API tools faq
paste
paladin316

Pony_1d546363eed006d85eda8a04d1dc9083_doc_2019-07-26_03_30.txt

paladin316
Jul 26th, 2019
2,113
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 211.02 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Pony_1d546363eed006d85eda8a04d1dc9083.doc"
  7. * File Size: 267399
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "c1b8ad40f7315948a5333ee590ffed98f49135816f0a0bdb76c8dd756b2d10cb"
  10. * MD5: "1d546363eed006d85eda8a04d1dc9083"
  11. * SHA1: "238e1caba5063501f75573c1f17868a3ea2539d9"
  12. * SHA512: "67a1ad4ab82d724801f920ae1699b828cc99425ac06fabcc16dab46a87fd1f0aa9951544caf1dc81a4ad391c5cccad57663ad4d5a79f3adb8f947efca8c29fda"
  13. * CRC32: "9C033352"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLey1ZnjJ7n4P7ZeZR5RPXEKpnIo2o3rXnFAfjhh:sxxQW3ymv4zZeXULcXnDrLdTVPMCb7YH"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2312"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  33. "Details":
  34.  
  35. "IP": "52.109.20.1:443"
  36.  
  37.  
  38. "IP": "23.60.72.96:443"
  39.  
  40.  
  41. "IP": "65.52.98.231:443"
  42.  
  43.  
  44. "IP": "92.123.51.45:443"
  45.  
  46.  
  47. "IP": "104.18.24.243:80"
  48.  
  49.  
  50. "IP": "184.28.188.193:80"
  51.  
  52.  
  53. "IP": "72.21.91.29:80"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  59. "Details":
  60.  
  61. "ioc": "ccent.glox"
  62.  
  63.  
  64. "ioc": "ontent.inf"
  65.  
  66.  
  67. "ioc": "iso690nmerical.xsl"
  68.  
  69.  
  70. "ioc": "rid.glox"
  71.  
  72.  
  73. "ioc": "..3b"
  74.  
  75.  
  76. "ioc": "quations.dotx"
  77.  
  78.  
  79. "ioc": "rc.glox"
  80.  
  81.  
  82. "ioc": "adial.glox"
  83.  
  84.  
  85. "ioc": "ist.glox"
  86.  
  87.  
  88. "ioc": "harvardanglia2008officeonline.xsl"
  89.  
  90.  
  91. "ioc": "iso690.xsl"
  92.  
  93.  
  94. "ioc": "chevronaccent.glox"
  95.  
  96.  
  97. "ioc": "sist02.xsl"
  98.  
  99.  
  100. "ioc": "chicago.xsl"
  101.  
  102.  
  103. "ioc": "pictureorgchart.glox"
  104.  
  105.  
  106. "ioc": "ieee2006officeonline.xsl"
  107.  
  108.  
  109. "ioc": "e.gu"
  110.  
  111.  
  112. "ioc": "gosttitle.xsl"
  113.  
  114.  
  115. "ioc": "turabian.xsl"
  116.  
  117.  
  118. "ioc": "rame.glox"
  119.  
  120.  
  121. "ioc": "rocess.glox"
  122.  
  123.  
  124. "ioc": "ext.glox"
  125.  
  126.  
  127. "ioc": "gostname.xsl"
  128.  
  129.  
  130. "ioc": "rings.glox"
  131.  
  132.  
  133. "ioc": "gb.xsl"
  134.  
  135.  
  136. "ioc": "content.inf"
  137.  
  138.  
  139. "ioc": "ividend.thmx"
  140.  
  141.  
  142. "ioc": "mlaseventheditionofficeonline.xsl"
  143.  
  144.  
  145. "ioc": "set.dotx"
  146.  
  147.  
  148. "ioc": "architecture.glox"
  149.  
  150.  
  151. "ioc": "nline.xsl"
  152.  
  153.  
  154. "ioc": "etropolitan.thmx"
  155.  
  156.  
  157. "ioc": "rop.thmx"
  158.  
  159.  
  160. "ioc": "iew.thmx"
  161.  
  162.  
  163. "ioc": "erlin.thmx"
  164.  
  165.  
  166. "ioc": "rame.thmx"
  167.  
  168.  
  169. "ioc": "uotable.thmx"
  170.  
  171.  
  172. "ioc": "anded.thmx"
  173.  
  174.  
  175. "ioc": "asis.thmx"
  176.  
  177.  
  178. "ioc": "eadlines.thmx"
  179.  
  180.  
  181. "ioc": "avon.thmx"
  182.  
  183.  
  184. "ioc": "ype.thmx"
  185.  
  186.  
  187. "ioc": "ircuit.thmx"
  188.  
  189.  
  190. "ioc": "g.n9"
  191.  
  192.  
  193. "ioc": "adge.thmx"
  194.  
  195.  
  196. "ioc": "arallax.thmx"
  197.  
  198.  
  199. "ioc": "late.thmx"
  200.  
  201.  
  202. "ioc": "eathered.thmx"
  203.  
  204.  
  205. "ioc": "roplet.thmx"
  206.  
  207.  
  208. "ioc": "amask.thmx"
  209.  
  210.  
  211. "ioc": "vent.thmx"
  212.  
  213.  
  214. "ioc": "rail.thmx"
  215.  
  216.  
  217.  
  218.  
  219. "Description": "Performs some HTTP requests",
  220. "Details":
  221.  
  222. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  223.  
  224.  
  225. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  226.  
  227.  
  228. "url": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/fwovksuqpshrym8.msi"
  229.  
  230.  
  231.  
  232.  
  233. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  234. "Details":
  235.  
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\xa0\\x96\\xcd\\xecmsz\\xd9\\x7f\\xb8\\xcc\\xd8g\\xe8\\xc8\\xad\\xf0\\xe9\\xd0\\x08\\x0b\\xda\\x8d2g\\xea#\\xf9\\xe2\\xb2 \\x03yb\\xe5\\x06\\x0f\\x80y6t*\\x8f3 \\xa5k\\xa3\\xd0>\\xedv\\xf9\\x10c\\x1e_\\xa8\\x05\\xa837y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x08*\\xa8\\xc5\\xa2\\xfa1\\xcb\\xe1\\xb2,\\x9a<8\\xfc\\x06\\x9a-<:1\\xaf\\x03t\\xc1\n\\x06\\x1f$\\xe3\\xadl\\xdf\\xa2\\x15^\\xba\\xe8-\\x10j&.\\xf2c\\x1a\\xd1"
  237.  
  238.  
  239. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  240.  
  241.  
  242. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  243.  
  244.  
  245. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe2\\xf8\\xe1\\xabo\\x9f\\xbf\\xb9\\x1cv3\\x9c\\xb2\\x00\\xd4>\\xb8ph\\xe6tf\\x18\\xbe\\xf8\\xa5\\xe4\\xcd\\x98\\xcd\\xf9\\xda4\t\\xac\\xb0hz\\x86q\\xd0\\x90p\\xa1\\x0eo\\xd06\\xde\\xf8r\\x19\\xa7\\x14\\xa3v\\x15\\xd8b\\x1a\\x14u\\x1c9\\xd4z\\xeb\\xe0\\x7f\\x93:\\x11\\x7f\\xb2j/\\xfe\\x06\\xad'\\x01\\xcbd8v\\xac\\x1cak\\xe5\\x8f\\xe2\\xec\\xd3k\\x19\\xfe/6\\xec)\\xcek\\x7f\\xc7\\x03\\xdc\\xd0\\xfe\\xce\\x11xp\\x8d\\xa8\\xd9 \\xd3\\xf3\\xe3\\x96w\\x89\\xda\\xf4\\xa00\\xb6y\\x96\\xbf\\x86\\x1e\\x95<\\xe59\\xda\\x94\\x11_\\xb6b\\x10\\xf8\\xa6\\xcc9\\xaa\\xc6\\x9c\\x92p\\x9d\\xdb\\x1a\\xb9\\xdf\\xec_\\x1ds\\xe1\\xf6\\xa8e\\x07\\xac\\xc8\\x1f|\\xf1\\xc1.\\x11\\x86\\x99\\x9fw\r-\\xcd|+\\xf9x\\xbf\\x87\\xbdb)i_\\xf5\\xa3t\\xa8\\xb6nio)\\xc2\\xca5\\xaa\\x8dx\\x7frw\\x0c\\xa5%gb\\x8dj\\xa9d\\x0e\t\\xe5\\xd3)\\x12kx\\x9f\\xf1\\x98e\\xc6@0\\xce\\x9a\\x01(\\xb1\\x81\\xc4\\xd2\\xe6s\\xb3"
  246.  
  247.  
  248. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xcf+\\x93\\xde\\x8a\\x90k\\x11\\xe7\\xcf\\xb6\\xc4\\x15|z\\xd6=\\xbaj\\x8c\\xa2dw\\xc1\\x01\\xd0\\xcc\\x9e\\xd8x\\x81\\xc9\\xbe\\x83\\x9c\\xfe\\xd9\\x15\\x98 \\x07\\xf6\\x00\\xdd 'j&\\xf3\\x03\\xb8\\xe5!kk\\x05\\xef:\\xdf\\xce\\xd0\\x14(\\xae\\x11ls~\\xben\\x94\\xe0\\x15\\xfe\\xc1\\x15\\xdc\\x88ev\\xe4l\\x04\\xed\\x7f\\x0e\\xe0\\xf94\\xb9\\xfbk\\x8b\\xd9\\xb6\\xb5\\x03\\x1a\\xbc4d\\xd7y\\xe3`\\x93\\xffu\\x7f0jn\\x13\\xf5\\x02\\x0f;\\x1b\\xdfl\\xf1mw\\xe2\\x08$c\\xbek\\xda\\x8a\\xe8\\x17\\xe5t\\xa0)\\xac\\x15\\xaa:e`;\\x0fp\\x1d\\xc6x8\\xf1\\x8d\\xc9\\xd1\\xe1\\xc8\\xd5\\x0f+r\\xf1\\x8c\\xc6vs\\xf2_\\xed+\\xb3\\xba\\x93\\xd3\\x1f\\x9f3\\x13\\xd2\\xdf\\x99\\xf6\\xa3\\x8a\\xa8\\x88@\\x89\\x8bn\\xca\\xad\\x94\\xf3\\xd9\\xf2^1/\\x92c\\x7f\\xd2\\x97\\xda\\xbd\\xe6\\x93\\xd0\\xbd\\xb8\\x9ae\\xeb\\xafd\\xa3\\x19fm\\x82\\x9b\\x0ff\\xb2?\\x98\\xdf\\x14\\x03~\\xd4\\xb8\\x055^\\xbc\\xe8j\\xc5z\\xfc\\xe3\\x97ss\\x837"
  249.  
  250.  
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01:j\\x1fq\\xceo-\\xeb\\xd0\\x05\t\\xe2\\xa8\\x1a.\\xd7\\xc6vu\\xce\\x8e\\xb2\\x89\\xb4fc\\xb9\\x9e\\xbc\\xa8\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252.  
  253.  
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\xfe\\xe6\\xdd\\x8f\\x05\\xb98\\xa9d\\xa8l\\x005\\xc0~\\xf6\\x1d\\xa0\\xa3|\\xb5\\x15\\xaf\\xc6\\xfa\\x93\\x00^\\xf2\\xb59\\x0ea\t\\xeao\\x18\\x9f\\xb9\\xea\\xe1a\\xe6\\xd0\\x00y\\xdb\\x94\\xc1\\x97\\x89\\xcfq\\xc2|\\xfdo\\xc2\\x06\\xe0r\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e@h\r\\xd2\\xa2d\\x83\\xa1i\\xa8=\\xfa\\xb0_\\x1e8jqv\\x00\\xe0l>\\xe0\\xeda\\xfc\\xf8\\x7f\\x16\\xf5\\xac;l\\xdd\\x12\\x04k\\xe2\\xdd\\xe9\\xa6\\x85\ri\\xb6\\xb8"
  255.  
  256.  
  257. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p,\\xf5r@\\x0e\\xed\\xb7\\x08\\xccc'\\xb39\\xb3s\\x11\\x12~\\x03\\x85\\x7f\\xa7v<\\x10?\\x1b \\xc2r\\xaa\\x9f\\x94\\xb2\\x1ed\\xebl\\xb2\\xa8\\x80x\\x95\\xb7\\xfe\\x90\\x82\\xb9\\x88\\xab\\x04xs\\x19;\\x9a\\xfbtt\"\\x00\\xd0w\\x9d\\x12\\x87\\x98\\x0f\\xb1.\\x00\\xe5@\\xb7\\xd2`\\xd6\\x1bt.\\xbe\\x0f\\xde\\x85\\xdcrv\\xb0\\xe1ls\\xf5\\x8eh\\xbb\\xb9\\xcfr&>@\\xbe\\xee\\x86\\x05g\\xfb\\x84o\\xa3b\\x1cv\\x02r\\xc8\\xdfb\\xf3'p\\xaa\\xb0\\x96\\x1fgk\\xf4t\\xcdr_\\xda\\x1bv\\xcb\\x97\\xcb\\x12\\xb1^\\xd7\\x06 \\xd3\\xeac8\\x9a\\x08\\x03\\xe9\\xc6w\\xc9\\xf9\\xcc\\xa7o\\x02.3l,\\x93x&c\\x94l:\\x13\\x10\\x99\\xae\\xfd\\x846\\xcf\\xe2&\\xf0\\xb2\\xf1`9y\\xcfotfs\\xa6\\x91\\xf9\\xa8+\\xc7\\x05\\xc8\\xb9s\\xd7\r\\x88\\x12u\\xb5\\xebj\\x80\\xbb\\xca\\x9c\\x8b\\xf9?\\x84\\xdd\\x8e\\x17\\xcb0s\\x9d\\xed(\\xb2<#\\xce\\x8f2\\xb0%\\xbf\\xed\\xa9n\\xd7(\\x87\\xd6\\xde\\x88\\xcb=e\\xe1"
  258.  
  259.  
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01:j!\\xd4\\x0c\\xef\\x1f\\xfc\\x89\\x1f<\\x19,\\x11up\\xea\\x8b!z+\\x1a\\xd2\\xe5\\xfe\\xd1\\xa9\\x99\\xc4w1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  261.  
  262.  
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xd5\\xe2u\\xb0\\xb3+\\x99\\xc3\\x81\\xdf\\xece\\xb8b\\xc6\n\\xf8eq\\xe3\r\\x8b-\\x10r\\xf5\\xf3\\xb0s,\\xd4#0w\\xac<\\x01\\xbb\\x9ci\\xb8\\x8e:4\\xfck\\xe23x\\xaf<d\\x9f\\x9e'\\xd7w\t\\xd3?u9\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\xa7o\\x89\\xc9\\x19\"p& \\xa3\\xa7\\x0b$\\x13\\x97\\xbft\\xf1\\x83\\x81?\\xf5\\x97p\\x18\\x0b!\\x8c\"q\\xbf2\\x9e\\x85\\xebo\\x8f\\xeee\\x17\\xa6herw\t\\xea"
  264.  
  265.  
  266. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfap\\xec\\x9b\\x14f\\xb2\\xdb\\xf1\\xa6\\x05\\x86\\xab\\xfd\\h\\xdb\\xe9\\xee9\\x9d\\xe0\\x9f\\xd5:\\xde\\x90\\xe6\\xf3\\xcb\\x13i\\xc7y\r=\\xf7\\xc2h\\x91\\xe0s\\xb6d\\xc0\\xbcqx\\x99\\xb0q\\xc2\\xb7ppf\\x08\\x85\\x81ba\\xd4\\x0f\\xc8s\\x7f\\x1b\\xac3\\x00\\x81\\xf48\\x9e\\xbf\\x07s\n4\\xbdt\\xe4u\\xab\\xb5)w\\xa8(\\x12n+\\x1d\\xa4\\x11\\x80'\\xc1z\\x12\\xe3\\x1bq\\xf4%\\x8d\\x1b\\x93\\x8cv\\xc5\\x1e \\xcad\\xcb\\xb6\\xda\\x91\\x10\\xaa\\xd7\\xbd\\xca%2\\xe6lu\\xe8\\xfa\\xc47l\\x82\\xefr\\xe0\\xf4\\xc0\\x91;\\xe0#\\x9c\\xf1\\xf2\\x19\\x93\\xf8\\xa8\\xc2\\xee\\xd7\\xde\\xa9b\\xbb\\x9c\\x89\\xa8\\xc3\\xf4\\xdf\\x82j\\xe3\\x98\\x1d\\\\xb7\\x97\\xd2\r\\x1ed:\\xad>\\xd4\\xcd7\\xe7\\xe6\\xfb\\x1a\\xc4\\xeb\\xac9\\xe5w\\x99\\xa2\\xb7yo\\x1f\\x8e\\xf9\\xc3,\\x8ehu)(\\xa8\\xdffv0\\x89\\x10\\xb8u\\xccph\\xb2j\\xe8c\\xa8\toui\\x81\\x83=k\\x1c\\xa6@\\xb2\\xba\\xba\\xd6\\x07\\x1c\\xd8a\\x91\\x89\\xe2"
  267.  
  268.  
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j!\\xcb \\xd2\\xbc\\x12\\xe9\\xff\\xf7\\xbftb\\x94@\\xd2\r\\xdf9\\xc33)\\x1fz\\x04\\xbeb\\xfcza\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270.  
  271.  
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j!`\\xe6\\x87\\xd2\\x95\\xb6\\xebihm\\xb8\\xfep\\\\xf1#\\xc1\\xcb\\xef\\x96\\x06\\x06$\\x02\\xd2\\x12\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  273.  
  274.  
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j!\\xe8\\xcab\\xba\\xf5\\x81p\\xc4\\xb7\\xae4*\\x8b\\xe42ol\\x15\\xe1\\x89\\xd6\rg7\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276.  
  277.  
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j!\\xdd\\xb4\\xa6\\x06\ty\\x83\\x9dv\\x94\\x12.\\x87h\\xd0\\x11\\xff\\x0f\\xfb\\x9d\\xa6hda\\x8f\\xe9d9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279.  
  280.  
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xacy\\xc8n\\xacwn\\xa8\\xe5v\\x0ej\\xc6m\\x05\\x8c\\xd2\\xffzo\\x13\"\\xe5lig\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  282.  
  283.  
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xeez5\\\\xaev|\\xf4\\x92\\x8b\\xc3\\xbey\\x17\\xd7$\\xa7|\\x1bviw\\x90\\xf1kk\\x81>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285.  
  286.  
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xd2\\xaf'\\x97\\x80\\xb0\\xcc\\x84\\x17g\\x96\\x19~\\x93g\\x8d\\xdc\\xb2\\x1e\\x85\\xc1/\\xa1\\xc4\\xb1\\xe5ot\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288.  
  289.  
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xff\\xd3\\xb2\\xd6\\xcdi\\xca\\x1bph|\\xbeu\\xe1\\xe5\\xfa\\x18\\xf5l\\x1a\\x89h\\x8e\\x90\\x8e\\xcex\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291.  
  292.  
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xb4hb\\x19\\x7f\\xdc\\xb7\\xdd\\x13q\\xc8\\xbc\\xa8\\xe4n\\xafg\\xc4,\\xfbq\\xf2\\x93\\x86\\x90\\x15b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294.  
  295.  
