API tools faq
paste
paladin316

RTF_294a0b9a202b662129d38bdb6eacf04f_doc_json.json

paladin316
Jun 19th, 2019
2,420
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 273.05 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Lokibot"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "RTF_294a0b9a202b662129d38bdb6eacf04f.doc"
  7. [*] File Size: 8542
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "4dc39d95a9f495deb801ac0376bd9b30811b40c79e46c855b865d51ef662d2dd"
  10. [*] MD5: "294a0b9a202b662129d38bdb6eacf04f"
  11. [*] SHA1: "f86443e328db7ddf99deb2a7edaba7d780b4dd9a"
  12. [*] SHA512: "5e86bb551b850de98d39f9f80184c6a735b213406397d5861980a5f5c2e3fba25f7643d991fc0e4fff6d38ec7d9dd527f89ce9311ce59364ad2f782ddb08f00e"
  13. [*] CRC32: "E66266AA"
  14. [*] SSDEEP: "96:SXdBzvxINTv5yn1zKX31+eu2NZXw6b6GOY9/nv7OBCGolnh:SXvbxINTv5y1QNmGOY9HBlnh"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 1648"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  31. "Details": [
  32. {
  33. "IP": "65.52.98.231:443"
  34. },
  35. {
  36. "IP": "23.36.176.37:443"
  37. },
  38. {
  39. "IP": "104.18.24.243:80"
  40. },
  41. {
  42. "IP": "23.59.154.34:80"
  43. },
  44. {
  45. "IP": "72.21.91.29:80"
  46. },
  47. {
  48. "IP": "52.109.2.18:443"
  49. },
  50. {
  51. "IP": "23.59.154.33:80"
  52. },
  53. {
  54. "IP": "104.115.144.95:443"
  55. },
  56. {
  57. "IP": "52.109.2.14:443"
  58. }
  59. ]
  60. },
  61. {
  62. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  63. "Details": [
  64. {
  65. "ioc": "pictureorgchart.glox"
  66. },
  67. {
  68. "ioc": "ontent.inf"
  69. },
  70. {
  71. "ioc": "chicago.xsl"
  72. },
  73. {
  74. "ioc": "ccent.glox"
  75. },
  76. {
  77. "ioc": "ist.glox"
  78. },
  79. {
  80. "ioc": "set.dotx"
  81. },
  82. {
  83. "ioc": "content.inf"
  84. },
  85. {
  86. "ioc": "iew.thmx"
  87. },
  88. {
  89. "ioc": "eadlines.thmx"
  90. },
  91. {
  92. "ioc": "uotable.thmx"
  93. },
  94. {
  95. "ioc": "erlin.thmx"
  96. },
  97. {
  98. "ioc": "adge.thmx"
  99. },
  100. {
  101. "ioc": "rop.thmx"
  102. },
  103. {
  104. "ioc": "avon.thmx"
  105. },
  106. {
  107. "ioc": "roplet.thmx"
  108. },
  109. {
  110. "ioc": "ircuit.thmx"
  111. },
  112. {
  113. "ioc": "g.n9"
  114. },
  115. {
  116. "ioc": "late.thmx"
  117. },
  118. {
  119. "ioc": "eathered.thmx"
  120. },
  121. {
  122. "ioc": "vent.thmx"
  123. },
  124. {
  125. "ioc": "amask.thmx"
  126. },
  127. {
  128. "ioc": "rail.thmx"
  129. }
  130. ]
  131. },
  132. {
  133. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  134. "Details": [
  135. {
  136. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  137. },
  138. {
  139. "http_version_old": "HTTP traffic uses version 1.0"
  140. },
  141. {
  142. "suspicious_request": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php"
  143. },
  144. {
  145. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  146. },
  147. {
  148. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  149. },
  150. {
  151. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  152. },
  153. {
  154. "suspicious_request": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe"
  155. },
  156. {
  157. "suspicious_request": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes"
  158. }
  159. ]
  160. },
  161. {
  162. "Description": "Performs some HTTP requests",
  163. "Details": [
  164. {
  165. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  166. },
  167. {
  168. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  169. },
  170. {
  171. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  172. },
  173. {
  174. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
  175. },
  176. {
  177. "url": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php"
  178. },
  179. {
  180. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  181. },
  182. {
  183. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  184. },
  185. {
  186. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  187. },
  188. {
  189. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe"
  190. },
  191. {
  192. "url": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes"
  193. }
  194. ]
  195. },
  196. {
  197. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  198. "Details": [
  199. {
  200. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p \\x8f$\\ u\\x82}~,\\x15\\xe2\\xe3\\xb5k\\xef\\xcdtl\\xccx9\n\"4\\xfe>\\xdd\\xdc\\x9b\\x0c\\xe0\\x80\\xc2\\x1d\\xf1\\xc4i\\xef\\xc2\\x08ue\\x01l/\\xac>\\x19w\\xef\\x1a\\x1a\\xc3\\x9a\\x96\\xaa\\x81xy\\x84\\xabad\\xd0(l\\xacp\\x04\\xacp\\x11%\\xab*-\\x8bux.\\xa8o\\x98\\xcd^\\xf9\\xe2\\xb9o\\xc8\\xdc]~)\\x07]\\xddxd\\x95\\x0e\\x0f1\\xa56\\x1fdt\\x8a\\xffx~\\xa5\\x0fu(\\x9c\\x95l\\xdb\\xb3\\xae\\xd3,6d\\xd9\\xae\\xe4\\x0e~\\x0e\\xd3\\xf6\t \\xc0\\x15\\x8f\\x89\\xfb\\x0fi>\\xbe\\x9e/p\\xed-\\xf0\\x0fsijn\\xdc\\xd5\\x15\\xce\\xf1\\xd5\\xbb\\xf6p\\x8e\\xeenf\\xb6\\xd0\\xa0\\xa4t\\xa5b|\\xf2m/7o\\xc9\\xa5\\xe2\\xe6\\xf5\\x81\\xb1\\x8d\\xa3\\xbc\\x11\\xf7sl\\xd8\\x8e]rk\\x01\\xf0\\xad\\x14\\x1f\\x8b[\\xd2\\xdf\\xbb\\xf5`\\x01c\\xaez\\xb6\\xec\\xf7g\\x90m\\xea\\xd31m\\xc2\\xfb%\\x15\\\\xd0\\xa97\\xc6\\x92\\xdfm5\\x10\\xbe+rt\\x8c\\xe0-\\xf4\\x89"
  201. },
  202. {
  203. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x08\\x0b\\xba\\xc8\\xb7\\xf3\\x13)\\x97#\\xcb\\xbex\\xe4\\x9e\\xee\\xb4\\xc1u\\xd73\\x80\\x9f\\x11\\xc0\\x9d*h\\x88\\xcbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  204. },
  205. {
  206. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xaa\\x15yy\\xdf\\xf6\\xbd$q\\xce\\xf6\\xa5\\xc4<\t\\x93\\x85c\\x04-\\xc6\\x8d7\\xb5]\\x92\\xa3\\xec*\\xfdc\\\\xe3\\x16>\\xda\\xada>up\\xd5b\\xd3\\xd0\\xe4\\x02~kja\\xaajtr\\xeb\\xc1\\x1e\\xd9h-\\x82\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xe2\\xf8\\xfb\\xea{\\xe6h;ee\\xdf\\x08\\xa2r\\x0c\\x10\\xb5\\xfd\\xcc\\x19w\\xc7\\xda\\xa6l}\\xb91\\xcb\\xd3\\xb0\\x93\\xc3o&\\xd2\\xb1-\n\\xbe\\xf1naab\\x9ca"
  207. },
  208. {
  209. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  210. },
  211. {
  212. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  213. },
  214. {
  215. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p6\\x12\\xc2\\xe0$\\xaeu\\x8e,g\\xa6al\\xa6\\x7f\\x01f\\xa8\\x88\\xc3\\xa8`\\xc5\\xdb$\\xc4\\xb9\\xc7\\xf3c\\x82r\\xda\\x87\\xbb\\xfc\\xd8\\xfe\\xa3\\xaf\\xa4\\xb26?\\x03\\xa7t\\x0evk\\x88\\xd4\\x8b\\xa0\\x0b\\xac\\xda\\xe0\\xf4la\\xfd\\x94@\\x19\\x0eg\\xf7n \\xd2^\\xaa\\xd3\\xa5+\\xe6\\xeb\\xe1\\xc1\\xcd@\\xad\\x9c\\x81\\xd9v\\xb6o\\xf2\\xd52o1d9\\x89\\xd1i|\\xdf\\x9a\\x07\\xa13\"\\xfa(\\xed2\\xc0\\xa9\\x19k\\xb6\n\\xa3\\xcb\\x8ft?s\\x80'\\x1ep\\xfad\\xa40w\\xff\\xac\\xa4\\xea\\x95ew=]d\\xf8\\xafhv,\\x139\\xfc\\xb2\\xe75g3\\xca\\xcc\\x82\\xf4\\xbc\\xcf8y\\x17.n\\xa2\\xe3\\xc6\\xa3\\xc2\\xea\\xad2\\xdb\\xb9r\\xde\\xea\\xf3\\xfa\\xc5\\x8c\\xbbgb\\xb9\\xcb\\xec\\xcc3\\xf3\\x1c8\\xa7{\\x19\\xf1\\x84\\xf7\\xff\\xa1f\\x11\\xeb\\xd7\\x11#:~t\\xcd\\xc4\\x1at\\xa19xi[\\xd4p\\x93\\x1c\\xa4\\xba%\\x81\\x01mm9{gh\\xb2\\n\\xa7s\\x90r\\xda\\x9e\\x89\\x0b;\\x06m*\\xfe\\xa9"
  216. },
  217. {
  218. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xda\\xe1\\xeewmp\\xfeg/c?\\xfa\\xd0\\x94\\x1d\\x8a\\x85\\xacb=au&\\xad{\\xb0\\x9a\\xcar\\xbbd\\x19\\xaf\\xc6\\xe8\\xf8s\\x0fb~\\xa8\\x94\\xda6\\x8e\\x14\\x0b\\xa5\\xfe\\xc5\\xf4\\xa5\\x84d\\x84\\x1d\\x96{\\xd6\\x8e\\xaf\\xdb\\xb4*0\\xd8\\xba\\x15\\xcd y\\x1c{\\xac\\x86`\\x10=\\x81\\x01\\x0b\\xc0\\xd23o\\x9d\\xac\\x02\\xb3\\xef\\xa0n\\xc9\\x8e\\x88\\xe4r4\\xeb\\xcc\\x19\\xb5\\xcc\\xc7r\\xd8b\\x0e\\x95\\x00x\\x1f4\\x1e?h\\xc1\\x97\\xf7~\\x92c\\x08\\x9c\\xb4hi\\xb9\\x1c\\xb3\\x19\\xeb$\\x98\\x8f\\xa1\\xf6\\xf1\\xc6\\xc6\\x80\\xd9n\\x90\\xd3\\x84\\xe8-\\x88~\\x86\\xdf\\x9ekx\\xf1x\\x97\\xa9\\x80/\\x84\\xfa\\x80\\xf9\\x90`\\xe1\\xd7\\xfd\\x8br\\x18:\\xc5\\xd9\\x96\\x9c\\xdb,r\\x03\\xe0\\xa4(\\x10\\xe6\\x877p\\x92w(e\\xcc.\\xdeto\\x10\\x87s\\x84\\x17~\\x97\\xff\\xbb\\xa8\\xc0\\xf0\\xabm\\xab/\\xa1:u\\xb9\\xe9yv/cfqg\\x08d\\xbd\\xd8yc\\xbe\\xff\\xd9@ur\\xff\\xd1\\xceb\\xb4}\\xdce\\xe5c\\x1e\\xd6"
  219. },
  220. {
  221. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x08\\x0b\\xc0>\\xear\\x91\\xf4\\xed\\xffoxw\\xdb\\xc5=\\x1c7t{kt\\x08`\\xe4\\xc9\\xff\\x8f\\xc1\\xf7i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  222. },
  223. {
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xba\\xfe\\k\\xd9\\xd1\\xe1\\xe7\\x89,/r\\x92\\xc9}\\x9f\\xf1\\x13\\xd4\\x0b\\x00&4o\\x1e\\xf4\\xbc\\xb8\\xba\\x99\\xc6\\xffa\\xa8s\\xa5\\xc8\\x0ci\\xfb/k!\\x1c\\xfb3\\xda\\x94\\xad\\xae\\xb4\\x04\\xb5\\xc4cd\\xa9r\\x0b\\xf6\\x01\\xf9\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!\\xbf\\xda\\x9bd\\x00kzlu_f]}\\xe2\\xde\\x0e\\x01k,'\\x8ex\\xe9\\xa4\\x86\\x80<py\\xa0\\xb9\\x1f\\xaa\\x15\\xe8\\x94\n\\xd3h\\xaces\\x99ifpb"
  225. },
  226. {
  227. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p#i\\xaa\\xd7\\xfav\\xab\\xe3\\xc2\\x88\\xb3t\\x7f\\xe1\\x9ar\\xd2\\xcf\\xf2ai\\xf6\\x00\\x04~o\\xb8lh\\x90\\xf0\\xdb5r\\x90y8\\xee\\xb3?\\xb6\\xf3\\x12\\xfa\\xe2\\x1ciy\\xc6\\xab@\\xea-y\n\\xe5z\\xdf\\xba\\xbe\\x90m\n\\xa5\\x17\\xdb\\xc6.\\xfb\\xf2v\\xe6\\xc1d\\x96\\x13\\xa7v\\xf4\\x16\\xd1\\xb1\\x14\\xc6\\xccna\\x99\\xd5\\x9d&8\\xa4\\x91\\xfaf\\xb0\\xefa\\xdf\\x97\\xf3\\xda_\\xc8o\\xf7>k\\xff\\x0c\\x1dr\\x149\\xbd\\x0fx\\x0fw\\x94\\xad9ohww4\\xd3\\xeb.\\x9e\\x0b(8\\xf2\\xc5\\xb1\\xafd\\x90~\\x7f\\x85}\\x08\\xc2\\xb8\\x81#\\xb11\\xb1\\xf4\\xc7\\xfc\\x8bgc]0_w\\xc8e}-\\x83r\\xa8\r;\\x01\\\\xc4\\xf5\\xca\n\\xfd\\xd0d8l\\xb3\\x1a\\xfe\\xb4d0\\xae\\xbb\\xc6`\\x86\\xfc\\x9c\\xa8\\x90q\\x97\\$k\\xa8@u-\\xf1'\\x91\\xb6\\xe3\\xeb\\xa73\\xb5\\xfb\\xcc3\\x1c\\xb12\\xa3\\x17\\x1d\\x1e\\xc4\\xfb\\xba<\\x9c\\x03]v\\xcf=%c\\x85\\x080g]\\x8f$!h\\xb3\\xb9\\xf34"
  228. },
  229. {
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x08\\x0b\\xc2\rr\r\\xe1\\x86c\\x90d\\xd4\\xe9/^&\\x8b;\\xf2x\"\\xb2\\xad\\x85\\xabr\\x8f\\x947\\xb0\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231. },
  232. {
  233. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xd2\n#\\x88\\xb3\\xf27\\x92\\x15\\x9b\\xbd\\xa2\\xb9\\x93\\x11\\xcd\\xf5\\x85\\x08\\xa2\\x9b\\x06\\xb8\\x10> \\xd2\\x970\\xd6\\xf4\\xf8\\xe31/\\xb7zy\\x89c!\\xcc\\xc6\\xeb\\x8b\\x7f\\x176\\x15,i\\xfd\"\\xbd\\xf8\\xcc\\\\xf1j\\x89\\xcb\\xa3\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\xfa\\xed5\\x7f\\xbb&x]\\xb9\\x91\\xe90f5b\\xb5\\xdb\\x1dzxq>&gm\\xc2\\xff3\r\\xdc\\xab\\x0b\\xfd\\x8ex\\x1es7\nr\\x18w\\xd5\\xddpso"
  234. },
  235. {
  236. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x03f\\xc6\\xa0w7x\\x9am\\xf9i\\xe9m\\xa8\\x00\\x11\\x87\\xd3s\\x1e\\xf5n\\xc2\\xb2\\xdaj\\x86o\\x92\\xe7\\xc8\\x91\\xe0\\x01\\xcc83rw\t\\x7f\\xb8\\xb1\\xf2\\x06\\x99%\\x1c\\x00\\xc9\\xf9\\xfe\\xe6 \\xf2\\xd0\\x91\\xa6\\x03h\\x9apz\\xe9\\xc8\\x03?hyk\\xcc\\xd2\\x0fv#n\\x1a\\xba<\\xebb\\xb8\\xfa\\x1dm\\xf8\\xe8k&\\xf7\\x98\\x9f\\x18\\xe1\\x9ah\\x8e\\x99(\\xf2c\\xcf\\xd9\\xdbh\\xee0\\xd4x>\\xc4q\\xc0^\\xcb\\xb6k\\xdf\\x0e\\x1a\\xa3\\x8e\\x86qp!\\x1b\\x1b\\xe8z\\x826\\xddv\\x83{\\xf9\\x9eydr\\xae\\x0f\\xb0m\\xc3\\xcab\\xea\\xa2(f\\xa2h\\x11\\xb15\\xc2\\xcf\\xf0c<\\x12r\\x01\\xca\\\\x11\\x11 g\\x03\\x05\\xd7_\\x9e\\x04@y<<\\x139\\xd5n7\\x1ev\\x1e,\\x94\\x94\\x91\"~\\xac\\xe8+,\\xcck\\xe1\\x92\\xf5\\xbe\\\\x15\\xfey\\x87\\xc9\\xe2,\\xfc\\xaccm\\xdc\\xba\\xb5\\xfa\\x9a\\x92\\xd5\\xa47\\xb5\\xf6\nf\\x92\\x18\\xday\\x8e\\xde\\xa2\n+\\x03\\xe4\\xc9\\xafl\\xc5h7\\x93\\xca\\x1f\\x94"
  237. },
  238. {
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3zt\\xcd\\xb1\\xf3\\x83\\xab#\\x837\\x86\\x90>\\xd4m\\x92\\xe20\\xab\\x00\\x8e\\x01u\\xde\\xa2\\x06\\xfah\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  240. },
  241. {
  242. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xfd\\xb3\\xca\\xa5\\xea)4\\xdc\\xfbh\\xb6\\xc2xl\\xc0\\xcc\\xe2\\xcdj\\xdb{c4%\\xfe\\xf5\\xa6\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243. },
  244. {
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3`0$\\xf0\\xda\\x05\\xd6\\xce\\xf7fr-\\x1f\\xedh\\xd4g\\xf9\\x1d\\x8ds\\x1b\\xbd\\xb5y3\\xd9=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  246. },
  247. {
  248. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\mi\\x0cbk\\xe8\\xf7\\xea\\xf0\\xa6o\\xea\\xb2 \\x1b\\x83k\\xf4\\x86\\x82\\x03'\\x87un\\x17f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  249. },
  250. {
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xfcr\\xd6\\xa2\\x8f>\\xc2\\xab\\xba4\\xc5\\xa7\\xa2\\x00 \\x81\\x11\\x92su4\\x1d\\x85\\x12\\x8d)\\x1c\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252. },
  253. {
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x8e\\x1d\\xaeh\\xb3\\xd1\\x84\\xa4\\xc4va|\\x8api6\\xde\\xfd1&6d\\xa3[u\\xbc\\xa1\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  255. },
  256. {
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xd3j\r\\xd7\\x8e\\xd9\\xccgi\\xf47\\\\xb52\\x13\r??\\x03\\xd5\\x96\\xb0\\xb8\\xf6\\xf7dx\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  258. },
  259. {
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3'\\xd1\\x98\\x96y\n\\x07}\\xd7\\xfd\\x88\\xf4\\x02s})\\x7f\\xae\\x13\\xa5;j\\x06\\x07c_}\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  261. },
  262. {
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xd8\\xa1m}\\x8b\\x19\\x87\\xc5ls\\xba\\x86\\xd4\\x96;\\xb46\\xfb?5\\xa1f\\xdf\\xe3\\xf4l\\xea\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264. },
  265. {
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3y)\\xac\\xb3\\xbe@\\xeb\\x89\\x13ced\\\\x01\\;2\\xe0\\xd4\\xba<}wl\\xe7o\\x16\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  267. },
  268. {
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xe0\\xc7\\xcd\\x1e\\xda\\x8e\\x83k<m\\xff\\x80-[\\xc4\\xa9\\xeb\\xee\\x08\\x17h\r\\xcaj\\x04\\x18\\x9a\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270. },
  271. {
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xa5\\x10n\\xd58\\xa0\\xc06pw[\\x87cy\\x03\\xbcj\\xd7\\xe5\\x8d\\x12\\x1a[\\xc8\\xccd\\x8ey\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  273. },
  274. {
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x8a7\\x1a\\xa5\\xa4\\xa7\\xd7f\\xbe7y\\x1dr\\xfc\\x94?l\\xc0m\\x0f\\xcc\\xf4\\x84w\\x01/\\x06g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276. },
  277. {
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xa9\\xe0\\x8es\\xc5\\xdcka&\\xd1\\x81\\xaa\\xcanb\\xd0\\xc0 k\nzc\\x0e\\xcd\\xf5\\xdd\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279. },
  280. {
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3c\\xb8y\\xe1\\xb8\\xbc\\xc5h\\xa8\\xe33\\xe6\\xce\\xf8\\x81\n\\x04y\\xa2f\\x89\\xdb\\x9cf\\x81\\xb1q\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  282. },
  283. {
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xe6\\xcf\\xac\\x19\\xd1\\x82w?\\xaf\\xc7\"\\xdb\\x03\\x14\\xee\\xfa\\x97+\\x16\\x81\\xfda\\xcb\\x12:\\xf2\\x12n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285. },
  286. {
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x1d\\x96\\x1b\\x8dg>\\xe8&\\xbdxv\\x11\\x15(\\xec\\xd47\\xa6\\x96'cj(\\xa5\\xa9p\\xffm\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288. },
  289. {
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3u\r39\\xf3t\\xd89&\\xe6\\xffm\\xd8k@\\xc07\\xd2#\r\\xd9w\\x19\\x17.\\\\x19\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291. },
  292. {
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x0c\\x17s\\x8b\\xb7\\xd4g!\\x0et\\xc7\\xd0\\x07,j5\\xd5k%\\xdapl\\x8ev\\xaa$\\x9a\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294. },
  295. {
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3@n\\x7f\"\\xb5/1\"\\x17\\x03w\\x1b2\\xe9\\x9a+\\xc7\\xf1)'\\xd4\\xf9w*\\x16e\\xd0\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297. },
  298. {
