xa8\\xf8w\\x08\\x0c\\x91\\x16\\x01\\x0ca\\xb2$\\xd2\\xfc\\x1fm\\xda\\x92\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\xf7z\\xa2\\xce\\x98|l\\x89\\\\xf8\\xe3)\\xe7\\x0c\\xe6b\\xb1ni\\x91\\x07\\xb6.\\x84h\\x15ki;\\xee\\x02\\x1e\\xb8\\xf0\\xd1\\x10\\x9f@\\xa2z\\xceq\\xdb\\x1d?\\xc1"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\x13n\\x89s\\x13\n\\xe1n&=\\xf8\\xa7\\xb0\\x83_\\xa6\\xf0k\\xf9\\xbey\\x8e\\xf6\\xb3\\x9c\r\\x82\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\xb7\\xdat\\x1bmqc\\xd5m\\xb0\\xb0i\\xdac\\xf6k\\x91\\x97\\xc0\"\\x83\\xa2\\xa5-\\x85\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\x91\\x12\\xf3\\xce \\xf4f0\\xb5\\x9b\\xb6u\\xbb\\x17s\\xff\\x92er\\xe85\\xb3\\x187*%\\xef\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019q\\xd2\\xces\\xd7\\xf8\\xb0\\xd2\\xe8\\x97\\x9c\\xe6\\xden.\\xa1\\xabw\\xcd\\xed\\xc5j\\xb9b`\\x935q\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98i\\xc6\\x8bk\\x06\\x08\\xa6\\x8a\\xee\\x80v\\x14\\xa37\\x92\r\\xdc\\x89k\\xd6<\\x0e!c\\xf9\\x11\\xcb\\x94\\xd0wp\\x90\\xacxp\\x02\\xfa\\xd6u\\xd5b5\\x9em\\xb2\\x1a\";\\x12\\xfd\\x11f\\x12a.\\x1b|\\xb2\\xbb\\xdf\\xd7\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x8f\\xee% h\\xb5\\xf9\\x8d\\xbb5\\xf1o`\\x07=@m\\x80k\\xd24\\x96\\xbe\\x86\th\\xc6\\x98!e\\xa5)\\xee\\xc1d\\xff\\x03\\x0b\\xacsq#\\xc4\\xfc\\x94\\xe1'"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040b\\xfc\\x99\\xa4\\xd6yvx\\xce\\x7f\\xbd\\xf9\\x0e\\x06\\xfb\\x98.\\xd2\\xf6\n\\xc3\\xee\\xe5th\\xf0u\\\\xdb\\xa7r;\td\\xff\\x13\\xed\\xf4\\xe6\\x04\\xcf\\xb5@\\x06\\xe4,x$?m\\xf1\\xb9j\\xe5\\x83~$\\xfe.\\x0fz\\xae\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\xc9\\xe5\\x1cea=r\\xdd0e\\xa5\\xee\\xbe\r\\x9f\\x8e\\xc7\\xce\\x9f\\xd5\\xd3\\xe0\\xc7\\xdb7\\xd7\\xba\\x02\\xdb\\x0bn^\\x9c\\x01\\xbb\"\\x8c\\xf3\\x874\\xab\\x9a\\xa2\\x0e\\x13*"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xe9v\\xe8\\x18\\xf4\\x14\\x93\\xe56\\x92t\\xd28(e:\\xd0\\x1em\\x1czf\\xfb\\x98\\xcf\\xf6d%,5\\xffa\\xce+-!\\x85\\xec\\xe9\\xa3y\\x9f&\t\\xd5\\x9fwu\\x83\\x17\\x13\\xb1\\x999\\xc1\\xd6\\x9az\\xa2t\\x9e\\xa2\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\x00\\xeco\\xb8\\x81\\xdd\\xca\\xfc\\x19\\x9a\\l\\xd26\t\\\\xe8xxu\\xb8\\xfae\\xf2\\x8c\\xd8\\x00\\xca\\xca\\xf7<\\x93,7\\xf3t\\xe2\\xe4z\\x9f\\x7fuq\\x8f\\xb9\\xb6\\xf5"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\xd5\\xecp\\xc4cd\\x98\\xb0\\x02\\xa4\\x0e\\x1b\\xaa\\x9ej\\x9f\\x90\\xee\\xa1\\x97u\"\\xd3\\x18\\x92\\xa3yk\\xc0\\x0f\\x07u\\xcaf\\x8b\\x83\\x91\\xc7\\x884\\xbfn\\xbcx\\xb8j\\x12g\\xa7z\\x86\\x80\\xd92\\xf8+\\x00\\x04xv\\xa0c\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000fj\r\\xaalq-a\\xd1\\xa90\\xe6\\x85c\\x0e\\x01v\t\\xcc0\\xbb\\x9f\\xe5\\xfa\\x05l\\x1b\\xdd\\xa2i1\\x1a\\xb7\rapt\\x14<\\x08\\xa3e\\xcd$\\xb69\\xbe"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xca%\\xb3\\xb5$\\xfb\\xf6\\xbbp\\xdev\\xf0\\xbb\\xb6\\xb0s\\x06\\xf1\\x00j\\x927\nnss\\x9e\\xb2\\xdcp\\xae\\x18\\xbe\\xdf:a\\xb5v\\xb8(\\x14)+5fl\\xd1\\xdd5\\x1e\\xcb\tb91\\xf4\\x02\\xb7e\\xe3\\x8a\\x9a\\x95\\xeb\\xf3\\x99\\x9f\\xb6&ac\\x85d5(\\xa9\\xa2z\\xc2w \\xfc\\x06e\\x95\\xf1\\xc3\\x83\\x14\\xfdw\\xd6p\\xd1\\xcfo1y\\xb2\\x1d\\xb9\\x92>&\\xfd\\x8c\\x0e\\x0e\\x1f\\xca8\\x95\\xe8\\x12\\xddg\\xc5\\xe4\\x8as\\xff'\\xc7-8 \\xe4\\xa0\\xd7k-\\xdb\\xe0\\x1b\\xb2\\xbd1\\xd0\\x04\\x85\\x06\\xba\\xd4az\\x8b\\x04\\x99\\xdf@0\\x84\\x8d0#e\\x11\\xc3\\xd3\\xd3?