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"$\\x97\\xea\\xd9\\xc5\\x82>5a\\x04\\x19iz\\xd6\\x8fdj\\x1b\\xdawl\\xd1;y\\xc1\\x83\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297.  
  298.  
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"#\\x19?r\\xdf\\xe0\\xe3\\xe1g\\x17\\x88\\xed#\\x8e\\x134\\x06(vp\\xd2l\\x06'\\xc2\\xeb\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300.  
  301.  
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\x0cq)\\xa1\\xcf\\x01\\xc4\\xfb.d\\x94u\\xf7@cr\\xce\\x94\\xd4\\xbc\\xa5\\xa4z\\x8c\\xbf\\x9e\\x0cs\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"fci\\xfdw\\xcd\\xd5h\\xc8m\\xf7\\xa9o\\xf4n\\x06\\x19\\xff\\x0b\\xed\\xa9\"\\xef\\xbb\\x1f#_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"y\\x0b|\\xecci?\\xf0\\xad8\\x14\\xf8\\x13\\x0e\\xf1\\x99q\\x9e\\xecd\\xd8\\x14\\xa6u1\\xcd\\xa8\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\x12\\xb2\"\\xbd\\x1d5\\xc6\\xc4\\xeb\\x8a\\x86\\xc6;\\=\\xb5\\xe0\\x7f0\\xed\\xdfo/\\xff\\x83\\xe4\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312.  
  313.  
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"a\\x9ee_\\xfd\\xdb+h\\xfa\\xbb\\xd6\\xa3\\xea\\xf4\\x9c\\xd4h\tz\\xe58\\x12e\\xc5js\\xbd\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315.  
  316.  
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\":\\xad\\x9a\\xfd\\xf4&\\xa2\\xcc\\x97\\xfe\\x1e\\xafb\\x13!\\x10w_x\\x1a\\x0e\\x97\\xb6\\x17\\xcb\\x97\\x97\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318.  
  319.  
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xa6\\xfb\\xe0\\x9fu\\xb6\\xcc\\xd4j\\xc7ve\"\\x81\\x0e\\x90\\x80r\\x1c\\x97\\x84o\\x0b\\x1f\\xf5\\x15\\x97m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321.  
  322.  
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xf8\\xd4\\x80\\xf0\\x0f\\xd0\\xd3\\xd6\\x15\\x08\\xef\\xca\r\\x88\\xb8\\xb5\\xb7\\x9b\\x8dov\\xb3\\xce\\xcf\\x19b\\xb5\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xb4\\xc3\\x0b\\xc7\\xc6\\x82e\\xa2\\x0c\\x1e\\xd2\\x00\\x96\\xf0\\xdd\\xa5\\x06\\xc49\\xee\\xe7la\\xe2/\\x88\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xe3~g\\xd8)\\x0cf\\x9ak\\xfa\\x97\\xa6h\\xaa\\xe2\\xcc\\x86~\\xc3\\x0f\\x17\\x87\\xc9\\xb1\\xca$)\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"s\\xd3\\xf2\\xc4\\x8e8\\x8e\\x88\\xffkg\\xe4\\x05\\xdb\\xb7\\xa6\\x0e\\x9a\\xa6j\\xd0\\xa2\\xe4\\xea\\xdf\\xbe\\xdea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xf5\\x9c\\xc1|\\x82<a\\x05\\x1dfd\\xffrut\\xa4\tk\\xfb\\x01\\x80\\x15\\xfadau\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\x92\\xfba\\xfah\\xd6o\"\\xbf7fw\\x1c\\xd0\\x06\\x94\\x00\\x1b\\xb0\t\\x9cy\\xc5$\\x0f\\xb9\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"_8\\x8c\\xa9j\\x93\\xb5\\x03\\uax\r\\xce\\x90\\xbc\\x07\\xae\\x9b\\xbc \\xdc(\\x86\\xbbhv\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xc0b\\x05g\\xf2\\xba\\xc3pf\\x0c\\x99\\xba0xp\\xf6=\\x07k\\x9b\\xa7\\xde7\\xf8\\xf6+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\xca\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\x83\\xcb\\xcf\\x94e\\xd6\\xf6h\\x05@l\\x06y\\xb6d^\\x9cg\\xd7\\x9fv\\xfctk\\xf8kg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xe9j\\xd2\\x86\\x8a\"\\xb3\\xb1x\\x1d\\xa4d)2\\xbbc-\\xf6\\xf7\\x06\\x14mb\\xef\\xd3\\xf2w\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"'4\\xe4\\xff\\xba\\x999\\xd4\\x85b\\x06\\xd8v\\x1f\\xfd\\x95'\\xfa\\xfbvvm\\x8c/\\x04\\xb8\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*l(\\x085\\xf6y\\xb2\\xee\\xa4,\\xc9\\x98\\x9c;\\xbe\\xe1^\\x0f\\xd1\\x83/\\x946\\xfe\\xdf\\x1bz\\x85\\x92g\\xba>\\xb7\\x08!0\\xddx\\x1btn\\x83i\\xc0\\xd2\\xfac4o\\x07\\xab\\xfd/\\x864\\xa9\\xf8+\\xcf\\xa2\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\x03\\x0e,\\xb0\\x90g\\x04\\xd3h\\xe7\\x82\\xe0\\xd7<wg\\xe3+\\x87\\x04\\x06\\x85\\xf3\\x8e\\x8d\\x82\\x92\\x91\\x0b\\x00f\\x01\\x07l\\xac\\xa9qs\\x162\\x10.\\xdao\\xf7"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q'\\xc5\\x11\\xa1/d\\xd0\\xfd\\xf7\\xce\\x9e#u\\xc9\\x17\\xfau,w\\x85-?\\x910\\xa1(j!\\xd1\\x08\\x93\\xea|\\xa1=8\\xad\\xd9\\x964qn\\xd40gv>\\xe8k\\xe4\\x99v\\xa19\\xeb\\x84\\xbdd\\x013n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\xa5n\\x8b\\x7f(\\xb9\\x80`kh\\x10s\\xa8%\\xfb\\xda\\xb6;\\xa0;\\xe6#\\x83\\x7f\\xe5\\x87d\\xee\\xf44i@\\xd2\\xe5y\\xfb\\x9b>\\x12>q!\\xf6a2"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xbc\\xea~\\x95\\xfd\\xb5z\\xd2gkw\\x807\\x99pg7\\x98\\xd4\\x81\"\\x13 \\xcb\\xaa\\xefim*\\xe4\\xb7\\xc2\\xb9d36\\xe25\\x1e\\xdc`\\xa4+i\\xc5\\x98e\\xd0\\xfd\\xfe\\x0e\\xfa\r\\xa9\\x058d\\x8f0~g\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1\\x85\\xd2\\x92\rel\t\\xef\\xf44\\xf7\\xf2\\xf4\\xb3zc\\x8e\\x0f\\xaff\\xab\\x05\\x13x\\x9d\\xf3\\xbe\\xe4\\xf4\\xa8\\xb1\\xd5\\xe4\\xfb\\xf5\\xef\\x9b\\xfa\\x99\\xc4\\xa2\\xbd<\\xf9\\x19al"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gh\\x9d\\x11e yi\\xe5\\xddv.\\xdc\\xf3pq\\xd6\\xc0\\x15\\x8d\\xbf\\xda\\xde\\xbdxd\\xd9\\xe8%j\\xedc\\x8djfx\\xa2\\xd8\\xd9n\\xee\\x9c\\xb6\\xcd\\x9b\\x17\\xfe\\x0e\\x1b*\\x19\\xd3\\x93\\xe5\\xf7\\x81:\\xa0\\x9c\\xa6\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xfd\\xd9o9\\x02@f\\xd9w\\xdc\\xfa\\xb6\\x04\\x08\\x9c&\\xd5`\\x91\\xd0\\x97zl\\xc7\\x14x\\xcd0?\\x16\\x9f\\xdf\\xa1\\x91\\x99 8\n\\x82\\xcfo\\xae\\x9e(\\xb3"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\x9e_\\xbb\\xf2\\x06j\\xc9\\x02'\\xa8\\xc0\\xf5\\xca\\x8bo\\x0c\\x1a1x\n\\xf0\\xfe@|\\xab\\xb5<\\xfd\\xcf\\x17p\\xbe\\x8b\\xe4\\x99\\xfd\\xf34\\x869\"`\\x90b\\x94\\xd6\\xe0\\x83\\xf7\\xac~\\x9er\\xcaoa\\xc5;d1\\xd3^\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\xb0\\x02\\x13\\xc1\\xbe\t\\x96\\xc6\\xcf\\x82\\xb0\\x16m\\xe6\\x92\\xd3\\x9d\\x87\\x8d\\x86\\x1d$\\xa4el\\xb4#\\x17/dgi;\\xdfb\\x9d\\xe5\\xafe4b\\xfc\\xf0\\xa7\\xd0"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0l\\x98\\xad\\xb7\\xcb\\x1e\\x9e\\xf9\\x01 \\xa3\\xf8\\xf4\\xb2\\x90\\x92\\x96\\x99b\\xa8?\\x86\\xa8o\\x8ds\\x04\\x1fpn\\x83d\\xb0\\xc1\\x07\\xbd\\xdes\\x81\\x85)\\x98\\xc5\\x08\\x1e\\xb3\\x12\\x83\\x84\\x12\\xf8\\xf3+\\xbc\\xc1\\x84\\x15\\xef\\x9a\\xde\\xb1ra\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\xe4<d\\xc7\\x8c\\x1b\\xfdrr\\xb4\\x84bs\\xf6e\\x1f\\x08\\xa9\\x9b\\xa0\\xeb\\xce\\xb8\\xe8.o\\x80\\xbfa\\xc8'\\xa83\\x8c\\xb8\\x00$\\xf3 nq55\\x03x\\xb5"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb\\xbc\\xcao2p&d\\x8f\\x05\\x8c\\xdb\\xcbp5\\xc9\\xed\\xa2\\x1f\\xe9?\\xff\\xe7\\xfe\\xf8\\x8a\\xa5\\xbc\\xb5c\\xdb\\x01\\x06\\x0e\\x01i\\xbaja\\x93\\xaa\\x8cg1\\x91g\\xf3\\xc4^\\xe8\\xde\\x1d\\\\x89\\xdf\\x80\\x82\\xf7x\\x18\\xdb\\xfa\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8ckol\\xfb=\\xe3:\\xb463\\xc1a\\xe4\\xf9\\x0f3\\x06\\xbc\\x1b\\xd5\\xac\\xe1\\x0c\\xb6\\x99#,\\xbbt\\xbb\\x15\\xf9\\xc09\\xedaf\\x86\\x1b\\xfc\\xdb\\x08m\\xd9\\xa7"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04nea\\xf7\\xd6k%\\xb6o\\xa0\\xf0<\\xe1\\x91;x\\x10\\xfa\\x15=!\\xf8d\r\\x16\\xae\\x08_\\xdb\\xc2\\xbb\\xdf7\\xcd\\x08aw\\xe3'\\\\x15~\\xc4\\x16\\x87\\xa4w\t\\xc8aym(n\\x93k\\xfd0\\xdfr\\xbc\\xb8\\x14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90o\\xfd\\xc8_\\xca\\x03g\\x8a\\xad~j\\x85_\\x9a\\xc8\\xe9\\x9b3\\xf8\\xb0i\\x97\\x86\\xdfv\\xb0\\xb6z\\xdd\\x1edgv\\xfdjkp\\xd5\\x89\\xb2\\xeet\\xd2`\\x8b"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"+a\\xd3t\\xdbkw\\xf5i\\xdel@\\xfb\\xf3\\x994\\x03:\\xa4?\\xb6\\xf5\\x85u\\xdc\r\\xd7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"h\\x97\\xe8\\x8a\\xadr%a,\\x14m%4\\xb6\\xfa\\xbc\\x94\\x9b9\\xbd'\\x9e!\\x86;p\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82gx\\xa3\\xcf\\x96a\\x83\\x97pqx\\x17\\x061\\x9b\\x83\\x9b\\xe4\\x11\\x01\\\\xab\\xad\\x847g\\xc3\\xaa*1\\x89\\xb1\\xeb\\x89\\x10\\xb9\\xb7b\\xca\\xbd@\\xb3\\xa9d\\xb1+y\\xe5\\x981#\\x81!\\x01\\xeaoa&m\\xc4+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\x93\\xe7\\xf1\\xc4\\xee\\x99&\\x81\\x000\\x18j\\xb3\\x82\\x7f\\x83\\x9a\\xc8\\xd0\\xd6\\xaf\\xd6\\x05h\\xa8\\x81\\x86\\xcb\\x88n\\xbb\\xe2\\x90f\\xd3\\xc2\\xd8\\xae\\x85\\xdd\\xdct~6\\xfe\\xb3\\xa9"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\x9exse\\xe5\\xf9\\x90\\xd3\\x9am\\xc0w\\xf3\\xc8.ad\\xf5\\x99x\\xed\\xe5\\\\xcb1\\xeb\\x0b\\x7fr\\xa3\\x82\t\\x05\\xd2\\xdc\\x84%z\\x02\\x84\\xa8\\x01n(\\xb4p\\xc7\\x99h\\xacw\\xc26r-\\xd0\\x8dhv\\x8c/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19=:\\xb5\\xe6\\x98\\xcb\\x0bx\\x83\\x1e4\\x84\\xb7\\x90h\\x04\\xfa\\xf3\\xe7\\x93n\\x01\\x88)\\xceq\\xc7+k\\x1d\\xd0\\x88t:\\xf9s\\xdc\\xe2o\\x08\\x8d\\:\\xbei\\xf7\\x04"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xf0\\x17o\\xf8\\xd5,\\xc3\\xcfz\\xbc\\xeb\\xd2\\x93\\xe9\\xa7\\x08\\xdd\\xb3\\x88\\xb8.k\\xfb\\xf7f\\xb2\\xd5h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"w-a\\xf2\\x8ej\\xa7x\\x1e,3\\xfek\\xe4\\x0c\\xc9b\\x81\\x16\\xb2\\x7f\\xe9\\x02\\xe1\\x1d\\xa3p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xe4l\\xd7\\xa8|\\x86\\x00\\x8c_\\x83\\x90\\xefty=f\\xd1z\\x85\\xcf\\xb9\\x94\\xc3)\\xb3\\xd7\\xaf\\xbb,\\x1ed\\xa8\\x82\\xf0\\xe0\\xb75\\xc1\\x97\\xe5\\xdb\\xe0(s\\xd1\\xa0\\x003y\\xb1\\x81\\x06\\x0fjy\\xafx\\xaa\\xaat\\x9aff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\x9a\\xad.~\\xed\\x98f\\xab>\\/2\\x8bt\\i2\\xd8\\x12\\xd2\\x05\"\\xcf\\xca\\xaf\\xadn\\xb4\\x04\\x92\\xcfx\\xe4\\x15\\x01\\x0b\\x8c\\xb5\\xc2\\x96\"tx\\xb5\\xc6s"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7\\xa7\\xce\\xe2\\x9el\\x87\\xaa!\\x9e\\x0e\\x81\\xab\\x03p\\xc5\\xa4\\x1a\\xcbas\\xf3f\\xcce\\xc0\\x12\\\\xc3!;\\xe3\\x0bl\\x01\\xb1\\xfcc `\\xeb\\xf0\\xf0\\xd89\\xd7\\xab7ugq\\xff\\xf0\\xaf\\xe4\\xb3^i\\xd2\\xab\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xc5\\xc4\\x9dnl9\\x81#'\\x14mb\\xbb\\xbd\\xfa\\xee\\xa1\\x0e^k\\xe8p\\x19\\x83\\xa3\\x0c\\xce\\x9d\\x91\\x9a\\xaa\\xf6\\x86f@\\x08\\x0f\\x8b\\xb1\\xddkc\\xbblz"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xb8k\\xbbp\\x17\\x1b\\xe5\\x15\\xef\\x86<3h\\x95\\xa1\\xe6f\\xfd\\xfd\\xd6\\x9e\\xce\\x85\\xd9\\x0c\\xbc.\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\x8a\\x88\\xe78\\x92\\x1d\\x13\\xb03l\\xa72;?t\\x1c\\xfds\\xd2\\xa0x\\xe5\\x8e|g\\xd6\\xb7\\xa8h\\x1e\n\\x08v\\x82.\\x83`\\xf4\\x80\\xf0\\xc5\\x1e\\x8c7my\\xf6d\\xe6\\x87\\xb2\\x06\\x01\\xaesx\\xd5a\\xc2\\xa8o\\x01\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\xf4\\x03\\x8b\\xc9\\xa3c\\x01e\\x893\\xael\\xfe@\\x1cg\\\\xe0\\xe8\\x01d\\x0f\\xb6\\x12v\\x11\\xe9\\x08\\xb9\\x98\\xc1\\xbd\\xcaa\\xff\\xf4\\x91j\\xeb\\xaa\"\\xf8p\\x14 \\x92"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe_(\\xed\\xc4\\xe86cj\\xa4\\x96\\x94z\\x17d\\xecw!