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xd6-\\xbb\\xb5\"\\xef\\xe0\\xd7\\x82\\xc9\\xdez'\\xc8\\xecl\\x94ou\\xce\\x0c%\\xf9\\x98\\x92\\x04\\xdb\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300. },
  301. {
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3emh\\xe8x\\x81'\\xfa\\xe8\\xc1\\x85\\x84\\x14xol\\x82\\xec\\x06\\xc2%u\\xf5\\xd9(\\xbc\\xd1\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303. },
  304. {
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xfc\\xff\\x1a\\x04\\xfe\\xe7\\xb6\\xb5\\x0e\\xd0\"\\xfe\\xe6\\x05x\\xe9\\xcep8\\xcd=\\xbar\\x06\\xcdu\\x0f\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306. },
  307. {
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xba\\xa4\\xc09i\t\\xd8\\x8a\\x8c9\\x16^\\x88x)+n\\xfd1\\x85\\xaf\\xe3q\\x94\\x94\\x10s\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309. },
  310. {
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x0e\\x8emy\\xfa\\xdey\\xd4\\xae\\x81t\\x96\\x7f\\xaa\\xbc\\xa6\\xa6\\xdb\\xf1\\x01{+\\xeda\\xcb\\xc01#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312. },
  313. {
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xc5\\xcc!\\xb8\\xa3m\\xbf\\x15%\\xfc\\xcd@\\x1b\\xe1\\x846lg%d'x(\\xea\\x8b1\\x94\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315. },
  316. {
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3,'puq\\xdc\\xfcf.\\xb4o|\\x11\\xb1\\xc1\\xd1bw\\xcb\\x9b\\xa8s\\xdd\n\\xa4\\xd5\\xda\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3`?\\x9b/;\\xa1\\x06;\\x92$\\x1e\\xf1;\\xee\\x8e\\x15\\x95\\x9e\\xd6\\xd0v7\\xa7/\\xe1k\\x1c\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xd7ng\\xf3\\x1f\\xd8c\\xa1\\xd3\\xb3\\x9dx#\\xc7\\x1e\\x91\\xf0\\xb5\\xa1u\\x13\\x9b\\x95z\\xe6ia\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc3\\x15r\\xce\\xfat\\xce\"\\\\xb1\\xfawu\\x98>\\xa2\\\\x17\\x17:{\\x87*\\x12\\x7f\\x82\\xe8\\xe4\\xd3j*3\\x83\\xf0\\xff_\\xa9\\x0f=\\xf0\\x01\\x1d\\xcc\\x0b\\xa3n\\x97\\xd6\\xe7:*\\xb5*\\xe2\\xa7\\x15\\\\xb3\\x82\\xe0\\xccdk\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\x8d\\xae\\xc51\\xddm\\xd5\\x81em\\x08m\\xcd\\xd5f!f\\xb7\\xd3\\xb4\\x8ah\\xdb\n\\x8f\\x19\\xccvsw\\xc7\\xe4\\xdcu\\x1d\\x083\\x04\\xc6r\\x15\\xe1\\x8f^}\\x97m"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xb2\\xd8m\\xeby\\xaf\\x860\\xff^jf\\x9c\\xde\\xf5\\xa2\\xdeg\\x18\t)w\\xf4\\xedb\\xe6\\x06\\x02\\x9d\\xaf\\xad\\xb4\\xc9\\x0b1srpu(c\\xe1\\xbf\\xc3w\\xa8\\xe5g\\x9e2\\xfb\\x8f\\x82\\x11\\x80\\xde\\xca:1\\xd0\\x1fmq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\x1e\\xd9\\x12rg\\xd5i\\x98\\xff\\x95\\x15\\xec\\xe6\\x9b\\x99\\x8e5a\\xb7\\xf0\\x9e\\xa4l6\\xa3,\\xe0&\\x06%d`x\\xa4vb\\xc6\\x99\\x8e\\xf8\\xf4t\\xbf:\\xaa\\x9f\\xee"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x13\\xa2:\\xbb\\xe8\\x10\\xcd]\\x1c\\xb2\\xd3\\x8a\\xc1jh\\xc3\\xdc\\xd4\\xd8\\x9d\\x02\\xde\\xadaui`\\xd9\\xd9\\x95\\x17\\x10\\xac\\x8d\\xaa\\xe0\\x8e\\x87s\\xb1\\xd1w\\x04hue\\xe5m\\x15\\xaa\\xc1:(\\x1e\\x1a\\x03\\x10\\xdf\\xcb\\xba\\xee5\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000- \\xc2\\xd8\\xc6\\xdcrf\\xd7g\\xef\\x0b\r\\xf5\\x02\\x0b\\x0b\\x8a\\xf9\\xadu3\\xfd7\\x05\\xfb\\x08\\x14o\\x05\n\\xc0\\xf1(\\xd1h|wo\\x99\\xdf\\xf7\\x95\\xe7\\xf9\\x13\\xb4q"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\x87\\xd2e\\xede\\xab\\xa4\\xba@v\\x8f\\xde\\xf8?\\x85\\x11\\x15z\\xb3?\\x00\\xf4\\x97\\x83s\\x9f\\xffi\\x1a=\\x1d\\x8e\\xe04\\xb1\\x12\\x94\\x86\\xb5i\\xf5l\\xc2\\xd5;eqz\\xe7\\xdd\\xd7 \\xab#\\xaav~)+\\xce\\xb0\\xe6\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x88\\x9c\\x01\\xb0\\xffa\\xf6\\xec\n\\xa2\\x06_\\xaa\nx\\x14\\x97\\xc4urk\\xe3\\x1bm{\\n\\xf8\\xb9\\x8b=p,tz\\xfb_\\x1cs\\xd2\\xe5;i\\xcb\\xe2\\x8d\\xe3"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04oz\\xa2\\x04\\x04q\\xf7,\\xd4a\\x1e\\xc6\\xfc\\x9esj\\xeb@\\xf5\\xe5wp\\xc4 \\x16\\xc31\\x18s\\x94\\x7f\\xb2v\\xa2v\\xf8\\x97\\xddv\\x99wu\\x18\\xea\\xb9\\x18\\xad\\xf5l\\xd5\\xd7\\x1d\\xb2\\xe7\\x92w\\x06\\xdet\\xf7\\xc9\n\\x9e\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\")\\x84(p\\xfe\\xc9\\x067\\x17\\x95\\xaf\\xc6*h\\x0c\\xfa}\\xe3\\xa5@\\x83\\x87\\x84$}4*\\x08\\xbd\\xa7v\\xf9%\\xf2;8<\\xd7a+3\\x9a\\xf7\\x17\\xcc_"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x80\\x07\\xc6\\x86\\xf6y\\x1ey}\\xe7y\\x88\n\\x9ca15\\xdbi\\xe4wv\\xc0\\x9ai\\x90s\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3b32\\x14\\xdf\\x9bg\\xfe\\xf4j\\xc1\\xc2\\xc2b[\\xfe}\\xbfa\\xfb?\\x10\\xdf\\xe4w\\xfc'\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xbe\\xb8\\x9e\\xc8\\xe0\\xcd\\x83\\x1b\\x85\\x8c?s\\x8d_=\\xc3\\x06\\x9b\\xe5{}\\x8f\\xbd\\xfd\\x1e\\x8c\\xe6\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xf6\\x1a\\xc1n\\x8fr''\\x10\\x91\\xc9\\xa4\\x01ie\\x9d\\x10\\x0f\\xedk\\xa07\\xb7wza\\xbf\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x18\\xd8\\x1a\\xd7bbq\\xc6\\xe1\\xcc1\\x0b\\x8e\\x14\\x16qe]\t\\x9c\\x18\\x9a\\xe8\t\\xe4\\x7f\\x94\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x15\\x9f\\xe4$\\xc0\\xb4e\\xca0\\x96rjz\\x1fc\\x02\\xe3\\x11\\x9c\\x83;r\\x85\\x94j\\xdd\\xf6e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\\\xdfr\\xb5\\x9a\\x0f\\xab\\x93\\xa7l\\x10ji\\xf2l\\xec\\xf0\\xb1\\x13\\xcc[/0:z\\x84\\xdb\\xb6`4\\xf6\\xb3x\\x83\\x91i,3\\x98s\\xe6\\x05~\\xd5>g\\xa5ym\\xaa\\x16\\xc5a@\\xb3\\x10\\xb7\\xc1.\\xde\\x87\\x8fx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\x07\\xc8\\x01z\\xcaj\\xc8\\xddcei\\x98~|\\x07\\xb3\\x07\\x82\\xa1\\xf2s\\xa6\\xa0\\xd9p\\x13\\x92\\xbc\\x92}\\xc9\\xc4l>\\x99\\xbf\\x13\\xdf_w\\xabay3\\xf3\\\\xbe"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3te-\\x11$\\xe9\\xc9{\\xac\\xc0\\xb0\\xbdug/\\x1b\\xbb\\x16\\xa1x<\\x10\\xdc{\\xa6w\\xbc\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xd2\\x82rf\\x9a\\x9d\\x9e8~\\xf8\\x88-sw\\\\xb1r[\\x97\\xe2\\xf9n\\xfd\\xfa\\xda9@r\\x96\\x98xmz\\xd0\\xbb\\xad\\xc6\\xd7\\x1c\\x99\\x8f(\\xd7\\x98\\x95gt\\x8c\\x94\\\\xde\\xa6 ng1w\\x1f\\xd6\\x9f\\xc3t\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x1f\\xa4\\x8b\\x13\\xe0v3\\x8fk\\x07\\xff\\x9cw-\\xb6>\\xd6$'si\\x17='\\xb6\\x06ti]\\xe4\\xa9\\x08p\\xa5\\x07\\x11p\\x89u\\xd1\\x08z\\x80\\xac\\xcd\\x06\\x03"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\x1d\\x9a\\xd9\\xc0\\xa7\\xe5\\xc2|\\x05\\xc6\\x8e\\xd5\\x0c\\xf1\\x04\\x1a\\xc2l'\\xf4\\\\xace$\t\\xf9, \\xe2\\xb0\\xe2\\xaes\t\\x06\\x1b\\xa1\\x0ewt&pn\\xc0e/\\xc3r@\\xcdw\\x86\r\\xf2\\xfe\\xc8\\xf1\\xe08/\\xb1\\x13\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xfc\\x07\\x1f\\xad\\x07o}\\x82z\\x81\\xe0~\\x1ck.\\xe1\\x92\\x1a\\x93\\x13j k\\xa3\r\nf\\xd5\\xdf\\xfb}\\xd6\t\\xe7d\\x19ca\\xfda6\\xaa272\\xf8/"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x1ex\\xd2\\xac\\xf7_\\x96d\\xfao\\x80f\\xb0h\\xfd\\xef\\xcf8\\x9e$\\xc9\\xb5\\x95v\\xf6\\x02\\xca%\\x07\\xffj\\x8e\\x17\\x9c\\x04\\xe8il\\x88\\x1d\t\\xd1\\x1a\\xd9\\xe4\\x02\\xdb\\xdf\\xad5=\\x8a\\xd3\\x98\\x92\\xf8}\\xa0\\x80\\xcb\\xe0b\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0f9\\xea\\xec\\xf1\\xa2\\xe4g*c\\xbd3d\\xf2{\\xc1\\xb51,nu\\x97\\x81\\xc9\\x9f\\x9fp\\x02\\x03^d\\xb6y1\\x9d\\xfbg25\\x8e\\x8aj\\xfe\\xfd\\xae\\xb4\t:"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\\xd2\\xfc\\xa3\\x98-\\x8d#\\xd3\\x1e'?\\x93:\\x9f{=\\xdb\\x87\\xbde\\xb9\\x85\\x1d\\xc5d0\\xb4\\xd8r\\x94ze\\x89\\xfc\\x9e*~\\xa9{\\x1e\\x1c\\xca\\x0f\\xc7$\\xc2-\\x98\\x83k\\xcf\\x9cz\\xd1\\xf32\\x92\\xf27 \\xd5\\x86\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeew\\x13$\\xe0'\\xc8\\xbd\\xc7\\xddag\\xfd2q\\x06\\xdb\\xcd\\xa8llu\\xcf\\xce\\xeb1u\\xa8\\x7fe<f\\xf7s|v\\xeb\\xd0\\xe4#ew]\\xa4\\xbf\\xea\\x89\\xac"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04k2u;\\xc5\\xc1p\\x83:\\xf8\\x9b\\xa4*\\xfcu\\x109\\xces\\xbe\\xc1\\xe8%i\\xc0\\xb5z\\xa4ug\\x1d\\xfb\\xf1\\xe2$\\xea\\xa6\\xff(8\\x84\\x86$\\x8b\\xf6\\xe8\\x8a\\xe9k\\x1a\\x80\\xc6\\xb8ow\\x916\\x8b\\xfc\\xa2\\xd3\\xbae\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xf6\\xc9r \\xee\\x83\\x14\\xd9\\xc7\\x8e\\xc0\\xc8l`\\x8d\\xba\\x15\\xf0\\xb8\\xca\\x0cx\\x0fwf*\\x99\\xfb\\x0c\\xe5\\xadq\\x82\\xc3\\xcd\\xa9x\\xd7\\x12\\xb4\\x07\\xdf\\xa3\\xa7\\x130^"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9eq\\xd5c\\x1f\\xf1p\\xf7\\xb9\\xb9\\xb1cj\\xdd\\x92p\\xd5\\x91f\\x8b]\\x10\\xf7\\xf5\\x907\\xea\\x07\\x96\\xe4\\x85]t8\\xdf\r\\x1a\\xf7\\xa3\\xcfh\\xa2u\\xf1m\\x83\\x08q\\xf9=\\x05v\\x1f\\x9a\\x08\\xcer\\xf0\\x17\\xcc$\\xedy\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006;*r\\xa4\\xc15v\\x81^\\x1e\\xa1t\\x86e|\\x0f\\xad\\xbeg\\x06\\xa5\\x1di\\xf3q2\\xd9\\x97\\x8c-\\x84%\\xeb\\xcey%(\\xbc\\xc4\\xdf3\\xab\\x91\\xb2\\x89_b"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\x99\\xb7\\#~09y%ah\\x05\\xc0(\\xc2r\\x9e\\xd1\\xcbdn\\x91=\\x0c\\xb9s\\xc0g \\x87\\x86\\xb7\\x9e2\\xaa\\x19>x'\\xf3\\xe0:\\x7f\\x9c\\x91<k\\x9a\\xb8\\x9f\\x0fw)}i\\xe527\\xe9\\x1f\\xb6\\x93\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfbcv\\xae\\xd5\\xdb\\xbb\\xa6r\\x05\\xa2-\\xa3l\\xe7.\\xaf\\xff\\x80r\\xc2\\x04h\\xceb\\xc9\\x12q\\xd3\\x8f\\xce\\xc7\\x98yx\\xa0\\xf85v\\xe2\\x19\\x04\\xe06\\x84\\xa08\\xf1"
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x17\\x9b[\\x84p [\\xbd\tn\\xd8j\\x85\\xa9on\\x81\\xd5\\xe1\\x89\\xea\\x9287i\\xfa8{\\xe0\\x16al\\xdd2@\\xba\\xb0\\xf6\\xe1\\xa58\\x1c\te$\\xc3\\x8b;\\xbcf\\xd3|p\t\\xe3\\x98.5\\x94\\xb0\\xc1j\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xb6\\x85x\\xfc\\x07\\x84\\xba/\\x07\\x84*\\xde\\xb8=1*\\xac,\\xf7\\x17w)\\xf1\\xb3\\x9f\\xeel\\xca\\x9amsj\\xdb\\x1cf\\x84=[\\x1f\\xd2\\x89\\xcc%\\xa7i\\x92\\x08"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04s \\xb7\\xbf\\x8d\\xc0\\xaey\\xd1sv+?\\x04\\xeb\\x84\\xb4v\\x06eg2\\x87+\\xd3\\xf0\\x05\\x16\\xc3\\xfe^<n.\\x8do@\\xaf\\x9dh\\x94j\\xff\\x86\\xba\\xb7\\xbf\\x96e\\xf0\\xa3p\\xd1\\xaf\\x9f\\xee\\x8e\\x91\\xe1\\xe7\\xa3\\x00\\x9fy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\xfb\\x83\\xd3\\x18\\x1d\\xaa\\x1df\\xe1\\xf8\\xba\\x19a\\xd4\\xfd\\xd2\\xcb\\x1e\\x10\\x82\\x85\\x8cp\\xbbb\\x17\\xd4\\x07\\xb0\\xaa\\x10\\xb4\\xa0\\x81\\xde\\xf8\\xacd\\xdb\\x06\\xca\\x0b\\x0b\\xf5\\x8c\\xa1\\x98"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04km\\x07\\x0bbj!\\xa6k\\x1c\\x83\\x11\\x1b\\x85b\\xbf\\xda\\x18\\xbf\\xfd\\xc1w\\xa6\\xdf\\xef\\xfa\\x01\\x87\\x88\\xc9\\x9e\\xa0\\xf3\\x93.ki\\x05\\xf2\\x1a~.\\xa0\\xfe$\\xbb\\xed\\xde`\\xd2oz\\x9a\\xb9\\x86\\xdbmb~5v\\xd6z\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xb2\\xed\\xe2<\\xcb\\x7f\\xd8\\xee\\;v4\\xfe7\\xcf?\\xab\\xb3\\x1bb\\xf4\\x9bt@\\xebul\\xa8\\x16u\\xcb\\xbc\\xe2\\xd5\\xf3f\\xf6\\xee\\xa4\\x8a\\x82\\xfe\\x95;\\x08\\xf4-"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c\r\\xb5:-\\xf4\\xa0\\xea|\\xa0\\xce\\x9f\\x99\\xc8\\xef\\xd6\\xf7+m\\x97/u\\x85kd\\xd4 \tt\\xe7\\xea\\xbe\\xf8o\\xd8\\xb6\\x8db]\\xb4d:\\xb1t\\xc5\\xe4h:8\t\\xcdl\\x1e\\xf8>5\\xba\\xe7\\xd6yb\\xf063\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91@@\\xaci}\\xf7g\\xf6\\x1c\\x05e\\xae\\x99ck`e\\x1f!h\\xb9e,\\x17\\xfd\\x92+\\x9c>x)\\xb4\\xb1\\x90\\x0c\\xb2(u\\xfa\\x1fmn\\xe8dd\\x82\\x86"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2np\\xec\\xce\\xc3\\x83\\x1c\\xeb\\x0e\\xaa\\xd7\\xcau\\xfdo\\xe3\\x8f\\xbe\\x16\\xe7=<\r\\xc1\\xa3\\xb3$\\xad\\x0e\\\\x0by\\x0f\\xc8\\xca\\xcf\\x9e\\x94%\\x91\\xbevq\\xb9\\x03ib(j\\xf02\\x1e\t\\xae#~\\xbc\\x02\\xe8\\xb2\\x9a\\xf2l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdfl\\x13\\xf9\\xben\\xafp\\xdac\\xc1\\xd2\\x1dh\\x7f1\\xf4\\xc3\\xf46\\xaf\\x16\\x1b\\xa1n\\x1c1\\x83\\xb8\\xfa\\xe0\\xc3\\x9c\\xeb,\\xce&\\x0e\\xfd\\x0e\\xbbq\\xec\\xc1~@\\x17\\x85"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8\\x19\\xea\\xc5\\x13\\x9a\\xf7@3vsy\"\\xba\\xca^\\xcf\\x8f\\xaddrm\\x1c\\xc8z\\xb5>\\xe73\\x9d\\x99\\xe6\\x99bg\\xf6\\xf8\\xd8\\x91\\x85\\xf2\\xf7\\xc8:@\\xec!\\xb85<\\xc0q\\xb1\r\\xc4\\xf7\\x8a\\xeer]@\\xd8n\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ti\\xc3\\x8e\\xe3vk\\xbe\\xb0o1\\xa2&o\\x8c\\xf7\\x99\\xdc\\xa0a\\xcc\\x11/{\\xdc\\xcc\\xf8\\xed+\\x99w\\x93\\xd6\\xe5\\x1c\\xb9#\\xe1w^\\xd6!o\\x9a\\xa93v\\xe3"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xf4\\xd7\\xbex\\x1e'\\xd2\\xd2v\\x95\\x02\\xbey{\\xca\\xc5\\xc5\\x93\\xec<*\\x0fa\\xcbp\\xe6h\\x0cb\\x00\\xe6\\x1e\\x80\r\\xfd\\xce \\x8d\\xd6\\x84\\xff\\x9b`\\xd4\\x10\\xcd\\x1d\\xe2\\xadk\\xe6\\x1f\\xf0t(\\x97ey]\\x02\\xc1\\xea3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf84\\xc0\\x1f\\x9e\\xfa\\x98\\xd2gx\\x86\\x8c\\xa3\\x8d\\xf9\\x16\\xcb]\\xdb0h\\xda\\xd7\\x82=+\\x87h\\xb4m\\x05\\xf8\\xb7r*\\x0eg\"e8\\xfa\\xdd9\\x10\\xcd\\xfe2\\xfa"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x89!\\x14\\xac(\\x95\\x96\\xbe\\x98\\x94\\xf6\\x05\\x15c\\xbd\\xd6\\x9f\\x05\\xf1s\\xbd3\\x9b\\x9d\\xf0\\xd2\\x98\\x8f\\xba\\xc8\\xbf\\xa1\\x01\\xef\\x92s\\xe0\\xff\\xb5s\\x00\\xc4cb`\\xd7\\x19-\\xf7\\xb2h\\xcc\\xa1l+\\x0bc(?\\xfa\\x15\\x85:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001$#\\xb1\\xb8\\xfc\\xc03\\xc8\\xfep\\xfa})\\x1c\\xdf\\xe8j<\\x13p\\x9c\\xcb\\x9b\\x9a\\x1c#{!0\\xc04m\\xc6b\n\\xff\\xba\\x9e\\xd8v\\xc6\r,j\\xbc\\xfc\\x9e"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\x93\\xb1\\x8d6m\\xea!^h\\xe9&\\xef\\xf0-#\\x9e\\x18\\x11/\\xf1h\"\\x13_\\x05b\\x9c\\x16\\xc1\\x99\\xd6\\xb5\\xa7!\\xf6n\\xdd@z\\xcax\\xef\\xa4\\xb8\\xe1a\\xd1\\xcb\\x1e\\xac~c\\xddx\\xc7\\x06\\xc6/xp<\\xa5z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000'\\x06\\xfe/\\xea]0\\x88\\x17\\xb7h\\xc7n\\xech\\x93\\xe4\\x1dr\\xdav\\x88\\xd1\\xfe\\xdcg\\xc6\\xf1\\xa4\\x9epj*\\xd0\\x0b\\x9d\\x16\\xa6xt\\xbb\\xe5\\x94\\x0b7;t\\x86"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\x9dkgh\\x04xp\\xa9^\\xac\\xde\\xfe\\xf6\\xbc\\xa9\\xb1\\xbf\\x97\\x0f\\xd0\\x1b\\x9c33\\xc2\\xc4\\x9b\\x8b\\xad!\\xf5\\xa3\\xb0\\xf4\\xf2s\\xfeg\\x93lj\\x14a\\x18_\\xd3\\x15\\xd9#\\x86\\xf6a9\\xc5\\x80\\xad\\xad\\xa1\\xc8\\xd9\\xddk\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\x9f#\\xc2n!\\xe6\\x03k\\xe2\\x8e\\x87\\xb9\\x87\\xf5\\xa5f\\xcfh\\x01\\xcale\\xa6\\xa4b.\\x11\\x056\\x99?\\x11@h*4\\xb5\\x0f\\xf1q(>\\xcd.|\\xa3\\xb5"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xaa vzaf\\xe8\\x0e#\\xc1f\\xea'\\x88\\x97/\\x80g\\xf8c0u\\x9b{\\xe9=4\t\\x95\\x13x;7\\xc50\\x9c\\xe5\\xf6\\x83\\x8a\\x9d]\\x00\\xca\\xcd\\xbdr\\xa5a\\x94\\xd8o\\x87\\x87\\xa8\\xda\\x0f\\x06\\x1et\\x8f\\x8b\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^\\xec6\\xed\\xb8n\\xe2n\\xa6\\xa7\\xfda\\\\xae\\xc8\\xdc\\xa4\\xe9f\\x12\\x91\\x1e\\xa8\\x85\\x839\\xef\\x82)\\x06<z/\\x8e\\x94\\xc3b\\xf3\\x8c\\x12a\\x119w\\x86\\xb2c\\xc0"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e=\r\\xf2\\x08\\xb7\\xbbb\\xb4\\xb1\\xb1\\x1c\\x144,}|@q_\\xaa\\x8an\\xdey3\\xc85l\\x9f~\\x1c5\\x1c~]\\xe89\\x8a\\x14\\xaf\\xb6\\xf30p\\x93\\xc5\\xdew)\\xfa\\x07\\xa85\\xb8{\\xf0p\\xd6\\x1aq\\xe4\\xeb\\xf0p\\xfd\\xf8a5\\x84$;\\x84\\xcd\\x15x`\\xba\\x90m{\"\\xe8\\xc4\\x15\\x1a\\x1a\\xd7\\x0c\\xa1fs\\xa4\\xe1\\xb6\\xd9\\xc4\\xb1\\xa0\\xf5\\x99\\x81\\xcf\\xe3\\x0c\\x17\\xcf\\xaa\\xf2*k\\x1e\\xc8zp\\x02\\xd8\\x1b\\xaa\\x12/\\x85\\xa9\\xa2'\\xa7\\xb7\\x93\\x88_\\xcdu\\x03c\\xb7\\x8e\\xdf(\\x85k7\\x0cvsd\\x8b\\x9d\\xd3i|\\x07>\\x9ez\\xa5\\xef\\\\xa0\\x84\\x96\\x8f\\x00\\xb9s(\\xecf'\"\\x03yf\\xa8\\xdb,\\xad\\x1ai\\x88\\xb6@}\\xca\\x1d\\x82\\x87<\\xf1\\x14gj$\\xe3%\\xa3\\x13\\xf3#\\xbfn\\x839;\\x93\\xbc2n\\xd6\\\\x86z~\\xfd\\x83\\xfel\\xaa\\x00\\xf3\\xa9\\xb3[\\xf3\\x9e{j`\\xb3x\\xcd\\xa9\\xf6\\x19\\x0ek)\\x04z\\xeb\\xdc\\x8d\\xb1\\xf9\\x15\\xe5\\xc5?\\x8c*dd"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\x9b*\\x8d\\x10\\xc0\\xef\\xceit\\x02b7e\\xdf\\xba\\x7fp\\x05\\x85e\\xc5\\xe1\\xa0\\xa2\\x01\\x00?