\\xa70_h\\xedb\\x7f\\x16\\x85\\xad\\x9a\\xdfw8x;`\\x8e\\xccuz\\xa2\\x80h\\xff\"\\xf0\\xd2 \\x06\\x90\\xe3\\xa3\\x10\\xf7)i\\xd2l\\xbd\\x18\\x03:\\x97/\\xc9\\x88\\xee\\xd5\"\\x90\\xdb|z,\\xb7\\x9d'>\\x96\\xe3w6\\xc9g\\xd7\\x13<\\x1b\\x15\\xb7.e\\x88\\xdfq\\x8c\\xa0\\xc6\\x93a\\xe7\\xf5o"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mq<*z\\x9b\\xfa\\xac\\xf9\\x05\\x0b\\x06\\xdb\\xed\\xd3\\xf5\\xe9\\x84\\xcd\\x157\\xd9\\xdbx\\x17\\x00\\xbe:\\xf7\\x01\\xd519zbd5\\x9d\\xf2<\\x98$\\x90\\xdb\\x99\\xd9y\\xff7\\x84\\xfa3\\xae\\xd3\\xea5\\x98\\x91\\xda\\xdezl\\x89%\t\\x98\\x0ef\\xde\\x19p\\x9d\\xba0%\\xdd,\\xfa\\xa4@\\x99\\x80\\xfc\\xb8\\xe7\\xb7\\xd0\\xc0\\x88\\xa7\\x93\\x8c)\\xa3\\xffz+\\x84\\xbd\\x16\\xeau\\x80p\\xec\\xfa\\xa9~wkg\\x94\\x0er\\x952&\\x92\\xe1\\x88\\x97n\\xc7\\xb9c\\x9c\\xdbw\\xc2\\xd1\\x04\\x04\\xc7\\xcc6\\xd3\\xba\\xcf\\xcdjv\\x8cm\\xaa\\x98v\\xa4\\xc4+\\xf6g\\xab3\\xb1\\x18yg:\\x96\\xad\\x9c\\x9dy\\x9b\\x0f\\xcf\\xf7\\x90\\xf4\\xb5u\\xfc\\xe9\\x9c:y\\xf3\\x07\\xe37\\x00\\xed\\x19\\x9b\\xf2\\x10&*b\\x04q:\\xbd\\x89\\xb10\\xbac\\xed\\x00\\xde\\xe0\\xfa\\xd9\\xfa\\x12v\\xaccb\\x03\\xe9\\xf6?\\xb8eli\\xc4\"\\x10&\\xf6\\xe3\t$\\xa2\\xaf\\x02\\xad\\xb3>\\x8f\\xfa\\xb4\\x15/f\\xb6\\xc4'\\x12\\xb6\\x8d\\xaay"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1\\xcd\\x8e3d\\x14j\\x81f\\xbd\\xe9\\xb5\\xaf\\xdbm\\x1ckp\\xf7?\\xf8\\xc6\\x1c?\\x17\\x9a,%\\xbfk3^)\\x13q\\x94\\x12m\\xf116dt\\xd0$\\x19gn\\xbcgo6\\xc2\\x0c\\xf4\\xfc\\xcd\\xfff\\xa7\\x12\\xf9\\xfc\\x99\\x92\\xe8\\xd6\\x96\\xf0\\xd4\\xb2\\x1a\\xc3s\\x8b\\x9b\\xf1\\xa5brjt\\x12\\xccq\\xdbx\\xfcze\\xc6\\xd7?jo\\x05\\x01l(m\\x02y\\xe0\\xe0x\\x7f\\xed\\xdf&7\\xc7\\x9d\\x0ci\\xa8z+\\x84a\\x1be\\xd7h\\xec%b\\x1a\\xadz! \\xe9+rp\\x0c\\xa12n\\xaa\\x9e+\\xb8s\\x04z\\xf0\\xa8\\xab\\x03\\xc82\\xb6\\xce\\xbd\\xd2\\x1e\\xde\\xd8)\\xd7\\x18\\xbf\\xa9\\x17\\xa8\\x07\\x92\\xf3g\\xf7\\x94\\xf3\\x01p\\x80\\x9e\\x01\\xf9 \\x99\\x95\\x12\\xfd\\x9b\\xc4\\xbd\\xacv\\x82\\xabs\\x105e\\xd9\\x99;+m1w\\xe5>m\\xdb\\xe0\\xde\\xa2\\x0cr\\xa0\\xc4\\xc72\\x7fg\\xde\\xf5\\xb0|v\\x1es4\\xbdmj\\xe0\\x1b\t\\x19\\x86\\x8b\\xdf.\\xc3#\\xa4y\"k7\\x9aj\\x85"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xc4o4\\xd1\\xeeq\\xbd\\xd7\\x15\\xff\\xdf\\xcbu\\x03\\x13\\xa7o,.'\\xb0\\xea\\xe3\\x88\\xfc$\\xae\\xbe\\x81\\xaf\\xcd0q,1cx\\x94`l4g\\x8e\\x86\\xfa\\x90\\xb6\\xd4b\\x1e\\xba\\xc9\\x01\\xc4n\\xa1\\xa2\\x92\\x0e\\xadq4\\x96\\x84\\x92\\xda\\x80\\x7fa\\xdf\\xf9ark\\x837$\\xb8\tjo\\xd8\\x90\\x19\\xbd`f\\x10$\\xef\\x03\\x14\\xe1\\xd8\\xa99\\x9b\\x9d'\\xbc\\x8f\\xd2\\xfb|\\xf2\\xf2i$\\x18\\xb3\\xa10\\xb9\\x8ewa\\xfd\\xaa~/f\\xd4t\\x19\\x0c2\\xbe\\x9a\\xeer\\xd0\\xfbn)0\\xa7\\xdb!\\x15#\\x86\\x98\\x9a\\xe85\\x80y#\\xc2\\xa1\\x8bc6\\xee/\\xe0\\xa3ck\\xcf`\\x1f.\\xbfku\\xd0\\xe4\\xa0i\\xa0f\\xbc\\x86l\\x02y,\\xb1+\\x8cyl\\xa2#\\xa1\\x99\\xbb\\x0c\\xaek\\xd8\\x92\\xc8\\x02\\x9f\\xd7g\\xaf\\xc8\\xf6\\xda|\\xcd\\x8e<\\xd8\\x17|\\x1bh\\xb4\\xde\\xb8\\xff$\\xce\\x15\\x18\\xb9\\xe0\\xec\\xcf\\xb1t\\x86f\\x08\\x7f\\xdfo\\x96kp\\xae\\xa1\\xe6\\xab\\xf2l\n\\x8a\\x93\\x01\\xda"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\th\\x07\\xdav\\x96q\\x8c\\x05\\x037!\\x8e\\x87\\xf2\\x0c\\xed\\x0c\\xfd\\xb9\\xc0\\xfc|\\xa7_\\xe5\\xef\\xa5\\xd9\\xcf\\xb8\\xac\\x15\\xd7\\xd9s_nv\\x92uz\\x06h\\xaa\\xffz\\x95\\xd8\\x05\\x0e\\xce\\xe5?*\\x81\\xd9t9(k/r@\\x15\\xe8\\x05\\xaf>xeik!\\xa6\\xbb\\xdcr\\x96\\xb5\\x91k\\x12\\xc3\\xcem\\xcb\\xa4r#\\xbb\\xa7\\x84\\x9d\\xfd\\xa3\\x9b\\xeapq\\x9a8ib\\x86\\x06h>ur=\\xea^\\xc7\\x9dl7\\xf8\\x8ab4\\x1a\\xb8\\xf1z\\xfe\\xf0\\x93b37xs\\x8a\\xc6\\x86\\xe2\\xf7\\x1baj+\\xff\\xb7|o\\xc06\\x88\\x84qv\\x07\\xe4\\xde\\xa5\\xab\\xc6\\xac\\xd4>j\\xac\\xb8\\x8e\\x02\\x16f\\xaf6szst&~\\xfe\\x18\\xc73#\\xf5y>\\xb8.\\x97\\xfblo\\xbe;0\\x9bw+\\xd3y\\x06\\x0c\\xda\\x1f\\x90s\\xfeiwy\\x12\\xa9\\x8bxc4\\x9bjw ;\\x1c\\xfe\\x99\\xb7\\xa1|pf\\x94o\\x08\\xd9tf\\xc1\\xc0.o\\x9c\\x02\\xe3\\x90\\x1ctu\\xd1"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x98lj\\xb2,y\\x96q8?\\x13\\x1a\\xa1\\x1d\\xc0/\\xca4f1;\\x99\\x1br\\xd4\\xfc\\xc2\\x7f\\x95\\xb5at\\x17d\\x16\\x7f1b\\x8d&2\\xdcm=l\\x9d\\x1do\\x01\\x8e\\x05t\\xb0\\xb3f\"\"\\xee\\xf1b?