\\xce\\xde&\\x03\\xad\\xc6l#f\\xf0\\xae\\xcb\\x14\\x0e\\xbd\\x0b\\xcf<\\xdd\\x8a\\xb0\\x1dch\\x05\\x1e\\xb2\\x88\\xedu\\xcb\\x1b\\x9d\\xea\\x836\\xdbom\\xde3n\\xc8p\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3/\\xc0\\x0f\\xbe6\\xbb\\x9f\\x97u\\xa2g\\xa9?|r~x\\x98\\xcf\\xb6\\x9fl\\xd7no\\x1d\\x9er\\xed\\x9a@\\xd0\\xc8\\xf5\\xdd\\xd9\\xa5\n\\x08\\x0f*b\\x04h\\xa1\\xd1\\x85"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\x05aij\t\\xb0s\\x81t\n:~\\xdal\\x07x<\\x8d\\xbc\\xbc9\\xf8if!$3\\xbb%\\xb9.\\xa3\\x12>q\\x9a0\\xc1g\\x1c\\x81\\x8e>\\x01\\xfau\\x0e\\x80\\x12\\xa59y\\xc4~\\xff\\x7f\\xad\\x0e\\xa8\\x8a\\xad\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd\\x8ft0x\\xa8\\xf1g\\xf7\\x13t\\x11\\xad\\x92\\x8d?\\x8e\\xecd\\x9d.\\x11\\xd4\\xd6\\x9c\\x00\\xb3\\x97\\xbd\\xe6\\x88:\\xfd\\xe4\\xeb\\x99\\xb0y\\x81\\xee\\xd3\\xc5\\xd4z\\xc8\\x87\\x8b"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\x8c\\xf6\\xd9\\x12\\xa5\\xaey\\x04\\xb7\\xc6\\xd6\\xc6=!\\x83\\xac6\\x04\\xdfd\\x8a\\xc57\\xe1\\xbd\"+\\xad\\x06ty\\xdf\\x97\\xdd\\x97\\x8b\\x92p\\x89>\\xe5q\\x81( zy>j0\\x8d\\xb1<a\\x9c\\xe9vo4\na\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000dcb<\\xec?v\\xb75\\xf5`\\xf0\\x9f\\xde\\xd2\\x86\\x0b\\xd6\\xfd\\xc8\\xac\\x89\\x9f\\x82'\\x94\\xbf\\xde\\x11\\xbc\\xed\\xd2\\xebp\\xfe\\xee&\\x899r\\xac\\x84\\x19\\xbba\\x85b"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0ir\\xcb\\x0e0\\xbd\\x16\\x12 t\nz\\xf1\\xa1\"z\\xcey\\x9c\\x90\\xb2\\xc2@\\xb4\\x1c5\\xec+v\\xc2\\xda\\xe5k\\xd6q\\xe9\\xe7\\xb5n=\\xa5y\\xad\\x08\\x96\\xcf\\x8b\\xc7\\xbb\\x1a\\x85\"\\x15\\xca\\x93\\xfbeq\\xa3\\xb18\\x1e!\\x02\\x80>\\x8a\"9\\xaa\\xa2\\xf4\\xf1\\x0b\\x0fs\\xd3b9\\xd1\\x01\\xccj\\xc0h\\xa4\\xfcjs\\x9b\\x0c\\x7f\\x97\\xee\\xe7\\xc9\\x9ed\\xaa\\xd8p\\xdb \\xa3\r\\xd0\\xe4\\xad\\xed1\\xc8\\x9a2\\xcbo1\\xb8b\\x9b7b\\xa1\\xf1\\xb8\\xe5\\x02\\xf9\\xba\\xe1\\x9a\\xf8\\x98-\\x80\\x87\\xb8\\xa5i5@\\x11\\x1f\\xc4\\xe5\\xe7:>\\xcf\\x02b\ts\\x9b\\xf2k6\\x08\\xe9\\x96g\\x8c\\x95pch,\\x16\r\\xd8\\x18o\\xab;( \\xd8\\x82\\xc6?\\x9d%\\xc8a\\x1a\\xb0\\xade\\xc0\\x81$\\x02k\\x92\\xf5\\x1f\\\\xb8s\\xc4\\x8a\\xb8=e\\x05\\xe7$\\xcc\\xbbg\\xa3\\x0f\\x19g\\xf8/v\\xca\\x06on\\x947\\xe9\\xfa\\xeb\\x8d\\xf6's\\xb0^\\xf0\\xbbb\\xad\\xe8;\\xe3\\xe1df\\x8c\\xd4\\xad"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xe8\\xbc\\xb38u\\xb6\\xdb\\xd5\\xd3zmm\\x0c;u\\x8f_%8\\x82k\\xaa0\\x7f:>wz\\xee0\\xb5\\xf6k0\\xc7\\xeb\\xa1t\\xe6\\x03\\x17\\x14\\x93_\\x8a\\xc6\\x89s\\x18\\x89q>\\x16hc\n^\\x13 \\xdf\\xc5\\xcc\\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\x8f*&\\x95\\xf8\\xe0\\x9bu\"\\x10\\x8e\\x80\\xdcl\\xe5\\xcf\n\\xa2\t\\x87\\xf5\\xd7 `\\xc65\\x03\t\\x1d=\\xd7\\x17\\xed\\x93\\xef\\xb5p\\x89\\x91\\x87\\xee\\xdc7\\xb93\\x9c"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c^\\xde\\xf9\\x91\\xbb\\x00\\x0f-\\x8cp(+\\xba\\xec\\xc6\\x94\\x17\\xe8z\\xe5\\x8ar\\x07\n\\x1d\\xf5\\x81\\x11\\x8c\\xec\\xcaj)\\x96\\xbe\\x9f\\x1f\\x0c*u\\xa1\\xb1\\x9d\\xc0\\xdb\\xfb\\xe1\\xdej\\x04\\xb3l\\xfd\\xb1\\xc1\\xa5:3\\xa8\\xa9\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\q8w\\xcb\\x8c=\\x91\\xe1i=\\xaf\\xbd\\xae\\xfd\\x883\\xe7\\x89\\x88\\xff_f\\x90\\xfcol\\x8e\\x87\\x81\n\\xe0\\xecf.v\\xcf\\xf1eb\\xf79\\xa6\\x9e>\\xb0\\xcd"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\x06gcs6s\\x996c\\x1e\\xd9\\x06\\x8d27\\xb3;&of\\xd5ci\\xed\\xd2\\x00(`\\xf7;\\x81v\\x99\\x91\\xecrm\"\t\\xe4\\xa06\\xb7pr=h\\xba\\x9aiv\\x9b\\x9fw(x\\x06\\xee\\xc0d2\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x96\\xb2\\xcdx\\x8f\\xac\\xfd\\xf6\\x1b\\\\xd3rd\\xd7u\\xcajm\\xb5\\xfaz\\x94uq$4\\x9d\r\\xf1&\\xfd\\xd9\\xa3/0jr\\xe7\\xd3uk\\x9ds\\xdav\\xf3\\xd2"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x1d$x\\x8epn\\xaf\\xbde\\xf1\\x11\\xa2\\xd0\\x10\\x8a\\x1b\r4\\x8e\\x07sr2\\xf2c\r\\xa7\\xa5\\x99\\x03\\x07x\\xc9\\xcau\\x19\\x0b\\x89\\xca\\x81dj\\x15\\xc9d;\\xd0\\x1b#j\\x00+9\\xd7\\x8e*\\xe4sd\\xce\\xd5\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\x10\\x95d4\\x99 \\xc2\\x06\\xc8b\\xf8\\xc0i\\x86\\xb4\\x9e\\x08&\\xc4k\\x85\\xfd$\\x89uj\\xccv\\x83\\xf9\\xd0\\xfb\\xc1(\\x03\\xf5;\\xeap\\x18\\x98\\x83\\xa6s\\xbb\\xa5"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07m\\x96@>\\xea\\xdf\\x95\\x85\\x15\\xdd\\x03\\xb9\\xc2\\x815\\xb48\\xc3\\xc7\\xc0\\xbap:\\x8e\\xe9~rv\\xb7\\xc8\\xa8\\xcc\\x0cqg\\xe6\\xee\\x0b\\x9e\\x19\\x93\\xf9\\x95\\x7f\\xfb\\xa6s\t\\xff\\xe7\\x00q\\xcc\\x0c\\xb2\\x81\\xb3\\x9e\\x82!u\\x01\\x18\\x87\\x18oe\\xec\\x90\\x92#\\x99\\x06i9\\xbc\\xcd\\x9f/kny\\xb1;\\xfd\\x0f\\xda\\xd0\\x1a\\xc6\\x81\\x8fo+\\xb6+h\\x98\\xdbkw\\xd7w\\\\xde\\x8e\\x0f\\xad-\\xf5\\xbb\\xb9\\x81\\x81\\xc2e\\x92i7\\x85\\x84\\x12e\\xa1l\\xfd\\xfe\\xc4\\x1a\\xbe*\\xca\\x91n9ze\\xaf\\xff\\x03\to\\xa1\\x98\\xfa\\x7f\\x1ca0\\xe3\\xddo\\x99\\x0e\"j\\xe4\\xcd\\x1a\\x1c\\xf2\\xaet\\xde\"\\xd1a,j\\x1d+w\\x9a\\x93j\\xbe \\xedu\\x83\\x18\\xfb\ns|\\xcf\\xca\\x884\\xae\\x8e\\x07\\x89d\\x0e\\x82\\x0c\\xa6m\\xd0$w\\xe1s98\\x9b\\xd7\\x86\\x87\\xa8\\x96\\xdd\\xc2\\xf8\\x80x\\xb6&\\xe3\n\\xbb\\xfe\\xf3\\xc4q<\\xac\\x96\\x9f\\xde\\xfa\\xc8;\\xd7\\x83\\xe6\\xcb\\x95\\x0b\\xea\\xf8\\xaf"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x02of\\x99\\x17\\xf0\\xb7\\x86/\\x80\\xfd\\x86\\x87\\xa0\\x1f\\xe0\\xb09f\\xaa^\\x90\\xc7v-\\x8d\\xe2rx\\xef\\xda\\xf3\\xaa\\x05\\xe0_\\xd2-\\xad\\xa2\\x85\\x1d\\x03;o\\xfappqh|\\xee\\xaf\\x8e\\xd3\\x8a-\\x7f5\\x8f\\xca\\xc1\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\x98b\\x019\\xe0\\x05\\xaap28d\\xd24\\x98*g\\xd9y\\xd1\\xa1\\x11+q\\x86\\xe4\\xb3ni\\x08q9j\\xf5;\\xb3\\x16\\x13\\xa1\\xac\\x16\\xc6\\x08\\xaef\r\r|"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0>\\x127\\xca\\xef\\xa9\\xd2\r\\x18x,\\x05=\\xf0\\xa4\\xbct\tt\\x1c\\x89d\\xe4\\x12\\x11\\xff\\x9bl\\xa2\\xd4\\xd2\\xe9\\x95\\xa6\\xcf\\x11\\x1cl\\x1f\\x86\\x14v\\xf5\\xb7\\xc3\\x99g3h\\x83|\\xad\\xffp\\xcf&zm8\\xb7\\x9b\\x82f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\x9a\\xa0\r\\x16\\xca5s\\xc16\\x95y\\xc9\\x878\\xf9\\x7f\rty\\xf0\\x9acv\\x83f\\xa3x\\xea\\x9a\\x9c\\xf3\\x94\\xf2\\xef\\x1a\\xa5\\xf9\\x17\\x9c\\x82<\\xd4\\x0e+x\\x1a\\xe8"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa\\xe4\\xcb\\x8f\\x91\\x12\\x0f=x\\x05p\\xebpi\\xe1\\x82!$\\x88i\\xf5\\xb4_z\\xf0*\\x8f\\x986\\xf9j0 ^p\\xcdp#;wjs\\xa3\\xb3\\x87\\x99$2\\x8f\\xe6l\\x07\\xd1ub\\xd3\\x82\\xf0c\\xd4\\x08?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002\\xf2<g/\\x01%\t\\xca\\x16\\xf9\\xde\\xe0\\xb6\r\\xe1\\xbd\\xb3\\xcc\\xed\\xc9\\xd4\\xa7\\x8f\\x97>\\xcd?a\\xb5\\xcev\\xc8\\xf3\\xa6\\x03a\\x0f\\xc2\\x00m\\xd6\\x8d\\x18a\\xc2\\xb9z"
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\x1be@''\\x81ht\\xc2.\\x9a\\xc4\\xa1\\x1em\\xd4u\\xc89#\\x9e\\x17\\xf7\\xaf\\xb9\\x12\\x0f\\xc9\\xeb\\xb25+\\xbd.\\xf3\\xfc\\x92\\xc8\\xd3\\x0e\\xe9\\x1c\\xcf\\xb2\\x9c\\xd4\\xd3\\xdb\\x80\\xc9\\xff\\xd5\\xf8\\xdb\\x10p\\xef\\x05%\\xc4;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccoa\\xb1\\xf3\\xd3\\xbc\\xc7*\\xd8.0\\xf1\\xa3\\xfe\\xa2\\xe6\\x1e%)\\xd6\\xb2\\x1ek\\xa4\\x0e\\x99\\xea\\x8d\\x9d%iu8i\\xf0\\x0c\\xdba\\xd1iy\\x1a~\\xeaow`"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\x9f3\\xcb/\\xfc\\x08|\\xa6g\\x86\\xae\\xdf\\x9f\\x91\\xfe\\xca\\xcboz'\\x94\\xd7\\xc5&\\xf2\\xae\\xf1\\xdb\\x1b\\xa3\"\\x0e\\xaa8\\xc4cf\\x85zhr2\\x80\\xa5\\xba\\x93\\x968\\x1c\\xbbf05\\xde\\xd5\\xcc\\xd6\\xae^y\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>.\\x87\\x84q\\x9ce9\\xc4\\x95d\\x82o\\xcf\\xc0\\xebo|\\xad#\\x94g#\\xe9\\x0fc\\xd7\\xdd\\x8b\\xca\\xa8 m\\xabx\\xc61\\xcd\\xc6@\\xbd\\xddfphl\\x10"
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\xc1\\x049\\xd5k\\x8b\\xc6\\xa8\\xbd\\xb3\\xb4h\\x9erm\\x8d\\xa5\\\\xea\\xcd\\xde\\xb2\\x0fl-\\x96k\\x1e\\x91t\\x1a\\xa1\\xee\\xea\\xd27\\xbfzs\\xb2\\xd5le\\x9e-3\\xb9\\xccmg\\xf6\\x85t\\xdd\\xf9\\xafmk\\xcdir\\xb0\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xd3\\x82\\x8b\\xa7\\x1c!t\\x19\\xc2\\xd8\\xd6x\\xf6\\x9d\\xbb\\x03u\\xd4y\\xd8\\xa1\\xdc2\\xfb\\xef\\xc0x\\xd8\\x99\\xb6\\x96v\\xdc=\\xb48\\xb1\\xd8\\x8a+*\\xd1\\xebs\\xa2\\x0ce"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q^@u\\xe8\t\\x8d:\\xeb\\x0f\\x81\\x1c\\xc4b$\\xfa\\xe6\\xc7'\\xe4\r\\xed\\x14\\xd7\\xf1\\xe3\\x01\\xf1\\x9c\\x87\\x02\\x1e5\\xde\\xd5m\\xaba\\xeb\\xcb\\xd6\\xad\\xe8pe\\x84\\xdbs\\xbds\\x8c\\xc9i\\xa2w\\xd3\\xec\\xd4f\\x92\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xa3\\xbb\\x03\\x0c\\x93\\x13\\xda\\x98\\xdcn\\xd5\\x105ysb\\xfd;\\x15h\\xaei\\x0cmd\\xa8\\xd7\\xd3\\xfeg\\x06g\\x95~\\x1ey\\x86\\xc9y\\xea\\xd9r\\xf2\\x13\\xb8\\x05"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xfa\\xb9(k\\xd5\\xb7\\xbf\\xcem0g\\x93h\\xaek\\xc3\\xf3~\\xfb\\x0c\\xf7\\xa0w\\xa9i61\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6\\xb1\\xea\\x00i&\\xbb\\x10\\xb3\\x13\\x88\\xee_\\x1e\\xd5\\xa6\\xe5\\xb4\\xdb\\xd9z\\x844\\xf5s\\x02\\xd7d\\xf1a\\xfb\\xb4!>\\xff\\x95g\\xeb-\\xa8\\xfa\\xfb\\x03\\xcd--\\xaa\\xcba\\xc5v\\x9ed\\xf2\\x8bor7\\xff\\xb2\\xd2\\xa2\\xf0\\\\x1fl\\xe4\\x9a-'2hk\\x1b\\xe7\\xe0j\\xeb\\xfc\\xdd\\x0b\\xdd\\xec&\\xa6q\\x91\\x05#;\\xde\\xf5\\xab\\xb0\\x86i\\x98f\\x1c\\x80+'\\xeap\\xce3\\xba\\x98\\xd2\\xed\\xc2ifl\\xe9\ri\\xe6r\\\\x89\\xb57z\\xc7z\\xbc\\x91\\x8b\\x07\\xfa\\xd5ur\\xcf\\xeale$c\\x8a\\xae.\\x98u\\xd8\\x8d\\\\xbf\\xc3\\xcf:\\x0e\\xa6\\x05\\x9f\\xd0th\\xe0qlhk\\x9d\\xba.<g\\x19zb2\\xae\\xbdi\\xdd\\xe4\\x16\\x08gmz\n\\xc2y^(\\xa3\\x95\\xf5\\xcff\\xda&\\x88\\xef\\xee\\xf6\\xfcr\\xb1c*\\xd8\\x9c~\\xd6sx\\xf6\\xa5$9d8\\xc7\\xf1\\xe5\\xc4\\xac@\\x9b\\xe5f\\xf0\\xfc\\xc3\\xf4:\\xbf\\xb9\\x90\\xe6u\\xd8\\xd9\\xde\\xdf\\xf7\\xcc\\x80"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\x81c\\x80\\x08\\xc6%\\x06\\xfb\\x8fj\\xef(\\x86\\x06\\xd4tw\n\\x1a\\x80?\\x87\\x82u\\x9c9y\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xd0\\xe0\\xfc\\xe2&pd&@\\x11o\\x87$\\xe0l\\xc5\\xe5qd\\xc6\\xe4\\xcf*\\x93-\\x10\\xff\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99pxi\\xcej\\xedt\\xd4\\x85v&b\\xc0-\\xc2\\x9f%y0\\x0ci\\x9fv\\x8am c\\x04tq\\x8a\\xab3\\x9e\\xe6\\xa5\\x8cx\\xc6\\xe5\\xfb\\xa9\\x11\\xcf\\xff\\x9f\\x9e\\x015\\x99ti\\x14\\xd2t@\\xcf\\xa6\\x82f\\x05\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\x8e\\x8f\\xa3c\\x8f\\xed.\\xa9\\xa4?\\xd3\\xa7\\xdd\\xd6\\x1d\\x18(q:\\x806\\xe7-\\xe6\\xb1s\\x00h\\x0f\"*\\x9c\\xef\\xbe\\x98\\xa2\\xb4\\xb1qr\\xa4\\x15\\xa6\\xccb_"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xa1\n\\xcd\\x9e\\x01\\x88\\xd2\\xf7\\x9b\\x00)\\xeb\\xb1s\\x7f\\x1e\\x9c\\xb6\\x92\\xba\\x94\\x10\\x99a\\x1a\\xc0w\\xf0\\x124=\\xcb\\xa5\\\\xd7~h\\x1f\\xfc\\xb0h\\xd1i?