\\xe6\\xad\\xea\\\\x88\\xb0\\xb3\\xbapq\\xc21\\xac\\x9c\\x1c=x\\xe0\\x14\\xf7\\xe3s\\xba_o\\xeb@f\\xee\\x1e\\xdat\\xf9\\xebyu\\xc7\\x070\\xe9\\x90\\xe0\\x19q^\\x08\t\\xab\\xfb\\xd2\\xc3\\xe8\\xc3\\xc3\t\\xcevy\\xcb2\\xaf\\xd7a\\xdb\\x07\\xca\n4\\xcf\\x8f\\xfb\\x11\\xb2k\\x9b\\xeb\\xde\\x17\\x8f\\xe0\\x80\\xb3\nj\\x00\\x82j\\x13v=\\xae\\xf8\\xb6\\xb42\\x8a\\x19\\x13\\xd3\\xf8\\xa9f\\xeb\\xc9\\xe4\\xcc\\x85\re\\xe2\"|\\x91\\x1b\\x0e,\t\\xdc\\xda\\xf3\\xd3\\xd7\\xc8\\xc9\\xda\\xd2\\xe9\\x97\\x83`\\xf2\\x93g\\xda\\x10\\xb5\\xe3^\\xac`]\\xe1'\\xc8\\xa6\\xb2|\\xacks\\xa4s{@\\x8d\\xb6\\x00\\x03\\xd1\\xb8\\xa2\\xe6\\xe0p\\xa3\\xc8\\xa0\\xd9\\xf7\\x96w_\\xaf\\xd4\\x0be\\xda\\x11u\\x1e}iq\\xb3\\xfc\\x16r\\xf0\\xd5\\x89\\xc5\\xbact\\x075-m\\x85f~\\xbf}v\\x07\\x98\\x85#\\xdf\\xd7>\\xe0\\xd9v\\xa8\\xbd\\x14r\\xd6\\x86\\xbe\\x0b\\xa1"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4_r\\x85\\x91\t\\xa9 v\\xf9'\\xfb\\xbb\\xb3\\x8f\\xe4\\x90\\xce\\x8f\\x1f\\xf1\\x08\\x9btz\\x88\\x8dw\\xd7\\xa3?\\xf8\\xfb\\xf8\\x9a\\xc7<>)$\\xa7\\xa1\\xd7\\xec\\x0e\\x94\\xaf\\xda*\\xaa\\x06\\xf9mg\\x15\\x19\\x8f\\x82\\x14\\xd2@)_\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\xea\\x9d\\xc0\\xf0\t\\x8d\\x83\\x17\\xb4u\\xb9\\xdc\\x98\\x0e\\xbe\\xfc\\xc3[\\x1d8[\\x9d\\xbd\\x17\\x94y70\\xee\\xe2\\x1bk.i\\xe5\\xd5\\xe2\\x98x\\xc0\\xb0\\xa4\\x0c&\\x89d\\xae"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xfd\\xad\\x19n\\xcck\\xd1\\x156d\\x97\\x86\\xc1\\xec=\\x96n\\x9f\\xc6i\\xa4&'\\xbb\\xb2v\\xff\\xbc\\xccrfw\\xc4\\x96i\\xdfu\\xeb\\xc1s\\xdaxan\\xa7\\x1e\\x01@\\x90j\\x94\\x93\\xff?\\xb1\\xc8\\xae\\xd7\\xc7\\xc7u\\xa1\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xba\\xd9\\xb4\\x11\\x02\\x98\\xa3\rqj\\xf6\\xe1s\\xea\\x89@'\\x012\\xb0\\xd5\\x04\\x1b\\xd9f\\xffi\\xe0\\x91o6*\\xbf$\\xb6$o\\xc5\\x99\\x0fri3y\\xf5\\xb9\\xee"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d+'\\xd4i\\xb9p\\x11\\xe7\\xdc\\xfd\\xa3\\xa7\\xde\\xc9\\x8d0\ty\\x80?t\\x9e\\xe5\\x8e\\x83\\xf8~\\x13\\xa7\\xf9_\\x93}\\xb2\\xce\\x1a|\\x12\\xdd\\xa7zj\\x04\\xa4\\xdck\\xf5\\xde\\xc2\\xf9\\x8ahu\\x9f\\x0e\\x8e\\xa6\\x17\\x16q\\x1e,\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xdf\\xd4v\\xd9\\xdb\\x8f\\xd1\\x08\\x86\\xd0\\x90\\xb3\\x87\\xda\\xb3 \\xee\\xa1\\xde\\x19\\xb9\\x05\\x9b\\xf9\\xa0\\xd1]\\x140y&r\\x9adj\\x7fb>_\\x9fl\\xafh\\x9d\\x92:\\xf6"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdew\\x14\\x99i{\\xc1\\xad-\\xf2r\\xa5\r?\\x93\\xc9\\xae\\xb8\\xdd%h\\xa9t\\x8a?\\xe0\\x83\\xe3x\\xc7\\xf4x\\xe2\\xd6\\x07\\xff\\xa8\\xf1\\xc4\\xc4\\xeb\\xd0\\x7f\\x83\\xe0t\\x80g\\xf3\\xfe\\xbbh\\xea\\xcdwf[e\\x0f\\x9e\\xf4\\x08\\xe7\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xcf\\xc4\\x17\\xdb\\xf43!\\xf5f'\\x1fd\\x1d(l\\xd8q\\xac>\\xaf\\xa7\\xb4>u\\xd8.\\xadl\\x95f\\x8e0!\\x8eq\\x06\\xf2\\x85\\xef<:\\x91w\\xf6\\x1e\\x02\\xb8"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1i\\xc6\\x96\\xc5s$\\x07\"\\x8f\\xd2\\x1be\\xfa\\xd1\\xddj\\xe5$\\xbe\\x99\\x1a\\x9d5\\x0efn\\xf2\\xe81_i<c+\\x13\\x8a\\xf6f\\xa3\\x82\\xb6\\xf2q\\x15\\xba\\xe3\\xe1\\xc3\\xa2\\x1e\\xbfxe\\xe0\\xca\\xa3\\xe6\\x92q\\xab\\xd8\\x9a!\\xa7\\xa9h9\\x16\\x96\\xb7\rc<i\\x0b\\xb2;\\xb5\\xea\\xc5}jz`\\xf7\\xad=/\\x912\\xf1d\\x93\\xa8\\xb9\\x0e\\xbd\\xce\\xf1\\x83\\xbe\\x16\\xee\\xc0\\xaf\\xbb\\xcc\\xdd#^-d\\x9e$j\\x1d\\xde\\x7f\\xac\\xa7\\x91\\xb0\\x84?h\\xdc\\x0cr\\xa7ja\\x9fo0\\x06\\x92\\xe1;\\xedgr\\x0e\\x0e\\x8ac\\xadk\\xd5\\x8a\\x00i\\x13\\xce\\x87\\xdf[\\xd4\\xb1\\xc6[\\x96\\xc9\\xcap\\x85a.\\xdb\\x7f\\x8a\\xaf\\xa4ls\\xbb\\xad\\x1bd[8\\xb4\\xaf\\xf9~\\xb1#\\xb2\\x96\\xa5@\\xad\\xfe|k9\\x8f3\\x8d\\x0f\\x1f\\xa3s\\x16\\x8b\\x9b\\x8b\\xe4tg\\xabq\\x90'\\x7f-\\x857\\x13m\\xc8\\xa8\\x85\\xc2\\x84\\x94\\xaar2\\xf1\\xa5\\x95\\xce\\xd8|\\xd5l-\\xbfe%\\x0fw\\x82\\x10!\\xca,l\\x81@"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9b\\x7f\\x0b\\x07\\xf3\\xea\\xe3\\x9a\\x11\\xde\\xc0zth\\x0b0i\\xff\\\\xff\\x08\\xb4\\xa6\\xb2\\xd3\\x88f+$l)\\xd7\\xd7\\x18e\\x8a\\xab\\x0cx\\xea\\x9b\\]\\xf0_bf\\x7f\\xed\\xd8\\x9f\\xfb+h^q\\xe3\\x02\\xf6\\x94\\xef\\xd6\\x1a\\x14\\xe1@\\xbc\\xee\\xaa7\\x9b,\\xa4\\x8e9x\\xd9\\xf7.\\x9c*\\x8a\\xa0\\xa3\\xd9\\x93/\\xd4\\x1d~\\xac\\xc44-[\\xc1\\x81\\xc3\\xdb\\xa3\\xff\\xe1bo9n\\xed\\xf7\\x7fcjp<\\x99d\\x12*v\\xff\\xa1)\\xd5\\xbe4jq\\xd3\\xa6\\xcd/\\x87\\xdck\\x8e\\xeae#pc\\xd2\\x14\\x82ytd\\x95\\xf9h\\x14_\\x18\\x0f8\\xa9n\\x89\\xccd;d\\x1d\\xcc\\xf1\\x81t\\x9b\\xe8\\x18\\xf2\\xe9\\x11\\x01?\\xff\\xe5\\x8cqwgx\\xa0wu\\x0e\\x9b\\xae\\xb4\\xbe\\xe67\\x0be\\xd8\\xa8<\\xcd\\xb8\\xf7j\\x9e%g\\xc5eh\\xed\\xaa\\xc6\\xc62\\xa1s/\\x0fl\\x93znt\\xfb\\xad\\xf0c\\x8e\\x19\\xa2y\\x90\\xf3g\\xe7\\xe7\\x96nc(b^\\xb7\\xa29\\xcf\\x9e2\\x89\\xa6\\xc3\\xd7\\xa02\\x0e"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'l\\xc6\\x01rvrp\\xff\\xa5fxq\\xf3\\x97xe\\xefa\rr\\xfc\\x95\\x91\\xea\\x9ci\\x13\\xf6s\\xaf\\xe5\\xab\\xea+\\x90\\xc1$\\xa5w\\x15{\\xb0\\x04v\\x02#|\\x9ey/\\x0b\\xbd\\xc1\\x81\\xc5\\x10\\xed\\xe3;\\xf5\\x87\\xaeg\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2y\\xe8\\xfe\\x94\\xf3y\\x04\\xf6\\xea\\xcd\\x01.\\xab\\xdfvo\\x19y\\xc8^\\xdc\\xbf\\x05\\xa1gn\\xbd.h\\x8f\\xa8\\xaey\\xb1\\xe5 \\xc5b)^\\xe7\\x9e\\xfa\n\\x11\\x02\\x85"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xacz\\x9c\\xa1q|'k\\xea\\xfe?\\x10\\x03\\x04\\xd6\\xf9\\xa0\\xcdiio\\xff\\x82x\\xc3\\xac\\x06\\x1a\\x8b\\x91\\x89uwx\t\\xbb\\xb8\\xf9\\xa5\\x1f=\\xa9\\x9e\\xbb\\x95\\x97\\x0e\\x99\\x18\\xd44\\x0f\n\\xda\\xe7\\x0cw\\xc5\\x8d\\xe1\\x8f\\x18\\x85\\xaa\\xed:\\x0c\\x8c\\xd7\\x1d\\x8b\\x0f\\xdca\th\\xfa\\xc5\\x89\\xd74\\xf2\\x8ar!6\\xd4\\xf6u\\xff\\x88\\x88\\x80\\xd8\\xd6v\\xfa\\x98\\xb1\\xf6\\xdd\\x8a\\x1bijd,\\xd6\\xfe\\\\xaa\\x8c\\xce)i\\xb8<\\xa2\\xcd\\xf9\\x1d,\\xd3d\\x89\\xe0\\xce\\x1fm\\x83\\x9c\\xa5\\x04\\x10{gd]hyy\\x82\\x97\\xbf\\xa3\\xda\\xa2\\xd19\\xbb\\x85\\x87&^\\x97\\xabr\\xe1\\x99\\x84\\xeb\\x91n]\\xc6\\xddekmd\\xea\\x92\\x1e\\xcay\\xa4\\xec\\xa8\\x17+\\x85\\xb3\\xd7`\\xdb\\xae\\x0b\\x87\\x96\\x8fg<\\x87\\xb1,\\xd3\\x95fc0\\xdez\\x08wk\\x9c\\xbd\\xd1\\xb5\\xbf\\x0e\\x86x\\x86\\x1b\\xed\\xed!\\xe9\\x99x\\xd0\\xc0\\x89\\x98\\x02\\xb8\\xf9\\x1bx\\xf8\\x11$\\xa7d\\x10\n\\xb5(\\xba\\x12\\x00fe\\x1ec\\x08\\xb68\\x0es"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9ax6\\xc9\\xb5lz\\xecc\\xa7\\xcc\\xb4\\xe0\\xb7v[b\\x10\\xa40\\xca\\xf4&\\x8a\\x0f\\x00o\\x8f3\\xaf/^0\\xaac\\x97\\xd2g@\\xe7\\xa3\\xd0\\x00\\x9ca\\xde\\x1f(\\x91\\xe2\\x8b\\xb9\\x07\\xd4\\xfd\\xcb\\xf1ak\\xe0\\xff\\xa6\\xddp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xd4\\xd5\\xf5~\\x8b\\xe3\\xd6\\xcc\\x88\\x0c\\xa6\\xaa\\x08\\xf0\\xa8|q]\\x9e3d\\xc3\\x9b7\\xd2\\xba\\xb6\\xd2\\xbf\\xaaz\\xdcw\\x90p\\xef\\xa4a\\xf73\\xde\\xd7\\xf3\\x19\\x94\t5"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t<\\x83\\xcf\\xdb?v\\xdf\\xc1\\x1e\\xbf\\xeb\\xb6\\x9d\\xca\\xb6\\x85\\x80\\x06\\x84\\xd1\\xd7\\x9b\\xf29\\x8cd-\\xaf\\xe6m\\xe4\\x9f\\xcdt\\xd1l\\x9d\\x86\\xb8\\x97#j\\x0e\\xef\\xb0\\xb6\\x06\\xd6\\xd8\rs>\\xf4\\x82\\xb5\\xc6\\x88\\xc33s\\xaa\\x8b\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5?c9\\xcb\t\\xb6\\x00\\xca\\xab\\xa1\\xe9l\\xc1d\\x1d\\xcd_&\\xd3\\xb3b\\xe8\\x80\\xb9n\\xef\\xbe\\xee\\xdb:\t\\xb2\\xd4uh\\x951\\x15\\xb8\\x9d3@\\x93om>\\xc6"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?,\\xdew\\xe0\\x8c>\\x95\\x15s\\x04{ \\x9d\\x17\\x9b\\x9a\\xb5\\xb1\\x98\\xc3\r\\xe5\\xa5~\\xe4tzyl:\\xfcg\\xbd\\xa9a\\x1f\\xbb\\xb2c,\\xe0\\x1b\\x80\\xcd\\x0b\\xd8}\\x1d\\xaco\\xc1\\xd6-\\xe1}\\xce\\xc3\\x1f\\x900\\x83\\x0f\\xb8k)\\xc31\\x19\\x93c\\xbb9\\x89\\xe1\\xd2^\\x81d\\x9558\\xdf\\xae?gb=\\xad\\xe2\\x1e\\xf4\\xb4$_\\xa0\\xe8\\x11\\xc7\\xfd\\x81\\xb5\\xb9\\xfd\\xc1\\x8eq\\x1fs,\\x0bqy\\xcd\\x04\\x94\\xca/\\xf2\\xbdj\\xe1a\\xdb\\xb98\\xc9\\xe1\n\\xdd\\x01m\\x8f\\xab\\xa6\\xac\\x94\\xadk\\xab\\xc8\\xff\\x88+\\x16af^!j\\x9d\\xdc\\xa3-\\xa8\\xe2\\x87\\xc0\\xc1\\xfe\\xc0\\xb5\\x92\\xf7\\xd5\\x1d\\x1b\\xc9\\x9bj\\xf5\\xd4\\x19 \\x0e\\xb2|#\\x8a\\xb8r\\x89\\xd1\\xd9\\x93\\xa0\\xf3\\x1b\\x88\\x88\\xa5\\xec\\xd2n=\\x8f\\xf2\\x95\\xba\\xd5]v\\xdb\\x80\\xfcp^\\xf0\\xd5+\\xf1\\xe0\\x05\\x8c\\xab\\x0b\\x8eu\\x8b\\xc3\\xd1]\\xd8\\x1d\\x00\\x9eu\\xa5\\xda\\xd1\\xc9\\x07^\\xbc\\x1a\\xa6\\xeb;kg\\x8f2\\xea\\b.\\x02d\\x84\\x94\\x84"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18dz3\\x96:`\\x08r\\xa4b\\x18i\\xda\\xba\\xedirk<ak\\x88\\x0f\\xfc\\x87\\xb4\\x9f\\xbf;\\xd7qp\\x90\\xde\\x91j\\xb2\\xd9,v\\x1f\\xaf\\xee\\x82\\x95\\xe8\\xdc4\\x85$y\\x7f\\xee\\xed3\\x8e\\xc3\\xb8\\xab\\xc3\\xc9n\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\x1fo\\x1c_3z-\\x88\\x87\\xeas\\xc2\\x12\\xf7\\x10\\xb0\\x032\\xe5o4\\xe0\\xd4\\xf4\\xcd\\x86\\xcdt/\\xa7\\xc4bg\"r\\xf2k\\xfb?cl\\xf5\\x8f\\xe7\\xbf\\xbbz"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\xb5\\xc8\r\\x07\\xd7\\x0c\\xde/\\xaaan\\x9d\\x1a\\xa2,\\x97\\xcd\\xe2\\x0f\\x8c\\x1b\\x02a\\xce(\"\\xbb$\\xcb\\x81\\xa5l\\xd2\\\\xf9\\x18\\x0e\\xd6\\xed\\x0e\\xfe\\xd4`\\xeb@0\\xf2\\x8az\\xe7\\x94\\xb6`c\\x15\\x05\\xe9\\xc3\\xc6u\"\\x81\\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa8**\\xaf-h\\xc5\\x1b\\x95\\xd2h\\xbf\\xe6\\xa2q[\\xfch\\x1b\\x80\\x16\\x82#c\\x0e\\x15\\xc3\\xbc\\xae%$\\xba\\x1cde\\xe7\\x0c\\x1c\\xe4\\x7f\\xb4\\x06\\x1cp2\\xde\\xed"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x93\\x9dl\\x8bm\\xaf\\x96\\xc1\\x83\\xa6b\\xd0e34\n\\xe5\\xd1\\x83c\\x002\\xf4\\x89\\xa6\\x9a\\xe3d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_z\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\x0c\\x95\\xcd`\\xad\\xecv\\xe85\\xf7\\x9f\\x92\\xbb\\xf3\\x92\\xb9\\xf9c<\\xae\\xe9\\x1a\\xc6=b\\xb8\\xf6\\xf76\\xef\\xdb\\x8b\\xc3\\x90u\\xe8\\xad\\x86*\\xc3\\xc1s\\xb8\\xdd\\x85\\x08n\\x1ak\\xf0x\\x16)\\x1487&m\\x1ce\\x8a\\xb5\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xf2\\x1f\\xff\\x0e\\xa4\\xf8c\\xed\\x84n\\xba\\x02&\\xa4cpx\\xbf\\xceuk\\xed\\x10xio\\xfd\\xf7b\\xdcd\\xf8\r\\x18\\x9f\\x8f\\x13&\\x8aotz\\xf5>\\xf1\\x99o"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xfa\\xbb!\\xe6\\xbeu\\xf4\\xe1f\\x91\\xa4\\xcc\\x19\\xe5\\xf7h\\xc9\\xfc\\xb9t\\xe8\\xa8~\\xbdofo'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe\\x8dte \\xdf\\xe8\"\\x18j&\\x15\\x97\\xad\\xf2\\xc6\\x9c\\xa2\\x1f\\x81uy\\xde\\\\xa1\\x7f+\\x02\\xfd\\xf6\\xc6@\\xaa\\x85j\\xe9\\xcf\\x99\\xdev\\xc0ioz\\xdfvz\\xdeu2\\xa7\\x90\\x03c\\x84\\x0f\\xca\\xd3\\x06v\\xff}[\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\x91xu\\xafi\\x04\\x89\\xd2\\xf1q.\\xc1$\\xf7l\\xa7ao\\x19v\\xca\\xc3u\\xe3+\\x05\\xc2o~\\xa1\\x149\\xf0\\x8d\\xdd\\xf6s\\x80\\xa0x\\x88\\xf2\\x04if\\x80v"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xf0\\xc0\\x1d}\\xbf\\x05>\\xe1\\x08\\xff\\xdd*\\x88n\\xfd\\x83/\\xd3]\\x9dq%\t\\x83w\\xa7\\x02\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xcc\\xc1\\x04k.\r^albd4\\x85\\x13\\xe7\\xeb\\xf8\\x97\\x97`\\xdc\\x07\\x1d\\xbdv\\x8fkyx\\xe7\\x11\\xfa4\\x80s\\xba\\xbd\\xb3\\x81\\xbbt\\x06u\\xeaa\\xf2$\\xc4\\xe3\\xea`a\\xeb,\\x01\\xe7\\xcd\\xf0\\x16\\xc4\\xa7t\\x89\\xc6\\xbe\\xa2\\xc3\\xde\\x1f\\x9b_\\xaf\\xf2\\x9b\\x8fw\\x01\\xd9\\xe0vu\\x811\\xd8\\xf5\\x04\\xbbp>\\x85p\\\\xd6/\\xf5\\xa8bm\\xa8\\x85:x\\x93\\xac\\xdcz<\\x81o;\\x89\\xd3o\\xab\\xc8\\xe2\\xcc>\\x8fjt\\xbeg\\xa8e\\x047\\xb8\\xee\\x0bag\\xdb\\xc8\\x89\\x88\\x17sc\\xa1\\x9b\\x9c\\x90 \\xf7\\xb9\\xfc\\xcac\\xf8r\\xf2\\x00\\xd6\\xe63c\\xb7}\\xe8^\\xa7\\x98\\xcbu\\xe5q\\xf0:\\xb2\\xe9\\xd2\\xcf\\x1fx+\\x9f\\xa1\\xef\\x8c8\\x03\\xdae\\xfc]\\xeb\\xbe\\x13\\xc3\\x8ae\\xc5r\\x0e\\xe4\\x94\\xc3tfo\\x1a\\xc2\\xc19\\xbel \\xad\\xc7h\\xe0\\x1c\\xe8\\xdas\r(\\xa6\\xad\\xc7[\\x96:;\\x14\\xcap]y\\xea\\xd0\\x82\\xf7\\xa3\"'\\xb1\\xafa\\x04\\xb9\\x14\\xfbfe\\x064me"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\x0b\\xe83\\xea2\\xf6b\\x0f\\xa6\\x04\\xd8\\xd8\\x99\\xfb@\\xfd\\xd1\\xaep3\\xc0\\xbd\\x81y!\\xc5s`d\\x14\\x16n3d*\\xca~\\xe8\\xfc\\xd82\\x1e2qr\\xdd\\xeb\\xc09\\xfc~c\\xf7t7\\x99a.\\x19\\xb7\n\\x84eg3\\xfc,\\x96\\xe7\\x8f\\x7f\\xf3\\x92\\xa5c[\\xc7\\xcd\\xd48\\xd7!\\xc5j7n\\x07\\xcb\\xbd\t\\xacj\\xb5}\\xaf\\x1b{\\xf0n\\xb2\\x1e\\x11\\xd0\\x0ci\\xf4a\\xe9@\\x0c\\xe0\\xdb\\x08\\x11\\xbfo\\x91\\xc7n\\xe2\\xfd\\x9c\\x89\\x0fa\\x90\\xcf\\xd1f\\xae\\xc8z\\x1dr\\xa6\t\\xd7\\xa2`\\xec\\x9a9\\x03\\x16b\\xcenoq\\x8d\\x12\\x97p\\x9e+?\\x89\\xc7j\\x9b5\\xb8\\xe4y_\\xa6\\x808\\xc5\\xcb&\\xcf\\x18\\x1eft%s\\xcc\\x89@\\xceoyq*\\x15\\xbbg\\x14]\\x05\\x15nn>(n%\\xf9\\xa1n\\xc0\\x08\\xfb\\x160\\x98\\xc6\\x97wx5x\\x82\\xa5o\\xb3\\xca\\x16=\\x1c\\xbem\\xf2\\xa2\\x07m\\xb5\\xa7\\xd8\\xb5\\x8c\\xbd\\x9e\\x85\\x9e \\xb5\\xa3\\x0b\\x0bp\\xaa\\x83\\x86\\xbd\\xabqj"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\xbe\\x16|\\xa40\\xac#\r\\x9af\\xc4z\\x0634\\xa3vn\\xe6\\x9e\\x03\\6\\xf9\\xd0\\x84\\xa2:\\x81\\xb0\\xeab\\xb3\\xa7\\x1d\\xa0m\\x00=a|\\xad\\xe8]\\xa9\\xe0l\\xb9#\\x1d\\x84\\xa4\\x9ch\\xee\\x07\\x85&,\\x86g\\x93\\xba\\xda\\xf5\\x828\\xc8r\\x9ep\\x04\\x1d\\xb2\\xd3o\\x97\\xa71\\xce\\xa9n\\x928+\\xa4\\x94\\xb6\\xb7\\x11\\x98\\xa1\\xb3\\xac{\\xf2\\xbc\\x08\\x81id u\\xb4\\x9e\\x88\\xf4\\x12\\x8d\\xa9(\\xcc*u\\xcc=v\\x7f\\x04\\xb2\\xa9\\x1b\\x8ar\\x1ee\\x15.s\\xfc\\xc4\\xf17*\\x00d\\xa0\\xbf\\x84e\\xa1\\x17_\\xd3h\\xa3\\xa0\\x93\\xbf\\xdd\\xd8l\n\\x19\\x044:?\\xd0\\xa7wh\\xf9cv\\x8f\\x93\\xeb\\xc8jd^i\\xd8\\x8e\\xcb\\xee\\xb3 b\\xf0*\\xc1x\\x86:e\\x12$\\xc4\\x7f\\xb7p:\\x14\\x1c\\xbb\\x17\\x84\\x13k\\x00\\x88k\\xf3\\xc5\\x88\\x0e\\xc5\\xc3te\\x00u\\xddr(h\\x9d\\xda\\xa3g3\\xac\\xa4%\\xd1c\\xa3\\xb8\\xe9\t\\x18\\xd4x\n\\x8em:2\\xc0\n\\xf0\\xe7f\\xc1b\\xde\\xd9z"
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x02\\xbb\\xb7pg\\xefu\\x85e\\xafcl\\xf8q\\xfe7'~\\x8a\\xbf2q\\xad\\x8b\\x98\\xb0q\\xa3;\\xa8\\x1b`\\x16\\xd39\\x07\\xc5\\xbb\\x11\\xbd\\xe9v\\x04\\xd7\\xcf\\x8ex\\x85b^\\x82%\\xcf\\xf5\\xb6i\\x9fi\\xc3\\xeaf,\\xf3\\xa5\\xd0\\xd9\\xcb\\xe8\\xb4m\\x96\\xd0g\\x88\\x93<e<\\xad\\x8d\\x86<:\\x06\\xb2\\xe5\\x10\\x10l\\xca\\x86\\x9f\\xb6\\xa4\\x0b:\rb\\xd3\\xf9\\xb3\\xe1\\xc1\\x91:\\x8c\\x17\\x1a:\r\\xa4\\xf9\\x84\\xad\\x0f\\x06\\xbf@\\xf1\\xd0\\xc6\\x87`\\x12\\xac-\\xbdas*\\xfbn\\x8bg.\\xa9(j\\xc8\\x08\\x14\\xc6\\xaaa(\\xe1[\\x81\\xd7c\\xce'c\\x17m\\xa1\\xe1,\\xbe\\x18142!\\x9f\\x8a\\xd2\\x8co\\xfb\\xe1\\xacp]\\x83r%n`\\\\xb2\\x9b\\x01 \\x0f\\xf3ai\\xa7\\xa4g\\xd1\\x81\\x9d~,\\x85\\xef\\x07\\xc0\\x1a\\xd8\\x8ff\\xce(>\\xdad\\xedoj\\x85\\xdd\\x9e\\xcc\\xba\\xc8\\xa1\\x18\\x8f\\x8cpq,n[\\x8d\\xf6|<.d\\x9c\\xdf\\xb1\\x9c\\x1dc\\x03!\\xcb\\x90\\xe6\\xed\\xd5\\xc1u\\x07\\xa5$"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8f\\xb3\\x15\\xbe\\xc2\\x0e\\x1b\\xe58gi\\xe9\\xcb\\xaa\\x11ito\\xdaw\\x18\\x88\"\\xba[\\xde\\xb2\\xa3x4>k\\xd4\\xe2]z\\xe2<\\x8c\\xc1\\xdb*,!\\x89#\\xab\\xd2 \\x86\\xbet\\xd9\\x13o\\xe2\\xf9\\xc3{p\\xd2\\xc0k9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\x1b\\\\xa4xe\\xd1t\\x1e\\x9a\\xea\\xbe\\xcf\\x8cb\\>\\xf6\\xdd\\xab\\x0b\\x119\\x86\\xb9i\\x12`\\xe4\\xb5\\xa0#z\\xb6\\x948d\\xc6\\xd5t\\x95!\\xc0\\x01\\x81\\x0c\\xf7i"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\xb00d\\x08\\xf0\\xc1h\\x08\n\\x7f\\xfb\\xcfk%k\\\\x94q_\\xa8u\\x84\\xbe*+\\xd5\\x00f\\x12<\\xa5\\x19\\x0c\\xa3r\\xd4\\xb8^\\x84#m\\x9e\\xedx8y+7>\\xdc\\x93cw\\x9e%@[\\xbf\\x90\\xf8[\\xca3\\x94\\xcb\\x86\\xf3\\x07aki\\xbe\\xd9x\\xcd\\xb6\\xf88z\\x18\t\\x10\t\\xf4j\\xf3\\x9ak1\\xce\\x9e(\\xdd}ex\\xfdh\\xd1\\xddu\\x8f\\xd0\\xda\\x06\\xdek\\xc9\\xc8\\xf06\\x1bo\\x0c,\\x12\\x96\\x0e\\xc7\\xc3\\x7f\\x15u\\xf5mw\\x06h\\xdf~\\x137\\x14\\x7fb\\x98\\xde\\xe7\\xcfi\\xd2\\x07\\xa37\\x08\\xa1i\\x07>\\xb2\\xe6\\x88\\x0eb\\xa3z\\x85].\\xc9\\xfb\\xb5i\\x14m\\xc4\\x8coz\\x8e\\xde\\xc1h{\\xab\\x876\\xdb;h\\x98=\\x1b\\xff\\x0f\\x85o\\xc6\\x86u\\xb5\\xd96\\xb0\\x0e\\x9e\\x99\\xb1u\\xe1\\xc6\\xb8\\xfa\\xf5m\\xde\\xe3\\xbb\\xedj\\xfa\\xed\\xc2p\\xff\\xf7ygg`\\x82\\xcd\\x04\\xe7\\xff\\x8c\\xcb\\x7f\\xc4\\xd7l\\xc8\\xf4\\x82\\xf6\\xe7\\xe1yp\\xef\\xb7l{\\xa8\\xf7\\xeb\\x99\\x93*\\xbd\\xe2\\xef\\xc4\\xa0o)"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9a\\x1e~4\\x97\\xc4\\xcd\\xab\\xdc\\xe7\\x10\\xf2\\x0cf\\xf0p\"\\xe6v\\x0c\\xed\\xees\\xe1w\\x01\\xd3\\xbbl\\\\xe1a\\xfc\\xbe*\\x0c\\x91\\xcf\\xd9\\xbd\\x81\\x8cuq\\x8a\\xeb\\xcas\\xa4g\\xca\\x03,c\\x12\ng\\x06\\xf6y\\xbfu\\xe6u\\x93\\xa2\\x05\\x08\\x87\\xfb\\xe2\\xfb\\xf1&\\xf6k\\x87\\xbb5h\\xfay\\xd9\\x81\\x81\\x96\\xcb\\xd8$\\xa3\\xc4\\xb0\\xaa\\xc17hf;|*\\xad\\x1bd\\x00}\\x0c\\xaf\\xddk\\xe0k\\xa2r\\x90e\\xef[3x\\x94f\\xff!