\\xe3\\xae\\xe7f\r\\x82\\xfb\\xbf\\x8a\\xc6g\\xc8\\xcd\\x99\\xb66d\\x16(\n;\\x85(\\xe1\\x95:\\xd3\\xc2\\xb9\tp\\xbewh\\x93zg4~\\xe7%k\\xc63ez\\xa1z\\x9c\\x1fo<x\\xben\\xb4h\\xde\\x90\\x02e\\xe5\"\\xf0\\x93\\x8c\\x03e\\xbb9\\xe0\\xdb\\xeai\\x16-)v\\xa6\\xe8l\\xfbyo\\xc7\\xb0/\\x857\\x8d0\\x82\\xbe\\xa9\\x8b\\xac!\\xa8k\\x17\\xa1\\x89\\x9e\\xc4%\\xdd\\xbaf\\xc0\\x00\\xdfae\\x8d\\xcf/\\xba\\x9ah\\xaf\t9t$b\\x14^\t*\\x03.\\xab\\xb0~\\xd66\\x13\\xe2\\x14\"p\\xbc\\x91u\\xd3\\xc9`@\\xda\\x82_p\\x95\"*\\x0b\"\\x8c\\xa0\\x9cf~\\x8b\\x06\\x01\\x13i\\x1a\\x03\\x95r\\xa2z\\x9b\\x90\\xa8\\xfc\\x9d\\xfa1,s\\xcd\\xb9c\\x90"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l1\\xa3r\\xf1#\\xd7s9s\\xf4\\xa6i\\xa9\\xc8\\x9edq`\\x15\\x8f\\xe9\\x90\\x0876\\xc9r\\xe5yf^\\x1b\\x17\\xc4\\xa8\\xe5\\x92\\x94\\x1be\\x9f\\xf8\\x9bf\\x8e6\\xe0\\xcf\\xacu\\xd9\\xe9l\\x0b\\xd3%\\xdf\\xe3i@f\\xb0\\xf9\\xe1\\x85\\xbb\\xcf\\xae\\xddle\\xbfaj\\xb7h\\xd1\\xfe\\x85\\xb9\\x80\t\\xd87\\xae\\x11d\\xcbw)\\xb8n\\x94\\xbb\\xd3\\xe9\\xba\\xeb\\x14\\xc32~\\xa9\\xfa\"j\\xb9\n\n\\xa2*ok\\xd5\\x98\\x1821\\xe8m\\xb2q\\xab\\x83\\xba<3\\x14\\xddf\\xebh\\xd2xi=@\\xf3\\x97\\xc5\\xf8\\xae\\x7f\\x8b'\\xd4\\xc8\\xf5\\x18\\xa3\\x85\\x05\\xb7\\x0b\\x13\\x1d`#\\x00\\xf5b\\xb0\\xe8\\xb2\\x13\\xd1\\x003\\xd3,u\\x06\\xeb`\\x87\\xbd\\x12\\xe4\\xa9t\\xd0r\\x8a\\xb9\\\\\\x18\\xa40\\x1a\\xfc\\x0c\\xe9\\x08+\\xa69\\xe0w\\xf7\\xa5k\\x11r%d\\x86u\\x08`h\\x8e\\xf9\\x83\\xcb\\xe4<u\\xd5\\x15\\xdc\\x12,\\x80\\x97z\\xbc\\xe5\\x9a\\x02\\x9b\\xbe,\\x0c\\xe0\\xff\\x00\\xbf>\\x89b\\xc4\\xc0m\\x1f\\xd5"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xb3j*\\xe68y*\\xbf\\x12\\xc3\\xb0\\xfd7bs\\xe2\\x8e\\xc01\\xd3\\xdel\\xae^\\xd2\\xa7\\x02\"qq+\\x14\\xcf\\xcdd\\xa0\\x84\\xe8p\\x1f\\xe3c\\xa2\\xcd\\xb7\\x1e\\xc3\\x9f\\xbc:<b\"\\x0bw\\xed\\x93i\\x0e\\x05\\xce\\xdco\\xe7\\xdd<ub\\xdckz9\\xd7\\x82\\\\x90\\x085\\xa6f\\xce\\x05'f'<\\xe7\\x93\\x98\\xa6\\x84\\xed2\\x81\\xbcs\\xd9y&\\x8e'\\xca\\x03\\xbc\\xd9b\\xaa\\xc0*\\x01\\x89\\x1c*\\xc0\\xa9v\\xf5r\\x04\\xb46\\x95\\xcc\\xea\\xca6\\x13r\\xc7\\xa5n\\xf22\\x8d\\xa2\\xc1\t\\xe5/%\\xcf\\xd4_~\\x85\\xdc\\xf0\\xaa8&!f\\xb8p \\x8a\\x93\\xe6\\xdb\\x05\\xcc\\xc0\\xcc30\\xd5\\xba\\x89\\xf0l.\\xc2\\xd0\\\\xde\\xe8\\x05\\x05\\xcf\r\\\\xd7\\xa9,\\xb3*\\xca\\x12\\x0ff\\xc5\\xf2\\xb8\\xa9b\\x177\\xd7\\x1d\\x01tt \\x00e\\xff\\xfb\\xd6:q\\x1c\\xa1\tw \\x01w\\xfdn+\\x81o\\xdd\\x92\\x89\\x0e\\x8c\\xd8\\xc6\\xe0\\x12jl\\xb5\\xc0\\xb8'p,\\xf3\\x19#9x\\xb2\\xac"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010th\\xb6n1\\x81\\x85\\xb7\\xf9a\\x8c\\xb6\\xdd(t\\xac\\x9a\\x0e?\\x05\\x96\\xc3\\xf4q\\xc5u\\xb9\\x0c\\x89\\x98\\xf4\\x96\\xf1vn\\xbc\\x1d\\xfd\\xb2\\x18q\\xb27p.\\x12\\x18\\x0e.\\x98\\xb3\"c1\\xc34`\\xa5\\xb0q\\x03\\x19\\xf2\\xce\n*,\\xe7\\xc75`o\\x8c\\xb0\\x84\\xb9\\xb7\\x89\r\\xb7u\\xb8\\x8e\\xf9c\\xee\\xca\\xae2m\\xcb\\x89\\xcec\\xefh\\x81v\\h\\xd4\\x0f\\xbbg\\xedf_&\\xa2sszg\\xcb\\xfc\\xc8\\xae\\x1f\\xe3\\x81\\x1ax\\xb0\\xe0\\xd9\\xf4\\x98=\\x86\\xf3\\xe5c\\x82\\xda5\\x93\\x88n\\xfa\\x99\\xbadf(\\x91pv\\x8c\\xf5\\x07w~\\xef\\xfaob\\\\xfc\\x84\\xe09i\\xc4<z8p\\xf5\\xdd?\\x97\\xf9o@t\\x9bsh0\\x87\"\\xea:+\\x90\\xcb&\\xe5\\xa9d\\xab\\x1b\\xa8\\x98\\x15\\xc4\\xdb\\xbd\\xe3\\x8f7x\\xdd\\xe7jh\\xf4k\\x16/q\\x9ei\\x92\\xd5w\\xcd\\x1a37|\\xe5\\xf6\\xad\\x89\\xe6f\\xd7\\xfaxq5\\x07\\xce\\x95k\\xf1\\xfc\\xab\\x98\\x9b\\x7fi"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xc7\\x97\\xb0\\x8c\\x10\\xa0\\xca\\xc8&\\x06t\\xb0.w\\xd2\\xd1\\xa4\\x7f&\\xda\\xc8tb\\xec\\x1e\\xd8\\xa7\\x93\\xae\\x03\\xb2$\\xc6\\xb3j\\x06\\xc1\\xaad\\x07\\x02\\xadt\\xd6\\xae\\xf0\\x11\\xc7\\x02\\x11z\\xd2\\xdf\\xec\\x08\\xd2\\x15f\"\\x9e|x\\x13\\x99c\\xc7\\xa7k\\x91?