\\xf5v\\xd8\\xde\\xf8\\xdfe6(\\xe9\\xa6\\x93\\x17\\xb1\\xd5\\xa2\\xd29\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\xf72\\x08y\\xc9f\\x88g\\xb3\\x1c\\x80`:u\\x12n\\x81\\xfc\\x07\\xef\\x0e\\xb4\\x95\\xf2\\x8fha\\xd8\\xef\\xcc\\x91\\x9d\\x18`j@\\xfde\\xa2\\x9c\\xa6\\x0b\\xe3\\xfas\\xae3"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04s\\x16\\x9d:z\\xb7\\xdd\\xcf\\x87\\xe6\\x9b\\x8e\\xe9\\xae\\x1cls\\x81j\\xd5\\xd5`\\xfe@e\\xbc\\x9e\\xeb\\xa8p\\xbe\\xd0\\xde\\xc3\\x07\\x0c\\x02\\xf1\\x84\"wt\\xb83\\xee(\\x92\\xcd\\x14\\x08m\\x91\\xebn\\xd6j\\xc6\\xff~91\\x8c\\xf71\\xc3\\x82\\xeb$:\\xbf\\xa5\\x0e\\xc8\\xa1\\xfd\")\\x8f\\xb3\\xa8\\xcep\\xe6i,t\\xff\\x88.y\\xb2/rc\\x99\\xb3\\xaa\\x1c7z\\xb63\\xf7\\xf6\\xaf\\xcbj\\x02\\x8e\\x14\\xfc\\xad\\xff&\\xa6\\xf4r\\x80t\\x91\\xcc\\xe2\\xa0rh\\x1a\\xdc\\x84\\xb8\\x7f\\xe9\\xa42e\\x03\\xcf\\x0b\\x95\\xa8\\xbcq\t6\\xc5\\x808v:\\xab\\xc9\\xed\\xe2\\xce\\xfbl\\xd0\\zsq&?\\x93\\xafkb\\xe8\\xf8\\xc3\\x83\\xef\\x0cz\\x92\\xf8\\xfb\\xc2f\\xc6\\x99\\xae|\\xa88\\x14\\x8f\\xa3@z@\\xf0e\\xe2$\\x91v\\x00p\\x0b\\xe0\\xd5fcv\\x903i\\x1d\\xb4\\xfcw\\x8b\\xc3\\xbaw\\xc9h\\xd0ua<\\xe2\\xc4\"vf\\x7fp\\x8fd\\x86\\x11m\\xf17\\xd2\\xca\\xed\\x7fa\\xeb+"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89f\\xb4/%p@d\\xda,\\x0e^n\\x05\\x92q\\xdd\\xf9w\\xbc\\x01\\x9dv\\xb5\\xfaq\\x99s\\xdbb\\x9b,\\xd7\"\\xeb\\xc0\\x9bc\\xfd\\x96l\\xee\\xab\\xda\\x93\\x9d*gya\\xde\\x7f\\xa4\\x1a\\x0b\\x07\\x8e6?\\x83\"\\xe8|\\x8f\\xc2\r\\x01\\xab\\x13\\xe4<\\xe9\\xa7\\x1024p\\xa5\\x97f$\\x91\\xfb\\x9b\\x01 \\x87\\x8bs\\x96\\xbd\\xd2\\x8c\\xe4-\\xc94y\\xbd\\xdf\\xd7\\x0b\\x8f\\xb6\\xe9o\\xac:os\\xcbci\\xf3\\x84\\x05\\xe54\\\\xa4-\\xe39\\x97qs-\\x98\\xba\\xcd^8\\xdc\\xcdc\r \\xdfu\\xd9\\x19\\x87.d\\x8eptx4\\xe7\\x13\\xea\\x92\\xf7@\\xd7\\x92\\xd5\\x1e\\xcf\\xc8#\\xd7\\xb4\\x18vh.\\xe2\\xe8\\xf1+\\x00\\x85w\\xb6\\x18y\\xe6\\xa1\\x10\\x8d\\\\xd1&\\x0b\\x1c\\xa9\\xf2r\\x95x\\xa0\\xda\\xbe\\xaf\\x9f|\\x8di\\xffg\\x82:c\\x956\\x13\\xb4l\\xd6 g\\x1c~.;\\x9a\\xe0\\x14i28\\xa7\\xc7\\x01\\x81fn\\xf3\\x9e\\xe5b\\xb5\\xc4k\\x90q\\xe9q/z\\xfa"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%\\xea\\xe6\\x8a\\xd3\\xf2\\x93j\\xa5\\xfe\\x98\"\\x8a*\\xf0o,\\x1b\\x8b\\xb9\\x9d_\\xbe@\\x81p\\xe0_b\\x88\\x8a\\x1ei+b\\xdf\\xad\\xdc\\x18\\x91i#\"\\x80v\\x92hnt;\\xbas\\xa7\\x0e\\x8d\\x84\\x84m\\xb8\\x92\\x0b4\\xc2\\xeb<\\x16\"ol`y\\xd0z*\\x9b\\x8f\\xc1\\x8e\\x8a\\xbbr\\xe05\\xb5pc:\\xdd=y\\x1a.\\xe5\\xb6e\\xf7\\xa0\\xec\\x9b\\xcf\\xdb\\xe96\\xfb\\xed\\x8f%\\xf6i\\xd7\\xa5b\\xda\\x9b\\xa3\\x05h\\xe1\\xe1\\xd8\\xde\\x99\\x99\\xd1\\xfd<\\xe1\\xb5\\xc6c\\xc3 \\x19\\x9frq\\xa2\\x1f%\\x1b\\xces\\xe0\\x9e\\xc4/\\x17\\xe2t\\x9d8\\xc6\\xb9\\xb1\\xf0hi\\xe3\\x0e\\xeb\\x11k\\xbd\\x95\\xa4\\x0f\\xd3\"\\x06\\x91pce5\\xe5\\xce9\\xd8\\xff\\xc8~\\x1d\\xb5\\x12k\\xa2\\xf3b\\xa9\\xb7\\xd3\\x04zz\\xd7\\xb2\\xbf?\\xdb\\x90\\x1f^y\\x98?\\xd2\\x8b9dk\\xb5<\\xd1\\xfe\\x0f\\x0fa\\xb0<\\xdc\\xb9\\xd1%\\x84\\x8et\\xdf\\xd8\\xe9\\xa8j\\xd3\\x94okx\\xc8\\x02\\x88\\xb9\\x1e\\x92\\xef1k\\x8f8"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\xc8\\xd0\\x08k\\xa1j\\xc3\\xb2z\\x94)\\x94\\x0eeqe7\\x12\\xcbx3*\\xb1m\\x03\\xd1\\x8buil\\xf0z\\xa9\\xb0\\x88f\\x97\\x9bm\\xf8\\xea\\xad\\x02\\xbdn\\xe9\\x84\\xccy\\x18d\\xdac46\\x97\\xb2i\\xc2)\\xe1\\x10\\x1c7\\xa8\\x93?\\xe5\t\\xc20d\\xd0s\\xed\\x83\\x15\\xf0\\x13\\x0f\\x9e\\xbc\\xd8\\xf6\\xe9\\x17>\\x16\\x17y\\x03\\xcd\\xaa\\xce\\xea\\x97\\x90\\xa6\\xf0c\\xc8\\xce\\xae\\xa9:\\xd7\\xd8\\xab\\x94\\x83mq\\xd9u\\x15%\\x85\\xb2\\xafo\\xf5\\xb9e\\xa9\\xf1\\xb6;\\xa4\\xb8\\xc1\\x9e\\xdeifq\\xfc\\x7fz\\x17\\xdd\\xb2\\x9a\\xb9\\x1b9\\x07\\xc6d\\xab\\xa6\\x1e~\\x19\\xd3`=\\xa1\\xd6f\\x8f\\x9c\\x9d\\x1d\\x94x\\xfd;\\x19\\xa4o\\x8c\\xb6\\x82\\x04 \\x87&1af\\xc3\\x94\\xfd4\\x04\\x9a\\x1f\\xb9d\\xdbn(\\x13\"\\x1f\\x97\\x95\\xed\\x17\\xda\\xc5\\x0f\\xcf)\\x02no\\xf7\\xda\\x8f\\xdc\\xaf\\x12\\xf6~\\x88\\xad\\x8f\\x94!s\\xfa\\xfd%\\xdfk\\x8ct%\\x81\\xcfw\\xa8\\x7f\\xa1\r\\x16\\xa5o\\xc6\\xc5\\xa7\\x82vn"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd<\\xdf\\x00\\x1ea/#\\x12\\xd5\\xd3;?vl\\xbfs\\xc6\\xf5\\xf2\\x8b\t\\xc5|\\xf3\\x13\\x15\\x1c\\x1c\\xda\\xe8 \\xa0\\xa2\\xda\\xe2\\xbd\\x9f\\xaftj\\xbe\\\\xb1qb\\xbdd\\xf4\\xf9\\x05\\xd6s\r\\x0f'(\\x85\\xba\\x9ec\\x91\\xa1\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*'\\xdcwc\\x1d6:\\xe1\\x13\\xbe\\xa2\\x98\\x9c\\x9cm\\xed9\\xca\\x01\\x91\\xb1\\xe8\\xb5\\xddq\\x01\\xc5\\xb7\\x05\\x08/\\xf4475k\\xc7'\\xd5<\\x0c\\x7f\\x04\\xf6\\xab0\\xe4"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;~\\xb0\\xb1\\x1d\\xc8\\x1c\\xdbxsq(\\x80\\xd6g\\xcd8\\x7f\\xa0\\xb9\\x89;eia\\xfbd\\x80\\xac\\x91\\xb4\\x92_\\x00\\xf1p<\\xb2\\x1d\\xf67\\xf6\\x17\\xd5\\xce\\x84\\xees\\xa4x\\x19\\xbc\\xfa\\x11\\xc2\\x82m\\xca\\x14\\x8awe\\xb9\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1ak\\xb3\\x06yu q-\\x86\\x92\\x92c\\xc3\\xbc\\x9f\\x95\\x84d\\xf4\\\\x071tyh\\x0e\\xbc\\x91n\\x1c\\xde\\xfdt\\xf1\\xd0,\\x12o8b7\\xbf\\x12\\x8c\\xdfg"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xdfoc\\xb0\\xce\\x1b\\xdf\\xbd\\x919?n\\xddq\\x04\\x85bc\\x04v\\xd7\\x91\\xf8i\\xa2\\x8fs\\xac\\xfe\\xff\\xd7f\\xfc5\\xd0d\\xb9\\xd95`\\x10\\x8a\\xdd\\x82\\xd0\ry\\x7f\\x8f%@j\\xa9u%\\x93\\xbep&\\xb7yn6j\\xd9~\\xe5\\xbay\\xbe\n\\xfb\\xca\\xeb<\\xde9\\x08k\\x1b\\x15\\x00\\xa4\\x9b|\\xe2\\xfc\\x01ij.s\re\\x87n\\xeab\\x7f\\xe7\\xcbc\\xb7g\\xde\\\\xdc\\x88\\x96\\x0b\r\\x01+\\xdb\\xe7\\xff\\x86\\xbd\\xcd\\x90\\xe4\\xc3#\\xd8\\xc60\\xbf|#u\\x89\\x94\\xe9\\xb3\\xea9\n;\\x9e\\xf5\\xb8u\\x81\\x16\\xb08t4$\\xc5\\x91\\xbb\\xea\\x9c\\xcd\\xe3`\\xceok\\x05\\x8b\\x13;xu\\xa5<\\x96m`)g+j7\\xc0\\xcb\\xe6m\\xa3+\\x9e\\xd0\\xeb\\x80\\xdf\\xa5\\xc10\\xfb 3\t\\x9e\\x8c\\xf2\\xefp\\xf4)\\x172o\\xd0w\\xe7<\\xe5\\x807\\x02.\\xe1r\\xcd\\xce\\xec\\x0f\\xb4%\\x9c\\xd3bk\\xa1\\x81ss\\xc6=\\x93\\xaf\\x1c\\x03y\\xd8\\xf8\\x8di>\\xe2?"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\xa4\\xbe\\xd1\\x0e\\x8ag\\x9fv\\x14\\x9d\t\"'\\xa9\\xb8\\xd8l\\xa7\\xb1\\xfewe\\x97\\x19\\x95\\x9b1>\\xa5\\x18\\xff\\xfb\\xcf\\x18\\xa3l\\xf4\\xea\\xa0\\xc9\\x0e\\xc8\\x1f\\xfc\\x85\\xd0\\x80\\x9a)\\x1de\\xaa\\xde\\xec\\x809\\xdbx\\xe9\\xdf\\xcb\\x18\\x95\\xe2\\xa7p\t8\\x18u\\x04\\x83\t\\x84\\xe8h\\xe4\\xdeijd\\xba2d\\xf5\\x07\\xdei\\x87\\xc3\\x99\\xf1\\xb3\\xf2,f\"\\x8ay\\xb6j,\\xaf\\x08\\xb0\\xd4#\\xb7\\xc1i\\xcd'\\x9fk\\xb14xn9%\\xd6\\xca\\x02\\xf6\\x01k\\xa9d\\xf4\\xcb\\x89\\x1fup0\\xc3^\\xe8\\x82\\xa9)f\\xcf\\x92\\xf1m|\\xc5\\xad2l\\xd7\\xcd\\xc4\\x9eo\\x17)\\xd7\\xcd\\x01q9\\x1a\\xec\\xc5g\\x9f~\\x93w\\xea\\xe2\\xc7k\\x936)\\xad\\xdb\\x851\\xd9\\xd9~\\xb6`'\\x1fh\\xfcj\\xd8i.\\xb3hp\\xe3\\x1d\\x16rco\\x18\\xb2\\xa4n\\xdd1?\\xc1\\x84\\xae\\xa4\\xf6\\x8au\\x97\\xe4\\x0c\\xcc\\x98\\xed\\x905\\x9f\\xfew\\x89z/\\xdd\\xa9\\xab\\xc3e$\\x91g\\x18\\xdc\nz\\xa1\\x8c"
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\x8dv\\xeft\\x07cu\\xda\\xe6\\x82\\xd0\\xc3\\x90l\\x18\\xdb\\xbd<\\x9eqdm\\x18zp\\xbfn\\xa8\\x80\\xe8\\x1e\\x9a\\xf3\\xf6\\xf3\\xab?\\x1b\\xd3\\x00\\xeb\\x18\\x96\\xaba\\xf9c\\xee\\x01\\x1a\\x1f\\xd7=\\xaf\\xf0\\xe9\"\\xa7)b\\x95\\xacm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4\\x83\\xdd\\xe2\\xb6\\xb6\\xf5\\xaa\\xe7\\xf7\\x03|\\x8dh\\x90k\\x05kurs\\xdb\\x8a\\x13\\xa7\\xb1\\x17\\x88\\xd5\\xf5\\x18\\xfc\\xcedw\\xfc\\xaa6\\xee\\xb7\\x14\\xec\\xa4\\xcd\\x8d\\xb6\\x0b\\xde"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c-\\xf1\\xe6w\\xe9;\\x80\\xa5\\xc0\\xa0\\xee<\\x8d8\\xaa\\xf1y\\xc2u1\\xbd\\xdf\\xff\\x92\\xb9\\xcd\\x83q\\x1f8x\\xe8lc\\x80\\x87\\xac7\\xc2\\xad7\\x0cn\\xa3\\x8cd\\xe7\\x15\\x9c3\\x94\\xc4g\\xe06\\xdc\\x049l\\xa1\\xe2mt\\xbc\\xf5k\\xe7x\\xc3\\x92\\xde|\\x93\\x85j/@\\xf3\\xb7\\xc3\\xc4\\x98\\xc2\\xd6\\x05\\xc0k\\xcf\\xc5r\\x10h\\<!\\xec\\xddbs\\x83$/e$\\x11:\\xd7w\\x803\\xf4bg\\x80\\xf4s\\x04\\xc1\\xf4p\\x06y\\xff\n\\xef\\xe9s\\xb3r\\x92\\xf8\\xfc\\xc3\\xcc#\\xd5\\x01\\x96y\\xf1\\x01\\x84\\xd4\\xb0\\x1d\\xfe.\\x97\\xd6\\xf65\\x97\\xc6=n\\xe68\\x1a\\xafa\\xf2\\xf0\\x8dn\\xad\\xbd\\x91p\\x94\\x90\\x1a\\x85cg>f\\xe9z\\xf4\\xd8*/yjs8d\\x13\\xb4/\\xed\\xe9\\xdd\\xf1\\xc8\\x04\\x03\\x9a\\xb7\\xa0\\xa6\\x9f\\xf2k\\x93\\x96\\xd9\r\\xf3\\xbb\\x87\\xcahaj\\xb8h\\xb5\\xba\\xeds\\xbc\\xa7$\\xfd\\xae\\x8e\\xb4rm\\xf5h\\x8a\\x0e\\x076\\xfd\\xb7\\xf6\\xc9\r\\x1dk\\xf0\\xb3\\x9a"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc04\\xb9\\xa7\\xc1h\\xed\\xae\t\\x8b\\xa7\\xe0\\xee\\xfa\\xb55n\\xe1$d*\\x07c3\\xcdv\\xf48\\xc6\\xec \\x82l@\\xd2\\xfe\\xbb\\xb9\\xe0\\xe9,d\\xae\\xcc\\xaa\\xaex\\xea\\x02\\x9e\\x0e\\xd5\\xbc\\x0e\\x1e\\xae\\x9b\\xc6\\x10\n\\\\x00\\xbd\\x05\\xcfq\\xa8_n\\x86\\x9c^\\xc2v\\x16\\xe6\\x86\\fl\\xa3\\xce\\xcc\\xa8\\x0c\\x8c\\xc7?\\xd4j\\xfe\\xa1\\x0c\\xa6\\x95?\\xefl\\xd3\\x9bf\\x08\\x92~\\xd2\\xe3brv\\x16\\x88\\x0b\\x92\\x1a\\xc2\\xe9\\x19\\x98\\x99:\\x03\\xea\\xd7\\xf9\\xccjqn\\xda\\x8d\\x8c\\x81\\xa5\\x8b\\x91\\xc0\\xd8\\xc0\\xbb\\xdf\\xa5&\\xa0\\x1fa\\xectu\\x83\\x97\\xbcf\\xc0\\xe3\\x0b\n\\x93\\x87\\xe1\\xeep\t\\xef\\xa5vb\\xbc!\\xb4\\xa0\\xf8\\xaa;\\xa4\\x8fw5\\xe4\\xe92\\xe5\\\\xaf\\xb2\\xed\\xbcf\\xdb\\x85\\x0e\\x06#\\xd4\\xb5\\xe9cp\\x19\\xfb3\\xa8\\xf6\\x12\\xa9\\xc0\\x1d\\xc6\\xdb\\xf8`!=\\xdde\\x81\\xa5\\xc5\\x8c*\\x13\\x8fxo\\x7f\\xd0\\x86u\\xf8\\xf7\rc\\x97\\x97\\x06\\xa0\\xd2\\xfd\\xcb\\xf3\\xb3\\x1e\\x18\\x10\\x9e\\xc2\\xef\\xe6\\x915"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xafh\\xb4'\\xee\\xc7c\\xdd\\xfa6j\\x1e\\xa2\\xf3\\x9fd\\xef\\x1a4o\\x13\\xd9y8^\\xf1\\xe8\\x9a\\xd8\\xf86\\xda|\\xde\\xe9\\x1eo\\x96\\x13\\x88\\xd1lbkd\\x08\\xde\\\\x02eb\\xd1\\xf3\\xac\r\\~x\\xdf\\xc3\\xdd.\\x18\\xa6\\x02\\x0c\\xc8\\xcfx\\xe6\\x0ebi\\x00\\xd9q\\xe0\\xb4@,*3\\xd3u\\xe6q\\xc7\\xaf\\x9f\\xc6\\xe0jl4`\\xe9\\xf4\\x04l\\xde\"\\x9cvv\\xa2\\x13\\xc6\\xd0\\xe5k\\xc9\\x8e\\x91^=\\xa7\\x938\\xc7x0\\xcb#%\\xfdp\\x03p\\xf5\\x920r\\x19g\\x98\\xb6i\\x14\\xb2\\xfb\\xe0c\\xad\\x00yw\\xa4\\x05nv,5\\x83f\n\\x8e\\xb1\\xeb\\xa6<bg\\x1e\\xe8\\xeb\\xe3u<\\xbb\\x0c\\x98\\xc6f\\xaf\\xdc\\x9c\\x9d\\x8e\\xa0yl\\xd8%38\\x8f\\x8eks\\x0b\\x9a\\x1b\\x133\\xa5\\xe7\\xc9u\\xc7\\xb3\\xc82=:\\x82.o\\xe5\\xcd\\xda\\x07\\xf0\\xc5\\xc1g\\xb8/\\x11\\xfd\\x88\\x1eji4nd\\xaa\\x80\\xf6\\xaen\\xa8p$f\\xd1\\xb1l\\x1a\\x04\\x89\\xc9\\xccp\\xe5\\xb0>\\xd3)h"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xf4\\xf9\\x94\\x98\\x02\\x91\\xc0\\x7fa\\xf2<\\xd8\\xc7\\x96\\x1fpe\\x19\\xd6#m9\\x88\\xa3\\x9f\\x10\\x7f+xq\\xf6\\x9d\\xe5\nxy\\x83\\xe3\"\\xc2>\\x7f\\xf4\\x9c\\xb0\\xb3\\x04:\\xd5ep\\x93i\\xa9\\x80\\xc3d\\xf5\\xc2\\x87\\xa0\\xf2*y9\\xc0\\x1cik&p\\xbc\\xd4\\xc0\\x93\\x95v\\x05\\xbdpnf\\x883m\\xe4$8\\xdfr<o\\x84g\\xa48\t\\xa5\\xbdbl\\xd1@\\xe8\\xd2\\x10rn\\xec2\\x07\\x13\\xeb&\\x000\\x9c\\xc3\\xb9ee\\xa8\\xd6\\xb4\\xfd\\x82\\x03\\xe8:4\\x1ac&\\x82;v:@\\xdd;\\xfd&\\xd3\\x9c\\xa6k\\xf6,m\\xc3n9\\xce\\xc3#\\x00\\xe2\\xa6\\x17l\\xf2\\x9e\\xc7h\\xd0\\x0e/\\xf3\\xd1v$e\\xc42\\xa8\\xd6\\xa4\\xfb\\x92\\x8e\\xeb\\x01\\xee\\xddq\\x04p\\x82\\xaewi\\xa6k\\x84\\x064\\x88\\xab\\x8cah\\xb9\\xe8\\x83\\xcd>\\x7f7\\x94\\xfbk\\x18\\xa9\\xcbka&\\x03p\\xe2`\\xa1\\x8dt,\\x93p\\xb7\\x8b\\xdec\\x03\\x01\\xa6\\xee\\x0cz\\xb4\\xd6\\x15?