\\x83\\x80\\x06\\xe1\\xbc\\xc1\\xa6\\xb1\\x1f\\xb7\\xda e\\x9c\\xad\\x99\\xe4\\x9do?\\xcf}\\xe7\rjy\\x16\\xe4:\\xafgx\\xe54s\\xad\\x9e\\x07su\\x924.a\\x99\\x1c\\xac\\x13\\xe8\\xd0\\xc6\\xf5z>\\xb7a_r}\\x8b n\\x894@\\xbb\\x8a&\\xcafq\\xeb\\xe5\\x9a1\\x92\\xf6\\xc1\\xa3\\xbf\\x97\\xd4\\x93}\\xdf\\xda\\xb6\\xfd\\xcb'=\\x10\\xca\\xd8\\xc52\\xb1\\x92n\\xc2\\x8b\\xc4\\xd0n\\xdf\\x8e\\xf8\\xd9h\\x08\\xc8f\\xeea\\x85\\x8ae\\xa61\\xfd,\\xfd\"\\xc4d@f\\x00"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3i<p\\xda*\\x04\\x8a4\\xc7\\x93\\xb3\\\\xcd\\xbf\\x8dv\\xc5\\x1e\\xd4\\xb3$c\\x0e\\xd59$a/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3kr=\\xa0\\xef\\xdc6\\xf8x:\\x96\\xa3bm~\\xa4\\x00\\x04z2\\xae\\x94y^\\xea\\xf7\\x03\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_r\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xa9\\x04\\x1fn\\x12]y:\\xf3\\xd3z~r\\xa0\\xaf\\xc5s\\xe2\\xab\\xc7\\xe1\\xf5/\\x11\\xba\\x00\\x9d\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xf1#\\x01y\\xebw\\x1a.;r*s\\xd6\\x8d\nn\\xfc\\x96-\\xdbl\\xb8\\x9c\\x06(o\\xf6w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc36+\\xcd\\x81\\xad\\x85\\x0e]\\x14l\\x8a\\x81\\xd4\\xd7\r\\x0f\\xb0\\xef\\x14\\x8a0vb\\xf9\\xb3:q\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3<c\\xe5\\xed\\xf1\\xa4\\x1e\\x02\\xca\\x1a>\\xec\\xcf\\x9a9<\\x86x>\\xd2\\xaar\\x01tod\\x90'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3k\\xb3\\xfa\\x1f3/\\xda\\xfaq\\xb8v\\x0f\\x86/z\\xef\\xd0\\x16)\\x8e\\xdc\\x16\\xff\\x1cc\\xca\\xcc\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3?x\\xcd\\xc7\\xe7\\xe36\\x8d\\x99a\\xbf\\x14\\xd4w\\xa1\\xed\\xb6\\xb8\\xf3\\x15^\\xf3z\\xd7\\x18\\xa84\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x03`\\xc2\\x10\\x9b\\xad\\xbe\\xb0gqp]\\xab\\x81[\\xe6\\xa1\\xb8\\xbd\\xfe\\xb0\\x13\\x8ay\\xae\\xd1\\x8f\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xda\\xc8\\xae\\x02\\xfc\\x90\\xfe\\xab\\x1c\\xfd\\x84c%\\xe1q\\xf82\\xae\\x06\\xeck\\x9e\\x17\\xed\\xb8x\"]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xe4\\xc0\\xcc\r{\\xc6\\xf0\n\\xbb0\\x12x\\xe6\\xee\\xc4\\xea\\xf2\\xdc\\x1d\\xc6{\\xf4\\x0b\\x85\\x11u\\x96e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3c[\\x16k7\\x13\\x8e\\x84=\\xde\\x87\\x98\\xbb\\xec\\x05\\xec\\xach\\xd4\\xdd\\x0f\\xc5\\x81\\xea\\x19\\xa0\\xb2\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc34\\x1c\\xa2b\\xdf\\x83\\xcba\\xfe\\x04\\xf2\\xa1b<\\x08h\\xa2\\xd5;\\xb0\\xe1\\xebx\\xa5-%\\xd7\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xd9\\xa2j\\xf1!\\x86\\xd6\r\\xa6d\\xe3\\xa4\\xee\\xda\\xf5\\x0ew\\x9c\\x80\\xc1\\xe2\\xe5\\xa8\\x82\r\\xc0vi\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\x1d\\xaa\\xa4\\xb5b\\xdb\\x9b\t\\xa1\\xb4\\xc0\\xbc\\x99ff\\xe8?\\xbf\\xf3\rj\\xf0ke\\x96\\xfb\\x87\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xf2\r\\xd3\\xadhr9\\xc79\\x8ex\\xe9\\xcfx\\xed\\xd8$m+\\x08\"w#\\x8f\\x06\\xdeq\\x11\\xff\\x01/\\xf2\\x8c\\xa8\\xd2\\x0f\\xe8\\x84\\x94\\x0fn\\x91lst\\x9f\\xae\\xe1d'll\\xe2\\x84=\\xe3v\\\\xae\\xeb(\\xd5\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xa4-\\xd9\\xea\\x04e\\xa7\\xa1\\x7f\\x9e-\\x1c\\x13\\xa1p\\xb0\\x8d\\x05\\x08,\\xad\\xa2|[re7t\\xd4k@\\xe2\\xa5\\xbd\\xf2t\\xa3cu\\x16g\\xdcd\tu\\x17\\xc4"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdera!\\x9b\\x1dw\\xc8\\xa7\\x19z\\x85\\x84\\xc7\\xa7\\x90\\x87\\xaa\\xb2fi\\x9cj\\x0e\\xcez\\x8e\\x80\\xc6m\\x15\\xda\\xb9\\xb0\\xd3\\xa7\\xc8\\x8eoz\\x0c\\x15\\xe3s\t\\x98 \\xc1\\x8d137\\x9b\\xc8\\xf8\\x00\\xb6\\x9b\\xb8\\xb80\\x81\\xb4\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2b\\x89\\x8c\n\\x8c\\xf9\\xd80o\\xca\\x05\\x9d%!g\\x1elwi\\x10'w\\xd5\\x80\\x93\\x8ai\\x11\\xaf\\x16\\xdc\\xea\\x87.z\\xf5\\xf2\\xcdsq\\xf5\\x8c,\\xe6\\xe5m\\xc2"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\xd5\\x08`\\x10\\x17\r\\x1a\\x98q[2\\x8cq~\\x18\\xc3\\x9e/-\\xed\\xfe,;\\xb0\\xaeo5 \\x80\\xcd$\\xe1h\\xf2!\\xfd\\xfdaxw\\xcan$\\xcd\\x05/\\x93\\xf9\\xe8.\\xb2\\xac\\xa2\\xaf\\x0b7\\xbc\\x08\\xd6\\xa6\\xe8\\xae1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\x18\\x02\\x0f45\\xce'\\x05gt[{lm\\xf6f\\xb6\\xa8n~\\xdbbf:\\xa0\\x86\\x972\\xc4\\xbbj\\xe5'h}\\x9f\\xb2\\xc4h\\xd3n\\xe9\\xb0aa\\xe8\\xfc"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xaatuz\\x19\\xf3\\x93\\xf5w\\x82\\x0f{i\\x9b\\xcf\\x19e\\xa5\\xf1\\x18~n(e\\xc3\\xbc\\x93\\xef\\x88pu\\x13er\\x95\\xf12%o\\x06\\xe2\\xd0\t\\xa9(\\x00=\\xd8}\\xe1i\\xf3\\xc6\\x9d)4\\xb0+\\xa8\\xbcx]\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xdff\\x95<\\x93nf\\x12`\\x1f\\xfd\\x12\\xa1\\xc5\\xd0\\x12\\xf6\\x14)m\\xdd\\x9fhi\\xde\\xb2\\xc8v\\x99\\xe1\\x01\\xe6\\xd7\\x8f\\x0e\\x04'r\\x91z+\\x88\\xcf\\x12f\\xea\\xfe"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93\\x92\\xd8\\x90i\\x17\\x02+{\\xa1:gj\\xaf\\xf7mo\\xdc\\xe7\\x7f\\x9fh\\x15:\\xb0m\\x14\\x90~\\x0be\\xd7\\xce\\xcc\\xac4zg\\x86\\x0c\\xa4\\xb6\\x9f\\x0fi\\xc7y\\x93\\x8c\\x87\\xb4z\\x81\\xa5m9\\xc6\\x04\\x9e\\xba\\x1c\\xc7\\x8e\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x86\\x9byf|\\xb9\\xf0s\\xa3\\x95\\xdc^8\\xb4p\\x81:\\xc4\\x9b\\xe2\\x852n\\x9c\\xe7\\xce\\xe8h\\xd5\\x16q\\x11e\\xa2\\xa1\\xc2?g\\xc3\\xd7u\\xbe\\x888\\xb2\\xc3'"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x08\\x0b\\xc3\\xb0\\x1f\\xe1\\xfa\\x07\\x8b@\\x16m\\x99lg\\xc5\\x11\\xa1\\x83\\x10j!8g\\xd7b(\\xaa\\x16`\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x9b\\xf3\\xbcy\\x14i\\x88\\xacw54\\xab_\\xbf,lp9m\\x9b\\x8d\\x1c\\x16\\xff?p1!&j\\xf5\\xa1\\xea\\xdc>\\x190hl\\xa5m<\\xb4\\x17\\x04\\x8c\\x0c\\x17v\\xd3ne\\xc9\\x97\\x9c^#j\\xcc\\x17\\xb4b?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\x8f\\xdcp\\x16\\x03y\\xa7\\xf3\\xb6\\xe6\\xe6i\\x0fn\\xect\\xb5\\xe4\\xc3\\xdc(\\xd1\\x9a\\xbc\\xd9bv\\xe7\\x11o\\x0625r\\xa3\\xd1^e\\x13\\xe3\\xd4\\x06t3\\xb7\\x01\\xee"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x1b\\x89\\xa9,#v\\x8f\\x92\\x12\\x0b\\xd13\\x11\\xded|z\\xf64\\x0bzy<\\x1d\\xa5yc\\x1a|\\x8cu\\x98\\xad\\xe0i6~\\x94\\xd7\\x97\\xdea\\x00\nl\\x81t\\xc0\\x9b*g\\xb5|x\\xfecv\\x17\\xd3ye&\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x104\\xa4\\x89\\x8c\\x11\\xf5u\\x8f^i)\\xa6l\\xc4e=b\\x07j\\x86\\xd1\\xe6\\x17\\x98\\xd9\\xe9)s\\xe7[\\xe4?\\xeb\\xfe\\x1cy\\xa3i\\xa1\\xb1v:#\\x91nt"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&\\xae\\x8b\\xe3\\x01b\\x8e<\\xadx\\xa1b\\xe7{\\xc7w\\xd2d\\xae\\x98\\xdd\\xc4\\xad\\xa5c\\xdb\\x9e\\x97\\x89\"\\xca\\x83\\xad\\x92n=;\\x9a.\\x02\\xb2@\\xc3\\xc7m.o\\x1do\\xa5\\xf3\\xd8u\\xfe\\x9a\\xef,x\\xbd\\xdd\\x82 \\xe8~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85\\xe8d\\x0b\\xc7\\x9bd\\x88\\x9a\\xecz\\x8a^\\xf6d7\\xdb\\x9e\\x98\\x18\\x06e\\x97#\\xda\r\\x9f\\xbf\\x13\\x19ce8\\xffu\\xec\\xda\\xae\\x12\\xc4\\x81}i(\\xdd\\xecr\\xa7"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19o\\x10v\nc\\xbd\\xba\\xe5r\\x84\\x12\\x0f\\xc8*\\x19\\x00]hmm'\\xbb\\x15\\x0c\\xa1\\xd4w\\xb5\\x14\\x8f\\xe7up\\xf98\\x8c\\xe2<\ta\\x88\\x91\\xabl+\\xf2\\xef\\xc4[8\\x87\\xfag\n\\xf5\\xd4r\\xe4&e\\x93\\xf0t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xffs2\\xa3\\x1d\\xbe}\\xc9\\xee)\\x07*\\xf1\\xe1b\\x12\\xf4x^u\\xe2m.\\x97(8x\\x0b\\xc7k\\xb1\\xde`.=\\xbfm\\xffb#\\xcf\\xa0\\xd2y\\xdds\\xb1"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\xef\\xb3\\xbc]a\\xeb\\x91\\x95y\\xff\\x13\\xf4? 1\\x7f\\xb3wk\\x0f\\x11u\\xad\\xa1\\xce\\xff \\xe9\\x8b\\xad\\xf9\\xb2\\x8aa\\xc2\\x15d\\x13\\\\xaeh;.\\x8be)\\xb1\\x16\r\\x88\\xf6\\x8b<\\xe2\\xd7\r\\xae\\xbc:g!o\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x9c\\xf2\\xf2;?\\xd1}=\\xf6\\xcb<\\x9c\\x95;z\\xb8\\x97\\x80\\xc7\\xf7\\xef\\xd4q:\\xcb\\x7f:u\\xc5\\xe1\\xbc\\x89\\xd1\\x13\\x8e\\xb1\\x87\\x85$\\xa0@\\xd1_\\xb8v!a"
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\xe3h\\x97!s\\xb1\\xda\\xb1u\\x19e\\x00o\\xf6\\xf1\\x89\\x92\\xec\\xe2\\xad\\x95\\x13\\x1d\\x8b\\pi0\\xee\\x87\\xc5\\x1d\\x8a\\xd0\\xb5\\x91$l%aj\t0!h\\xdb\\x04-\\x84q,>cn\\x9b\\xd9#\\xba\\x8b\\x9af\\xb6\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`m\\x17-a\\xb1\\x02\\x86\\x838>v\\x89\\xa3\\xfb\\xb3u\\xb5!\\x92\\xa4d\\x10\\xfb\\xc4d{&\\xafb\\x9esi\\xeb(&k\\x83ee\\xa5\\xda\\x91\\xd1\\xdd\\xea~\\xba"
  579. },
  580. {
  581. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfec\\xfa2\\xaf\\xbac\\x07\\x01\\xe7\\x9e\\xb6\\x99x#nq\\xffk\\x0cn\\xb2\"|\\xdas\\xac#cl\\x17\\x1a\\x00\\x8e\\x98e\\\\xfe8\\xab\\x9a\\xe4\\xe1>\\x8c\\x01m\\xa0\\xe8\\x83\\x95\\xc6\\x80p\\x0f}\\x98\\xf5 \\x85#bam\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:u{\\xfe3\\xe4*\\x0fk\\xc4j\\x01\\xb0\\xdc\\xee\\x93\\xee\\xa8_-\\xa2\\x83t\\x8b\\x9c\\xfb$\\x1d\\xc9:\\x92k\\x96dos\\xc0\\xaf\\xaa\\xef\\x00\\x0cm\\xd3mj}\\x19"
  582. },
  583. {
  584. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\xfc\\x9c\\xbc%!\\xec0\\x89\\xd6>3\"\\x13\\x89\\xff\\xff\\xbe\\x1a\\xa9#\\xdf\\x11!c\\xb3\\xc45`\\x8ai0\\xc3a\\xe92\\x02\\xfd\\xdfh\\x04\\x89p\\xa0p\\xd3\\x0c-@\\xbej\\x80\\xd6\\xd0\\xfa\\xf6\\x17)j\\xd1a\\x1ay\\xa6\\x8bn=\\x90\\x1e\\xf4\"\\xf05\\xa0n\\xc9wly\\xe7[$\\xfau\\xe6\\x93\\xc4\\x04d\\xb6\\x9e\\x07*j\\xe3\\xd6l\\xaa\\xf5\\xd4\\x93\\xb3\\xd0\\x03e\\xe2\\x92\\x140\\xf7xs)\\x8a\\xe6\\xce\\x90\\xbb|\\xe4_\\x82\\x95p\\xf3g\\x06o\\xc8\\xa7\\x9a\\x7fs\\xb2\\xe5\\xc8jbc\\xcb\\x9f\\x19o\\xfa\\x01\\xec;\\x8b\\x8d\\xeds\\x9e\\x9d\\xb8\\xd8\\x8a\\xaf)\\x11\\x95=-\\x90\\xe3\\xead\\xdc\\x01\\xbes\\xd7nfs\\xd5\\x95#\\x0b|\\x84\\x10\\x86\\xadl\\x10k~\\x9d%\\xc6\\x92*z\\xcc\\xaf.(\\xca3i5\\x07\\xc7\\xd2\\xbfv\\x82\\xc7\\x9fy\\xea\\xef\\x15of\\x98\\xb7\\xc4\\xb9\\x10\\xca\\x82\n\\xa3\\xa1l\\xden#x\\xe1\\x1de\\xd6@\\xa4\\x10\\xb5h\\xff\\xf4\\xfa\\x14`\\xaf\\xa2\\xcd\\xf8\\xa7\\x02\\x15"
  585. },
  586. {
  587. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010hs\\xe9\\xeb\\xd0z\\xa1\\xed\\x8b\\x89\\xa6gq\n\\xd75\\x913k\\x18\\xc3\\x1d\\xadyf\\x18\\x89o\\x10\\xe4\\xb94\\xddl\\x8f\\x98\\xda\\xc7\\xb0\\xf8\\x17\\x9fnfz\\xa6\\xe9in\\xba\\xf3*y*/y]\\xaa\\xbap\\xe6t\\xe3\\x96\\xc1\\xd2<\\xcc\\xb7\\xa9\\x84\\x86_\\x7fl2q\\xb61\\x9ef\\xebiim\r&\\xff\\x0e%bs<;eb\\x95\\x93\\xc1\\xb6\\x19r\\x8d$s\\x15\\xe7\\x93\\y\\x1e0y4\\xd5o\\xaf8\\x80l|\\xac\\x8d\\xaex\\x95\\xf2\\xc9\\xf7\\x93\\x13\\xa2\\xd2\\x01\\xdd\\x8e\\xa6?\\xb7~\\xbch|\\x88\\x8b\\xb1\\x0b\\xaa/z}b\\x96m\\xed\\xbd\\xc2\\xb7`\\x97i\\x91\\xa6r\\x97\\xe6\\xe6i\\xe2\\xda\\xcb\\xdc\\xba\\x15\\x03\\xa8\\xc0\\x90\\xc7\\xe3\\xbb\\xc2\\xfe\\x0f\\x93\\xe6\\x08:x\\xab\\xb2\\xa8\\x08\\x0fq\\x98\\x9b\\x93h.\\xda\\xa1qz\\xe9\\xe8\\x0c\\xdc\\x90\\xf5\\xef\\xcb\\x91%\\xe2\\xb6\\xb7\\xe5\\xc3(\\xa3\\x8a\\xd4\\xc1\\xcd\\x04\\xdc\\x9d\\xe2z\\xc6&\\x18\\xd4y\\x8f\\xe5\\xfa\\x9et{\\xa9\\x1cqu\\x80\\xb1\\xa2\\xd6v\\xa2"
  588. },
  589. {
  590. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\x85\\x93\\x13\\x96\\x14\\x0e\\xe6\\xb9 [nl\\xb2@>\\x81pd\\x15\\xc2vx#\\xe426'\\x13\\x85k\\x96\\xe0\\xe6m\\xfb\\xbc\\x07\\xc0\\xd4ai+\\xfc\\xa3\\xd9\\x0b7(_\\xbb\\xf25\\xe1]\\x92\\x9dz\\x98\\x9f\\xccx\\xbb}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@rm\\x8f\\xba\\xe3\\xfd\\xfa\\xdd\\xbd\\x0b\\x80k\\x14\\x9f3\\x10,e\\xc6b\\x9e\\x1a\\xcba1k\\xfbmj`k\\xfb\\xf1\\xa3:&\\xa3\\x06?\\xaekp-\\xe4\\xbe\\xa9\\x96"
  591. },
  592. {
  593. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xc2\\xbee-\\x93\\x06q\\xf7\\x08\\xf1\\xad\\xbaln\\x9a~\\xff\\x8cu\\xd4\\xfb\\xdbyh\\xc1\\xc3\\x8c\\xde\\xb9\\x8a\\xfc\\xa8\\b\\xa8{\\xe9\\xfal}\\\\xbf\\xe7a\\\\xb4q\\xa7\\xfe\\xcf\\xcb\\xf7\\xc6\\xc5\\x83\r\\x0b{\\xcakzz\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\xc0vl\\x8d.\\xcck\\xf0\\xe5}b\\x80wxi\\x14\\x8d8\\xb2\\xc8\\xd4s%\\x102\\xb9\\x15\\xdff\\xcd\\xf1ik\\xd3\\xd0\th=\txl-\\xf7\\x92\\x9f\\xd2\\x05"
  594. },
  595. {
  596. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1d\\xa8\\xda$\\xcf\\x05\\xb0`\\x03\\x9a]\\xdd\\x9d0k\\xd4\\x07l\\xae\\xc4@\\xd9]:\\xc1\\xe8r.4\\xc6\\xbf\\xa4\\xa1\\xd0\\x19\\xc3\\xebyc\\xbb\\xe8\\x06j\\xbf\\xa1\\x98\\xe9>yd\\xa0\\xa5}@6\\x11\\x16\\xecz\\x9a9v\\x9a%\\i\\xcbf\\x08\\xd2\\xcb\\xfa\\xa39,\\xdb\\xe0\\xf7\\xe8p\\xd1m\\xa3\\xd6\\xc1\\xc5s\\xe8+k\\xc7\\xab\\xd8,\r{m\\xb4\\xd2\\xd5\\xb1gd\\xf9\\x0c\\x02\\xd1p\\xbe.\\x832\\xd1j2\\xc4v`\\xd7\\xefa\\xab\\xb4\\xb1\r\\xbd\\xd5\\xaf\\xd1\\x06\\x8f\\xa3\\xc1\\x8e\\x83fm\\xd2]\\xf2\\x1c\\xde\\x82\\xa6\\xb8\\\\xe6\\xe6\\xba\\xc7pc\\xdd\\xba\\xeb\\xe5\\xf0\\xa6\\xbf\\xe1\\x85/\\xe6m\\xd1\\xf5\\x0cl\\x02\\x9d\\xb1\\xa1@5\\xf2\\x94fb\\x9a5\\xd5\\xe8\\x03\\x08\\xa4\\x87h%\\x99\\xe1\\xab\\x95n\\xb3\\xf0nz;\\x19n3\\xb6\\xbcdf\\x84\\xf2\\x97~\\xd9\\xf9z\\x07d\\xd9\\xe9p\\xdb\\x03x\\x05:w\\x05\\xb3\\xe8qw+}v\\x85\\xc0\\xba\\x81\\x9b:\\x01k\\xa6^l\\xa7\\x93\\xfd\\x1f\\xa0\\x11\\xb3\\x9c"
  597. },
  598. {
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.4q\\xf3=\\xc5\\xb3\\xc5\\x01\\x06/n\\xa7\\cy=>(\\xdc\\x07\\xd3\\x9b\\xa4\\x04\\x1f%\\x05d\\xcf\\xc0\\x8c\\xc6\\xe7dtr\\xff\\xe0\\x95d\\xcf(i3\\x08\\xe7nw1\\xdbs\\xff\\xe4d\\x12p\\xc9\\xd8\\x19r\\xe0\\xc0\\x89\\x1c\\xb7/\\xb8\\xc0\\xbc\\x07\\xc1\\xb4\\x1a\n\n{q\\x95\\x01o/6\\xcao\n\\xf5\\xec\\x0c\\xbbn\\xcc\\x06]j4\\x97n\\x02\\x9f-*\\xf5\\x11\\xf0\\xbchk\\x10\\x0e\\xb0j\\xba\\xe9\\xf1\\x94\\xc6l\\xd8\\xd7\\xc2\\xe9<\\x88w\\xe8\\xc2\\xda\\xcd\\xa9\rn\\xfe\\xe9w\\x18\\xa1\\xf8\\xa6h@to\\x08\\x83\\xbcg\\x93\\xa5\\x92st\\xe0*\\x055\\xfa*\\xff\\x01\\xb2\\xa7\\xde\\xb9\\xa8\\xaau\\xb5\\x1f\\xd3\\x06\\xa8}}k\\x90g4z\\xb1\\x07\\xf7\\xf2\\xfd\\xbfpr\\x91\\x1b\\x89\\xa6j\\xbed\\xd9x\\x10_c\\x84o>\\xb2\\xdd\\xa1*\\x05\\$\\x10\\xadc\\xdf\\x99@`w\\xd4it\\xc5e\\x1b\\xb1t\\xe6\\x12\\x81\\xa5b0p\\x0c\\xb4\\xee\\x8d\\xba\\xd9:\\xb1\\xec\\xed\\xec\\xc2\\xe7\\x94h\\xee\\xe3#/"
  600. },
  601. {
  602. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\"\\xca4\\xa5y1\\xd8h\\xfa;\\xe9\\xd4\\xd3o\\x02\\x18-\\xf5\\x85\\x1e\\xb7x\\x18\\xba\\xe9\rv-\\xc9\\xbc_?\\xd52/\\x11\\xd8\r\\x7f\\x16\\xbb\\x92*&\\xcdf^!#\\xa9\\xb4\\xfd\\xe0/\\x0e\\x99\\x12x\\xdeo\\x16\\xa4[\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7e\\x9a\\xa3j\\xa2\\x85bj\\xce\\x8f\\x92\\xc9;(!\\xe3m\\xf7\\xd9<\\x85/:\\xa3\\xa8\\xec@/\\xb4\\xf7a\\xb3\\x84\\xef\\xd8\\xdaq`\\x85s\\xd1\"\\x0b\\x99\\x8d\\x0e\\x16"
  603. },
  604. {
  605. "http_request": "winword.exe_WSASend_\\x90\\x96h\\x08\\xb8\\x14b\\x08z\\x1aj\\\\xec\"fi\\x83\\x96\\xa6%@\\xf4o\\x86y\\x9d\\xbcl\\x7f1\\x04g\\xe5\\xb0\\xa7\\xf0c\\x03\\xe7t7\\xeb\\xe2\\x7fki\\xa0/\\xfdl\t\\x90u\n\\xfbek\\xb2>\\x80\\x0b\\x13\\x94|>!fq\\x97o\\xc6=t3\\x02\\xb7\\x90\\xa0\\x85ks\\xc9\n\\xc3\\x1d\\uc\\xe6\\x01\\x9e\\xab\\xc0\\x00\\xa9\\x06[\\xa6\\xf1\\x0b\ra\\xb4\\xe6\\xe2\\x92'\\xf7\\xb9m\\xdf\\xe0\\xb7\\xce3\\xee\\xc4\\xe4w+\\x15(\\xdb=v\\xf9\\xa7\\xb9\\x17\\xc4\\xfb\\x94g\\xc1.\\xbc\\x956\\x9bc]\\xad\\x86\\x03]t\\x076\\x96ux\\xa5=ax34\\xbb\\x95\\xfdy\\xb3,pt\\xbc\\xd8\\x8f/\\xd8\\x14\\xbc\\x89\\xb3\\xebi\\xa3]`sg,g\\x99^h\\xc6j\\x9aig)\\xbc:\\xd7\\xb9\\xfa\\xae\\x0f\\xb7xs\\xdb\\x87\\x80\\x84\\xf9\n3g\\x0b\\xc5\\xf8\\x05\\x12v\\xb5`\\xe4\\x14\\xa7\\x053?k\\x87\\x19\\xb2\\x88\\xb7\\x18 \\x13+\\xd0u\\xfe9r\\x15\\x17\\xe7f\\xefn\\x9bc\\xa0h^\\xfc\\x82\\x89o\\xd4\\xd8"
  606. },
  607. {
  608. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b!\\x1c\\xe0\\x8b\\xfe\\xa5\\xa7\\x92mzl\\x10\\xdb\n\\x89\"\\xd3\\xb3\\xb5\r\\xfer\\x8b\\xf4a\\x8fy\\xe6d\\xc7e\\x12-\\x1c$\\xa8\\/\\x82=i\\x05*\\xa8\\x0ek\\x86`\\x19f\\xf8{\\x89ub1\\xc2\\x06\\xafq\\xe9\\xfb\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\xd7n\\xd5\\x1b\\xae\\x08\\xd5@/\\x01\\xf8\\xe7\\x92\\xc6g$!'\\xb5\\xca\\xc4\\xba\re\t\\xeew\\x17\\x8dk\\xd8\\xc5\\x04\\xcf\\x0f\\xa2\\xf6?\\xf2\\xc1s\r\\x1f\\xd5o\\xcc\\x99"
  609. },
  610. {