\\xfcg\\x9b\\xe3\\x0b\\x8c\\x98b\\xca\\xb2lm\\x16\r+\\xac`>\\xf5%\\x99\\x1b)\\x94e`\\xbd\\xb5'`%m\\xe7e\\xfc\\xd5\\xad\\xefb\\xec\\x89sb\\x03\\xcd\\x83\\x94\\x04\\xa8,x\\x1d\\x99\t\\x92\\xee\\xfbd\\x15(\\xeb&\\xe9\\x0f\\xc5z\\xd4\\x04w\\x06\\x01\\xdd\t\\xa9\\xd5\\xa2\\xbck\\xa7\rj;a\\xb8\\x12\\x8f\\xc3\\xa6\\xda\n,\\x03\\x1921?,\\xe0\\xef7|(\\x0fbb\\xbbr\\xe4\\xec\\xa0\\xff\\xadi\\xaf\\xc5\\x83\\x91\\xdf\\xf2k\\x93\\xaa\\xa6\\x1a\\xe9of>\\x9f7,rm\\xb9:\\xc0\\xd5\\xb1e\\xaednfd\\x8es\\xb7+\\xd3\\\\x0b4\\x0c9\\xce\\x94\\xbc\\xea\n\\x03=\\xe5\\x8e\\xd3\"s\\x7f\\x8fy\\x10\\xd2d\\x8d\\x809i\\x12\\xc5k"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o)-\\xc7\\xe2\\x8fj\\x00\\xfe\\xbb\"9\\xa8\\xfb\\x13g\\xfe3\\xac\\xc5\\x817j\\xc8\\xf3e\"-z^\\xa8#nft\\xcc\\x1c\\xbe\\xdac\\xc7\\xd9r&\\xf17\r\\x0b\\x85\\xcb\\x97\"4\\xa2\\xd2\\x04\\xf3d>n\\xb5,\\xb2\\xaec\\xa9\\x11\\x942\\x88\\xc0@v\\xb9\\xf8\\xcehd\\x06\\x82\\xca\\x8b\\xc1c\\xdfea4\\x9f\\xba\\x1a\\xf3\\x87\\xe4\\x13p_\\xab\\xbd\\x9d/\\xe9\\x1a<\\xfa\\xc9q\\xc5\\xdd\\x0f\\x85)cc\\xeb5\\x99d\\xcb,\\xa6b\\x87\\xdc`1\\xca`\\x11\\xb7p-\\xc7\\xd7xyj\\x0b\\xae\\x9dz+\\xd6%\\x12\\x04\\xbf>\\xeb\\xb1h\\x16\\xd2/k\\xcb*\\xd2&\\x98\\xce\\x87\\x8db|\\x9fe\\xb8s\\x9e\\xcd\\xeb\\xe8x\\x08\\xce\\xc7\\xba\\xb4^\\xd9bd0\\xf8\\x89\\x0e\\xbb\\x9d\\xb7\\xd0\\xa0\\x82\\x81\\xd9y\\x16\\xa8\\xb1\\xd8\\xd3\\xad\\xf3\\xed\\xe828(\\xd5\\xf3\\x11z\\xa3p\\xbe\\x10w\\xec\\x99\\xa8\\x08z\\x0f\\xd7\\xc1\\xe2\\xc4\\xd8\\xa6hl\\xae\\xd2\\xaf*$\\xb6\\xd6\\x93\\x07p\\x16x`\\xea"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\x9f!\\xc1\\xfe\\x83%?q\\x0e\\\\x85\\x97\\xadmr\\xca\\x9a\\xe9q\n\\xe7!\\xaa\\xc5gb\\x03\\xf18\\x04\\xc3\\xa1\\x84;\\xe88\\x0f\\x0b\"\\x14\\x96\\xc2\\x815\\xee\\xcbj\\xc6\\x82\\xecsd\\xd8i'i\\x88h\\x8ep/2\\x81s\\xc4\\xc6\\xeb\\xbac \\xeb\\xf7\\xfbzf\\xc7l\\xa7o\\xfd\\xf0\\xff\\xd3\\xcafid\\xce5\\xa8\\xf4\\xc6\\x91b\\xce5l\\xba7\\xd8\\x0b\\xa4eo\\xb1\\xa9\\xa4=\\xb5d\\x9a\\xf3\t\\xe9l\\xb3\\x199\\xad\\x07\\x16\\x08r\\xeb\\xde\\xe1%\\xda\\xdame\\xce6\\x07\\xca 6\\x08b\n@e+\\xe3_4*87\\x189l\\x04\\xaf8\\x00 q\\x91\\x9c\\x0f*w\\xb4\\x13e`)\\x12o\\xe1\\xa4\\xeev\\xf0\\x87|~*\\x89\\xa4\\xb6g\\x10#\\xd9m\\x91\\xd9\\x8e\\xa2\\x04\\xcd\\xea\\x80v\\xd0?\\x9c\\xf3\\x87\\x17\\xe1\\xc4\\xcbz3*\\x0b\\xb7\\x07\\xfe\\xb4\\xd7o1\\x94\\xc2a~\\x94\\xfc`\\x06-\\xaft\\x8c\\xf7i\\xc2w\\x1a\\xae\\xbej\\x052\\x1e\\x9aik \\x84a\\xe5\\xcb"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\x11c\\xb3\\xce\t\\x19\\xe0\\xabe\\xedg*\\xa7\\xbf\\xbe`\\xa5\\xe7\\x9e\\x88\\xd5\\x07@<\\x07\\xd6\np\\xeba4k\\xb4\\x07\\x10\\x1e\\x8a|\\\\xc4\\xe7\\xd9\\xac#\\xaex\\xa1\\xda\\x87\\xd7\\xfe\\xca\\xb3\\xea\\xa1\\xbe\\x18h\\x14\\xe7\\x9d\\x0e\\xee\\xc5\\xec\\xf7a\\xe4#y\\x8a7r\\xddxs!\\x1f\\x0c;\\x95m\\xa2\\xe0\\xb7\\xaf\\xa7\\x7f\\x96o\\xfc*k\\xb5lw\\xb0\\xf4-q\\x85\\x1dj~l%\n~\\xc1\\x84\\xd6\\xffr\\x0b\\x0b\\xcd\\xeee.\\xe8\\x13j\\x11\\xa8\"\\xae\\x8eq\\x980\\xb77~m-v\\x84\\x9b\\xbe\\xd6\\xff0\\xd9k\\xcb1\\xbb\\xf2_1 \\xecf\\x18\\x9c\\x8b mf\\x1c\\xf8\\xbb2\\xeb\\xc9\\x0e\\xec\\x9ba$\\x14pf~\\xd9\\xc9\\xdb\\xd4\\xcb\\x957d\\xd6_\\xa6?\\x1e\\xedg\\x92\\x91*\\x01\\x93s\\xf8\\x05o\\xd3\\x8b7\\x80\\x94y\\xaf\\x07$\\x05\\x1a\\x0c\\xfa\\xe7\\xe2\\xa7\\xc2@\\xa2\\xd5gd> o6\\xa8\\xaa\\xb3^k\\xb1\\x11\\xf66\\xfc\"\\xcbo\\xf6\\xbd\\xf0e\\x87\\x05\\x19\\xd5\\x8c"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\x04'qw\\x8c\\xca8\\x98\\xdby\\xd8\\xda\\x8e\\x85w\\x0ck\\x9ab\\xc71\\x8ee&a\\x0f`\\xd4\\x0e\\x0b1(\\x1b\\xb1\\x9e\\xb0\\xc49\\xa2\\x96wk\\xd0+p>\\xdf\\xe4\\xa7\\xa0\\xda\\xb6\\x9ft\\xd7\\xda<\\xc2\\xec\\xc5\\xb9q\\xda\\xc4\\xf1\\xcf\\x9a=\\xc2\\x87%m\\xde\\xf3\\x8ax#_\\x1c\\xc6\\xf3\\x99r\\xc7k`<4\\xbb<\\xfe\\xb2\\x1b\\x19s\\x85\\xeez\\x95/\\x1a\\xcd\\x0f\\x1a~v\\x08\\x83u\\xf3d\\xeb\\xf5z\\xc0\\x0bx\"l\\x7f\\xcbw\\xfb\\x11\\xe5\\xb21\\x1c\\x19\\xbf=\\x81\\x83\\x17r\\xc4\\xbc\\xf6\\xa0\\x05\\xe8\\xea\\xcb\\x96\\x06,r\\x82\\xe1\\xdf\\xaf\\xdb\\xa92\\xf6\\xbfs9\\xd2b\\xb1\\xac\\x9c0\\xba\\xc7\\x8b8\\x0c\\x81\\xc4\\xc1\\x12\\x9b\\xf4\\xdd\\x89\\x10~\\xe5\\xa1\\xe1\\xb3o96a\\x03\\xa2\\xd4\\x06;\\x04\\xf5w\\x95\\x88\\x9e\\x0f\\xb2xsv\\xb6\\x0fx\\xc0\\xaf\\xae\\x8cd\\xa1\\x80\\x8b3,\\x15\\xc4\\x8fc\\xb9\\xf