\\xca\\xacj^w\\x0f"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bw\\x18$\\x8cvs\\xbc\\xbf\\x9b0\\x98\\xfb\\x18t\\x18\\x12\\xa0\\xc0\\x02\\x9bo\\xa2\\x1f\\x14\\xd7!0\\xb3\\x11b\\xff(\\xd8\\xc8\\xe3\\x8e0\\xe4)\\xec\\x05>)\\xade&?\\xe7%\\xaf\\xe9\\x16jzry67\\x14\\x02uwp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1\\xb47\\x11\\xe9\\xca\\x0e#\\xda\\x8a\\x8fz\\xd7\\xe0\\xfd\\x9eb\\xc2\\x00\"e\\xa3\\xd2\\xad\\xdd\\xa1\\xf0\\xf6t\\x02\\xdb\\xe7lt\\xb0\\xc7\\xbc\\xd2\re\\x91o4\\xe3\\xfdm\\xa2\\xc8"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87u^q\\xf0\\x04n\\xa8\\xd9\\x8e\\xe2\\xa9\\x02\\xe8h\\x82\\xd8\\x95o\\xb9#\\x13=\\x84\\x8f\\xb7a\\xa8\\xdfqj\\xef\\x80\\xd0%\\x19\\xda\\xfa\\xb9\\xd6\\xf3j\\xfa\\xeb\\xc2\\xc8\\xf3%_\\xc3+\\xd8\\xd6\\x15q\\x1c\\x88\\x97q\\xa5\\x03\\x19\\x1c\\xed\\xe0\\x0f\\xf7\\x96\\xbf\\x8cc\\x1d\\xe5a\\x05m \\xae\\xe0\\xff\\x06\\xbe\\x16\\xc5(\\x931\\x8e\\xce,\\xe7\\xf2\\xbe\\xcd\\xe5\\x1c\\xde\\xff(\\xfb\\x08,\\x16\\x86e\\xc4\\xc2\\x05\\xe3'\\x03d\\xcb^\\xa1w\\xb2\\x99\\xebs\\x0f\\xb3\\x11\\xc6s\\x16\\xc4w<p\\x83\\x00 j\\xb9`\\xf0+8:\\xc2\\xc3\\x96\\x971+\\x11\\xe0\\xc3yq\\xf7\\xac\\x15\\xeca_\\x18?\\xb7\\xean\\x8a*|\\x03+\\xf86\\xf6;\\xdci\\xf2;a\\x08\\xba\\xe1\\xad\\xd0\\x18\\x84\\x16\\x98\\x88\\x14~d2s\\x16\\xb1\\xd8\\xb2\\xb2\\x9e\\xa6\\xaa\\xd7\\xd5\\xfel\\x95\\xe93\\x13\\xe4\\x9a\\xb2\\xf0\\xd9r\\x8c\\x8d\\xe7\\xc0\t\\x93\\x02\\xe0\\x87\\x97\\xe5ju\\xdfdt0\\xac<3\\xed\\xf1\\xe5\\xe4\\xba\\xcd\\x18\\x83\\xc7>\\xe1\\xb3~\\x1e\\x1f\\xce\\xe7"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04jh5\\xee\\xc5\\x144le\\xf2i\\xe7\\xab\\x8d\rek\\x9e\\x02\\xf9\\xf7\\x97g#\\x12\\xf0bm\\xd6\\xac\\x93t\\xcb\\xe4<<\\xad\\xbb)\\xa7t\\xdd\\x19\\x1a\\x0e^%\\xc1\\xfd\n\\x98\\xae\\xa3\\xe4d\\xb6\\xe8\\x13w\\xeby\\x05\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xf5\\xcb*\\x10\\xea\\xf2\\xfb\\xa1\\x93\\xc8\\xfbq?\\xdf\\xe6\\xe47\\xd9\\xe4\\xa8>p\\x84\\xfd\\x03f\\x9d;\\xb5\\x184\\xc3\\xc2\\xf8\\xf4\\xe3~\\xe7\\xaf\\xde\\xbct\\x90&\\xd4\\x92\\xd9"
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06,\\x8a9\\xca\\xfe\\xe6\\x89!\\x11\\x05u\\xa2~\\xd6\\xdc\\xdc\\xa3\\xf0o\\x10\\xff\\x13\\xc1\\x92\\x1b\\xa4\\x02ie\\xe4\\xf7\\x9b\\xb5\\xc9\\xee\\xfau\\x89i\\xe3\\xd7\\x9cr\\x16\\xdd\\xf5~\\xc5\\x94|\\xad\\xe0s\\x84i\\xf4?\\xa3\\xc6\\xad\\x9a$7\\xf8n\\x1f#\\x8b\\xce<8\\xacr\\x15\\xdf\\x03y\\x02s\\x93,\\x88\\xba,\\xeb\\xe5\\xbc\\xac\\x18\r1\\xb9\\xd8\\xe8\\x0ec\\x93c \\xe1\\xe3k\\xb7\\x7f\\xa6\\xb9cw\\x827\\xf6~\\xc5\\xbe\\xe8\\xbf\\xea\\xbb\\xe8\\x18\\x82p\\xb0ve\\x8a\\xa8\\xb8\\x999\\xe6c\\xe5\\xb8\\xfb\\x87\\xae/\\x94\\x87\\xf6\\x0b \\xf5\\x1c\\xd4q)\\xab#\\xbb\\xd3\\xe7\\xe8\\xbehx\\xbf\\x8b\\x1bo\\xed\\x9b\\xa9\\xc56\\x83\\xd7%\\xeb\\x94\\xef\\xd2\\xae\\x12\\xcfq@\\xcf\\xdd\\xfd\\xccy\\xfd\\x89\\xb5i@\\x13\\xc7\\x07\\xe4\\xc7\\x943\\xfdx\\xd8\\xf4lp\\xa1fm\\xf2\\xb1u5\\x9f\\xf7\\xe6\\x08s\\x81\\xa7\\xe1\\x82\"\t\\x18\\x9f\\xf3i\\x07\\xc6w;\\x9c\\x05+\\x83jv\\xdf\\xab.\\xfd\\xee\\xa2r\\x87\\xec\\x13"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e*\\x9b\\x01\\x0e\\xe1\\xc9ok\\x8f1y\\xb1c\\xd4\\xc6\\xb2\\x14\\xed\\xe8\\xc5@\\xf9\\xfe;-9jg$\\x19g\\xee,\\xcc\\x14\\xb4\\xef\\xb2\\x17\\xf7<\\x9c\\xf9\\x9a\\x01\\xcf\\x0f\\x12\\x84j \\xf2\\x85\\x1csm\\x8d\\xd5\\xacs-c3\\xb0\\xf7-\\xdd\\x0fh\\x80\\x10\\xbd\\x87z\\x99r(?\\x81\\x03\\xbf\\xc1\\xcc\\x96\rl\\x06\\e\\x99\\xae\\xc5\\xf2\\xf1\\xe3\\x06\\x13\\xc0\\x1d5!\\xe08c\\xb7\\x11\\xfd:\\x0b\\x82w/\\x8a\\xec\\xb4\\xdb\\xcf\rybsi\\xb6\\xb66p\\xc2\\xf5kd\\xcbg\\xf5\\x9d@a\\xa6)\\xf6\\xd0d\\xb7d/\n\\xe1\\xf1\\xc8\\\\xff\\xa8p\\x0fm\\xf6\\xa3=r\\xe9\\xd7v\\xd9\\x83h~\\x1e\\xd6\\xfbt\\xe8\\x18\\xe8\\xb6\\xa4\\xd2\\x9b\\xdfi\\xdb\\x038r\\x02\\x8a\\xa5\\xe9\\x91\\xa9\\x1e:\\x8e*\\xfc\\xdc\\xc5\\xd8g\\xc2\\x12\\xc8\\x97\\xde\\x9c\\xe5q\\x8e\\xb1\\x119\\x1f\\xc2i\\xcf\\xe4fv\\xc9\\xf9\\x1d\\xd5\\x1d\\xcd\\xae\\x88j^\\x0f\\xf9\\x8e\\x91\\x01\\xc5\\x19(j\\xb0\\xd3\\x8a3\\xaa&c\\xbec"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x98\\x87\\xc4\\x00\\x07/\\x923\\xbe<\\xd7=\\xd5\\x84\\xda\\xe8\\xda.\\xe8\\xce\\xe4zg+|\\x84\\x82\\x8e\\xaa\\xb1\\ui6\\x98\\xfa\\x851\\xa3\\x91\\xa3\\x8c\\xe4\\\\xf6\\xf8spq\\xf2b\\xd2\\x8cl^\\x9br!'\\xa4\\xc8\\xad\\x80\\xec\\xd0\\xe7\\xcebr\\x95\\xd1q.wk\\x13\\xc8\to\\xed\\xbf\\x85\\xb1\\xb5\\xeb270qnc5\\xa2\\x88\\x14\\xbc\\x16\\xb2t\\x15\\xa2>a\\xff\\xec\\xae&\\xb1#@\\xdd\\xb0h\\xcez\\xed\\x1c\\xcf<f;h\\x1ez\\xb5\\x8ck\\xe8f\\xa5eo*\\xe9\\x14\\x87z\\xd2\\x7fx\\x85\\x03\\xdal'\\\\x1d\\xf2\\xaf7\\xa0\\x19\\x11\\xc5\\x82\\xfe\\x12\\xf4ta\\xda\\xae\\xa0\\xac\"6\\x03\r\\xc8:\\xbd\\x00b\\x07\\xf8 \\xcc\\x15\\x0f\\xdf\\xd6>\\xf2\\x1a0\\xdc\\x84\\x85@\\xa3>\\xef\t\\xa9q\\x06\\x18\\xae\\x12\\xa1\\xbe\\xe3\\xce\\xd2m\\xd6\\x93\\x87;\\x17\\xf9\\xb4\\x08\\x95\\x87\\xb0\\xb8\\x8a\\xe3op\\xbf\\xb81\\x83i9>\\x7f\\xba\\xa8\\xd6\\xd4\\x80\\xb7\\xa5w\\xcfk>\\x95mf\\xc8\\xc4b\\x1a\\xe4"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@1\"2\\xcco9d\\xf5\r\\xb8\\xf4\\xde\\xd1e\\xbf>\\xd0\\xd6\\xddj\\xc5\\xdb\\xf8\\\\x07\\x10^\\xaa)f_\\x0cu\\xf0\\xd6\\x87\\xae&\\xf4\\xba8\\xdf)e\\xf4\\xb9\\xf5j\\xb1\\x7fdh\\xcc2\\xc8\\xb2\\x9b\\x8b\\x04\\x9d\\xc6\\x1df\\xaf\\xa7~\\xf1\\xdb\\xd1\\xc6\\xe2\\xd9'\\x8d\\xd2\\x1b9\\x81\\x0e\\x13\\x9am\\xa2,.\\xea\\xd3\\x87\\x8f;\\xc2\\x96\\xfba\\xe7\\x94\\x99\\xe9:\\x84i\\xca\\xec\\xa5\\x9cn\\xad\\xa4p\\xb7v\\x90\\xc3\\x90w\\xaf\\x87l~\\xe9\r\\x1f%\\x10\\xc2\\x95\\xab,\\xdb\\xa9\\x0c\\xaea6\\xe8\\x85\\xbeab\\xe5\\xfef\\x0f\\xbc!\\xa2\\xdc*5\\xd5(c\\xca\\xcf\\xa2\\xd8\\x0ft\\x89\\xd5\\x835<j\\xb02\\x80\\xa5\\x18\\x9e\\xb3\\x0b\\x03y!qk\"\\xca\\xd6q\\xee\\xa2;\\xb0\\x04!\\xf1\\xfa\\x03\\xb6\\xee\\x86\\xbfue\r\\xbb@2\\xe4\\x8a;da\\x855\\xb6a\\xa5u\\xact\\xe9@\\x14\\xed\\xb7lf1\\x0e\\xcf\\x87d\\xfa\\xa0u\\x89e\\xef\\xf2j\\xe1\\x90f\\xe9\\xd0\\xc2/\"\\x9e\\x91"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xed\\xf1p;\\xc5\\x85v\\xd3\\x9aq\\x002i\\xcb\\x0b\\xfau\\xd3\\xfcdnb\\xdc,\\xd81\\x91\\xc0\\x99\\xb2\\x00\\xf9\\x9aa`\\x05\\xc8\\xcea\\x01_\\x11y\\xdbc\\xe6c\\xff\\x88do\\x1f\\xa2a\\xb7^j\\xb8\\x18i6-\\xb6\\xc5^\\xf4\\xc5\\xf4\\x02!1\\x17\\xe9&\\xf8\\xd3e\\xc4\\xb6\\x8f\\xad\\x9a_\\xc1\\xbc\\x0c/h\\\\x91$g\\xda &\\x0b\\x1fqb\\xe8as\\x8c\n\\xfdk\\xe9!0c\\xc5b\\x14\\xbe\\xb9\\xc8\\x1c\\xe6\\x0f%\\xcf\\xbf\\xcc\\xfdt\\xbb\\x8d\\x87zw\\xe34\\x070'f~\\x8aw\\x18\\xf1y#|<>\\xc2\\xca.\\xcfh\\xcd3i\\xe9\"1krj\\xa4n\\x85\\xac+1\\x8cc\\x9f\\xaat9\\xf3\\x0c+\rw\\xe1|(-5\\xb0whmr\\xf5e\\x18\\xb5i\\x89\\xdfg\\xe0\\x14\\xe8\\xd9\\xb7\\xde>\\xb3s\\x0f\\x14\\xfa\\xde#\\x1cgv4\\xcb~h\\xc7\\x1a\\xebd`\\x12\\xec\\xd1\\xe8g\\xa6\\xd3\\xe6\\xfa\\x1e\\x10\\xaf\\x94\\xd7+\\xe7$\\x84\\xcbhi\\xacf\\x9b"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae\\xbb\\xb0\\x92wu\\xbaf\\x9c\\xe7\\xd9c\\xdf\\x14\\xd5\\xdflxmf\\xf0\\xc02\\xd5\\xf1\\xc2\\x04\\xc0\\xd4\\xdc\\xedh(\\x8d*-\\x08\\x1a\\xa9\\xfb\\x0emi\\xa4\\x98\\x801\\xb9\\xef\\x1b\\xc3\\x04c\\xd6\\xd9\\xfd\\x9c\\xe62!\\xa2t?r^g\\xe8\\xfe7t!\t\\x18\\x88\\x01\\xb1\\x02\n\\x9cs\\xb6\\xc3\\xa6\\x88m\\xf5\\xcd\\x8e\\xc8e\\xd1s\\x15\\xe6\\x82\\x82c\\x00\\xabu\\xbc\\x03r\\x16*\\x80\\xdfj\\x88(n\\xa5l$\\xcf\\x8d\\xbd\\xb1d\\xa2\\xc1z\\xaa\\xb9\\x88\\xe2ah~\\xca\\xde\\xb3\\x00\\x7f\\x8e\\xad\\x9c\\xefjm\\xa8\\xd2%\\xd5\\xe5\\xe4*i\\x06e\\xd8b\\xfe\\x91\\xf8me\\xb3\"\\x83m\\xb78\\xa1\\x9c\\x9f\n\\xd3\\xdb\\x1b\\x13x\\xd0&y\\xf2\\xdd\\xf2\\xb0\\x80?\\x92f\\xf6?\\xa5\\x96gn\\xb1\\xe5\\x7f\\xe1\\x19bk>t\\xdclt\\xf0\\xdf\\xfc\\x0f\\x9f\\xbfy\\xae1c\\xc8\\x9a\\xd7\n\\xfb\\xa2).q\\xa5,\\xb8\\x91\\xad>&\\x8d\\xe2e\\xa3,\\xfd^\\xcd\\x01,\\xe0\\xf0/p\\xe0s\\xfb_y\\x1c\\xb4"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2_8\\xbc\\xc4\\x1d\\xd5\\xa0!\\xab\\x18\\xfa\\x07^ihm\\xaf\\xa9;v\\xf4j\\xdc\\xcc\\x16\\x8bogcm\\x1d\\xf5\\xa0\\xcd\\x82\\x7f\\xb8e\\x94y(p\\xb5\\xa61.51c\\x15rm\\xad\\xfd\\xb2g`q\\xf6\\x86\thg\\xc8\\xec\\xddb\t\\xe3\\xe1\\xe8c\\xa2\\xef`<9\\x00\\x86zhr\\x8f\\x97.\\xce\\xa15\\xc6q\\x10\\xaev\\x13\\x1c\\xf99\\xd3\\xea4\\x91\\xf0\\xe5\\x83\\xefp\\x1e\\xee\\xe2\\xe3\\x91\\x88\\xaey\\xd5rrz1\\xb6\\xb6a=\th\\x9c\\xfc\\x11\\xef>\\xcd\\xce\\x07\\xdf\\xfb\\xad\\xcb\\xa0\\xb9h\\xf5\\xc2\\x02\\xec\\x95\\xcd\\xf0\\xdcx\\x18^yo\\xd0\\x80^s\\xa8\\xc0\\xa3\\x1f\\x0e\\x1c\\x02l\\xc7\\xe89\\xb2t\\xae\\xe7|\\x1f:\\xc3\\x04\\xe8\\x13w\\xf8\\xee\\x90x\\x17\\x9e\\xf8\\xfb\\xcac\rh\\x01\\x8f\\xf1\\xcd\\x1dt=\\x1fm\\x9c\\x06g)\\xff\\x86\\x8b\\xc8\\x0c\\xbb\\x9a \\xf1\\x87\\x7f\\x027\\x04\\xae\\x15\\x1c\\x88!\\x9e:,)\\x13\\xb1\\x83\\xc6\\x1a\n\\x97\\xaan!#(\\x7f\\x0c\\x97\""
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac3^\\x9c^s\\xbb\\xbc<\\x8f\\x1a\\xc8\\xa2\\xb7_\\xe5\\xa3\t\\xa9\\xf7\\x18-\\xf6\\xa7\\xf0\"\\xb7b\\xfe\\xe5_\\xeem\\x82%\\xa1\\x07\\x87\\x9f\\x07\\x92\\xcf\\x1b\\xd4z\\x8f\\xd7%p\\xac\\xf8)\\xe1\\xf4\\xef\\x81\\xc8s\\xad\\xbd'y\\xe7t8\\x08\\xbd!\\x98\\xc6\\xf6fx\\xeb\\x93\\x0c\\x1d\\xc8\\xcb3n\\x86\\xb0\\xf9\\xfa\\xa6\\x99pa-\\x85@\\x07\\xfd4)\\xf9\\x8a;4\\x12bu\\x97\\x13\\x82\\xac\\x04\\xc0\\xeb\r\\xc7!m\\xc5\\xd8q\\x01\\xda4\\x9e\\xbdg\\xf4&\\x8ak\\xbds\\xdd<\\xf3\\xe3\\x06,\\xcdt+9\\xfd\\xca\\xbc\\x81\\xf4\\xed\\xa6\\xf0\\x9dz\\xfc\\xc4\\x88\\x08\\xdb\\xe6\\x93\\x02c\\xd2e\\xf8ut\\x8aze^\\xbb\\xb5\\xa3\\x94m$\\x1a\\xbfl\\xf1\\xaf\\xd0\\xcd\\xf7\\x9f\\xafb\\x04d4#\\xe9\\xbc\\x8fe\\xbf\\xe3t\\xcdp\\xb6!o\\xc2\\xf2\\xac6g\\xcc\\xfaxzj\"bb\\x8a\\xcas\\x9314\r\\x87*\\x8bw\\x0e\\xe7\\x1d\\xaf\\xd4`\\xed\\x93\\xc6g\\xe2\\xdf\\xf8\\xb3\\x89v 4\r&\\xcf3\\xdaw\\x00"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010pn\\xd3\\xc5\r\\xcb\\xc8v0\\x1e\\xd9\\x88s\\xa9!\\x11\\xbc\\x13q\\x03\\x82_s\\x9f;\\x14\\xffz\\xd8$+u\\xb2\\xf3q<\\x85\\x98s\\xf3h\\x95\\xa8\\xbdl\\x00\\xc9\\xa9:\\x8d\\x08\\xb0\\x90jk\\x1a \\xf1x\\xd8pz\\x19\\xcc2\\xa5$\\xdbir\r\\xdb7t\\x0egm\\xbc\\xe6\\xf2@\\xf3d\\xde^s\\x96\\xf1s\\x7f\\xb0t\\xa1\\xfa\\xde\\x1e\\xaf\\xb9\\xaas\\xb2!cb:;\\x92\\x8b\\x0c\\x99\\x0b\\x1f\\xd4t\\xf6f\\x0e\\xf0\\xca\\x01\\xe5\\\r\\x13\\xces\\x89\\x00\\xdd\\x11\\x97e\\x90x\\xa6\\x91\\xcd\\x7f\\xc3\\xa9\\xb0nq\\xc5\\xd42\\xe0\\x80f3\\xfb\\xd5\\x16\"\r\\x8ek\\xbe>n\\x1a\\x0c\\xff7p\\xee\"\\xd3\\x8b\\x84\\x88\\x073q\\xd2@\\xe6\\xd6cg\\x83\\xa3\\x15\\xd3\\x83#oc\\x1c_\\x05\\x08\\x81\\xf2\\x02\\xe9\\xe4ou\\xf4\\x0e~\\x1c<\\xd6\\x13@\\xc4\\xf7=\\xe2\\xd0\\xf2\\x9537\\xa2\\xf1l\\xb5\\x873't\\xa1\tk\\xe5\\xfe\\xfe\\x9b\\xbd\\x81\\xd3t\\xde\\xe5w"
  549.  