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x88\\xd4\\x86\\xf9\\xc2\\x84\\x07\\xd6s[\\xf4e\\x02r\\xbd\n\\x04|r\\xe2o{\\xa4=\\xd8\\xd3 \\x15er\\x85z\\xe3\\xdbqo\\x80\\x12z-\\xfc\\x8f\\xf3m\\xdb=\\xe0wh\\x00$\\x1e\\xc8\\xaf\\x1ab\\x92\\xb4\\xff\\x01\\xc3+\\x1f3\\u\\x13\\x8f\\x07\\xe6_:\\xceg\\xef\\xd6\\x9f\\xe2\\xf55#j\\x16\\xb7z\\xddp\\xe2b2\\x122vy\\xfcf\"z\\x0b\\xdb\\xe7z\\xde\\xa8\\x00\\x1fcb\r7\\xd1\\xd4t\\xce\\xd5,\\x92n\\x1fz\\xf0\\x1b\\x9a\\x1a9<\\x15\\xc4\\xd0\\x1dmg\\xb7\\xe3\\x87\\x83\rc\\x1d_\\xdc\\x95mk[\\x83\\x11]\\xfe\\xc0\\xccb\\xf8\\xe0jf\\xfb\\x01\\x95\\xa9[\\xa2\\x9e\\x94\\xa7_r[y\\xf5:w\\xda\\x04\\xeec57\\xeb\\xdd\\xd9\\xb0\\x0fy<v\\xdc\\xf8\\xb3\\xb9ve\\xf9\\x83\\xd8$\\xc3\\x1d\\xd49k\\x1b\\x05`\\x04\\x18\\xc5l\\xa3\\x0cyt7b\\xcb:s~\\xe04j7\\xe8fh\\x031\\x1f\\x90o\\xee\\x8er\\xcd\\xf9 \\x9b\\xc0e\\xae\\x8e\\x8a\\x8b\\xbd\\xc5\\x99\\xd3p_="
  612. },
  613. {
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\x03f\\x98\\x1d\\x8a\\xc3\\x0f\\xa8\\xefe\\x05\\xe1\\x9a\\xda\\xf1c}\\xa31r\\xaf(\\xe3n\\x80\\xb4\\x04tzl\\x88dl\\xf52\\xad>r+a\"q$t`\\xd2/\\x17\\xd1:xc'?\t*\\xe30cl\\x19\\x0c\\x94\\xf1|i\\xb1m\\xcc\\xeb\\xfa\\xcad\\xcd-\\xaf\\xfc\\xb2\\x9f\\xcfp\\xd1y\\x15\\xf9\\xad[cq\\x9c\\xd8g\\xdf\\xd8mt\\xb7\\xc15\\xa60\\x97q\\xd8)\\xc6\\xdb\\x88\\x05&h~9!)u\\xb7\\xdc@\\x04m\\x8cj3\\x16u\\xd9\\xdb\\xef\\xc2\\xe0\\x0e\\x052\\xaf\\x95\\xb9\\xb8\\x86\\x19\\x96\\x87r\\x87{\\xc8\\x1b\\xc9'p\\x06\\xe0\\xef\\xcdw_\n\\xee\\xdd\\xa9\\xbb]\\xd0u\\xc3\\xf4\\xcdo\\xc7[\\xdb\\x08\\xea\\x8fx=\\x1cezvgfue$rug\\x9f\\x84\\xd5\\xad!\\x81(u\\xea4\\xcc\\xb9\\x06\\xd7\\x86\\xfd1\\xe6\\xd7\\xa2\\xe4.\\xcb8\\x1b\\x87\\x8a\\xfc\\xd17\\xc5\\x84t*@g\\x8d\\xdd\\xc6\\xc1)kd<\\x9d\\xc0\\x17\\xa7t\\xc1\\x91\\xf4\\x9artey\\xeb'\\xbfv\\x1a"
  615. },
  616. {
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010zc\\x80ov\\xbd\\xd45\t\\xc9i\\xcb\\xa0m\"o\\xad\\xb88\\x92l\\xa7j\\xfcu\\x17\\x100\\x08c2\\x91\\xb4\\x81\\x0c\\x14,&\\xd5-\\xc7\\xc2z\\x18\\xf1b\\xd2\\x8d\\x99m*\\xd3\\x12\\xfb\\x16\\xa7\\xdbqw=^\\xf87\\x80\\xf5pun\\x83\\x86c\\x9e\\xd0r\\xd5y?'\\xc1{\\xab*\\xc5r\\xb3\\xcau\\xc8=\\x06j\\x9b\\xa8\\x07\\x1ag\\x98pz\\xae\\x0f\\xa3x\\xc0\\xf2l\\xf5o\\x13ve\\xd5w\\x8c.\\x170\\x0e\\xd2\n\\xf2\\xea\\xf9\\xe2]\\xf5'\\xa9%\\xa3myd\\x1d\\xcfy\\xdf\\x01i\\x88\\xb8&\\xfb\\xd3\\xd7;\\x97\\x18\\xff\\xe8\\x85\\xd5\\x10\\x14-\\x9e\\x99\\xcb\\xe2k\\xb7\\xc9\\xbe6$s\\x8ah\\xa2\\xf2yd\\x00d%p]mc\\xa9\\x01\\xa6\\xca\\xf6=;a'\\xfb\\xdfq\\xce5\\x13|~\\xcf\\x81\\xc4\\xbfhh#e\\xc0\\xf5cd9p\\x94\\xe6p\\x03\\xb6w\\xa8\\xb1-b\"\\xad\\x01\\x8bl\\xe3vtuok\\xc4\\xeai\\xe1\\xf4\\xecm\\xc1\\xba$\\xf4u\\x90\\xda\\xa4\\x96\\x1a'm\\xe5"
  618. },
  619. {
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\xd3c\r\\x90\\xb2g\\xce\\xaffi.\\xa3\\x8f\\xe5l-n\\xa4\\x06\\x9ah5\\x87\\xd1\\xf0\\x1e0\\x19wg|#g\\x94\\x1f\\xfd\\xfa\\xa0\\x14!\\x99\\x10\\xe5\\xa3\\x06o\\xab\\xca\\x94\\x1c\\x1e\\x00\\x1d\\xff\\x95\\x89\\x94\\x95\\x80\\xffvy\\x86\\x0b\\xf0?\\x98\\xf2\\xd3ln&s:!\\x8at\\x00x\\xd9lefc.\\x97e~\\xa1r\\x1e\\xdd\\xb7\\x14\\x87q\\xd7\\x14\\xfb\\xe1bw\\x17j\\xf2\\xdd\\xed&z\\x83\"<v\\xe5\\%\\xc0\\x12\\xa1^\\x02\\xed\\xf8\\xf2\\x89n\\xf1\\x18\\xf2&\\xaa\\xb9jcx\\xa4\\xa5e\\xc0\\x1fc\\x9a\\x9c \\xe2l\\xb3\\x87\\x85\\x8a\\xe9\\xae\\xcd\\xf1\\xd7\\x9e\\x9d*\\x93a\\xe3\\xfct\\x88\\x06\\x9e\\xa2x\\x89\\xc9x*\\x86\\xc4!\n\\xcf\\x14u \\xd6\\x8d\\xb2\\xa2\\xc4\\xcc\\xe2\\x1c\ng\\xdbl\\x06\\xd4l$\\xac\\x0c\\x12kv/\\x00\\x81\\xcber\\x82\\xa8\\xa6\\xd18\\xf2\\xe4\\xc7!\\xfb\\x7f\\x0c\\x12\\x0cn\\xa3g\\xce\\x19\\x88\\xa4\\xa0$\\xa4?\\xaa\\xd5\\xf77\\x0c/l\\xbedp\\x7fu\\x9f:\\x86\\xc5\t\\x15"
  621. },
  622. {
  623. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x04\\xbf[\\xd8\\xdb@\\xec\\xc0\\xec\\xb3b\\x0f\\xeaka\\xac\\xc5\\x08m\\x17\\xf3\\xb4h\\xd4\r\\xb5c\\x99\\xe0\\x1d\\xce\\xbdtb\\xa3&\\xfb\\xc2\\x19\\xc0\\xee\\x1a\\x9c\\x92g\\xa9\\x86\n6q\\xc8n-\\x10j\\x0e\\xb2\\xfd\\xdd\\xb7\\x90\\xd2\\xffj\\xdbw\\x18\\xdfddf\\xc0d\\x94&\\x95\\xca$\\x8c{p\\xb4\\xda\\x92u\\xabp\\x08\\xd4\\x80b\\x02$w\\xdb\\xed\\x82(y\\x9b\\xbc\\xb9\\xbes\"a\\xc6z\\xed\\x12\\xf0\\xb4\\xd1\\x8c\\xe2\\xf8\\xe5j{9\\xcas\\xfb\\xdf\\xe7\\x8fy\\xf66\\xbd{\\xdb\\x81\\x01a\\xb6\\xdb\\xd3\\xf7\\x05`g?\\xe7g]\\xdd\\xdc\\xfcnyh\\x0eqp\\xe2{\\x12?,\\x9ewn\\xf0\\xc1\\x81-v\\xf0\\x0c\\x9d\\xdfc\\xa5\\xb0\\xf9y'd\\xbf a\\xfd\\xa0\\x8c\\xe5\\x97\\xff\\xca\\xfa_0+ndw\\x14\\x82\\x83\\x06\\xea\\xc97\\x1a\\xe1u\\x8f~\\xeb,\\x12\\xa0e\\xa2\\xac0\\xd0\\xee\\x83\\xe7\\x98\\xf7\\x13\\x01\\xee\\x8d\\x07u5\\x01\\xcfe\\x16\\xe2c\\x12\\xf6?\\xabr)\\xef\\xf8\\x00\\x15\\x1b\\x8c8'\\xb2"
  624. },
  625. {
  626. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85b\\xbe\\xb2\\x96\\xf2/:\\xe7\\xe2\\x19g{rqcl/$\\xbc\\xf2x\tl^\\xe6\\x00\\x1b\\xe7y.\\xbd\\xf7\\x97`\\xf2\\xd3\\x8d\\xbba\\x93\\x88nxv\\xcf\\xd2w\\xc8\\xf4\\xcb]z\\xd6\\xf0n2\\xf7\\xc4{7y\\xa6_\\x11\\x89\\xa6$\\xf4\\xfd\\xab![\\xd4*[\\x1b\\x03\\xf1\\xb2^\n\\xde\\xa1:\\xba\\xd9\\xb8@\\xe3g\\xc5l2_\\xac4\\xe5w\\xe4\\x80m\\xf1\\xfe\\xa2\\xbal\\xaa\\xb0\\x9c\\xa1(\\x923\\xfe\\xd8\\x9a\\x1f\\x05\\x16\\xd1\\x9d\\x17\\x86\\x0em\\x9f\\xe1\\x10\\xc9\\x13x\\x87\\xd4\\xb3\\xe2^q\\xd6\\xdd\\xca\\x8a\\x05g2\\xf2d\\xd0\\x17\\x1d-\\x07\\x82\\xa8\\x1bpe\\x00\\xd2g\\xcbv}\\xbb\\xf2\\x19\\xfd${\\xe1\\x81\\x96`\\xba\\xbb\\xc17\\x9f\\x9f&\\xe8\\xf5\\x1d\\xa0\\x81\\xd9\\x1e\\x11\\xac6\\xde\\xdeq!\\xd2\\xce\\x0f\\x9c\\x1d1\\x0e\\xf2=d\\x10\\xe7\"\\x12|a\\x89\\xe9\\xf1q\\xd2\\xc1\\xa2g\\xddel\\x8f\\x89y4g\\xe0=\\xffal-\\x8e\tr\\x86\\xfe4!\\x94\\xb1\\xc6\\xf9l\\xaf\\xc5\\x1e!\\xb0z\\xfb"
  627. },
  628. {
  629. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x849\\x18\\xc1\\xa3\\xee\\xf5\\x92\t\\xbc\\xd0\\xda\\x0bvtbm\\x92a\\x9a\\xf8\\xea\\xacp1\\x1c(\\xae^\\xbb!a\\x84\\x8d\\xad\\xe3\\xef\\xb2\\xa1=\\xca;\\xcd\\xcb\\x130:\\xd0\\xc9\\x95\\xc2\\x14x\\xa9\\xc1\\xef8\\x17\\xe1}*\\x96%\\xc7^\\x06c\\xed\\x06\\x83\\xd8\\xd6\\xa8^\\xf7\\x15\\x9b\\x93\\xee\\x08\\xf7cw\\xec\\xfb\\x00\\x0ejx\\x02\\xd8wdn>\\x94nc\\xa1\\x19w9\\x84=z\\xf2dyc\\x0f^=\\xa1\\x17\\xb1\\xf5'>sf\\xe1\\xc7j\\x16\\xe5+y\\x82\\x03$<\\xa3\\xfe\\xed\\x10g\\xae\\xabi\\xd9\\xea\\xea\\xe8ni\\x04\\xaf\\xe8\\xad\\xaf\\x86\\x06\\xb3\\x9bcx\\xe6\\xdf\\x9ev,f\\xa0\\x07\\xf1\\xe7\\xb0<\\x9c\\xa9\\x01o\\x07\\xa5\\xb0\\xe6)f\\x95\t\\x87\\x8a6\\x9c\\xc0\\x94\\xf0c\\x03\\xb5\\xb1\\xba\\xb2\\xa8!\\xfb#\\x08\\xcc\\xff=\\x1a:\\xc4\\x8d\\xe0\\xdaw\\x1f\\x00\\xf0\\xb2\\x0cgt/\\xdd}\\x01\\x8ey=\\xc2#y\\x92l\\x13\\x85n\\xba\\x0e\\x97w\\x8c':x\\xc7:\\xf0\\xc5\\x87w\\xb1(\\x1b\\x1af\\xa5"
  630. },
  631. {
  632. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08\\x8ah\\x1e3\\xd2\\xbb\\x13\\x914\\x8a\\x0cpx\\x17\\xc5>\\x0c.n\\x9de\\x04dq\\xed\\xe1u\\x84\\x90\t5\\xc2c\\x1djw\\xd2z\\xd0\\x93o\\x871dq\\xc2\\xcf\\xcc6\\x9a,k\rz?\\xf3nmqo\\x8c\\xc6\\xcb\\xed\\xda\\x99\\xca\\x07\\xe7\\xe7\n\\x0c\\xe9\\xcfd\\x02b\\xdb.j*\\xeen'\\x8ck\\xe6\\xffx\\x94\\x8f3\t\\x90\\x0ey\\xd7&\\xd2,\\xe8c\\xa9\\x8c\\xe9\\x98n\\xfe-\\xa93-\\x1b\\xc2\\x98a\\x1d\\x07\\xb4\\x1a\\x1b\\xff\\x12&\\xc6b\\xd78\\xec\\x13\\xc5\\xf4\\x04\\xf3h\tw#\\xd4t\\xfc#\\xa7'\\x7f8'+\r\\xc7\\x03\\xc2\\xe8\\xa1\\x08ol\\xd4@\\xc6\\xab\\x8f\\xbf\\x10\\xf29\\xbbyc4\\xf4\\x06\\x01\\x1e\\xd7\\x1b+:\\xd4\\xb9l\\x0c\\x989\\xf4\\x0c\\xda\\xba\\xd7r\\xf6x\\xaea\\xc10_\\xac\\x03\\xc9=\\x9fp\\xc2\\x982bj\\xbc\\x9d\\xcf\\xe9!\\xb2\\xc5l\\x10\\xb7\\xa0\\x93q\\xec[\\xd7\\x9a7\"\\x0e|p{\\xbe\\x97\\xd6\\x98y'\\xd4\\x8b\\x0c\\x90\\x106\\x1e\\x89z\\xf6\\xb7\\xd4\\x96"
  633. },
  634. {
  635. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\xb6\\xd1]\\x00\\xc6\\xe9t\\x1f\\x851)\\xcf\\x81ut4a\\xe4\\xbf\\xd5\\x8d\\xa9b\\xd1\\xc7`\\xfch\\xb5x\\xc7\"\\xc4\\xd7u\\xa7\\xc3\\x0e~\\x11z#\\x1d\\x19\\x18\\xe7\\xc6\\x9b\\xb9\\xb4\\xcek(\\xc6\\xbd\\xc7\\xbf;k\\xdd\\xef\\x1b\\x1b\\xef\\xd9\\xf4\\xb4\\xc43dr#\\xc2ru\\x13\\xc1\\xc8\\xda\\xcf<*\\x17w\\xe6`im\\xbcq\\x06i\\x12#c8\\x80\\xb5\\xa7\\x1c\\xc4\\xf7t2\\xe1\\xc6\\x88f|`\\x97\\xe2)\\xd8\\xc1\\xf1\\xe2\\xa1]\\x9c\\xc2\\xd2}rza3\\xeea\\xc4\\xe1\\xcf\\xd7\\x8f\\xbfj{\\xce1i\\xde\\xf5~+\\x0e\\x07\\x9a\\xde\\xca\\x9d\\x8e\\xee0$\\x8f5\\x9b4\\xf0\\xdf\"\\x96\\xb9o|5`\\xb8\\xb0<\\xae$\\xd0\\xdb\\x9b\\xb5g\\x1d\\xfa\\xbc\\xd7\\xd0\\x10aho\\xdb\\xac\\xf5\\xaf6\\xbev\\x1d\\xd7\\xd0\\xc0\\x16\\xda \\xe9\\xd5\\x9fy\\xef\\xff\\xa1\\xe3w\\xf7\\xac\\xca\\xc9\\xa5=\\xcc\\x95\\x88\\x8d\\xfd\\xa1\\xce\r\\xda\\xa0\\xac%y}\\x85\\xf9\\xe8\\xa5\\xf9|?\\xe5\\xf0p\\x91\\xcdwg\\xa25\\x16\\xdd\\xcf\\xdd\\xcd"
  636. },
  637. {
  638. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xed\\x90\\x1e\\xcb\\xf9dy'\\x84\\xa0\\xa40n\\xa9a\\xb6g\\xccg\\xc55\\xcb:\\x0c\\xea\\xae\\xb3w\\xf9\\xf2\\xc3m$s\\xd5)\\x1b:\\xb1\\x97og\\xb2p\\xdc\\xe4c\\x15a\\x01,\\x8a9\\x83\\x04,\\x8b\\x95\\xa0(\\xd1\"\\xa0\\x13\\xe0\\xc9\\x1f\\xfa \\x1e\\xc0\\xf3\\xe3\\xc6\\x03_rc\\x01\\x9a$\\x8fx>\\xc4k\\x1b\\x90\\xe2\\xe7\\x800\\x1b@\\x01p\\x071m\\xaa\\xbb/\\xc3@\\xbfz\\xa7q\\x88\\xb7ob\\x90\\x10\\xde\\xc2\\x95\\x18\\x95\\xd7y\\xf7?w\\x8en\\x9e\\x1fw\\x9d\\xe0\\x99_\\x90>j\\xcb\r\\x8deb/x6\\xc9:&\\x10!l]\\xc6gyk5~\\xe9:\\xc2u\n\\x1ee\\xe7\\xa4\\x1d\\xa9\\xd7j\\xc5\\xf3\\x0ci\\x01\\xa6\\x94\\x1d\\xa9\\x01\\xd4o\\xb3\\x82\\xcb\\x80\\xb2\\x02{c\\xf1\\x9eff!n\\xf9\\x8a\\xb5\\xe8\\x82g\\xbb\\xdfl\\xcc\\xa4\\xab\\xa3\\xf8\\x8ei\\xe0\\xad\\x9dc\\x88:`\\x10\\c\\x0e]\\x95\\x9e\\x10z\\x88\\xc0\\xb3o\\x8av\\xe7$\\x01\\xcfz,\\xd6\\xaf\\x07c\\x00\\xcew=\\x97^1"
  639. },
  640. {
  641. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0n\\xb3\\x06\\xf2hh]\\xe6\\x87\\xfbs2\\x80c\\xb2\\xfe\\x16\\x97\\xe9\\xe8\\x7fj\\x8d\\x86y\\xfd,70\\xc9\\xef!\\xd3e?vdx\\x96\\x8f\\xf5\\x1c\\x17\\xf9\\xc8n\\xb2\\xea`\\x9f\\xdcj\\xbe\\x01\\x80\\x89\\xa3\\xfe\\xe3or\\xcc\\xca\\xc4\\xed\\xc3\\xec~!p^\\xfe\\x82\\x043\\xa9_\\x98\\x14fo\\xa4\\x83\\xfe\\x0f\\xc0\\xdc>\\xab.f\\x12\\x07\\x85\\x98\\xfe}\\xf1\\x12\\x8cn\\x8f-\\xa2\\x13\\xcf\\x131\\xc3\\xc7\\x8e\\x04\\x15\\x1fx\\xc1\\xa3\\xffy\\x8b\\xe1l\\x05\\xbe\\xe2\\xef+\\xf7\\xdb\\xa3\\x8a\\xd5\\xbd\\x0b\\x88\\xb4m\\xcd\\x92u^#\\x83r\\xe0c\\xac\\xe7\\xc9\\xad\\xe5\\xcc\\x80\\x89%\\xb40\\xe7o\n\\x1d\\xabh]w\\xaeb\\xb5\\xbeh\\xc7\\x15\\x00\\xb4\\xa6p\\xec{\\xc0\\x9b\\x83\\x89\\xb0\\xc2\\xbeu\\xb2r#\\xb0\\xf5\\xc3\\x88\\xe2\\xf8\\x1at\\x9d\\xd2\\x85\\xb0\\x17,\\xec\\xcd\\x02 8\\x17\\x19y\\xf6'\\xa0b>\\x0f\\x06\\xfc{\\x9d\\xd2^\\xce\\x19\\xa6\\xae\\xe1\\xce9/gk\\xbc\\xac\\xcf\\xaf-\\x80x\\xce\\xa7\\xf6\\xf5l\\xdfb\\xc9\\x92\\xac"
  642. },
  643. {
  644. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  645. },
  646. {
  647. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x08\\x0b\\xc5u\\xc7\\x11\\xcdrq\\xad\t\\xc3\\x86j3\\xdf\\xc9\\xea\\xc5\\x80\\xb6\\xb3\\xffr\\xe8:x\\x02tr&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  648. },
  649. {
  650. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00_\\xe5\\xc2^_\\xd0\\x8c\\xe2\\xce\\xed\\xbc\\x87\\xe7\\xa0\\xb0xt\\xcbr.q\\xe8?\\xba\\xa7\\xe0hm\\xef\\xbf\\xda\\x9b&\\xce\\x15&\\x0b\\xc8nm\\xdd_\\xbd\\xae\\xcd/~\\\\x19\\xb6\\xc3\\x84=0\\xe26\\xeab(\\x15\\xf4\\xd5aku\\xdc\\x99\\x84\\xc6\\x8f\\x8d\\xc0^l\\xbdqy\\xa5?\\x16\\xab^\\x05/\\x18tt\\x0e\\xbeup\\xbcsj\\x12\\x16r\\x91\\x8d\\xc7\\x91nh\\xae\\xb2\\x97\\xd9\\xf5\\x1d\\xb1\\x14\\xd2\\xd2]\\xe6\\x12ne\\x1e\\xcb\\xe5\\xd5\\x02\\xa6\\xc5\\x8cck/\\x1e\\xe1ib.\\xdd\\xed.\\xfc\\xc2\\x8fkf\\x14\\xe9\\xe8\\x80y\\xe0\\xfb`\\x13\\xca\\x85\\xd1\\xa3\\xf8ej\\x97\\x9f\\x95\\x7f=\\xd9=e\\xe1;o\\x9c}w\\xe8\\x98\\xc3(3\\x8a\\xe1\\xf8p(\\x05\\x88v\\xa4,\\x19\\xda\\xf0\\xe2\\xb9k\\xaa}zhgt\\xf3ze\\x02\\xe4vl~v\\x89\\x06\\x899\\x9b\\xdc1\\xec\\x81\\xd7\\xb3'\\xd2\\xfe\\x89\\xf4\\xabg\\xea\\xc5d\\xa0a\\xf4\\xc7\\x9c\\xac\\x14\\x9ew}\\xe2\\xbec\\xac\\xce\\xa8"
  651. },
  652. {
  653. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x17v\\xa2\\x1b\\xb2\\xfe~\n3z\\xe3,\\x87<\\xeaa\\x99p\\x98\\xdf\\xb5a\\x0c\\x9eno5?\\xf3\\xfc\\x88(j#y\\xc4\\xb4|\\xf8\\x1bs\\x8e\\x0flpb\\xc6sz)\\xe6\\xb8\\x94-\\x93_v\\xb6\\x1a\\xb5\\xad\\x03%\\x11&\\xcd\\xb5\\xb5\\x92n\\xb3\\xf1|\\x95s|pg\\xa6z\\x85\\xd7\\xfd0\\xd6x\\x84m\\x92\\x9d\\xb6%\\xf1b\\hz==5t\\xbbe\n\\x0c\\xf2\\xf6\\x96f\\x85\nkd\\xa5{\\xe0\\x9f\\xc7\\x86\\x9e\\xd2\\xc3\\x1d\\x1c\\xa6\\xc7w)\\x8f\\x16\\x1c\\xe2\\xbb\\xabb\\x05i6\\xd6a{\\x9a\\xcc\\xc6\\xc6\\xbc\\x9f'\\xf2\\xc7-;\\xd9\\xdb\\xc9s\\xcc\\xa0\\xaf\\x82)k\\x14\\xe3\\xdbh\\x84[oky\\xef\\x0e\\xc4\\xb8\\xddr\\x99\\xf8\\}m\\xf6\\xf5%>\\xaf\\xb5\\x82\\xd7\\x1c\\xa3z\\xe5l)\\x92\\xb33`\\xb5k)\\x83>9\\xc6\\x18-\\xa5\\x93\\x06\\xac\\x90\\x93\\xbd)\\xf2\\x02\\xf4\\xf60r\\xd7\\xc0\\x89\\xf7\\x00\\xbeb7}sy\\x89\\xe0\\x8e\\x9b\\x86\\xd9\\xd0=av,\\xbfj\\xbb\\xba\\x11\\x0f"
  654. },
  655. {
  656. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x99d\\xa7\\xc4w\\xbc\\x1a\\xa5\\x1da\\x8a[\\xd1`\\xd5\\x08w\\xc7x\\x87.\\xca\\x0e\\xfa\\xf7d\\x1ax\\xed\\xa8\\xc2\\x87\\xcb\\xb4\\xe5z\\xbc\\xf6\\xe3\\xbe\\xaa\\x1d\\x91\\x9a\\x9c\\xca:\\xe5\\xda\\x88v\\x9a\\x8e8\\x87\\xfc\\xbdo\\xd3\\xb7\\xb5\\x86\\x86\\xe32\\x95\\xe0x\\xe3&\\xaf\\xc31\\xf3wx\\xed\n\\xe3j\"\\x85\\xae5t\\xcd\\xd6\\xa5\\x18\\x8f\\xc0\\xe4j\\xaba:\\xad\\xb5{\\xe8\\xbf6r\\xfc\\x16,\\\\xd3k\\x8c\\xd0jt\\x1dqk\\x04\\x17&\\x84~x\\xe2\\x04\\x12\\xcb\\xb86)\\xbb\\x17\\x0c?\\x8a\t5`\\x92\\xa7\\x9b\\xff\\xe9\\x8d\\xd8\\xa8\\x949\\x9f\\\\x01\\x8e\\x0bh\\xd6\\x10*\\xcb\\x8d\\xb6\\x96\\xae\\x82\\x10\\x1ee\\xb6\\xb1\\xef\\xd6\\x8e\\x7fz\\xe3\\xe7+\\xd4\\x88\\x19\n!p\\xb9\\xf2i\\x98\\x94\\x15\\x8a2\\xdf\\xbc\\x17\\x9b,,b\\x1a\\xe7\\xbe\\xcb&\\xdb\\x84\\x17#\\xf0b\n\\x88\\x82\\x9b\\xee`\\xf5\\x15'|2\\xc5\\xd3\\xf4#zo}\\xb1u\\xcb\\xa9\\x1eo}f\\xc1\\x02\\x9dn\\xa9\\x00\\xe3:\\x9d\\x04im\\xa8,\\xc5}\\xea\\xeb"
  657. }
  658. ]
  659. },
  660. {
  661. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  662. "Details": [
  663. {
  664. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  665. },
  666. {
  667. "McAfee": "Exploit-CVE2017-11882.yx"
  668. },
  669. {
  670. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  671. },
  672. {
  673. "Avast": "Win32:ShellCode [Expl]"
  674. },
  675. {
  676. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  677. },
  678. {
  679. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  680. },
  681. {
  682. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  683. },
  684. {
  685. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  686. },
  687. {
  688. "Sophos": "Troj/RtfExp-EQ"
  689. },
  690. {
  691. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  692. },
  693. {
  694. "DrWeb": "Exploit.ShellCode.69"
  695. },
  696. {
  697. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  698. },
  699. {
  700. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  701. },
  702. {
  703. "Cyren": "CVE-2017-11882.E.gen!Camelot"
  704. },
  705. {
  706. "Avira": "EXP/CVE-2017-11882.Gen"
  707. },
  708. {
  709. "Microsoft": "Trojan:O97M/Obfuse.AE"
  710. },
  711. {
  712. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  713. },
  714. {
  715. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  716. },
  717. {
  718. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  719. },
  720. {
  721. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  722. },
  723. {
  724. "ALYac": "Exploit.CVE-2017-11882.Gen"
  725. },
  726. {
  727. "MAX": "malware (ai score=87)"
  728. },
  729. {
  730. "Zoner": "Probably W97NativeOnly"
  731. },
  732. {
  733. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  734. },
  735. {
  736. "Ikarus": "Exploit.CVE-2017-11882"
  737. },
  738. {
  739. "Fortinet": "MSOffice/CVE_2017_11882.BB!exploit"
  740. },
  741. {
  742. "AVG": "Win32:ShellCode [Expl]"
  743. },
  744. {
  745. "Qihoo-360": "virus.exp.21711882.d"
  746. }
  747. ]
  748. },
  749. {
  750. "Description": "Created network traffic indicative of malicious activity",
  751. "Details": [
  752. {
  753. "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
  754. },
  755. {
  756. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
  757. },
  758. {
  759. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
  760. },
  761. {
  762. "signature": "ET TROJAN LokiBot Fake 404 Response"
  763. },
  764. {
  765. "signature": "ET TROJAN LokiBot Checkin"
  766. }
  767. ]
  768. }
  769. ]
  770.  