0%\\x80\\x87a\n\\xa3e\\xba\\x05\\xa4\\xe9ux\\xc3\\x1c\\xbf\\xa7@\\x8a\\xc8\\xfe\\x0b\\xbb\\xeb"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\x7f\\x0b\\xa2\\x95-\\x8f\\x1a\\xca(\\xbe\\xe1`\\xa2\\\\xb5\\xbc\\xe5z\\xd94\\x1b\\xba\\x9c\\x8f\\x84\\xd7\\x7fj\\xc3o:c\\xa8b\\x19:\\xdd\\xbchd\\xe5\\xe6+$\\xcb\\x8f\\xd5\\xe7\\x1f\\x08;p:\\xc3-\\xe7\\xe5\\x02\\xff\"r\\x9f\\xa1g\\xe7i\\xa4\\x84\\x1ct\\x97m*\\xb1\\xb1\\xb3\\xa7y\\xe7\\x0f\\xe1\\xe8\\xcd\\xcbbl\\xbe\\xb5\\xf1q\\x98\\xfc.7>\\x03\\xd4;b\\xc5\\xf8\\x0b/\\x0cf\\\\xbf\\x93j^\\xf4\\xb0v\\xdf\\x08\\x1c\\x06\\xe3\\x1e\\x17\\xde\\xe8\\xac\\xe7\\xa0\\xbf1\\x1e^\\x80*ng\\xeb\\xa7\\xbe\\xaa\\xc0\\xb5\\xedqc%\\x92\\xd4\\xba\\xe1w\\x9bf\\xe3\\xa5\\x11\\x08\\x11%\\xd2@\\xc3\\xbe1\\x1dz\\xb6\\xfc\\xb5\\xbd\\xa8r6io\\x8c\\xde\\x19\\x85'\\x1b\\xfbmj:\\x1a2\\xf1#\\xbe\\xa5\\xb2\\x082\\x1b(\\x8bkq\\xf3;\\xd2\\x9ffy\\xed\\x7fc\\xa8\\xa0\\xa8=wvwjc\\xc6\\xa9i\\xc2?\\xef&\\xf7n\\x1f\\xe4l\\x9f%\\xa2\\x7f\\xfa\\xd6\\x1b\\x08\\x87\\x80\\xa3\\\\xa7rt,%4&~p"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@?*\\xdd\\x99\\xf1\\xaa\\x11\\x88;\\x18\\xa8\\xb7\\x03no\\xca\\xe4@\\xf0p\\xa4\\x0c\\xecq\\xc0\\x19u\\xc62\\x98\n$\\x8e\\xf87\\xf1\\xc4::xi\\x96\\x80vl\\xd8\\x0c\\x8f:\\xc3\\xe7d\\xd1\\xec\\xf1_\\x19\\xce\\xbd\\x13\\xe6\\xd4y\\xab\\xb9\\x9e\\x88!\\xf1k\\xe6\\x92\\xd04\\xb6\\xd7\\xca\\x1b\\xf7#!\rv\\xcb\\xed\\xe7gq&d7\\x92\\x9e\\xaf\\x13-\\xcf\\xce5\\xfa<\\x1e\\xe9\\x90\\xdb\\x90\\xbe\n\\xb1\\xc6\\xber\\xf4#\\xf6m\\xa6\\x0e\\xb08\\x83\\xfc:\\xb4\\xa4\\xb3\\xf2\\x1e\\xe3\\x02\\x99\\x17\\x97\\xc2\\x05_*\\x93h0\\xeb,\\xa323`\\xe7\\xb6`\\xa7l\\x92\\x8f\\xda\\xf4\\x89\\x11\\xeao\\x002e\\x00\\x11,\\xeb\\xd7\\xc6\\x14\\xee\\xd0\\xff\\x0fu\\xe3\\xa27-*?\\xa3\\x07!\\xe3\\x00\\xbf#\\x190\\xad\\xb5\t\\xe3km9\\x89\\xd3~\\xf1u\\xf5\\xd3q2\\xf0\\xe9x\\xc8\\x9css\\xc9\\x93\\xf0\\xca\\xe1f2\\xc3\\x10\\xcf\\x00x5$t\\xb3\\x89\\x88?k\\xe5\\xf0\\x0f'\\xaen4l\\x03"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\xc3\\xd9\\xd4\\x02\\xb8\\xfd\\xf1\\xbe\\xce27\\xf3,7\\x08\\x10\\xf5\\xaf\\x8c.\\xc6\\xebt\\xe1ua~m%uk\r\\xcc\\xc0\\xef!\\xb4\\xefq\\xfb\\xf5>\\x01\\xf1^!\\xc1\rt\"\\xcc\\x8b7\\xcb+7\\xb8\\xbds\\xdf\\xf19\\xa3/\\x0e\\x9b\\xa8\\xc1\\xd9t\\x05\\xc9\" \\xac\\xc1w\\x0co\\x0f\\x9d\\xbe\\x8d-\\xa6#k\\x84\\x94w\\x14\\xda\\xa9\\xb7\\xab80\\xf5\\xb5\\xf3\\x91\\xd7\\xc9l\\x89\\x1c_\\x13\\xdc\\xabib\\xf8<\\x0fcu>\\xf4b\\xac\\x0c\\xa6\\xf2\\xc0\\x04\\xb7\\xb3\\xcbl\\xcc\\x18\\x12\\x85m\\x0fx\\x81dmx\\x01\\xc5\\xa7\\x8b\\xa8\\xf6akke\\x04\\xccsg \\xf13>\\xb9`9\\xb1\\x92d\\xe4\\xe2\\x00\\xd7\\xd9\\xc4\\xac\\x18\\xb6\\xdb\\xcf\\x04\\xec8\\x16t\\x8b\\xe0\\x12v\t\\x8eoz(\\xbda\\xb8h\\xe4\\xa8b\\xc9\\xabuv\\x06\\x08\\xaa\\x16\\xad\\x10s\\x1d\\xa9\\x91~\\xf4\\xfe^\\xfe\\x07\\xd5nc \\xf1e\\xbf9e\\xa6\\x88\\x15g\\x87\\xc3\\x16\\xc8\\x1e\\x06\\xae\"\\x02\\xe0\\xa3\\x94\\xa5^c\\x04k\\xd7\\xc0"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v2\\xf9\\xc8\\x1fc\\xed\\x96\\x06\\xb9\\xda\\x88\\xb1'\\x7fj\\xe15\\xcf\\xb6\\xf6x\\x94\\xf1lh> \\xf5yo\\xeb\\x96)\\xc6f%\\xf5k5\\t\\x83\\xfais\\x01\\xc8\\xb3>\\xe3z<\"5q\\x055\r\\xa8m\\xd7z\\x0e\\x95\\x04\\xd5fo\\x11\\x89\\xaf\\xeb,\\xc6u\\xe2-\\xf4j\\xca\\xe2\\xad\\xec4\\xd9f\\xaa\"\\x91\\xd2\\xee\\x96\\x88\\\\xb9\\xc7\\x08\\xf8\\x90\\xc3\\x87\n\\x0c^\\xec\\xec\\xb2k\\x039\\xa4q\\xa1b\\xe0\\x94\\x13\\xb3\\xaec\\x84\\xc6cgs\\x8d\\xcf3\\x8c\\xdd\\xe53\\x97m\\xf8\\x040\\xce\\xfehi\\xe6\\xad\\x8f\\xaa\\x16-\\xf5\\x9fy1@\\xbb0\\xe6w\\x97\\xf1\\xd2\\xffal\\x8f\\xc6\\xf9\\xb2>\\x88\t\\xc4\\xb5\\x909\\x11\\xf1+\\xc1\\xaa,\\xb2\\x8aib\\xd1\\xd8\\x10\\x1b\\xa3t\\x92\\xfep\\x03<h\\xc5\\xcc2h\\xad\\xec\\x10\t\\x97a\\x17\\x10\\x19\\x95+\\xddf6knj\\x11\\xf5\\xee?y\\xb3juz\\xe7\\xaf\\x84\\xb6\\x86\\x01i\\xa9\\xc6\\xd7\\xf1-\t\\xde\\xc0\\xc6"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\xe7\\x90;\\x9d\\x12\\xd0\\x1b\\x12_\\xa6\\xc1\\x8a\\xf9\\x85\\x8c4\\xd0\\xfe\\xfa\\x83\\xa2\\xf9g\\xfc\\xff\\x07\\x07\\xb0\\xda\\xd6b7\\x9a\\xda&z\\x1cp\\x1a\\xa2\\xa7r\\xd1_6s\\xf2g'k\\x19\\x94m\\xa8\\xfd\\xa2\\x91\\x17\\xa3u&\\x83\\xbc\\x00\\xdbw\\x1f\\x02\\x87\\xbc,\\xc0\\x02\\x0c\\xba\\x9d\rg\\x06j\\x02j\\xb4\\xfc\\x9en\\xdb=\\xa0\\x872\\x08sk+\\x9eg\\x9f\\xbf\\xf0\\xc6\\x06c\\x1f\\xfap\\x08\\x16\\xb65\\xbb=\\xf3\\x91\\x0b\\x9e\\x85\\xccw\\x01\\xbc\\x84\\xa2\\xa7\\xf3\\x88\\xc4\\x04\\xb4\\xec\\xa8kn\\x1d\\xafj\\xb9\\xb7\\x7f\\xd65\\xaf\\xff8\\xacd?