  550.  
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\x19\\x9cac'\\xca\\xf1\\xbb1\\xf2n\\xa0$k\\x97\\x08\\xa6\\x15\\x03>\\xbcp\\xfb\\x80\\xf4\\xa6j\\xd1_\\xd94\\xf5@9\\x13\\x84\\xb4653tl\\x11\\xc5\\x08\\xcc\\xeafq\\x9bg\\x8c$|a\\xaaq\\xc3m\\x8f\\xceo*\\xdag'o\r\\x1e\\xd8\\x91\\xc1\\xd4\\xb5\\xe7\\x11~\\xdb\\xf3\\xc2\\x7f\\xb8\\xd2xd\\xbb<ix\r\\xa6'\\xc2l\\xc4\\xb0.n-\\xb5\\x95(t\\x93o\\xd5\\xfc\\x92\\xf0\\xf6\\xb2\\\\xd8\\x10\\xa3\\xfa\\xf7\\xa9\\x96\\xa4\\xda\\xd7y\\xf4\\xb4w\\xae\\x10.j2\\xfby\\xdch\\x97\\x03\\xb04i\\x16\\xeed\\xadw\\xb3\\xffa$\\xe2q\\xff\\xc7_j\\xbb!\n\\x96)7\\xb1cct\\xb6\\x89\\x9d\\xaf\\xfd\\x882\\xc4\\xd7>\\xe7\\xbf\\x85*\\x19_\\xa5\\x14t\\xee\\xadn\\x19\\xa0\\xcf\\xa7u3\\xddbsx\\xef\\xe9\\x8c\\x15\\xa5>\\x8f\\xf3\\xb3\\xcfp\\x01\\x9e^r=\\x02\\xd4\\xe7\\x87a\\x02\\xf8\\xa4?\\xbb\\xb2w\\x81\\xe8\\x8dl|\\xd4\\x00\\x8c\\xbdo!\\xa6\\xfb\\xd4u\\xe3gsw)"
  552.  
  553.  
  554. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1t\\xba\\xf7\\x885\\xa4\\xd6jn\\x8d|\tevq\\xb3\\xad\\xb1>\\x16\\x7fg\\x96\\xcf >\\x816\\xa8\\xc4\\x90r\\xe0\\xd7\tg\\xc9\\x0e=\\xf3\\xc3h\\xee-\\xa5)\\x89%\\xf3/\\x10\\xf2f\\xadz\\xb2\\xa6v\\x82\\xa3\\xf5/\\x04\\xa9\\xaa\\xc7d\\x842<\\x99pp#\\x89\\xe1c\\x06x\\xe0\\xe4\\x84\\xc9h\\xd8nr\\xf6\\x7f\\xbf\\x06wl\\xdf\\xe1\\x0e+\\xbbx\\xa4\\xe2z|\\xa1\\x01\\xde*\\xc4v\\x05\\xb5r\\xca@\\x8d\\x89\\xc3\\xc5\\xae\\x18\\xcd\\xb5e\\xe5\\xad<\\xa6zd\\x88\\x1b\\x81+\\xde-f\\xaf\\x00\\x8bgt\\x0b\n\\xdd\\xcfu:9uk\\x062\\xe5\\x96b\\x10\\xcfr\\xe9\\xc6\\x8b6o\\xb2\\xb2\\xca\\x8e,\\x02*$\\xcc\\x9d\\xff>>\\xef\\x89z\\x97p\n\\xe9\\xebbm\\x03\\x15\\x8b\\x0c#\\x9e\\x1d&\\xda#%l+&\\\\x9a\\xe7\\xef\\x94\\xd5\\xfbk\\x11v 0>\\x8c$\\xd1\\x15\\xf1,\\xe9o\\xf2(jpz\\x7f:\\xf0\\xee\\xd4\\xf94\\x81\\xacj\\xcd\\x11\\xa7\\xb8\\x8b\\x00\\xd9\\xd7g\\x1fj"
  555.  
  556.  
  557. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\x14\\xcat\\xa5?k\\xfa\\xd2\\xca\\x0fd9^\\x11\\x07\\xe2\\x02i\\x88\\x9a\\xcc;\\x98g\\x9a\\xc0y\\xce\\x193\\xa1\\xaa\\x9e\\x9d\\xe0\\xb9e8\\xc1\\x0cg\\x81\\x14\\x93\\xc1\\x1a\\xcd\\xe4\\xf8a\\xedwc\\xe7\\x82\\xfcd\\xed\\x19\\x0be\\xf8\\xd6\\xff\\x82f\\xed\\x88\\x96y\\xd3\\x03`\\x9b\\x12\\xfd\\x93\\x12\\x81\\xfa\\x12\\xce\\xd3\\x8c\\xbd\\xbe\\x8dp\\xf5\\xd4\\xbd2\\xb4\\xb4\\x1b\\xeci\\xdch\\xcbh\\xdb\\xf0\\x07-m\\x91\\xa2\\xaa@\\xb6-\\xeb\\x1d\\x82\\x9b\\x81\\xa0\\xa8?\\xa3\\x90\\xa6\\x15\\x1cn\\xc7\\x89\\x95\\xf6ub@\\xe2\\xd5\\xf7m\\xbc\\xc2g6\\xbe f\\x85h\\xef\\xb4v\\xfd\ttv\\xa0\\xc6\\xeda\\xf73\\x04\\xa7\\xefv%\\x93\\x17g\\x11|\\xd0?\\xc9\\x08\\xa6\\x16\\x9f\\x17\\xd0\\xc5w\\x0c\\xbc\\xc9\r\\xa3\\x9fqu\\xde\\xa50\\xdb\\x86#\\xd2\\xf5\\xb1,o\\xfd\\x91gbz\\xef\\x10\\x13~\\x1d\\xcb\\xa3\\xb6\\x05\\x91\\xc1\\xb6\rt@\\xee8\\xf7`9\\x92\\x10\\xc2_\\x10u&g\\xcf\\x9c\\x88\\x91n\\xbb\\x92\\x80\\xe2\\x9c\\x15"
  558.  
  559.  
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef*\\xb9\\xed\\xa3r&\\x04\\x9b\\xc4-s\\xc4\\xe8>\\xc0\\xbf\\xeb\\xf5\\xbb\\x82\\xc9\\x1e\\x8b\\x89\\xab\\xe2,b3\\x975y\\xfbq\\xa7w\\x91b\\xd4\\x7f\\xf8\\xbbe\\xdd\\xdd\\x10xep\\xd0\\x8b\\x92\\x87i\\xaa\\xb5\\x91\\xcap'\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd4\\xa0\\x07\\xe4\\xe6;\\xff\\xc5i\\x9arj\\xa30;\\xc1\\x99\\x9d\\xcc\\xa9\\xa4\\xf9yq&p\\xca\\xf9g$\\xc7e~\\x86\\xb1\\x8ai+$\\xe8k\\xe8\\xcdy\\x1a\\xda\\xd2\\xee"
  561.  
  562.  
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xcb\\x1a\\x05\\x9cs!\\xa3\"\r\\x8f\\x9b\\xd9\\xe3;/\\xab\\xc3z\\xb9\\xd1\\x05as\\xb3\\xc8\\xfb\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  564.  
  565.  
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l%\\x05u\\xf4\\xb4\\xffj\\x1d&a\\x1d\\xc5\\xb9\\x0cs\\xf7\\x16\\x9c\\xd8p\\xbdw\\xbfl&\\x086\\xa1m\\xc8\\xdb1\\xfc\\xa1e\\xf8\\xd6\\xc4\\xbb\\x17\\xfd\\xbe\\x00\\xaa\\xf2j\\x88%\\x95\\xf0\\x9e8p\\xfbot\\x8a\\xc7\\x87\\x9cd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x98`.)\\xa4\\x02\\xf9\\xe8e\\x82\\xeb!\\xf9\rc\\xd9r\\xd5h2\\x16\\xb2\\x98\\xba:\"wn@a+veo`\\xfc\\x8cf\\xc0,\\x9f\\x80\\x82\\\\x13y"
  567.  
  568.  
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xb7\\xa8.\\xfa:\\xf9a\\xc2f\\x0b\\xb1\\xff\\xfd\\x8ecp\\xdb\\xd0\\xc0\\x1e\\xa8\\x84\\xcf \\xb8\\x1f\\xa8vz\\xac\\x84\\xbeq\\x07?\\xf0x\\xa6n\\x8e+da\\xa8\\x92\\xa3\\x893\\x0f$y=\\x9f\\x93\\xae\\xeb+\\xf6\\x01\\xe0t,x\\xee\\x8e\\xf1\\x19t\\x93\\xd5b\\x8a\\xff\\xc9h3p/\\x1dm\\xcd\\x94 \\x8b\\xe0u\\x1d\\x84d\\xe5\\xc5\\xb5b\\x01\\xc6\\x0e\\x01\\xb1\\xa6 v=\\\\x19ol|s\\xc5\\xa5\\xb5\\xfa\\xe5i\\xd0\\xdc \\xf2\\x8c!e#\\x0e\\xa5\\xbfj\\xd9\\xdfl\\xfc\t\\xc9\\xf2\\xe5hb\\xcd\\xdbc\\xee\\xb0\\xfc\\xd7e\\x0er\\xd8u\\xb9\\xd2t&\\x8a\\xb4\\xef\\x1ew\\x03\\xb4v\\xc8\\xef\\xb4x\\xab\\x1c\\x02\\xd8\\x15w\\x85\\xdbq\\x80\\xe0\\x91x\\xcc\\x0e\\x1f \\xd7\\x8e\\xc3\\xeb\\x10;3\\x91&\\x19i\\xa4d0l\\xc0\\xc8\\x0ex\\xec\\xe5\\x9a\\x07\\xc1s\\xa1g\\xfdi4q\\xdd!*x*\\x10 \\x1e\\x04\\x86\\xcdb,\\x83\\xbe\\xb4\\xa5h\\xca|()iw\\x08b\\x84\\xe4\\x13\\xeb\\xfew\\xcbou\\x13"
  570.  
  571.  
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xed\\x83\\xdc\\xe3\\x9dh\\x86\\x006\\xe4 \\x924u\\xb5r\\xcaf\\x8c~\n<\\x98\\x1d\\x07\\x03\\x07\\x99\\x03\\x92\\x9ctu\\xf5\\x02w\\xe0\\xaceo\\xe3y\t\\xa7\\xbe\\xb6u\\xb9\\xee\\xc4\\x92\\xf3\\xd5\\x156\\x01\\x9fc\\xc5,m\\x8b-\\xfb\\xeby\\xceu\\xa0\\xdb\\xa0\\xdf\\xb6qm\\x92\\xe7\\xc86\\x81\\x18-\\x83\\xe2\\xae\t\\xd1\\xa5\\x9f(?\\xaf^4\\x13n\\xe4\\x1f?\\xee\\x95\\xca\\xa9\\xb0\\x8a\\xef\\xc1\\xa5\\xce\\xdf\\x064\\xa5x\\xa6\\xca\\x05f\\xfe\\x9a\\x89~\\xef\\xcfe~\\xed\\x92\\xad\\xcb$\\x00\\x93p>&u\\x8f\\x0e\\x0e\\xdej\\xf8\\xf5\\xf9,\\xac\\xad\\x94c\\xe9\\xfb\n\\xba\\xbbx\\xd2\\x91\\xb1)\\x99v4r\\x98\\x1c\\xbd\\xc1\\x85\\xb8\\xb5%r\t\\x0bk\\x8e5\\x8be\\xa4\\xeel\\x93-#\r\\x9e\\xe3k>\\xe6#9\\xa9g\\x17\\xf6\\xf5w\\xe0\\xba^\\xef\\x0e\\xd1\"a\\x16m\\x13\\xdf\\x946\\xdf\\x8cn\n\\xac\\xc9\\xb3j)\\x99oi\\xf9\\xda\\xbe\\xad\\xd2exc<\\xcbh\\xc4'\\x0f\\xa6\\x93bo\\x9f=\\xa5"
  573.  
  574.  
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\xe7\\xb9\\xce\\x05o\\xe3e\\xb3\\x1a\\x98l:\\x95\\x06\\xe8\\xcb:\\x80h\\x1a\\xd0w\\x02\\xa1\\xb3\\xfef\\xab\\xdf\\x13k\\xa4\\xd9o\\xd6\\xf6\\xe2\\x1a\\x11ryz>\\x07t\\xfc\\x1e\\xc1\\xfba\\xc5\\x08\\xcf\\x8f\\xd1a\\xd4@\\xf5 8\\x0b)\\xe0\\x82w\\xa4\\xb9\\xfb_\\x8e\\xc7\\xf2\\xf5%\\xd0\\xec\\x87hi\\xf5* \\x06c\\x98\\xe7\\xc2\\x8bz\\xd6\\xa8 \\xde\\xeaa\\x81\\xd3b\\xaa\\xb1\\xcb\\x9e'\\xb6w-\\xbf\\xc86e\\x88\\x83h\\xd7\\xa1\\xc2\\x07\\xf6\\x06\\xe9\\x0c3\\x91\\xf4\nu\\x96\\xbb\\xb8\\xe8\\xa1\\xa6\\x96\\x1a\\x08.\\xc7^\\xd5\\xb8\\xfeh\\xee\\x82\\xc3>t\\xeb<\\x16m\\x7f\\x86\\x8d\\xe1\\xb8azv\\x14\\xa1\\xe2>2g\\x1ed\\x1e\\x90\\xec\\x07\\x85~\\xb7\\xed\\xf8\\xba\\xcf\\xef\\xfdb\\xce\\x94\\x88b\\xdf\\xf7y=\\xa3\\xbfs\\x0c\\x1fh\\xe8k\\xb4\\xc9c\n\\xce\\x8b\n\\xd0\\x14g\"k\\xbf~d\\x08\t\\x0e\\x17o\\x84\\x82\\x0c\\xe8\\xfe\\xb9\\xc1\\x14=\\x9b\\xf9x!3b\\xce\\xcc\\xdc\\x05\\x1a\\xe9y\\x89|\\xb5z\\xee\\xd7"
  576.  
  577.  
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc`\\x8b\\xf4;\\xc14\\x0e\\xae\\xe3\\xc8p\\x8f\\xc6\\xa7\\x95\\xb1|\\xd9\\x8e`'$\\x1d\\x9e.ej\tb?\\xf1\\xef\\x89c\\x99\\xeb\\x18\\x0e\\x17\\xf8\\x87z\\xech\nh\\xabc\\xd3\\xae\\x80v\\xaf\\xc2\\x15\\x1f\\xc8\r\\xfe\\x8a\\xde\\x89\\x9d\\xf2\\xa9\\x1b\\xdf\\xff\\x91\\xfd\\xf8\\x1b\\xd8\\xcc\\xf0v\\xfb\\xb3\\x0e\\xd3v\\x85\\x00b\nu\\x83\\xb6h\\xd3\\xcd\\x9f\\xb1r\\x91o_n\\xfe\\xc8\\x07\\xe3\\xa0\\xc7\\xd9%\\x02\\xb7;i\\x12\\xcb\\x11\\x97\\xe2\\x0c\\x8a'\\xff\\x0c\\x90\\xda\\x84\\xc9\\x10\\xc2\\x06\\x10\\xba'a\\xd3dm\\xf9\\x9c;m\\x8c\\x88r\\xdf\\xa7&\\x9f\\xe9\\xfe\\x85\\xb3\n_a\\xea\\xc7\t\\xb3\\xafzu6\\x0e\\xee\\x8a2\\x9b\\xc5\\x18\\xd3\\xe6\\xb84\\x0b/\\xefwgqb\\xcd?1\\x82\\x07\\xbdk\\xfb\\xcb;\\xebb>7\\xe5\\x0f\\xc0d\\xa3\\xcd\\xc0\\x92q\\x022^\\xe5\\xdf_\\xa8\\x05\\xe0f\\x1d\\x91\\xa9\\x86pd-\\x172\nq x.\\xf71\\x16\\xa1\\xa9\\xdb\\x9f\\x9673\\xd4\\xeag\\xad\\xe8\\xbf\\xb5\\xc2+m\\xf1"
  579.  