  771. [*] Started Service: [
  772. "osppsvc"
  773. ]
  774.  
  775. [*] Executed Commands: []
  776.  
  777. [*] Mutexes: [
  778. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  779. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  780. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  781. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  782. "CicLoadWinStaWinSta0",
  783. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  784. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  785. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  786. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  787. ]
  788.  
  789. [*] Modified Files: [
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_294a0b9a202b662129d38bdb6eacf04f.doc",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_294a0b9a202b662129d38bdb6eacf04f.doc",
  792. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{C5739007-B37B-47EC-B51F-736EC1C0B35D}.tmp",
  793. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  794. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  795. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  796. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  797. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\CabE91B.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\TarE91C.tmp",
  800. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1E20F036-962F-4C7B-B3B7-CAD37CE011F5}.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BD.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5ED.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62D.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab64D.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\cab796.tmp",
  806. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  807. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FE.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FF.tmp",
  810. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E.tmp\\Element design set.dotx",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E.tmp\\Content.inf",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98E.tmp\\pictureorgchart.glox",
  814. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  815. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98E.tmp\\Content.inf",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC.tmp",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C.tmp\\chicago.xsl",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8B.tmp\\content.inf",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8B.tmp\\View.thmx",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C.tmp\\Content.inf",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2C.tmp\\RadialPictureList.glox",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2C.tmp\\Content.inf",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE27.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5.tmp\\Headlines.thmx",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5.tmp\\Content.inf",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\cab107B.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cab107C.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1280.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1291.tmp\\content.inf",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1291.tmp\\Quotable.thmx",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cab130F.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AD.tmp\\Badge.thmx",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1320.tmp\\Berlin.thmx",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14A9.tmp",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1320.tmp\\content.inf",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD146A.tmp\\Crop.thmx",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14C9.tmp\\ThemePictureAlternatingAccent.glox",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD146A.tmp\\Content.inf",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AD.tmp\\Content.inf",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cab16CE.tmp",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14C9.tmp\\Content.inf",
  853. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17CA.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17AA.tmp\\content.inf",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17AA.tmp\\Savon.thmx",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18C5.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1914.tmp\\content.inf",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19C2.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1914.tmp\\Droplet.thmx",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19B1.tmp\\Circuit.thmx",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1B59.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1C07.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1B5A.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19B1.tmp\\content.inf",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CB5.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1C08.tmp",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1DCF.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1DD0.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E3F.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E70.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E81.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E40.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E71.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E82.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F00.tmp\\content.inf",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F00.tmp\\Slate.thmx",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F20.tmp\\content.inf",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F21.tmp\\Feathered.thmx",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F20.tmp\\Main_Event.thmx",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab202C.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F21.tmp\\Content.inf",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21F2.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21F3.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2252.tmp\\Insight design set.dotx",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2252.tmp\\Content.inf",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab239B.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2448.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2449.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C7.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C8.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24F8.tmp\\content.inf",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24F8.tmp\\Damask.thmx",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E5F.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2F3B.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2F3C.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F7B.tmp\\content.inf",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F7B.tmp\\Vapor_Trail.thmx",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  909. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  910. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{78C8CCAE-9A9E-414B-9B55-D2F1EF86D1CE}.tmp"
  911. ]
  912.  
  913. [*] Deleted Files: [
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\CabE91B.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TarE91C.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475[[fn=Frame]].eftx",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475[[fn=Frame]].xml",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491[[fn=Metropolitan]].eftx",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430[[fn=Banded]].eftx",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485[[fn=Mesh]].eftx",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475[[fn=Frame]].xml",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491[[fn=Metropolitan]].xml",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444[[fn=Basis]].xml",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430[[fn=Banded]].xml",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464[[fn=Dividend]].eftx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  932. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434[[fn=Wood Type]].eftx",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485[[fn=Mesh]].xml",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491[[fn=Metropolitan]].xml",
  935. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464[[fn=Dividend]].xml",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485[[fn=Mesh]].xml",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464[[fn=Dividend]].xml",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444[[fn=Basis]].xml",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430[[fn=Banded]].xml",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434[[fn=Wood Type]].xml",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434[[fn=Wood Type]].xml",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FE.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FF.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98E.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD95E.tmp\\Element design set.dotx",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98E.tmp\\pictureorgchart.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab796.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8B.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BD.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C.tmp\\chicago.xsl",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8B.tmp\\View.thmx",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5ED.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2C.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2C.tmp\\RadialPictureList.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62D.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB5.tmp\\Headlines.thmx",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE27.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1291.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1320.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AD.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1291.tmp\\Quotable.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD146A.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14C9.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1320.tmp\\Berlin.thmx",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cab107B.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD146A.tmp\\Crop.thmx",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cab107C.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AD.tmp\\Badge.thmx",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17AA.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cab130F.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1280.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14C9.tmp\\ThemePictureAlternatingAccent.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab64D.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1914.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17AA.tmp\\Savon.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19B1.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14A9.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1914.tmp\\Droplet.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1B59.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19B1.tmp\\Circuit.thmx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab16CE.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1B5A.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1C07.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17CA.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1C08.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1DCF.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1DD0.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E3F.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E40.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E70.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1E81.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E71.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1E82.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F00.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F21.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F20.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F00.tmp\\Slate.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18C5.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F21.tmp\\Feathered.thmx",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F20.tmp\\Main_Event.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19C2.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CB5.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21F2.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21F3.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2252.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2252.tmp\\Insight design set.dotx",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab202C.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2448.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2449.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C7.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C8.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24F8.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24F8.tmp\\Damask.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\cab239B.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2F3B.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2F3C.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F7B.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F7B.tmp\\Vapor_Trail.thmx",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E5F.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_294a0b9a202b662129d38bdb6eacf04f.doc",
  1025. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1E20F036-962F-4C7B-B3B7-CAD37CE011F5}.tmp",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1027. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{78C8CCAE-9A9E-414B-9B55-D2F1EF86D1CE}.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRDB9D.tmp.cvr"
  1029. ]
  1030.  
  1031. [*] Modified Registry Keys: [
  1032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\a! ",
  1033. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F77A6F",
  1055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F77A6F\\F77A6F",
  1056. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1354. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1647. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1667. ]
  1668.  
  1669. [*] Deleted Registry Keys: [
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\a! ",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-e~",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F77A6F\\F77A6F",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1713. ]
  1714.  
  1715. [*] DNS Communications: [
  1716. {
  1717. "type": "A",
  1718. "request": "blogmason.mixh.jp",
  1719. "answers": [
  1720. {
  1721. "data": "150.95.52.111",
  1722. "type": "A"
  1723. }
  1724. ]
  1725. },
  1726. {
  1727. "type": "A",
  1728. "request": "exsimpetroleum.com",
  1729. "answers": [
  1730. {
  1731. "data": "101.100.204.200",
  1732. "type": "A"
  1733. }
  1734. ]
  1735. }
  1736. ]
  1737.  
  1738. [*] Domains: [
  1739. {
  1740. "ip": "150.95.52.111",
  1741. "domain": "blogmason.mixh.jp"
  1742. },
  1743. {
  1744. "ip": "101.100.204.200",
  1745. "domain": "exsimpetroleum.com"
  1746. }
  1747. ]
  1748.  
  1749. [*] Network Communication - ICMP: []
  1750.  