\\x90|x\\xe1'^w8a\\xb1h\\xce\\xa39h\\xd5\\xd2u)\\x1f\\xe1\\xd9\n\\xe2>\\xb7r'\\xfb\\x03)-\\xc8\\x86%.\\x1f\\xae\\xe2\\xc6\\xc5b\\xf9sd\\xfb\\x9c\\xf9j\\xb9\\xb3\\xcev\\x8c\\x9ej\\xe0kp\\xb7\\x9ar\\xa5\\x9cjp\\xf5\\xe5@\\xcdf\\xba\\x085s\\xb7\\x15\\x04-\\xebq\\xd5\\xb2\\x9dd\\xd3\\xbe\\x01\\xfat\\xf6cxl\\xff\\xaa\\x9a\\xd9o\\xab"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x019q\\xd9\\xdb\\xc0\\xc7\\x00e\\x83\\x88\\xb2\\xcaz\\x05\\x87\\xdes\\xf4\\x1e)t\\xb6)\\xf8\\xfe\\x9a\\xf7\\x82\\xef\\x9ce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x8e6s\\x93x\\xee\t\\xeax\\xbf\\xe0y\\x8f\\xcc\\x13\\xbd\\xc8\\x06\\xa6d\\xadg\\x12\\xd6\\xd7#.\\x7fj\\xc8k\\xd0\\xfd:2|\\x05\\xeb\\xcc,\\x1d\n\\x97\\xa9\\xb4$\\x96\\x8c\\xaco\r\n\\xc6\\xc2dl\\x8a\\xde\\xc7\\xe3\\x8bd\\xe5w\\x93\\xb2e\\xd5?u~\\xb9\\xe5\\x80\\xd6\\x81\\xd2\\xf5ud\\x0ckq\\xd8f\\xc5\\xd1\\x0c\\x07\\xff\\x1a\\xad\\xdb\\x17\\xa1\\xa8fg\\xfb\\xc1\\xac\\xcb\\x80\\xd3b\\xe0\r\\x15\\xc2 \\xdd\\xabsg\\xc2\\xe6w@\\x8e\\xd4\\xf2\\xcf6\\xc2q\\xbcdz@%\\xc6\\xc3\\x8f\\x99z/\\x88\\x90\\xee(\"`\\x81\\xc7x\\x147\\xfb\\xb4>\\x92`\\x91a\\x11/\\xb4\\x88\\xc7\\xed\\x13\")y\\xfa*$\\x96\\xde6b*&\\xac\n\\x82\\x05\\xaf\\xbc\\x94\\x00\\xef\\xcap\\xacz\\x1f\\x9fg\\x9b\\xa9\\xc2\\x8d'\\xaa\\xd6\\xe4\\xaf\\x1b\\xd9\\x0fr\\x0e<\\xd9:\\x05\\x10\\xba\\xe0x\\xcb\\xf8\\xfb\\x18x\\xbb\\xf2\\x87v\\xaf\\xb6\\xc4\\x1c\\xa6m\\xc7\\xfe\\xbc\\xb4~o-\\xbc\\xb6\\x8ds|\\xa7\\xa8z\\xe0"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xdd\\x98\\xbd\\x82\\xaf\\xf4\\xe2\\xf0\\xf1\\x80l6\\xf4\\xfdo\\x9d\\xe7\\xf9\\xed\\xa6o\\x9f\\xdd\\xe7\\xdc$\\x1e|\\x9b\\x99\\x1c\\xc0\\xee\"7\\xa8\\xdb\\xc1i\\xc8\\xe1\\xad\\xbc\\x1b\\xe0\\xc6\\x83wa\\xc9\t\\x84\\xde\\xd7\\xa6#',\n\\x9d\\x9b\\x97\\x86\\x8e\\xaf\\xa9n\\x94\\xe7\\x85\\xf6\\xa0)\\xdf\\xa8\\xb2\\xe1\\xef\\x08't\\xe8/\\xccd\\x81g\\xddjd\\xe5k\\xb8l\\x88\\xd1\\x98+q5\\\\xd1\\x87k\\xc4\\x90s\\xa0\\x90s\\xe1\\xe5\\xb8\\x0f+\\xd1\\xb0\\x9c\\x9c^\\x94b\\x078g\\x18j_v\\x1fja\\x87\\x7f\\x98t\\xdb7\\x92\\x9e\t\\xc8\\xad\\xc7\\xdfuu:_\\xc6\\xbda\\x83\\x85t|\\xf8b\\xd2\\xad\\xa1|\\x87\\x04\\x8cy\\xa0'\\xee)1d\\xb0x\\xa0\r\\x1d\\xeb|\\x04vq\\xb9\\xfca\\xb7p\r\tq\\x89\\xba\\x89\\xdae\\xa1\\xc4\\x15'\\xd6\\xc5\\xd8\\xdfl@\\x00\\x11\\xb4n\\x96\\x85xo\\x109&\\x9a\\xa2\\xd3mm\\xf5yv\\x13\\xda\\xdf\\x94\\x97\\xf0\"g'\\x90\\x17\\x9eh\\xab\\xcf7\\xd0t\\xcaa\\xb5\\xb3\\x94"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019pm>d\\x1e\\xb6\\x90\\x1cp$\\xae\\xd0\t\\xad\\xc6\\xa9;v\\x19\\x1bo\\x955\\xcd\\xfb\\x1a3\\xe1+\\x80.mm\\#k\\xc0\\x13\\xa7\t\\xc4bbt~\\xefd\\x13~\\x1a\\xa8\\xd1\\xb4d\\x0ex\\x04\\x8d\\x89\\xc8\\xb69\\xbb:\\x89\\xce\\xd2\\xa9g\\xa5\\x89phh\\xcb\\x97_\\x82\\x9b\\xce5\\xf6\\xff\\xe7\\xd0\\xb6\\xa6\\xe2\\\\xa1j2ak\\x81\\xe3\\xaarlr\"\\x81\\x9e;hg\\x82q\\xc0\\x18\\xbf\\x929&\\xbc\\x19)\\xb1)\\x16h\\xea\\xb9\\x1d\\xd7\\xdfd\\x88\\x13\\xb1\\xdc\\xca\\x05ya\\xb2\\xc9\\x99v\\xf0\\xb3\\xdf\\xb7\\xd3m9\\xe0\\x1b\\xc5g\\x9ba\\xef\\x0f\\xf0\\xe7$\\xf5-\\xbep\\x9ef\\xc5\\xe7\\xbf\\xbd\\xa2\\x91\\xfcby\t\\xd3\\x9d\\xbf\\x07\\x95\\xce\\x87\\xa7\\x7f_h\\xd6:\\x17/\\x8b\\xc0r\\xfd^\\xa2\\xd0\\xbbht>\\x17\\xa1\\xd6b\\xcb\\xbe\\x1by\\x8d\\xa0$\\xf5\\x917\\x9c\\xb1\\xd5f\\xad36z\\xaa\\xc0\\xf4t\\xa5\\xcccb\\xd4\\x9as\\x95\\xd9\\xd6k\\xa5\\xcfz\\xf2\\xd6\\xeb&\\xcb\\xa7\\xfd\\xa1!"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  656.  