  580.  
  581. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xca50b\\xe1n\\xfb\\xb3\\xd2\\xbd>\\x83\\xb75\\x81\\xde\\xa0\\xe0z\\xe2\\xac0\\xb32qt\\x1b\\xab\\xa6\\xf6\\xcb\\xd5i\\x06 \\x1d\\xf5\\x81)%zu\\x8erw\\xee\\xf9\\xdcj'o\\xa9wr\\x13@\\xcc\\xfc_\\xec\\x04i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nxn!\\xb8\\x8c\\xd5\\xd3n\\xaf\\xc8\\xack2\\xd4\\x0e\\xd6>(\\xcc\\0m|\\x98c\\x9f'\\xe4\\xaa\\\\x9b\\x8a\\x90\\x08kl\\x18\\\\xd5\\x8b\\x99\\xfek\\xfe\\xa0q"
  582.  
  583.  
  584. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101\\x7f#\\xd0\\xe3\\xf8\\xc9\\xcbzq\\xadh\\xa0\\xffc*\\xd5\\xe8\\x19\\xcc\\x12m!\\xa1\\xe7\\xc4\\xc5q\\xe2\\xb9\\xfd\\x8d\\x8f\\xd2\\xb8\\xf0\\x1bh\\x99\\x16\\x85\\xf4z\\x91h\\x07\\x16gt\\xad\\x08>uc\\xcbo;\\xe9\\x0f.o\\x17\\xa6+\\xd5\\xc3\\x87\\xe5\\x00\\xa5\\xd5\\x9b\\xe9\\x08\\x06\\xcf\\xb0-k\\xde0\\xa8\\x05ww\\x01\\xcc\\x92\\x19\\xc9\\xa9\\xf4\\xbar2\\x03\\xd4ne\\x82,j\\xfa\\xb4\\x08\\x8eewl\\x1fo\\xd2\\xb5\\xd7\\xa6\\x1b\\x11\\xdbi\\x06\\x12'c\\xdb%\\x84\\xd1q%\\xa5<\\xa4\\xe6\\xa6k\\xa8\n\\xfa^\\xd1\\xe6\\xe7\\x9f\\xc1xju~\\?\\xfa\\x9e\\x03\\xde\\x90\\xbb\\x96\\xdbjn\\x17.\\xd2\\x9a\\x96\\xb9\\x0b4\\x1e\\x9d\\xec\\x84#kd\\xd5v\\xc4w.q\\xbb\\xe0\\xd0\\xec\\xec\n\\xe2\\a\\x91\\xb2b\\xd2\\xcc \\xe3\\x8d\\xcdh\\xc0\\x05\\xfcq6\\xedp\\xeed\\x9e,a(urk\\xf4n_\\xa6im\\xfb/\\xae\\xe5\\xeaz\\xf7\\xd1\\xbba\\x00\\x19re\\x7f\\xe7\\x84\\xc4w\\xfe\\x91\\x01\\x93\\xb9s\\xe5"
  585.  
  586.  
  587. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"qt\\xc2\\x08ar\\x15\\xec\\xb5\\xc7e\\xbb\\xb4g\\xb2\\xd9\\xfd\\xd4@\\xbe:\\xfa\\xdak\\xaa\\xd05\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  588.  
  589.  
  590. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j\"\\xcd\\xf4\\x9a\\xc1\\x07\\xa0:,\\x92y\\xf2$\\xc1\\x95\\xc23'\\xfbq\\xda'dv\\x14\\xdea\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  591.  
  592.  
  593. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a1.2\\xc7\\xb5\\x94\\x05\\xe8\\xb2\\xb5$\\xc1\\xbe\\xac\\xd3\\xd0\\xcd\\xcc\\x97\\xec\\xf0^+vx9w.\\xe93\\xa6\\x04i\\xd5\\x9f\\x87.\\x88\\x99\\xe3g\\xb4\\xcd\\x9f\\xa8\\xe9@\\x91\\x9a\\xddp\\x12\\xbe\\xc5\\xa5\\xf0\\xf3\\xfb\\x1d\\xa1\\x18b\\x14\\xbb\\xc2k\\xcc\\xdfm?\\xc7\\xd1\\xc2\\xd1\\x82\\xc6\\xd8\\xdc\\xde\\xd7\\xb9\\xe0iq^;\\xb3\\x0c\\xbf\\x05\\xb9\\xac\\x10p,x2\\xc0_\\xe1\\xef\\xda\\xdb\\xdd.\\xaf@7\\x81b\\xaf\n>\\xa2\\xc9\\xa2s*\\xd0b\\xf9\\xb0\\xd9\\x80ex\\x1en.5ou\\xf4\\xa31\\xd7y\\xdee\\x8aj\\xce\\xa0\\xe5\\x7fy\\xbc\\xde\\xcb\\x16\\x01\\x0c \\xf1x\n\\xe3\\x9a\\xc1\\x81\\\\xc9\\xf5\\xcc\\x0f\\xb2\\xcf\\xda8\\x08\\xc2,\\xba\\xef\\x1a?\\x07m\\x87\\x1fj\\xbc(\\x84b=\\xa0\\xf0\\xb1\\xeewrb\\xb9\\xc8\\xbc,\\x8b\\xc4\\xc1\"5\\x01\\xe4*\\xec\\xf3\\x8e\\x9b9\\x98d\\x93~\n\\x97\\xe2k\\xbem\\x03\\x0c\\j\\xe1\\xf5* \\xa7_|\\xbf\\x80\\xab\\xd4\\x07se\t#\\xe4|\\xee"
  594.  
  595.  
  596. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6\\xf5\\x95\\xee\\xa1\n^\\xb2\\xd0\\xd0\\xa2\\xdfk\\xdbjh\\x86\\\\xe8\\x1ez \\xe0\\xd4\\x978\\x0c;\\xb0hrkr\\xc4x\\xfa<\\xdc\\x9a>:\\xfe\\xa4\\x04#\\xa4by\\xe7\\x1d\\x11\\x1d\\x93/\n!\\xf0n\\xae\\x1dc_\\x80\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80?`n\\xb3\\x9a\\xa071\\x9e\\x98`\\xbb\\xc0\\xab\\x93\\x01\\x98v\\xaa\\xaf\\x97e\\xe2g\\xc6-\\xef\\xa7\n\\xca\\xd0\\xa3\\xfeimz\\xd7\\x1c\\x11x\\xb1\\x88\\x85\"\\xdf"
  597.  
  598.  
  599. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86\\x12\\x98\\xc6v;^\\xd7\\xb2yc\\x01\\x0b\\x7fx\\xc5\\xcb\\x9asn\\xb0w\"el\\xb0\\xd8%7\\x17\\x1d\\x17\\xee\\x0f\\x81\\xd0`u\\xca\\xce1\\xd2\\xc1sn$\\x86\\x02\\x02\\xa69\\x8a\\xed\\xea\\x7f,w\\x1db\\xfe\\x8b5\\x9f<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xdb \\x08\\xe9\\x8eti\\x9b\\xc3=c+\\xf3\\xc2\\x9f\\x87\\x99\\xff\\xe7p\\x05yg\\xbb\\x02b\\xca\\xf4w\\\\xf7\\xcc\\x82\\xfb\\x98%y\\xdc\\x10\\xc2i\\xa4\\x98\\xba\\x1fs\\x16"
  600.  
  601.  
  602. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7je$\\xcc\\x87v\\xd8wp\\x94\\xf1\\x1b>;\\xc1\\xa9\\x96 \\xe4\\x8d\\x06\\x12\\xc0ru\\x8f\\xe9v1\\x02\\xfax5\\x07g\\xd7c\\xd1\t\\x87\\x16\\xb2\\xa0%w\\xad\\xc0\\xffx<\\xba\\x19\\\\xb2\\x87n\\xb0\\xecm,6k\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|5\\xac\\xad\\xfc\\xb2\\x89\\xad\\xc9\\xad\\xd8\\xa5\\xc0\\xa8\\x8e\\xc3\\xa4\\x16\\xfcipt\\x97\\x81\\x04w\\xb32\\xe1\\xa0\\xa7\\xf3f\\xc9~\\xd3\\x85\\xeb$\\xdc\\xd7\\xa7\\x83a&\\x9c\\x03\\xa7"
  603.  
  604.  
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3ndm\\x8f)g\\x1d\\xf4d>\\xe9\\xa1\\x8b5u\n\\xfd)v>\\xdag:\\x0b\\x89\\x94\\xc0s\\x83\\xad\\x94\\xb3\\xd4\\xccbf\\xa3\\xe8u\\xfch\\x18<#\\x1c\\x8e5\\xab\\xabc\\xf7\"\\xc6\\x12wu%\\xa8z\\xb17\\xe9\\xe4\\xd9\\x1c\\x07\\xc9\\xd9\\xb6\\x9c\\xcd\\xa6\\xfc\\x9e\\xb6\\xf9:i),\\x10\\xcc\\xcf\\x0b\\xac\\x90\\xbd\\xcd*p\\xa0t\\xfe\\xdetl\\x04\"\\xb9\\xa6 \\xa3&\\xb6.\\xaf\\xcfq@\\xaa\\xd5\\xaaxjqe\\x85\\x144\\x0e\t\\xc9\\x10\\x19\\x07\\xf0\\xd9s\\x88\\x9c\\x9a\\x07\\x10\\xe4\\xa2\\xce\\xc9\\x16\\xba\\xcb\\xce\\xd3&\\xc0\\xccx\\x95\\xe28\\xed:\\xdc-\"g\\x00\\xff\\xd1\\xd8$a\\x90\\x140,\\xb57\\xe1\\x87\\xc5\\xce\\x92\\xc2\\x8er\"@((t\\xfc&q\\xaed\\xf2\\xeb\\xcf7\\x98\\xa65\\xc7e\\x90s\\x96\\xfe\\x08\\xcf\\x86\\xe7\\xa8\\xdbm\\xc9\\x0e\\xa2m\\xb7o\\xdbz?\\x0c\"(\\xfa\\xd1\\xb4\\xb4\\xc4\\x9ej7\\xf9\\xf4f>\\xc8\\xbe\\x9a\\xc7\\xb1y\\x00\\xa2^\\x01\\x08\\xe8d\\xecej\\xf9\\x90"
  606.  
  607.  
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010wc\\x9dfw\\xb0\\xa9\\x0f7\\x8c\\xef\\x11\\xeel\\xe1\\x8fl\\xab\\x97h\\x18\\x8b0w\\xa4\\xab\\xc59e\\x07\\xd9\\v\\xc2\\x98\\xf94\\xf5b\\xcb\\x7f\\xa1=\\xe2\\x0e\\xeb.\\xa3:\\xd8\\x96\\x92\\x8c~\\x03\\xdfq\\x02\\xc5\\x81\\xaax\\x95\\x9f\\xb9\\xe0\\x85?f\\xac\\xe6\\x93\\xca\\xc0\\xcf\\x87 \\x0c8\\xac\\xe4\\xc4\\x1ds\\x9cl\\xbf\\xd8\\xc8\\x96\\x06jy:\\x9f\\xbfm%\\x8d\\xd1h\\xb4g-\\xa4\\xfb\\xb5\\xbfdb1\"\\xd9\\x8ehb\\xa6\\xc7\\xd3j\\xca\\x8f\\x16\\xc1\\xdd\\xa3\\x81\\xf7\\xca\\xb0\\x0e\\xb4\\xe3\\xee\\x90\\x076f\\xdf\\x985\\xee?t\\xeab\\xd8\\xd1\\xa5\\xcb\\xe3\\xaf\"^&\"\\xed\\xf8\\xf0\\xdb\\xef6d\\xe2\\x177\\xf6\\xd0a94\\x01\\x15\\xc1t\\xea\\xd4d\\x15~\\xda\\x18\\xf84*\\xdcg\\x0b\\xa6&\\xc3\\xb8\\x04\\xca9\\xe0r\\xe1\\xc3\\x07\\xcd\\xe5$)\\xe8\\xd3,u\\x13\\xf4\\xc3\\xbc\\xee\\xb9\\xe6\\xea\\xa0ck\\x81\\xe5\\xe5\\xae\\xb4l47\\x9el\\xef\\xafy\\x90\\x94\\x04\\xa1\\xebl\\xc5\\xfb\\xa4\\xe3;\\x00"
  609.  
  610.  
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8-e\\x89e\\xbb?\\xb8~fn\\xd3:\\xb3\\xe8\\xc6\\x97\\xeb\\xf0i\\xad\\xb2e(\\xe5\\xc9\\xffj\\xc5\\xa8;!\\xe4\\x9c\\x99k\\xc9bj)\\x0f\\xfa\\xc4_\\xe6\\xc9\\xde9\\xc7\\xbe\\xcf\\x9a\\x959\\xda\\x8b&\\x0b\\x11v\\x0b\\xa19)m\\xb1\\xac\\xa6\\xeb\\xf99\\xbbx-\\x07:\\x86$\\x8b4\\x0e\\xe2r9\\xbb\\xd7r \\xe6yel\\xdf\\xd8r:\\xe2+i,%\\xb1y\\x15\\x8eh\\x8c\\x16\\xa6\\xf6t\\x9d\\xe3\\x1d\\xee\\x9bte-\\x8c\\xb3\\xeb\\x01\\x83\\x1a\\xaa\\xbf\\xfd\\xb3mp_|\\x11\\xfd\\x95l|\\xba\\x08\\x9a\\xab4\\xaa\tv0p=722\\x1d)u0#\\xb2(r\\x15\\x06\\xa0\\xae\\xb5\\x90\\xd1\\x93\\xee~\\x8e'\\xb9=4#$\\xe5f;\\xf12\\xb7\\x90~)\\xc8\\xed|k\\xa2\\xcci\\xf1\\xfc\\xfb>\\xe6b\\xbazs5\\xf6\\xb8\\xe9\\xbe#m\\x93\\x98\\xf9^\\x02d\\xf6r\\xf7/>\\x18\\x95\\x1f\\x99\\xa3\\xbei\\xfch3\\x97\\xd5\\x85\\xb5\\xe4\\xe3\\xcd\\xc5\\x9de\\xad\\xe4\"dm\\xa4\\x06\\xbf\\xc7"
  612.  
  613.  
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06p\\xce\\x18k\\x1f\\xf6;\\x9b\\xa8\n\\x8a\\x13\\xe2`t\\xdb-0\\xe5k\\xe4\\xf5\\xd7\\xb6\\xd4\\xc0\\x18r\\x99*p\\x96w\\x02+\\x94\\x88\\x95.h^\\x15\\xe8?\\x16\\x05\\xfb\\xb83\\b\\x88\\xda\\x14\\x08\\xb3\\x18\\x1f\\xd4(\\xc1\\x9c,0\\xb5\\x91o\\xb0\tm\\x90\\x9b\\x1b\\xed>\\xcb!\\x1c\\xfa\\x901\\x9b\\x8e\\x94\\xf2\\x8d\\x88\\x9b\\x1c(\\x98\\xf4y\\x98\\x85y~\\x7f<\\xde&p\\xf3\\x9fo\\x99g\\x8f\\xbclk5.a#a\\xf2\\xac\\xe2\\xe3\\xfbvu\\x1d@\\xc0\\xe5s\\x8bn\\x8df\\xd3\\xf8\\x9b\\xe4u\\x90\\xfe\\x0f\\xd2fw\\x08`\\x9d\\x00\\x99x\\xf3y\\xd9<\\xdby\\xda\\x89\\xc5\\xb3\rq\\xeavf\\xbb\\x06\\xd3woma-e\\xee\\xf9c\\xf4\\x07\\x987\\x0e\\xc7\\xbby\\xbc\\xea\\x92\\x1ers\\xc8\\xbd\\xf0\\xbd\\xa5.\\x9e\\x0cg\\xf4\\xfe\\x07\\x00\\xc4\\xe3p\\x16i\\xf3\\x8d\\x1c\\xd1\\x12\\x1b\\xb4\\x05\\xa6\\x0e`\\xba\\xa3y\\xc33\\xbd_\\xeav\\xdbxm\\x97\\x1a;\\x1d\\xc7g\\x1d\\xa9\\x86m\\xaet\\x95"
  615.  
  616.  
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\xa9\\xc0d\\xd2\\x84\\xea\\xcd\\x88\\xdb\\x0e\\xb6\\xbe\\xad\\xad\\xa3 \\xe8\\xe8k\\xba\\xf4\\xd4\\x86\\xdd\\x7f\\xcc\\x80\\xa8\\xadv\\xfc\\x1dv\\xdex\\xf0\\xc9\\xd5o\\xcem\\xf8\\xd7,\\xe3\\x9b\\xa3j0i\\xaa\\xde\\xc9\\x17\\x97\\xc6\\x01\\xb4\\x8cg\\x15\\x84\\xfe\\xb5@~i\\x98\\xb1\\xfb\\xc9\\xdb\\x1f\\xda\\x19j\\xed\\x1e\\x02o\\x0e\\x8a\\xfd\\xf8\\x88\\xaey\\xcek_\\x19x\\x87k2.\\xc3\\xf3zj\\x87\\xb6\\xa1\\xa6\\xbd.\\xdc\\xa1*+cvu\\x01;\\xc3\\x14vt\\x14\\xd3\\x1b\\x9fo\\xaf\\xfe\\xfe\\xf3b\\xf1un\\xdcr4zt\\xb2u\\xfc\\xba\\v^w\\xbf\\xe1v\\xde\\xc8j4\\xb7\\xaa\\x04\\xc4\\xf1y&nk\\xeb\\xa5\\xf5\\x82\\xa5\\x06k\\xb3@r;\\x03\\xbd\\xebi\\x8b\\x8a\\xf7_y\\xa0c\\xdb\\x08\\xa1\\xb5\\xdb\\xd4\\x04\\xe2\\xd3\\x9bw\\xd0xw3a\\xe8\\x1f\\xc6\\xb5\\xedsq\\x9c\\x92\\xd8sv\\xa0./\\xeb\\x92\\x03l\\x05j b\\x96 \\xb2\\xc1d\\xf2#\\xe4\\x1c\\x8ck\\xa2(%\\xa3\\xdf0\\xc0\\xf8\\xab\\x98\\x0c3\\x15"
  618.  
  619.  