  1751. [*] Network Communication - HTTP: [
  1752. {
  1753. "count": 1,
  1754. "body": "",
  1755. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1756. "user-agent": "Microsoft-CryptoAPI/6.1",
  1757. "method": "GET",
  1758. "host": "ocsp.digicert.com",
  1759. "version": "1.1",
  1760. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1761. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1762. "port": 80
  1763. },
  1764. {
  1765. "count": 1,
  1766. "body": "",
  1767. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1768. "user-agent": "Microsoft-CryptoAPI/6.1",
  1769. "method": "GET",
  1770. "host": "ocsp.msocsp.com",
  1771. "version": "1.1",
  1772. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1773. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1774. "port": 80
  1775. },
  1776. {
  1777. "count": 1,
  1778. "body": "",
  1779. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1780. "user-agent": "Microsoft-CryptoAPI/6.1",
  1781. "method": "GET",
  1782. "host": "ocsp.usertrust.com",
  1783. "version": "1.1",
  1784. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1785. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1786. "port": 80
  1787. },
  1788. {
  1789. "count": 1,
  1790. "body": "",
  1791. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1792. "user-agent": "Microsoft-CryptoAPI/6.1",
  1793. "method": "GET",
  1794. "host": "ocsp.comodoca.com",
  1795. "version": "1.1",
  1796. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1797. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  1798. "port": 80
  1799. },
  1800. {
  1801. "count": 5,
  1802. "body": "",
  1803. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1804. "user-agent": "Microsoft-CryptoAPI/6.1",
  1805. "method": "GET",
  1806. "host": "crl.microsoft.com",
  1807. "version": "1.1",
  1808. "path": "/pki/crl/products/microsoftrootcert.crl",
  1809. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1810. "port": 80
  1811. },
  1812. {
  1813. "count": 1,
  1814. "body": "",
  1815. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1816. "user-agent": "Microsoft-CryptoAPI/6.1",
  1817. "method": "GET",
  1818. "host": "crl.microsoft.com",
  1819. "version": "1.1",
  1820. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1821. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1822. "port": 80
  1823. },
  1824. {
  1825. "count": 2,
  1826. "body": "",
  1827. "uri": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php",
  1828. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  1829. "method": "POST",
  1830. "host": "exsimpetroleum.com",
  1831. "version": "1.0",
  1832. "path": "/wp-content/admin/Panel/five/fre.php",
  1833. "data": "POST /wp-content/admin/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: exsimpetroleum.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: DEAAB24\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  1834. "port": 80
  1835. },
  1836. {
  1837. "count": 5,
  1838. "body": "",
  1839. "uri": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php",
  1840. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  1841. "method": "POST",
  1842. "host": "exsimpetroleum.com",
  1843. "version": "1.0",
  1844. "path": "/wp-content/admin/Panel/five/fre.php",
  1845. "data": "POST /wp-content/admin/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: exsimpetroleum.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: DEAAB24\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  1846. "port": 80
  1847. },
  1848. {
  1849. "count": 1,
  1850. "body": "",
  1851. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1852. "user-agent": "Microsoft-CryptoAPI/6.1",
  1853. "method": "GET",
  1854. "host": "ocsp.digicert.com",
  1855. "version": "1.1",
  1856. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1857. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1858. "port": 80
  1859. },
  1860. {
  1861. "count": 1,
  1862. "body": "",
  1863. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1864. "user-agent": "Microsoft-CryptoAPI/6.1",
  1865. "method": "GET",
  1866. "host": "ocsp.digicert.com",
  1867. "version": "1.1",
  1868. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1869. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1870. "port": 80
  1871. },
  1872. {
  1873. "count": 1,
  1874. "body": "",
  1875. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1876. "user-agent": "Microsoft-CryptoAPI/6.1",
  1877. "method": "GET",
  1878. "host": "ocsp.digicert.com",
  1879. "version": "1.1",
  1880. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1881. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1882. "port": 80
  1883. },
  1884. {
  1885. "count": 1,
  1886. "body": "",
  1887. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe",
  1888. "user-agent": "Microsoft BITS/7.5",
  1889. "method": "HEAD",
  1890. "host": "redirector.gvt1.com",
  1891. "version": "1.1",
  1892. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe",
  1893. "data": "HEAD /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  1894. "port": 80
  1895. },
  1896. {
  1897. "count": 1,
  1898. "body": "",
  1899. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1900. "user-agent": "Microsoft BITS/7.5",
  1901. "method": "HEAD",
  1902. "host": "r6---sn-a5mekney.gvt1.com",
  1903. "version": "1.1",
  1904. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1905. "data": "HEAD /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1906. "port": 80
  1907. },
  1908. {
  1909. "count": 1,
  1910. "body": "",
  1911. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1912. "user-agent": "Microsoft BITS/7.5",
  1913. "method": "GET",
  1914. "host": "r6---sn-a5mekney.gvt1.com",
  1915. "version": "1.1",
  1916. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1917. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=0-6329\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1918. "port": 80
  1919. },
  1920. {
  1921. "count": 1,
  1922. "body": "",
  1923. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1924. "user-agent": "Microsoft BITS/7.5",
  1925. "method": "GET",
  1926. "host": "r6---sn-a5mekney.gvt1.com",
  1927. "version": "1.1",
  1928. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1929. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=6330-17595\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1930. "port": 80
  1931. },
  1932. {
  1933. "count": 1,
  1934. "body": "",
  1935. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1936. "user-agent": "Microsoft BITS/7.5",
  1937. "method": "GET",
  1938. "host": "r6---sn-a5mekney.gvt1.com",
  1939. "version": "1.1",
  1940. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1941. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=17596-28267\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1942. "port": 80
  1943. },
  1944. {
  1945. "count": 1,
  1946. "body": "",
  1947. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1948. "user-agent": "Microsoft BITS/7.5",
  1949. "method": "GET",
  1950. "host": "r6---sn-a5mekney.gvt1.com",
  1951. "version": "1.1",
  1952. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1953. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=28268-38903\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1954. "port": 80
  1955. },
  1956. {
  1957. "count": 1,
  1958. "body": "",
  1959. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1960. "user-agent": "Microsoft BITS/7.5",
  1961. "method": "GET",
  1962. "host": "r6---sn-a5mekney.gvt1.com",
  1963. "version": "1.1",
  1964. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1965. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=38904-61504\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1966. "port": 80
  1967. },
  1968. {
  1969. "count": 1,
  1970. "body": "",
  1971. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1972. "user-agent": "Microsoft BITS/7.5",
  1973. "method": "GET",
  1974. "host": "r6---sn-a5mekney.gvt1.com",
  1975. "version": "1.1",
  1976. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1977. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=61505-108880\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1978. "port": 80
  1979. },
  1980. {
  1981. "count": 1,
  1982. "body": "",
  1983. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1984. "user-agent": "Microsoft BITS/7.5",
  1985. "method": "GET",
  1986. "host": "r6---sn-a5mekney.gvt1.com",
  1987. "version": "1.1",
  1988. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1989. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=108881-198719\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  1990. "port": 80
  1991. },
  1992. {
  1993. "count": 1,
  1994. "body": "",
  1995. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  1996. "user-agent": "Microsoft BITS/7.5",
  1997. "method": "GET",
  1998. "host": "r6---sn-a5mekney.gvt1.com",
  1999. "version": "1.1",
  2000. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2001. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=198720-377516\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2002. "port": 80
  2003. },
  2004. {
  2005. "count": 1,
  2006. "body": "",
  2007. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2008. "user-agent": "Microsoft BITS/7.5",
  2009. "method": "GET",
  2010. "host": "r6---sn-a5mekney.gvt1.com",
  2011. "version": "1.1",
  2012. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2013. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=377517-416864\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2014. "port": 80
  2015. },
  2016. {
  2017. "count": 1,
  2018. "body": "",
  2019. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2020. "user-agent": "Microsoft BITS/7.5",
  2021. "method": "GET",
  2022. "host": "r6---sn-a5mekney.gvt1.com",
  2023. "version": "1.1",
  2024. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2025. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=416865-721711\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2026. "port": 80
  2027. },
  2028. {
  2029. "count": 1,
  2030. "body": "",
  2031. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2032. "user-agent": "Microsoft BITS/7.5",
  2033. "method": "GET",
  2034. "host": "r6---sn-a5mekney.gvt1.com",
  2035. "version": "1.1",
  2036. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2037. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=721712-1269231\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2038. "port": 80
  2039. },
  2040. {
  2041. "count": 1,
  2042. "body": "",
  2043. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2044. "user-agent": "Microsoft BITS/7.5",
  2045. "method": "GET",
  2046. "host": "r6---sn-a5mekney.gvt1.com",
  2047. "version": "1.1",
  2048. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2049. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=1269232-2042869\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2050. "port": 80
  2051. },
  2052. {
  2053. "count": 1,
  2054. "body": "",
  2055. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2056. "user-agent": "Microsoft BITS/7.5",
  2057. "method": "GET",
  2058. "host": "r6---sn-a5mekney.gvt1.com",
  2059. "version": "1.1",
  2060. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2061. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=2042870-2864832\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2062. "port": 80
  2063. },
  2064. {
  2065. "count": 1,
  2066. "body": "",
  2067. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2068. "user-agent": "Microsoft BITS/7.5",
  2069. "method": "GET",
  2070. "host": "r6---sn-a5mekney.gvt1.com",
  2071. "version": "1.1",
  2072. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2073. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=2864833-4531371\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2074. "port": 80
  2075. },
  2076. {
  2077. "count": 1,
  2078. "body": "",
  2079. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2080. "user-agent": "Microsoft BITS/7.5",
  2081. "method": "GET",
  2082. "host": "r6---sn-a5mekney.gvt1.com",
  2083. "version": "1.1",
  2084. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2085. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=4531372-6465137\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2086. "port": 80
  2087. },
  2088. {
  2089. "count": 1,
  2090. "body": "",
  2091. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2092. "user-agent": "Microsoft BITS/7.5",
  2093. "method": "GET",
  2094. "host": "r6---sn-a5mekney.gvt1.com",
  2095. "version": "1.1",
  2096. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2097. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=6465138-8698503\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2098. "port": 80
  2099. },
  2100. {
  2101. "count": 1,
  2102. "body": "",
  2103. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2104. "user-agent": "Microsoft BITS/7.5",
  2105. "method": "GET",
  2106. "host": "r6---sn-a5mekney.gvt1.com",
  2107. "version": "1.1",
  2108. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2109. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=8698504-11167423\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2110. "port": 80
  2111. },
  2112. {
  2113. "count": 1,
  2114. "body": "",
  2115. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2116. "user-agent": "Microsoft BITS/7.5",
  2117. "method": "GET",
  2118. "host": "r6---sn-a5mekney.gvt1.com",
  2119. "version": "1.1",
  2120. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2121. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=11167424-12561464\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2122. "port": 80
  2123. },
  2124. {
  2125. "count": 1,
  2126. "body": "",
  2127. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2128. "user-agent": "Microsoft BITS/7.5",
  2129. "method": "GET",
  2130. "host": "r6---sn-a5mekney.gvt1.com",
  2131. "version": "1.1",
  2132. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2133. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=12561465-14813722\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2134. "port": 80
  2135. },
  2136. {
  2137. "count": 1,
  2138. "body": "",
  2139. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2140. "user-agent": "Microsoft BITS/7.5",
  2141. "method": "GET",
  2142. "host": "r6---sn-a5mekney.gvt1.com",
  2143. "version": "1.1",
  2144. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2145. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=14813723-17360376\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2146. "port": 80
  2147. },
  2148. {
  2149. "count": 1,
  2150. "body": "",
  2151. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2152. "user-agent": "Microsoft BITS/7.5",
  2153. "method": "GET",
  2154. "host": "r6---sn-a5mekney.gvt1.com",
  2155. "version": "1.1",
  2156. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2157. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=17360377-18991973\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2158. "port": 80
  2159. },
  2160. {
  2161. "count": 1,
  2162. "body": "",
  2163. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2164. "user-agent": "Microsoft BITS/7.5",
  2165. "method": "GET",
  2166. "host": "r6---sn-a5mekney.gvt1.com",
  2167. "version": "1.1",
  2168. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2169. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=18991974-21658623\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2170. "port": 80
  2171. },
  2172. {
  2173. "count": 1,
  2174. "body": "",
  2175. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2176. "user-agent": "Microsoft BITS/7.5",
  2177. "method": "GET",
  2178. "host": "r6---sn-a5mekney.gvt1.com",
  2179. "version": "1.1",
  2180. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2181. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=21658624-24492298\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2182. "port": 80
  2183. },
  2184. {
  2185. "count": 1,
  2186. "body": "",
  2187. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2188. "user-agent": "Microsoft BITS/7.5",
  2189. "method": "GET",
  2190. "host": "r6---sn-a5mekney.gvt1.com",
  2191. "version": "1.1",
  2192. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2193. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=24492299-27186256\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2194. "port": 80
  2195. },
  2196. {
  2197. "count": 1,
  2198. "body": "",
  2199. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2200. "user-agent": "Microsoft BITS/7.5",
  2201. "method": "GET",
  2202. "host": "r6---sn-a5mekney.gvt1.com",
  2203. "version": "1.1",
  2204. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2205. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=27186257-28992392\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2206. "port": 80
  2207. },
  2208. {
  2209. "count": 1,
  2210. "body": "",
  2211. "uri": "http://r6---sn-a5mekney.gvt1.com/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2212. "user-agent": "Microsoft BITS/7.5",
  2213. "method": "GET",
  2214. "host": "r6---sn-a5mekney.gvt1.com",
  2215. "version": "1.1",
  2216. "path": "/edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes",
  2217. "data": "GET /edgedl/release2/chrome/AO3hQFiic1uW_75.0.3770.90/75.0.3770.90_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.83.40.106&mm=28&mn=sn-a5mekney&ms=nvh&mt=1560808478&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Wed, 12 Jun 2019 22:15:46 GMT\r\nRange: bytes=28992393-30355199\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r6---sn-a5mekney.gvt1.com\r\n\r\n",
  2218. "port": 80
  2219. }
  2220. ]
  2221.  
  2222. [*] Network Communication - SMTP: []
  2223.  
  2224. [*] Network Communication - Hosts: []
  2225.  
  2226. [*] Network Communication - IRC: []
  2227.  
  2228. [*] Static Analysis: {}
  2229.  
  2230. [*] Resolved APIs: [
  2231. "mso.dll.#1443",
  2232. "mso.dll.#9214",
  2233. "mso.dll.#199",
  2234. "mso.dll.#1073",
  2235. "mso.dll.#4255",
  2236. "mso.dll.#3459",
  2237. "mso.dll.#1262",
  2238. "mso.dll.#5709",
  2239. "mso.dll.#7353",
  2240. "mso.dll.#5228",
  2241. "mso.dll.#2155",
  2242. "mso.dll.#1725",
  2243. "user32.dll.RegisterWindowMessageW",
  2244. "secur32.dll.FreeContextBuffer",
  2245. "ncrypt.dll.SslOpenProvider",
  2246. "ncrypt.dll.GetSChannelInterface",
  2247. "bcryptprimitives.dll.GetHashInterface",
  2248. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2249. "ncrypt.dll.SslImportKey",
  2250. "bcryptprimitives.dll.GetCipherInterface",
  2251. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2252. "user32.dll.LoadStringW",
  2253. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2254. "ncrypt.dll.BCryptGetProperty",
  2255. "ncrypt.dll.BCryptCreateHash",
  2256. "ncrypt.dll.BCryptHashData",
  2257. "ncrypt.dll.BCryptFinishHash",
  2258. "ncrypt.dll.BCryptDestroyHash",
  2259. "crypt32.dll.CertGetCertificateChain",
  2260. "userenv.dll.GetUserProfileDirectoryW",
  2261. "sechost.dll.ConvertSidToStringSidW",
  2262. "sechost.dll.ConvertStringSidToSidW",
  2263. "userenv.dll.RegisterGPNotification",
  2264. "gpapi.dll.RegisterGPNotificationInternal",
  2265. "sechost.dll.OpenSCManagerW",
  2266. "sechost.dll.OpenServiceW",
  2267. "sechost.dll.CloseServiceHandle",
  2268. "sechost.dll.QueryServiceConfigW",
  2269. "cryptsp.dll.CryptAcquireContextA",
  2270. "cryptsp.dll.CryptCreateHash",
  2271. "cryptsp.dll.CryptHashData",
  2272. "cryptsp.dll.CryptVerifySignatureA",
  2273. "cryptsp.dll.CryptDestroyKey",
  2274. "cryptsp.dll.CryptDestroyHash",
  2275. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2276. "ncrypt.dll.BCryptImportKeyPair",
  2277. "ncrypt.dll.BCryptVerifySignature",
  2278. "ncrypt.dll.BCryptDestroyKey",
  2279. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2280. "crypt32.dll.CertFreeCertificateChain",
  2281. "crypt32.dll.CertDuplicateCertificateContext",
  2282. "ncrypt.dll.SslEncryptPacket",
  2283. "mso.dll.#4314",
  2284. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2285. "mso.dll.#6484",
  2286. "mso.dll.#8499",
  2287. "mso.dll.#9871",
  2288. "mso.dll.#4743",
  2289. "mso.dll.#5452",
  2290. "mso.dll.#2088",
  2291. "mso.dll.#5274",
  2292. "mso.dll.#3195",
  2293. "mso.dll.#8165",
  2294. "mso.dll.#9175",
  2295. "mso.dll.#5315",
  2296. "mso.dll.#8140",
  2297. "user32.dll.IsWindowEnabled",
  2298. "ole32.dll.CoGetCallState",
  2299. "ole32.dll.CoGetActivationState",
  2300. "advapi32.dll.RegisterWaitChainCOMCallback",
  2301. "ncrypt.dll.SslDecryptPacket",
  2302. "winhttp.dll.WinHttpReceiveResponse",
  2303. "winhttp.dll.WinHttpQueryHeaders",
  2304. "winhttp.dll.WinHttpQueryDataAvailable",
  2305. "winhttp.dll.WinHttpReadData",
  2306. "webservices.dll.WsCreateError",
  2307. "ntdll.dll.EtwEventWrite",
  2308. "ntdll.dll.EtwEventRegister",
  2309. "ntdll.dll.EtwEventUnregister",
  2310. "webservices.dll.WsCreateHeap",
  2311. "webservices.dll.WsCreateReader",
  2312. "webservices.dll.WsSetInput",
  2313. "webservices.dll.WsFillReader",
  2314. "webservices.dll.WsReadToStartElement",
  2315. "webservices.dll.WsReadStartElement",
  2316. "webservices.dll.WsReadType",
  2317. "winhttp.dll.WinHttpCloseHandle",
  2318. "crypt32.dll.CertFreeCertificateContext",
  2319. "rpcrt4.dll.RpcBindingFree",
  2320. "webservices.dll.WsFreeReader",
  2321. "webservices.dll.WsFreeError",
  2322. "webservices.dll.WsFreeHeap",
  2323. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2324. "winhttp.dll.WinHttpOpenRequest",
  2325. "winhttp.dll.WinHttpAddRequestHeaders",
  2326. "winhttp.dll.WinHttpSendRequest",
  2327. "winhttp.dll.WinHttpConnect",
  2328. "winhttp.dll.WinHttpCrackUrl",
  2329. "winhttp.dll.WinHttpSetStatusCallback",
  2330. "winhttp.dll.WinHttpOpen",
  2331. "winhttp.dll.WinHttpSetOption",
  2332. "winhttp.dll.WinHttpWriteData",
  2333. "winhttp.dll.WinHttpSetCredentials",
  2334. "winhttp.dll.WinHttpQueryAuthSchemes",
  2335. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2336. "winhttp.dll.WinHttpGetProxyForUrl",
  2337. "winhttp.dll.WinHttpQueryOption",
  2338. "webservices.dll.WsOpenServiceProxy",
  2339. "webservices.dll.WsCall",
  2340. "webservices.dll.WsAddCustomHeader",
  2341. "shlwapi.dll.StrStrA",
  2342. "shlwapi.dll.UrlUnescapeA",
  2343. "cryptnet.dll.CertDllVerifyRevocation",
  2344. "profapi.dll.#104",
  2345. "sensapi.dll.IsNetworkAlive",
  2346. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2347. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2348. "rpcrt4.dll.NdrClientCall2",
  2349. "winhttp.dll.WinHttpSetTimeouts",
  2350. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2351. "shlwapi.dll.StrStrIW",
  2352. "winhttp.dll.WinHttpTimeFromSystemTime",
  2353. "cryptnet.dll.I_CryptNetGetConnectivity",
  2354. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2355. "setupapi.dll.SetupIterateCabinetW",
  2356. "kernel32.dll.RegOpenKeyExW",
  2357. "kernel32.dll.RegCloseKey",
  2358. "cabinet.dll.#20",
  2359. "cabinet.dll.#22",
  2360. "devrtl.dll.DevRtlGetThreadLogToken",
  2361. "cryptsp.dll.CryptSetHashParam",
  2362. "sechost.dll.QueryServiceConfigA",
  2363. "sechost.dll.QueryServiceStatus",