  657.  
  658.  
  659.  
  660. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  661. "Details":
  662.  
  663. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  664.  
  665.  
  666. "FireEye": "Exploit.CVE-2017-11882.Gen"
  667.  
  668.  
  669. "McAfee": "Exploit-CVE2017-11882.yx"
  670.  
  671.  
  672. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  673.  
  674.  
  675. "Symantec": "Exp.CVE-2017-11882!g3"
  676.  
  677.  
  678. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  679.  
  680.  
  681. "Avast": "OLE:CVE-2017-11882 Expl"
  682.  
  683.  
  684. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  685.  
  686.  
  687. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  688.  
  689.  
  690. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  691.  
  692.  
  693. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  694.  
  695.  
  696. "Sophos": "Troj/RtfExp-EQ"
  697.  
  698.  
  699. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  700.  
  701.  
  702. "DrWeb": "Exploit.ShellCode.69"
  703.  
  704.  
  705. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  706.  
  707.  
  708. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  709.  
  710.  
  711. "Ikarus": "Exploit.CVE-2017-11882"
  712.  
  713.  
  714. "Avira": "EXP/CVE-2017-11882.Gen"
  715.  
  716.  
  717. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  718.  
  719.  
  720. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  721.  
  722.  
  723. "Microsoft": "Trojan:O97M/Obfuse.AE"
  724.  
  725.  
  726. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  727.  
  728.  
  729. "ALYac": "Exploit.CVE-2017-11882.Gen"
  730.  
  731.  
  732. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  733.  
  734.  
  735. "Zoner": "Probably W97NativeOnly"
  736.  
  737.  
  738. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  739.  
  740.  
  741. "MAX": "malware (ai score=94)"
  742.  
  743.  
  744. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  745.  
  746.  
  747. "AVG": "OLE:CVE-2017-11882 Expl"
  748.  
  749.  
  750. "Qihoo-360": "virus.exp.21711882.d"
  751.  
  752.  
  753.  
  754.  
  755. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  756. "Details":
  757.  
  758. "target": "clamav:Rtf.Dropper.Agent-7073901-0, sha256:ca80938715ed9886604daf7caeca1e74f1024c7ce070c06ac24140bf59a817a9, type:Rich Text Format data, version 1, unknown character set"
  759.  
  760.  
  761. "dropped": "clamav:Rtf.Dropper.Agent-7073901-0, sha256:ca80938715ed9886604daf7caeca1e74f1024c7ce070c06ac24140bf59a817a9 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_110920778b09d04ecca9d0548cfd7752.doc, type:Rich Text Format data, version 1, unknown character set"
  762.  
  763.  
  764.  
  765.  
  766.  
  767. * Started Service:
  768. "osppsvc"
  769.  
  770.  
  771. * Mutexes:
  772. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  773. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  774. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  775. "CicLoadWinStaWinSta0",
  776. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  777. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  778. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  779. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  780.  
  781.  
  782. * Modified Files:
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_110920778b09d04ecca9d0548cfd7752.doc",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_110920778b09d04ecca9d0548cfd7752.doc",
  785. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF51C73A9E-118F-4D81-A256-0CE1B49D3B5B.tmp",
  786. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  787. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  788. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  789. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C0E.tmp",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6C0F.tmp",
  792. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCACB683A-EAAE-4BC7-BA1C-833C50977D14.tmp",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B72.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B92.tmp",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BA3.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BB3.tmp",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BB4.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BC5.tmp",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BD6.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BD7.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BE7.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BF8.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BF9.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C09.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C0A.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C0B.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1E.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1F.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1D.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1C.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C4F.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7CBD.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7DC8.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E18.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E17.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E77.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7EA7.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7FB1.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cab810A.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cab811B.tmp",
  822. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  823. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81C9.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81C8.tmp",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8275.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab82A5.tmp",
  828. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar82B6.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8324.tmp",
  831. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  832. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8335.tmp\\ThemePictureAccent.glox",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8335.tmp\\Content.inf",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83B3.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83C5.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD83B4.tmp\\iso690nmerical.xsl",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83F4.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD83B4.tmp\\Content.inf",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8434.tmp\\mlaseventheditionofficeonline.xsl",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8474.tmp\\Basis.thmx",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8454.tmp\\pictureorgchart.glox",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8503.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8553.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8564.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8574.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8434.tmp\\Content.inf",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8454.tmp\\Content.inf",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85A5.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8533.tmp\\Banded.thmx",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8585.tmp\\gostname.xsl",
  852. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85E6.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8474.tmp\\content.inf",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8502.tmp\\ConvergingText.glox",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85E5.tmp\\ThemePictureGrid.glox",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8533.tmp\\content.inf",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8721.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8711.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85E5.tmp\\Content.inf",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8585.tmp\\Content.inf",
  862. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8502.tmp\\Content.inf",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86F0.tmp\\TabList.glox",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86F0.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD884B.tmp\\Headlines.thmx",
  867. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab89D4.tmp",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD884B.tmp\\Content.inf",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8965.tmp\\content.inf",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8965.tmp\\Dividend.thmx",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8BAC.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B1D.tmp\\content.inf",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B5C.tmp\\content.inf",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B5C.tmp\\Frame.thmx",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B1D.tmp\\Wood_Type.thmx",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C2B.tmp\\content.inf",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8BEB.tmp\\content.inf",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8BEB.tmp\\Parallax.thmx",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C2B.tmp\\Metropolitan.thmx",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C4B.tmp\\ThemePictureAlternatingAccent.glox",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C7B.tmp\\Badge.thmx",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C4B.tmp\\Content.inf",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8CCA.tmp\\content.inf",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8CCA.tmp\\Quotable.thmx",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DD5.tmp",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C7B.tmp\\Content.inf",
  897. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D77.tmp\\InterconnectedBlockProcess.glox",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DF6.tmp\\TabbedArc.glox",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D77.tmp\\Content.inf",
  901. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F00.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F00.tmp\\Content.inf",
  904. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  905. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD903C.tmp\\Crop.thmx",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DF6.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F01.tmp\\gb.xsl",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F41.tmp\\RadialPictureList.glox",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F41.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F01.tmp\\Content.inf",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9108.tmp\\Berlin.thmx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD91A6.tmp\\Circuit.thmx",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD903C.tmp\\Content.inf",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9186.tmp\\architecture.glox",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9186.tmp\\Content.inf",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92C0.tmp",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab938D.tmp",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9108.tmp\\content.inf",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD91A6.tmp\\content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9534.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9524.tmp",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9593.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E2.tmp\\Feathered.thmx",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E2.tmp\\Content.inf",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97A9.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97FA.tmp\\content.inf",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97CA.tmp\\Insight design set.dotx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD973B.tmp\\content.inf",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD983A.tmp\\content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97FA.tmp\\Mesh.thmx",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9839.tmp\\turabian.xsl",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98B8.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD973B.tmp\\Main_Event.thmx",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD983A.tmp\\Slate.thmx",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9839.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97CA.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  953. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  954. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C14.tmp\\content.inf",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CA2.tmp\\BracketList.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C14.tmp\\Damask.thmx",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC4.tmp\\content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC3.tmp\\rings.glox",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CB3.tmp\\HexagonRadial.glox",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CA2.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CD5.tmp\\Element design set.dotx",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC4.tmp\\Vapor_Trail.thmx",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CB3.tmp\\Content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC3.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CD5.tmp\\Content.inf",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E1E.tmp\\harvardanglia2008officeonline.xsl",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9E9C.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E1E.tmp\\Content.inf",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9EAD.tmp",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  973. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  974. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  977. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FF6.tmp\\iso690.xsl",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA026.tmp\\chevronaccent.glox",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA036.tmp\\ieee2006officeonline.xsl",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA026.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FF6.tmp\\Content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA036.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA25A.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA25B.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA28B.tmp\\chicago.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA28B.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2F9.tmp\\sist02.xsl",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2F9.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA30A.tmp\\gosttitle.xsl",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA33A.tmp\\PictureFrame.glox",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA33A.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA30A.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B8.tmp\\content.inf",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B8.tmp\\View.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F7.tmp\\CircleProcess.glox",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB696.tmp\\VaryingWidthList.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB696.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB6B6.tmp\\APASixthEditionOfficeOnline.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB6B6.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB725.tmp\\Equations.dotx",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB725.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1017. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1E859769-9315-4E37-A74C-77A1DDB101AA.tmp"
  1018.  