  2364. "rpcrt4.dll.RpcStringBindingComposeA",
  2365. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2366. "rpcrt4.dll.RpcEpResolveBinding",
  2367. "sechost.dll.LookupAccountSidLocalW",
  2368. "rpcrt4.dll.RpcStringFreeA",
  2369. "webservices.dll.WsResetHeap",
  2370. "webservices.dll.WsCloseServiceProxy",
  2371. "ws2_32.dll.#3",
  2372. "webservices.dll.WsFreeServiceProxy",
  2373. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2374. "ncrypt.dll.SslFreeObject",
  2375. "ole32.dll.CoTaskMemFree",
  2376. "ole32.dll.CoTaskMemAlloc",
  2377. "ole32.dll.CoInitializeEx",
  2378. "ole32.dll.CoUninitialize",
  2379. "user32.dll.RegisterPowerSettingNotification",
  2380. "powrprof.dll.PowerSettingRegisterNotification",
  2381. "user32.dll.GetWindowThreadProcessId",
  2382. "user32.dll.GetWindowTextW",
  2383. "mso.dll.#25",
  2384. "mso.dll.#1056",
  2385. "mso.dll.#8136",
  2386. "mso.dll.#8931",
  2387. "shell32.dll.SHGetFileInfoW",
  2388. "mso.dll.#5362",
  2389. "mso.dll.#6044",
  2390. "mso.dll.#6516",
  2391. "mso.dll.#6221",
  2392. "mso.dll.#5780",
  2393. "mso.dll.#4870",
  2394. "mso.dll.#6046",
  2395. "mso.dll.#1241",
  2396. "mso.dll.#2821",
  2397. "mso.dll.#2340",
  2398. "mso.dll.#7287",
  2399. "mso.dll.#5290",
  2400. "mso.dll.#1508",
  2401. "user32.dll.IsZoomed",
  2402. "user32.dll.GetWindowPlacement",
  2403. "user32.dll.GetWindowRect",
  2404. "mso.dll.#821",
  2405. "user32.dll.GetSystemMetrics",
  2406. "user32.dll.MonitorFromWindow",
  2407. "user32.dll.MonitorFromRect",
  2408. "user32.dll.MonitorFromPoint",
  2409. "user32.dll.EnumDisplayMonitors",
  2410. "user32.dll.GetMonitorInfoA",
  2411. "user32.dll.EnumDisplayDevicesA",
  2412. "mso.dll.#2378",
  2413. "user32.dll.SetWindowPos",
  2414. "user32.dll.AdjustWindowRect",
  2415. "mso.dll.#5912",
  2416. "mso.dll.#9719",
  2417. "mso.dll.#8824",
  2418. "mso.dll.#6117",
  2419. "mso.dll.#3307",
  2420. "user32.dll.SendMessageW",
  2421. "user32.dll.DestroyIcon",
  2422. "mso.dll.#3813",
  2423. "mso.dll.#1815",
  2424. "user32.dll.PtInRect",
  2425. "mso.dll.#1613",
  2426. "user32.dll.SetWindowTextW",
  2427. "user32.dll.GetClassLongW",
  2428. "mso.dll.#8572",
  2429. "gdi32.dll.CreateDIBSection",
  2430. "gdi32.dll.CreateCompatibleDC",
  2431. "gdi32.dll.GetViewportOrgEx",
  2432. "gdi32.dll.SetViewportOrgEx",
  2433. "gdi32.dll.SetBkColor",
  2434. "gdi32.dll.ExtTextOutA",
  2435. "mso.dll.#1573",
  2436. "mso.dll.#8612",
  2437. "user32.dll.SetScrollRange",
  2438. "mso.dll.#2509",
  2439. "user32.dll.BeginDeferWindowPos",
  2440. "user32.dll.DeferWindowPos",
  2441. "user32.dll.EndDeferWindowPos",
  2442. "user32.dll.OffsetRect",
  2443. "user32.dll.EnumChildWindows",
  2444. "user32.dll.GetScrollInfo",
  2445. "user32.dll.MapWindowPoints",
  2446. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2447. "gdi32.dll.DeleteDC",
  2448. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2449. "mso.dll.#6126",
  2450. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2451. "gdi32.dll.GetFontRealizationInfo",
  2452. "gdi32.dll.GetFontFileInfo",
  2453. "gdi32.dll.GetFontFileData",
  2454. "mso.dll.#7261",
  2455. "mso.dll.#9540",
  2456. "usp10.dll.ScriptGetFontScriptTags",
  2457. "usp10.dll.ScriptGetFontLanguageTags",
  2458. "usp10.dll.ScriptGetFontFeatureTags",
  2459. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  2460. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  2461. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  2462. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2463. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2464. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2465. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2466. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2467. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2468. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2469. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2470. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2471. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2472. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2473. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2474. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2475. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2476. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2477. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2478. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2479. "user32.dll.SetRectEmpty",
  2480. "user32.dll.InflateRect",
  2481. "mso.dll.#1100",
  2482. "mso.dll.#7047",
  2483. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2484. "user32.dll.GetCursor",
  2485. "user32.dll.GetClientRect",
  2486. "user32.dll.SetScrollInfo",
  2487. "user32.dll.SetScrollPos",
  2488. "mso.dll.#3747",
  2489. "mso.dll.#8218",
  2490. "mso.dll.#5394",
  2491. "mso.dll.#331",
  2492. "mso.dll.#6829",
  2493. "mso.dll.#539",
  2494. "mso.dll.#4959",
  2495. "mso.dll.#6463",
  2496. "mso.dll.#4987",
  2497. "user32.dll.GetWindow",
  2498. "mso.dll.#7195",
  2499. "mso.dll.#7573",
  2500. "mso.dll.#445",
  2501. "user32.dll.GetCaretBlinkTime",
  2502. "user32.dll.CreateCaret",
  2503. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2504. "user32.dll.IntersectRect",
  2505. "user32.dll.DestroyCaret",
  2506. "user32.dll.GetCaretPos",
  2507. "user32.dll.SetCaretPos",
  2508. "mso.dll.#5932",
  2509. "mso.dll.#2071",
  2510. "mso.dll.#1024",
  2511. "mso.dll.#6245",
  2512. "mso.dll.#9041",
  2513. "mso.dll.#1767",
  2514. "mso.dll.#9369",
  2515. "mso.dll.#4617",
  2516. "user32.dll.FillRect",
  2517. "mso.dll.#343",
  2518. "mso.dll.#9636",
  2519. "mso.dll.#2022",
  2520. "mso.dll.#4750",
  2521. "mso.dll.#4577",
  2522. "mso.dll.#850",
  2523. "mso.dll.#1776",
  2524. "mso.dll.#9026",
  2525. "mso.dll.#4497",
  2526. "mso.dll.#4647",
  2527. "mso.dll.#8926",
  2528. "mso.dll.#7212",
  2529. "mso.dll.#5407",
  2530. "mso.dll.#5152",
  2531. "mso.dll.#3327",
  2532. "mso.dll.#6333",
  2533. "mso.dll.#420",
  2534. "mso.dll.#1335",
  2535. "mso.dll.#2041",
  2536. "mso.dll.#7834",
  2537. "mso.dll.#239",
  2538. "mso.dll.#6357",
  2539. "mso.dll.#7026",
  2540. "mso.dll.#1671",
  2541. "oleaut32.dll.#7",
  2542. "mso.dll.#8263",
  2543. "mso.dll.#9307",
  2544. "mso.dll.#1441",
  2545. "mso.dll.#9223",
  2546. "mso.dll.#6453",
  2547. "mso.dll.#8044",
  2548. "mso.dll.#3698",
  2549. "mso.dll.#8565",
  2550. "mso.dll.#8373",
  2551. "mso.dll.#9741",
  2552. "mso.dll.#478",
  2553. "mso.dll.#479",
  2554. "mso.dll.#340",
  2555. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2556. "bcrypt.dll.BCryptGetProperty",
  2557. "bcrypt.dll.BCryptCreateHash",
  2558. "bcrypt.dll.BCryptHashData",
  2559. "bcrypt.dll.BCryptFinishHash",
  2560. "bcrypt.dll.BCryptDestroyHash",
  2561. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2562. "mso.dll.#8633",
  2563. "mso.dll.#5213",
  2564. "mso.dll.#6163",
  2565. "mso.dll.#552",
  2566. "mso.dll.#5630",
  2567. "mso.dll.#2513",
  2568. "mso.dll.#1607",
  2569. "mso.dll.#791",
  2570. "mso.dll.#1848",
  2571. "mso.dll.#8735",
  2572. "mso.dll.#9374",
  2573. "mso.dll.#5286",
  2574. "mso.dll.#6368",
  2575. "mso.dll.#4262",
  2576. "mso.dll.#1010",
  2577. "mso.dll.#7979",
  2578. "mso.dll.#8549",
  2579. "mso.dll.#8970",
  2580. "mso.dll.#9198",
  2581. "mso.dll.#4795",
  2582. "mso.dll.#1865",
  2583. "mso.dll.#9688",
  2584. "mso.dll.#320",
  2585. "advapi32.dll.RegDeleteKeyA",
  2586. "user32.dll.DestroyCursor",
  2587. "mso.dll.#7173",
  2588. "mso.dll.#8511",
  2589. "mso.dll.#3299",
  2590. "mso.dll.#7001",
  2591. "mso.dll.#3913",
  2592. "user32.dll.PeekMessageA",
  2593. "mso.dll.#1380",
  2594. "mso.dll.#9500",
  2595. "user32.dll.TranslateMessage",
  2596. "user32.dll.IsWindowUnicode",
  2597. "user32.dll.DispatchMessageA",
  2598. "user32.dll.DispatchMessageW",
  2599. "user32.dll.UpdateWindow",
  2600. "mso.dll.#999",
  2601. "mso.dll.#287",
  2602. "dwmapi.dll.DwmIsCompositionEnabled",
  2603. "mso.dll.#1575",
  2604. "mso.dll.#5034",
  2605. "mso.dll.#1517",
  2606. "mso.dll.#718",
  2607. "mso.dll.#4708",
  2608. "mso.dll.#8046",
  2609. "mso.dll.#4175",
  2610. "mso.dll.#8672",
  2611. "mso.dll.#1990",
  2612. "mso.dll.#3051",
  2613. "mso.dll.#1819",
  2614. "mso.dll.#1419",
  2615. "oleaut32.dll.#147",
  2616. "kernel32.dll.WerRegisterMemoryBlock",
  2617. "dwrite.dll.DWriteCreateFactory",
  2618. "shell32.dll.SHAddToRecentDocs",
  2619. "ole32.dll.PropVariantClear",
  2620. "oleaut32.dll.#9",
  2621. "user32.dll.IsHungAppWindow",
  2622. "gdi32.dll.GetCurrentObject",
  2623. "gdi32.dll.BitBlt",
  2624. "gdi32.dll.GetClipBox",
  2625. "gdi32.dll.StretchDIBits",
  2626. "advapi32.dll.RegQueryValueW",
  2627. "apphelp.dll.ApphelpCheckShellObject",
  2628. "riched20.dll.REExtendedRegisterClass",
  2629. "user32.dll.GetWindowLongW",
  2630. "user32.dll.GetSysColor",
  2631. "user32.dll.SetWindowLongW",
  2632. "user32.dll.RegisterWindowMessageA",
  2633. "user32.dll.RegisterClipboardFormatW",
  2634. "user32.dll.GetDoubleClickTime",
  2635. "user32.dll.SetCaretBlinkTime",
  2636. "user32.dll.SystemParametersInfoW",
  2637. "user32.dll.GetKeyboardLayoutList",
  2638. "mso.dll._MsoGetFidUspDll@0",
  2639. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2640. "usp10.dll.ScriptGetProperties",
  2641. "usp10.dll.ScriptItemize",
  2642. "user32.dll.LoadCursorW",
  2643. "user32.dll.IsWindowVisible",
  2644. "user32.dll.GetKeyboardLayout",
  2645. "user32.dll.PostMessageW",
  2646. "user32.dll.DefWindowProcW",
  2647. "uxtheme.dll.IsThemeActive",
  2648. "uxtheme.dll.IsAppThemed",
  2649. "uxtheme.dll.OpenThemeData",
  2650. "user32.dll.GetDC",
  2651. "user32.dll.ReleaseDC",
  2652. "user32.dll.IsIconic",
  2653. "user32.dll.GetParent",
  2654. "usp10.dll.ScriptGetCMap",
  2655. "user32.dll.InvalidateRect",
  2656. "user32.dll.HideCaret",
  2657. "user32.dll.ShowCaret",
  2658. "user32.dll.NotifyWinEvent",
  2659. "user32.dll.GetWindowTextLengthW",
  2660. "user32.dll.EnableWindow",
  2661. "msctf.dll.SetInputScope",
  2662. "user32.dll.GetWindowRgn",
  2663. "gdi32.dll.CreateCompatibleBitmap",
  2664. "gdi32.dll.SaveDC",
  2665. "gdi32.dll.SetPixel",
  2666. "gdi32.dll.GetPixel",
  2667. "gdi32.dll.RestoreDC",
  2668. "imm32.dll.ImmAssociateContext",
  2669. "ole32.dll.CoRevokeInitializeSpy",
  2670. "comctl32.dll.#388",
  2671. "mso.dll.#806",
  2672. "mso.dll.#4908",
  2673. "user32.dll.SetRect",
  2674. "mso.dll.#8439",
  2675. "mso.dll.#2736",
  2676. "gdi32.dll.GetTextAlign",
  2677. "gdi32.dll.ExtTextOutW",
  2678. "mso.dll.#8122",
  2679. "mso.dll.#2114",
  2680. "mso.dll.#6558",
  2681. "gdi32.dll.GetFontData",
  2682. "usp10.dll.ScriptItemizeOpenType",
  2683. "usp10.dll.ScriptShapeOpenType",
  2684. "usp10.dll.ScriptPlaceOpenType",
  2685. "mso.dll.#8395",
  2686. "mso.dll.#379",
  2687. "mso.dll.#6338",
  2688. "mso.dll.#7964",
  2689. "mso.dll.#1437",
  2690. "mso.dll.#1427",
  2691. "mso.dll.#6137",
  2692. "winmm.dll.timeGetTime",
  2693. "mso.dll.#5940",
  2694. "usp10.dll.ScriptPlace",
  2695. "usp10.dll.ScriptShape",
  2696. "usp10.dll.ScriptJustify",
  2697. "usp10.dll.ScriptTextOut",
  2698. "usp10.dll.ScriptCPtoX",
  2699. "usp10.dll.ScriptXtoCP",
  2700. "usp10.dll.ScriptFreeCache",
  2701. "usp10.dll.ScriptCacheGetHeight",
  2702. "usp10.dll.ScriptLayout",
  2703. "usp10.dll.ScriptBreak",
  2704. "usp10.dll.ScriptIsComplex",
  2705. "usp10.dll.ScriptGetLogicalWidths",
  2706. "usp10.dll.ScriptApplyLogicalWidth",
  2707. "usp10.dll.ScriptGetGlyphABCWidth",
  2708. "usp10.dll.ScriptGetFontProperties",
  2709. "usp10.dll.ScriptApplyDigitSubstitution",
  2710. "usp10.dll.ScriptRecordDigitSubstitution",
  2711. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2712. "mso.dll.#7578",
  2713. "mso.dll.#8483",
  2714. "mso.dll.#2613",
  2715. "gdi32.dll.GdiIsMetaPrintDC",
  2716. "mso.dll.#7848",
  2717. "user32.dll.GetForegroundWindow",
  2718. "user32.dll.GetFocus",
  2719. "user32.dll.GetClassNameA",
  2720. "user32.dll.IsWindowRedirectedForPrint",
  2721. "gdi32.dll.CreateRectRgnIndirect",
  2722. "user32.dll.GetUpdateRgn",
  2723. "gdi32.dll.GetRgnBox",
  2724. "user32.dll.ValidateRect",
  2725. "user32.dll.GetUpdateRect",
  2726. "user32.dll.BeginPaint",
  2727. "user32.dll.EndPaint",
  2728. "mso.dll.#3624",
  2729. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2730. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2731. "mso.dll.#6247",
  2732. "gdi32.dll.TranslateCharsetInfo",
  2733. "mso.dll.#3300",
  2734. "mso.dll.#7465",
  2735. "gdi32.dll.SetWindowOrgEx",
  2736. "mso.dll.#732",
  2737. "mso.dll.#5804",
  2738. "mso.dll.#4746",
  2739. "user32.dll.IsWindow",
  2740. "ole32.dll.CoCreateInstance",
  2741. "user32.dll.ScreenToClient",
  2742. "mso.dll.#434",
  2743. "user32.dll.GetMessageExtraInfo",
  2744. "user32.dll.GetCursorInfo",
  2745. "user32.dll.GetCapture",
  2746. "user32.dll.TrackMouseEvent",
  2747. "user32.dll.GetInputState",
  2748. "mso.dll.#8461",
  2749. "user32.dll.GetClipboardOwner",
  2750. "user32.dll.GetActiveWindow",
  2751. "user32.dll.GetAncestor",
  2752. "mso.dll.#3544",
  2753. "mso.dll.#900",
  2754. "mso.dll.#1422",
  2755. "user32.dll.MsgWaitForMultipleObjectsEx",
  2756. "mso.dll.#7673",
  2757. "mso.dll.#709",
  2758. "mso.dll.#5913",
  2759. "mso.dll.#8051",
  2760. "user32.dll.SendNotifyMessageW",
  2761. "mso.dll.#8472",
  2762. "mso.dll.#3425",
  2763. "mso.dll.#5291",
  2764. "mso.dll.#1718",
  2765. "mso.dll.#4777",
  2766. "mso.dll.#1442",
  2767. "mso.dll.#4388",
  2768. "advapi32.dll.NotifyServiceStatusChangeW",
  2769. "mso.dll.#8662",
  2770. "mso.dll.#1885",
  2771. "mso.dll.#832",
  2772. "advapi32.dll.RegDeleteTreeW",
  2773. "xmllite.dll.CreateXmlReader",
  2774. "gdi32.dll.GetViewportExtEx",
  2775. "gdi32.dll.GetWindowExtEx",
  2776. "gdi32.dll.GetMapMode",
  2777. "gdi32.dll.GetLayout",
  2778. "gdi32.dll.SelectClipRgn",
  2779. "gdi32.dll.IntersectClipRect",
  2780. "gdi32.dll.SetTextColor",
  2781. "gdi32.dll.SetBkMode",
  2782. "gdi32.dll.GetClipRgn",
  2783. "gdi32.dll.ExtSelectClipRgn",
  2784. "gdi32.dll.CombineRgn",
  2785. "user32.dll.CopyRect",
  2786. "gdi32.dll.SetStretchBltMode",
  2787. "user32.dll.UpdateLayeredWindow",
  2788. "mso.dll.#4702",
  2789. "mso.dll.#9465",
  2790. "user32.dll.GetScrollPos",
  2791. "mso.dll.#629",
  2792. "advapi32.dll.CryptAcquireContextA",
  2793. "advapi32.dll.CryptGenKey",
  2794. "cryptsp.dll.CryptGenKey",
  2795. "advapi32.dll.CryptImportKey",
  2796. "cryptsp.dll.CryptImportKey",
  2797. "advapi32.dll.CryptExportKey",
  2798. "cryptsp.dll.CryptExportKey",
  2799. "advapi32.dll.CryptDestroyKey",
  2800. "advapi32.dll.CryptCreateHash",
  2801. "advapi32.dll.CryptSetHashParam",
  2802. "advapi32.dll.CryptHashData",
  2803. "advapi32.dll.CryptGetHashParam",
  2804. "cryptsp.dll.CryptGetHashParam",
  2805. "advapi32.dll.CryptDestroyHash",
  2806. "msi.dll.#111",
  2807. "kernel32.dll.FlsAlloc",
  2808. "kernel32.dll.FlsGetValue",
  2809. "kernel32.dll.FlsSetValue",
  2810. "kernel32.dll.FlsFree",
  2811. "ieawsdc.dll.HrExtractTemplateToPath",
  2812. "msi.dll.#90",
  2813. "advapi32.dll.ConvertSidToStringSidW",
  2814. "msi.dll.DllGetVersion",
  2815. "user32.dll.GetWindowDC",
  2816. "gdi32.dll.SetLayout",
  2817. "gdi32.dll.RectVisible",
  2818. "gdi32.dll.ExcludeClipRect",
  2819. "user32.dll.GetDesktopWindow",
  2820. "user32.dll.WindowFromPoint",
  2821. "user32.dll.FindWindowExW",
  2822. "user32.dll.RemovePropW",
  2823. "user32.dll.GetMessagePos",
  2824. "advapi32.dll.RegDeleteValueW",
  2825. "user32.dll.SetFocus",
  2826. "user32.dll.IsClipboardFormatAvailable",
  2827. "mso.dll.#8837",
  2828. "crypt32.dll.CryptQueryObject",
  2829. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2830. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2831. "cryptsp.dll.CryptGetDefaultProviderW",
  2832. "cryptsp.dll.CryptAcquireContextW",
  2833. "crypt32.dll.CertEnumCertificatesInStore",
  2834. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2835. "cryptsp.dll.CryptReleaseContext",
  2836. "wintrust.dll.WinVerifyTrust",
  2837. "wintrust.dll.WintrustCertificateTrust",
  2838. "wintrust.dll.SoftpubAuthenticode",
  2839. "wintrust.dll.SoftpubInitialize",
  2840. "wintrust.dll.SoftpubLoadMessage",
  2841. "wintrust.dll.SoftpubLoadSignature",
  2842. "wintrust.dll.SoftpubCheckCert",
  2843. "wintrust.dll.SoftpubCleanup",
  2844. "wintrust.dll.CryptSIPVerifyIndirectData",
  2845. "mso.dll.#1266",
  2846. "gdi32.dll.GetStockObject",
  2847. "mso.dll.#6501",
  2848. "riched20.dll.REMSOHInst",
  2849. "mso.dll.#511",
  2850. "mso.dll.#8118",
  2851. "mso.dll.#1455",
  2852. "user32.dll.LoadImageW",
  2853. "gdi32.dll.GetGlyphIndicesW",
  2854. "user32.dll.CreateWindowExW",
  2855. "comctl32.dll.HIMAGELIST_QueryInterface",
  2856. "comctl32.dll.DrawShadowText",
  2857. "comctl32.dll.DrawSizeBox",
  2858. "comctl32.dll.DrawScrollBar",
  2859. "comctl32.dll.SizeBoxHwnd",
  2860. "comctl32.dll.ScrollBar_MouseMove",
  2861. "comctl32.dll.ScrollBar_Menu",
  2862. "comctl32.dll.HandleScrollCmd",
  2863. "comctl32.dll.DetachScrollBars",
  2864. "comctl32.dll.AttachScrollBars",
  2865. "comctl32.dll.CCSetScrollInfo",
  2866. "comctl32.dll.CCGetScrollInfo",
  2867. "comctl32.dll.CCEnableScrollBar",
  2868. "comctl32.dll.QuerySystemGestureStatus",
  2869. "uxtheme.dll.#49",
  2870. "uxtheme.dll.CloseThemeData",
  2871. "user32.dll.EnableScrollBar",
  2872. "user32.dll.ShowScrollBar",
  2873. "user32.dll.ShowWindow",
  2874. "user32.dll.SetParent",
  2875. "user32.dll.KillTimer",
  2876. "user32.dll.ClientToScreen",
  2877. "user32.dll.MoveWindow",
  2878. "user32.dll.DestroyWindow",
  2879. "gdi32.dll.GetTextCharset",
  2880. "oleaut32.dll.SysAllocString",
  2881. "oleaut32.dll.SysStringLen",
  2882. "oleaut32.dll.SysAllocStringLen",
  2883. "oleaut32.dll.SysFreeString",
  2884. "mso.dll.#8705",
  2885. "mso.dll.#8060",
  2886. "mso.dll.#844",
  2887. "uxtheme.dll.GetThemePartSize",
  2888. "user32.dll.GetMessageW",
  2889. "gdi32.dll.SetTextAlign",
  2890. "gdi32.dll.GetTextColor",
  2891. "uxtheme.dll.DrawThemeBackground",
  2892. "user32.dll.WaitMessage",
  2893. "wininet.dll.InternetGetConnectedState",
  2894. "advapi32.dll.SaferiSearchMatchingHashRules",
  2895. "wintrust.dll.WTHelperProvDataFromStateData",
  2896. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2897. "crypt32.dll.CertCloseStore",
  2898. "rasapi32.dll.RasConnectionNotificationW",
  2899. "gdi32.dll.GdiFlush",
  2900. "sechost.dll.NotifyServiceStatusChangeA",
  2901. "osppcext.dll.SLActivateProduct",
  2902. "osppcext.dll.SLGetTokenActivationGrants",
  2903. "osppcext.dll.SLGetTokenActivationCertificates",
  2904. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2905. "osppcext.dll.SLSignTokenActivationChallenge",
  2906. "osppcext.dll.SLDepositTokenActivationResponse",
  2907. "osppcext.dll.SLFreeTokenActivationGrants",
  2908. "osppcext.dll.SLFreeTokenActivationCertificates",
  2909. "cabinet.dll.#23",
  2910. "user32.dll.GetClassNameW",
  2911. "mso.dll.#1541",
  2912. "mso.dll.#3702",
  2913. "mso.dll.#3484",
  2914. "mso.dll.#1966",
  2915. "mso.dll.#6960",
  2916. "mso.dll.#7892",
  2917. "msi.dll.#39",
  2918. "advapi32.dll.CryptReleaseContext",
  2919. "mso.dll.#7931",
  2920. "mso.dll.#3837",
  2921. "mso.dll.#8574",
  2922. "mso.dll.#8398",
  2923. "mso.dll.#2477",
  2924. "msproof7.dll.DllGetClassObject",
  2925. "msproof7.dll.DllCanUnloadNow",
  2926. "mso.dll.#4172",
  2927. "mso.dll.#1439",
  2928. "mso.dll.#9566",
  2929. "mso.dll.#111",
  2930. "mso.dll.#4191",
  2931. "mso.dll.#3802",
  2932. "mso.dll.#6982",
  2933. "mso.dll.#8800",
  2934. "mso.dll.#3572",
  2935. "mso.dll.#167",
  2936. "mso.dll.#5737",
  2937. "mso.dll.#590",
  2938. "mso.dll.#3758",
  2939. "msgr3en.dll.CheckVersion",
  2940. "msgr3en.dll.#29",
  2941. "msgr3en.dll.#30",
  2942. "msgr3en.dll.#31",
  2943. "msgr3en.dll.#32",
  2944. "msgr3en.dll.#33",
  2945. "msgr3en.dll.#34",
  2946. "msgr3en.dll.#35",
  2947. "msgr3en.dll.#45",
  2948. "msgr3en.dll.#46",
  2949. "msgr3en.dll.#47",
  2950. "msgr3en.dll.#48",
  2951. "msgr3en.dll.#51",
  2952. "msgr3en.dll.#50",
  2953. "msgr3en.dll.#49",
  2954. "msgr3en.dll.#43",
  2955. "msgr3en.dll.#41",
  2956. "msgr3en.dll.#42",
  2957. "msgr3en.dll.#44",
  2958. "msgr3en.dll.#39",
  2959. "msgr3en.dll.#40",
  2960. "msgr3en.dll.#36",
  2961. "msgr3en.dll.#38",
  2962. "msgr3en.dll.#37",
  2963. "msgr3en.dll.#56",
  2964. "msgr3en.dll.#52",
  2965. "msgr3en.dll.#53",
  2966. "msgr3en.dll.#57",
  2967. "msgr3en.dll.#58",
  2968. "msgr3en.dll.#59",
  2969. "user32.dll.LoadStringA",
  2970. "mso.dll.#2561",
  2971. "mso.dll.#408",
  2972. "mso.dll.#2714",
  2973. "mso.dll.#8622",
  2974. "mso.dll.#3380",
  2975. "mso.dll.#8172",
  2976. "mso.dll.#1003",
  2977. "mso.dll.#7531",
  2978. "mso.dll.#6420",
  2979. "user32.dll.SetCursor",
  2980. "mso.dll.#1414",
  2981. "mso.dll.#8202",
  2982. "mso.dll.#7189",
  2983. "mso.dll.#2738",
  2984. "mso.dll.#8691",
  2985. "mso.dll.#6079",
  2986. "mso.dll.#7167",
  2987. "mso.dll.#7163",
  2988. "mso.dll.#333",
  2989. "mso.dll.#1785",
  2990. "mso.dll.#5919",
  2991. "mso.dll.#1283",
  2992. "mso.dll.#5973",
  2993. "mso.dll.#2014",
  2994. "mso.dll.#9668",
  2995. "mso.dll.#2294",
  2996. "mso.dll.#2968",
  2997. "mso.dll.#2281",
  2998. "mso.dll.#2628",
  2999. "mso.dll.#1401",
  3000. "mso.dll.#1914",
  3001. "advapi32.dll.RegDeleteKeyW",
  3002. "mso.dll.#235",
  3003. "mso.dll.#4416",
  3004. "mso.dll.#9398",
  3005. "mso.dll.#8022",
  3006. "mso.dll.#8757",
  3007. "mso.dll.#237",
  3008. "mso.dll.#4214",
  3009. "mso.dll.#884",
  3010. "mso.dll.#121",
  3011. "mso.dll.#1712",
  3012. "mso.dll.#9344",
  3013. "mso.dll.#4203",
  3014. "mso.dll.#3974",
  3015. "mso.dll.#4882",
  3016. "mso.dll.#2449",
  3017. "mso.dll.#2767",
  3018. "mso.dll.#9199",
  3019. "mso.dll.#7948",
  3020. "mso.dll.#3209",
  3021. "mso.dll.#4083",
  3022. "mso.dll.#292",
  3023. "mso.dll.#795",
  3024. "mso.dll.#8349",
  3025. "mso.dll.#8796",
  3026. "mso.dll.#3930",
  3027. "mso.dll.#9105",
  3028. "mso.dll.#2427",
  3029. "mso.dll.#8116",
  3030. "mso.dll.#6156",
  3031. "user32.dll.UnregisterClassW",
  3032. "user32.dll.UnhookWindowsHookEx",
  3033. "mso.dll.#7002",
  3034. "mso.dll.#186",
  3035. "user32.dll.PostQuitMessage",
  3036. "mso.dll.#591",
  3037. "mso.dll.#2272",
  3038. "mso.dll.#4284",
  3039. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3040. "mso.dll.#4426",
  3041. "mso.dll.#8473",
  3042. "mso.dll.#8106",
  3043. "mso.dll.#8876",
  3044. "mso.dll.#4210",
  3045. "mso.dll.#8586",
  3046. "mso.dll.#8004",
  3047. "mso.dll.#6078",
  3048. "mso.dll.#815",
  3049. "mso.dll.#187",
  3050. "mso.dll.#5625",
  3051. "mso.dll.#8316",
  3052. "mso.dll.#7598",
  3053. "ws2_32.dll.#116",
  3054. "user32.dll.RemoveClipboardFormatListener",
  3055. "user32.dll.UnregisterPowerSettingNotification",
  3056. "powrprof.dll.PowerSettingUnregisterNotification",
  3057. "shell32.dll.#155",
  3058. "advapi32.dll.EventUnregister",
  3059. "user32.dll.UnregisterClassA",
  3060. "gdiplus.dll.GdiplusShutdown",
  3061. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3062. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3063. "mso.dll.#2482",
  3064. "mso.dll.#5458",
  3065. "advapi32.dll.UnregisterTraceGuids",
  3066. "comctl32.dll.#321"
  3067. ]
  3068.  
  3069. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!