  1019.  
  1020. * Deleted Files:
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C0E.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6C0F.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8335.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab82A5.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar82B6.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD83B4.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8434.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8454.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8474.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8533.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8502.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8585.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8335.tmp\\ThemePictureAccent.glox",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85E5.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81C9.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86F0.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD83B4.tmp\\iso690nmerical.xsl",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BF8.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD884B.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85E5.tmp\\ThemePictureGrid.glox",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8324.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8965.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8434.tmp\\mlaseventheditionofficeonline.xsl",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BB4.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8454.tmp\\pictureorgchart.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81C8.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8585.tmp\\gostname.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8474.tmp\\Basis.thmx",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8502.tmp\\ConvergingText.glox",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8275.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1D.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BE7.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B1D.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8533.tmp\\Banded.thmx",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B5C.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86F0.tmp\\TabList.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\cab811B.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E18.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8BEB.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C2B.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C4B.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C7B.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD884B.tmp\\Headlines.thmx",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83C5.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8CCA.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D77.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8965.tmp\\Dividend.thmx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DF6.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85A5.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C2B.tmp\\Metropolitan.thmx",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8503.tmp",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F00.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F01.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B5C.tmp\\Frame.thmx",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F41.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C7B.tmp\\Badge.thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8564.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8BEB.tmp\\Parallax.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD903C.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8574.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8721.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9108.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9186.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B1D.tmp\\Wood_Type.thmx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD91A6.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83B3.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C4B.tmp\\ThemePictureAlternatingAccent.glox",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F00.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8CCA.tmp\\Quotable.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83F4.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1F.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab89D4.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D77.tmp\\InterconnectedBlockProcess.glox",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1C.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F41.tmp\\RadialPictureList.glox",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F01.tmp\\gb.xsl",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7FB1.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8553.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DF6.tmp\\TabbedArc.glox",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85E6.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9186.tmp\\architecture.glox",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD903C.tmp\\Crop.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DD5.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BF9.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9108.tmp\\Berlin.thmx",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8711.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E2.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD91A6.tmp\\Circuit.thmx",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD973B.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97CA.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97FA.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD983A.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9839.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E2.tmp\\Feathered.thmx",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8BAC.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92C0.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9839.tmp\\turabian.xsl",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B92.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97CA.tmp\\Insight design set.dotx",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9593.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD97FA.tmp\\Mesh.thmx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD973B.tmp\\Main_Event.thmx",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9534.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C14.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD983A.tmp\\Slate.thmx",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab938D.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CA2.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC4.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC3.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CB3.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CD5.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9524.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E1E.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CA2.tmp\\BracketList.glox",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC3.tmp\\rings.glox",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CB3.tmp\\HexagonRadial.glox",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B72.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BA3.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab810A.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CD5.tmp\\Element design set.dotx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9EAD.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7CBD.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C14.tmp\\Damask.thmx",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FF6.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98B8.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E1E.tmp\\harvardanglia2008officeonline.xsl",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C0B.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA026.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA036.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CC4.tmp\\Vapor_Trail.thmx",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA036.tmp\\ieee2006officeonline.xsl",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA026.tmp\\chevronaccent.glox",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FF6.tmp\\iso690.xsl",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97A9.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BC5.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C4F.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BB3.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA25A.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA25B.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA28B.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA28B.tmp\\chicago.xsl",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C0A.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2F9.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA30A.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA33A.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B8.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2F9.tmp\\sist02.xsl",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C09.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F7.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA33A.tmp\\PictureFrame.glox",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BD7.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA30A.tmp\\gosttitle.xsl",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7DC8.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B8.tmp\\View.thmx",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F7.tmp\\CircleProcess.glox",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7EA7.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7BD6.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB696.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB6B6.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB696.tmp\\VaryingWidthList.glox",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB725.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E77.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB6B6.tmp\\APASixthEditionOfficeOnline.xsl",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7E17.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB725.tmp\\Equations.dotx",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7C1E.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_110920778b09d04ecca9d0548cfd7752.doc",
  1196. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCACB683A-EAAE-4BC7-BA1C-833C50977D14.tmp",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1198. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1E859769-9315-4E37-A74C-77A1DDB101AA.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR6508.tmp.cvr"
  1200.  
  1201.  
  1202. * Modified Registry Keys:
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\2t9",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2343EF2",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2343EF2\\2343EF2",
  1215. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1459. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1806. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1807. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1827.  
  1828.  
  1829. * Deleted Registry Keys:
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\2t9",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\(j7",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2343EF2\\2343EF2",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1840.  
  1841.  
  1842. * DNS Communications:
  1843.  
  1844. * Domains:
  1845.  
  1846. * Network Communication - ICMP:
  1847.  
  1848. * Network Communication - HTTP:
  1849.  
  1850. "count": 1,
  1851. "body": "",
  1852. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1853. "user-agent": "Microsoft-CryptoAPI/6.1",
  1854. "method": "GET",
  1855. "host": "ocsp.digicert.com",
  1856. "version": "1.1",
  1857. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1858. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1859. "port": 80
  1860.  
  1861.  
  1862. "count": 1,
  1863. "body": "",
  1864. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1865. "user-agent": "Microsoft-CryptoAPI/6.1",
  1866. "method": "GET",
  1867. "host": "ocsp.msocsp.com",
  1868. "version": "1.1",
  1869. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1870. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1871. "port": 80
  1872.  
  1873.  
  1874. "count": 23,
  1875. "body": "",
  1876. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1877. "user-agent": "Microsoft-CryptoAPI/6.1",
  1878. "method": "GET",
  1879. "host": "crl.microsoft.com",
  1880. "version": "1.1",
  1881. "path": "/pki/crl/products/microsoftrootcert.crl",
  1882. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1883. "port": 80
  1884.  
  1885.  
  1886. "count": 1,
  1887. "body": "",
  1888. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1889. "user-agent": "Microsoft-CryptoAPI/6.1",
  1890. "method": "GET",
  1891. "host": "crl.microsoft.com",
  1892. "version": "1.1",
  1893. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1894. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1895. "port": 80
  1896.  
  1897.  
  1898. "count": 2,
  1899. "body": "",
  1900. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1901. "user-agent": "Microsoft-CryptoAPI/6.1",
  1902. "method": "GET",
  1903. "host": "crl.microsoft.com",
  1904. "version": "1.1",
  1905. "path": "/pki/crl/products/microsoftrootcert.crl",
  1906. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1907. "port": 80
  1908.  
  1909.  
  1910. "count": 1,
  1911. "body": "",
  1912. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1913. "user-agent": "Microsoft-CryptoAPI/6.1",
  1914. "method": "GET",
  1915. "host": "crl.microsoft.com",
  1916. "version": "1.1",
  1917. "path": "/pki/crl/products/microsoftrootcert.crl",
  1918. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1919. "port": 80
  1920.  
  1921.  
  1922.  
  1923. * Network Communication - SMTP:
  1924.  
  1925. * Network Communication - Hosts:
  1926.  
  1927. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!