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\xa9\\xd7\\x03\\xec\\xe8$\\xbc\\x1d\\xea\\x8b\\x0c\\xd7r\\x0fcx=\\xb9\\x12\\xa4y\\x1c\\x0e\\x11\\xdc\\xd6\\xbe\\xbb\\xf6\\x1a<@\\xe0a/\\xc1yx-u\\xca$\\xd7\\x0c\\x91\\x07s\\x99?\\xf1y7o\\xe2t\\x89\\x91&\\x16\\xd4\\xbe\\x91\\x12\\x87q\\xc0s\\x9dng*\\x19v5\\xca\\x88\\xd2n?\\xf7\\xef\\xc0\\xa8\\x99e4>/\\xee.th\\xcb3\\x1cz)y\\xacv\\x10\\xf7\\x9b\\xc5r\\xcf\\xac\\xba\\x97;\\xc1\\xd4\\xcf\\xa5y\\xf0\\xda\\x88b\\xf5xp.\\xde\\x99b\\xb3\\x96\\xaa\\xc3\\xc8<\\x04\\x00iw\\xcd\\xa6\\xa2\\xbd\\xbc\\xe7|h\\xcfh\\xa0\\x9a\\xa5|v\\x92\\xc7d\\xd9\\x9d\\x83\\xc7\\x9b\\xc9\\x85\\x03\\x8e\\xe1w\\xb8\\x86\\xcb\\x11wh\\xd5\t\\x9a\\xff\\xf5\\xc6|\\x93\\xaf\\xb3\\xea+\\x08(@\\xbf\\x0e\\xeb\\xaf.\\xdd\\xdd\\xbfz~\\x8d\\x80\\xf0\\xef\\xbdus\\x1a4\\xd4\\x06\\xacx\\x07\\x91wnt\\x07\\xd9\\x02j\\xdd\\xa7\\xf5\\x13\\xf6@\\x89\\x9a\\xab\\xcd\\xb5\\xc9\\xcd\\xb3bh\\xc8lj\\xfe6\\xd5\\x85\\xdc\\xcdg\\xfa$"
  621.  
  622.  
  623. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x04f\\x98\\x0c\\xe7!t\\x81\\x80\\x16\\xef?\\x94\\xaa\\xdb\\xe5\\x02\\xb2\\xe8sd\\xd0\\x90\\x1d\\x9c\n\\xbct\\x14\\x06\\xf5&\\xd9=p>a\\x9a,\\xab\\xcdp\\xe3\\xdc\\xd8\\x07_\\x10\\xb3p\\x0bt\\xcb\\xf91e!qd\\x80\\xf0\\x97e\\xc2g+\\xad\\xb4(#a\\x1ce#\\x17\\xd2\\xd6\\xd6y\\xd9\\xb5\\xfc\\x91-\\xdf\\xeb\\xec\\xa6;\\x03\\xdc\\xc3p'\\x00>\\x91?b\\x06\\xcf\\xd7\\xa4\\xf4\\xff\\xbeu\\x9b\\xfc\\xec\\x06\\xe4c\\xa26\\xbe\\x1d\\xfc\\x07\\xc2\\xbd\\x12\\x1f\\xd6\\x81\\xe5\\x8b\\xe2\\xc0w\\xdb\\x13\\xfd\\xc5m\\xb2^\\x00\\xc2\\xba\\xa1\\xf2\\x06\"\\xf3\\xc4r\\xca\\xe4\\xc7\\x95\\xe1\\x10c(\\x991\\xc6`\\xa0\\x04\\x98\\xa2\\xf2e?1\\x0crn\\xf86\\xf5y\\xa728\\xbd=\n\\xa85\\x0e\\x1c\\xb3=il\\xc3\\xc8k\\x9dj@\\xa6\\xc4\\x91*\\xcd\\xb6b#\\xa7\\x01i\\xae\\xfb\\xdb'\\xd3\\xcd>\\xcd\\xed\\xe9/c\\xd8\\xb4\\x98a\\x8f\\x04=\\xd0\\xe97\\x96\\xcd\\x86\\xa1\\xe5-\\\\xafz\\xca-\\x88\\xfc\\x06\\xea:"
  624.  
  625.  
  626. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\x183\\xa7\\x18v\\xc8\\x90\\xdc\\xc5!\\xdc\\x88\\xefz\\x18v\\xeew\\x83y\\x91\\x0c)d?,\\x11&\\xda\\xb1\\xee\\xc4\\x9e\\xa8\\xe6\t\\xdd?tw\\x8f\\xf3vn\\x11f\\xa2n\\x8feq^/\\xaea\\xff\\xb1<q\\xac\\xbey%\\x91\\x17i\\xce\\xe7\\xa3%d\\x07\\xbf\t\\x99\\xbd\\x15t.\\xc1\\x08\\x0c\\xd0\t\\x14r\\x9c\\x88p\\xaf(\\x99$+\\xfer\\x02d\\x05\\x9c\\xe8\\xd2\\xb18\\x0c\\x05\\xdb\\xb9\\xe5\\xda&\\x9b\\xad^w\\x13\\xd1\\xa3o=\"\\xf8\\x1a&\\xb6\\x99\\x85\\xbc@\\xf9\\xa2h_\\x845\\xc8\\xc7\\x9es\\x1e\\x06\\x80\\xb7r`\\x1e\\x8b\\xe5\\xc8\\x18\\x96i\\xcf\\x92^n\\xe1\\x19\\x8e4\\xacgn7\\xb7\\x9b\\xe0\\x87\\xde\\x81\\xfc\\x08\\x92s\\xacc\\x03\\xfc+\\x98\\x89\\xaat\\x00\\xdeb\\xa6\\xa7c\\xb0\\xca5\\x8ag\\xed\\xf3i\\xef\\x8e ^\\xf2\\xbd\\x7fp\\x88\\x1f\\xf6\\xb3\\xee\\xaf\\xccbk\\xce\\xbf\\xf3\\xe8\\x8c\\xa9\\xc7\\x9d&e?\\xdab\\xc8\\x96f\\xf5\\xa1\\x89\\x11\\x96~\\x03\\xa5\\x80\\xc8rz\\x8b\\xac\\x9b^"
  627.  
  628.  
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:j#u\\x81\\xa4,\\xaa\\x8e\\xf3\\xc7\\xc0\\x8d\\xde\\xb5\\xb5\\xe4>\\xf6\\xa3\\x1e\\xbe\\xd2\\xf56\\xed\\xee\\x10\\xb8\\xa0!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  630.  
  631.  
  632. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1%\\xf4y\\x9261\\xdbf\\x9d\\xdf\\x0e\\xbbq\\xc3\\xad\\x91\\x018rmej\\x1e\\x96v+j\"gq\\x82\\xf0\ndxj\\xfe\\x8e%e\\xf6\\xdb%\\xe4\\xd7\\xae\\xa1\\xf4\\x07\\xebd\\xc6\\x00gn\\x02\\xe6\\xb8\\xae\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^\\x1fm\\xf0\\xf9.\\xd1\\x9e#(>\\xe46\\xc1\\x8f\\xe7\\x0bd\\x9e\\x86q?/y\\xc3z\\xa41%\\x82\\x8da\\xbc88r\"\\xf1n\\xe1\\xc9j\\xf3\\x10\\xa5\\xfbi"
  633.  
  634.  
  635. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  636.  
  637.  
  638. "http_request": "winword.exe_WSASend_\\xc4\\x00j\\x00x\\xf7?\\x11\\x88c\\xd4x3\\xcb\\x10s\\x8b&\\x91\\x04\\x8e\\xec<\\x05\\xef\\xc3;d\\x15\\xf0\\x99\t\\xda/\\x19\\xcd@9:1i\\x8e\\xab\\xa8l\\x19\\xe9v\n\\xc8>i\\xd4k)\\x0f\\xadg\\xa9\\x8bp\\x84`:\\xf0\\xdea\\xc9t&\\xf1\\xf6\\xc4\\xcf\\x1a\\xaa\\xe1:\\xe7\\xfa\\xcd\\xc57&tj\\xf0\\xb91\\x15\\xa0\\x18\\x97\\x1e\\xd5g\\9\\xad\\x8c2\\x83s8\\xc7\\x82\\xd3\\x10\\x0c\\xc4\\x16\\xear\\x1b\\x9ax\\xe7\\xc9\\xa5\\xbd\\x0b\\x05\\xb7\\xf3+v;\\x14\\xb9\\x88\\x80\\x14\\x1et\\xa6\\xb7#\\x9b\\xa7\\xb7\\xd5\\xf9\\xd4\\xa6\\x98\\xa0\\x92\\xff\\xffh\\x8b\\xe9>\\xa1r\\xdb\\xcc\\x0f\\x84l\\xab\\xe9\\xaf_\\xf2t0\\x13\\x84i\\xd2\\x0eg`\\xce\\x86:\\xfc|b\\xfen\\x19(\\x9df\\xb6u\\x86\\xa4\\x8c'z\\xa4\\x9e7\\xe3\\xb6\\x9f/\\xe2p\\x80\\xec.\\xd7r\\x8d\\x9e\\x1aej\\x9efa\\xae\\xc5\\xc1\\xce\\xd7=/\\xe8\\x01\\xefr\\x92\\x9e\\xf8\\x82\\xc0\\xc7\\xf5\\xd3#\\xd3\\x02\t\\xb4\\x99\\x92\\xe3x\\x1d*\\xab\\xf2\\xcahzm\\xde"
  639.  
  640.  
  641. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01:j.\\x1a\\xa8\\x1b8y\\xea\\x15\\xcf\\xa0\\xa4sv\\x8d\\x0e;\\x97$\\xac\\xc4\\xe1\\x90\\x1b\\x06\\xectmd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  642.  
  643.  
  644. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00a\ro\\x04\\xe0\\x8e\\xb5\\xb1\"\\xa7\\xcb%e\\xe8\\xe6\\xcfs\\xd7\\xc9\\x15?n\\xb6\r\\xdbgza\\x91\\xda!\\xe7*k\\xe7\\x95\\x95t\\x83x\\x90`\\xde\\xa6|y\\x08\\xf9\\xdd\\x9fr\\xfa\\x03\\xfa\\xc9\\xa6\\xcd\\x83\\x01\\xd8\\xf4\\x96\\xf6,\\x13\\xa1\\x1c8\\xaf\\xdc\\x88)\\xf3-\\x87j\\xf6\\xe5o\\xc7\\x89\\xc8\t\\x92\\xdd\\x87\\xd0\\x00\\x99\\x08\\xed\\x8b\\xcbu\\xd9\\xd9\\x04j\\x8ag\\xac*\\xb6\\x9c\\xa3\\x84\\xdd\\xeci\\xdc\\x9b\\xa9\\xce=gv\\xba\\xa8\\xa1f\\xb5\\xbb\\xbe\\x8b\\x18v_8z\\xf5\\x0cg\\x8a\\xb12k\\x91-z\\xb2.\\x9b-o\\x8f\\x9b\\xeapr\t\\x81\\xc1\\xe0\\x04\n\\x9f\\xa9\\x1e\\x7fk-qq\\xf4d\\xb4e\\x93\\xf2\\x18\\x16\\xba~\\x8e\\xaa\\x9c\\x174\\x1a\\x9a\\xd1\r-\\xdab\\x11r\\x89\\x97\\xa5\\xda\\xaaj2mn\\x1c\\xb3\\x1ajl\\xfe$\\x0f\\x18k\\xed4\\xab\\xe7\\xef\\xeeq\\xaau\\x94\\x89 \\x14\\xecb\\xed\\xa4_\\xfcmb\\x12f\\xdb`r\\xea~\\xba\\xeb\\x1bz=^"
  645.  
  646.  
  647. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  648.  
  649.  
  650. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xfad\\x93o\\xe4l\\xb5\r\\xd0g\\x1c\\xf1\\x1a\\x00~\\xc0y\\xabq\\x07\\xc0~\\x9b\\xe8!\\xe0z\\xe2\\xd4l\\xe3gdc52\ripd\\xe9\\x99b\\xdc\\x9ec\\xb5\\xf6\\xa6i\\x90\\xa5\\xb0\\xff^\\x07\\x13h\\x80|f\t\\xfej\\xf0\\xe2\\xed\\xedqy\\xda\\x85\\xf9\\x14d;f\\xa8\\xd2\\xd4\\x05it:\\xd5 \\xc9\\xcd\\xc40\\x1dp\\xdb\\x7f\\xb4n\\x16\\x82\\\\xafswh\\xe2\\xfd/u\\xcb3e\\xca\\x01x\\x8b\\xed\\xe8\\x1d\\xbbi?j\\x93*n\\xfc\\xe35\\xa0\\xd3\\xed\\xa2\\x12v\\xa2\\xd1\r0w\\xaa\t\\xd5\\xd7ux\\xf6o\\xd9e\\x9e\"f\\xc4j\\xe5\\xe9\\xc0/k\\xe7\\xf7k\\x877\\xe2\\x18be#\\x0e\\xb5\\x14s\\xbd\\xae#\\xb08y\\xa0\\xd9f\\xd1\\xae%p\\xf4\\xb3\\xa8%\\xc5\\xd02y1\r\\x8d\\x93\\xf7\\xb4s\\xad\\x17vig\\xc2\\x8f\\x14!\\xf0\\x8f~\\xbaf\\xee\\x9c\\xce\\x8b\\x01\\x9d!\\xcd\\xba\\xe8\\x9fc\\x97\\x17\\x96c\\xac+\\x0e\\xcc&5\\x0e\\xe6\\xae\\x9bo\t\\xbdq\\x8f\\xb2\\x18"
  651.  
  652.  
  653. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x8d\\xack\\xea\\x92\\x10\\x0f\\x9b\\xeb\\xaa\\xb0\\xc8ez\\xb2\\x1e|\\x94\\xbc\\x0b\\xb9\\xc2h5pb5\\x01\\xf8\\xe5\\x1b@0@a\\x85\\xa0\\\\x90\\xd0h\\x82\\x1f\\x80bhjxa\\x7f\t\\xdc\\x81\\x96\\xf7?\\xaa\\x06\\x1e^\\x07\\x02y\\xd0\\x12\\x86\\xcdf\\xc3\\xaf'u\\xf1 \\xa2\\xe01:\\xd7k,*|\\xd6\\x1ci(\\x0c\\x1b\\xde\\xe97r\\xbb\\xdcqz\\xa2\\x8dnr$*\\x0e\\x85p\\x8a\\x81\\xbe\\xfb8\\xbc\n\\x044\\xf1z\\xf9\\xba\\xb2\\xb1\\xe1\\x1ci\\x84r\\xa2\\xab!\\x91q\\x85\\xed\\x81\\xfah\r\\x92\\\\x93\\x82\\xf5a\\xcc\\x0e\\xf3\\xc1cr:\\x0b\\xa36?>\\x80&\\x91\\xe5\\x08w\\xa4\\xac0\\x17\\x82i\\xdd\r\\xb1\\xde\\x8c\\x19\\x89\\xacq\\x93a#\\xa2s\\x05\\xac'\\x1c\\xd6j\\x8d\\xee\\x9b\\xc3\\xc8\\x04\\x8a\\x03r\\xc33\\x9a\\xbf\\xe8gi\\x17\\xc6\\xb8\\x0e3\\x16c\\xe6\\x83\\x16\\xa1m!r(pll\\xdb\\x14\\x8d.5\\xb4uf\\x95\\x90\\xc6\\x8e\\xf3\\x14\\xb5\\x8b\\xd0tu\\x98\\xaf\\xb1o\\xf2"
  654.  
  655.  
  656.  
  657.  
  658. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  659. "Details":
  660.  
  661. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  662.  
  663.  
  664. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  665.  
  666.  
  667. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  668.  
  669.  
  670. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  671.  
  672.  
  673. "Cyren": "CVE-2017-11882!Camelot"
  674.  
  675.  
  676. "Symantec": "Bloodhound.RTF.12"
  677.  
  678.  
  679. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  680.  
  681.  
  682. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  683.  
  684.  
  685. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  686.  
  687.  
  688. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  689.  
  690.  
  691. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  692.  
  693.  
  694. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  695.  
  696.  
  697. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  698.  
  699.  
  700. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  701.  
  702.  
  703. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  704.  
  705.  
  706. "TrendMicro": "Possible_SMBCVE20170199"
  707.  
  708.  
  709. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  710.  
  711.  
  712. "Sophos": "Exp/201711882-P"
  713.  
  714.  
  715. "Avira": "HEUR/Rtf.Malformed"
  716.  
  717.  
  718. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  719.  
  720.  
  721. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  722.  
  723.  
  724. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  725.  
  726.  
  727. "GData": "Exploit.RTF-ObfsStrm.Gen"
  728.  
  729.  
  730. "AhnLab-V3": "RTF/Malform-C.Gen"
  731.  
  732.  
  733. "McAfee": "Exploit-CVE2017-11882.ah"
  734.  
  735.  
  736. "MAX": "malware (ai score=94)"
  737.  
  738.  
  739. "Zoner": "Probably RTFObfuscation"
  740.  
  741.  
  742. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  743.  
  744.  
  745. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  746.  
  747.  
  748. "Qihoo-360": "susp.rtf.objupdate.gen"
  749.  
  750.  
  751.  
  752.  
  753. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  754. "Details":
  755.  
  756. "target": "clamav:Rtf.Dropper.Agent-7074366-0, sha256:c1b8ad40f7315948a5333ee590ffed98f49135816f0a0bdb76c8dd756b2d10cb, type:Rich Text Format data, version 1, unknown character set"
  757.  
  758.  
  759. "dropped": "clamav:Rtf.Dropper.Agent-7074366-0, sha256:c1b8ad40f7315948a5333ee590ffed98f49135816f0a0bdb76c8dd756b2d10cb , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Pony_1d546363eed006d85eda8a04d1dc9083.doc, type:Rich Text Format data, version 1, unknown character set"
  760.  
  761.  
  762.  
  763.  
  764.  
  765. * Started Service:
  766. "osppsvc"
  767.  
  768.  
  769. * Mutexes:
  770. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  771. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  772. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  773. "CicLoadWinStaWinSta0",
  774. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  775. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  776. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  777. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  778.  
  779.  
  780. * Modified Files:
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\Pony_1d546363eed006d85eda8a04d1dc9083.doc",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\~$ny_1d546363eed006d85eda8a04d1dc9083.doc",
  783. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF9895D330-ED43-46EC-A3BF-D0F571E305DB.tmp",
  784. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS41D2FFB0-E75E-4604-B311-C6C4B22E5F06.tmp",
  785. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS7B201B9D-C28B-4EE0-B93F-42E45F89A359.tmp",
  786. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  787. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  788. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  789. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAB9F.tmp",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\TarABA0.tmp",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD06.tmp",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD26.tmp",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD27.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD28.tmp",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD39.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD3A.tmp",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD5A.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD6C.tmp",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD7C.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD8D.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD8E.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD9E.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDB0.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDB1.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD9F.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD6B.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD5.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC3.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDE8.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD6.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC4.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC2.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD7.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE09.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE1A.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD4.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDF9.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE2A.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE2B.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE4C.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC031.tmp",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1B9.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC237.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC238.tmp",
  826. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2A6.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2F5.tmp",
  829. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC3B3.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC364.tmp",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC431.tmp",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC4BE.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC4FF.tmp",
  835. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC4BF.tmp",
  837. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC53E.tmp",
  839. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC649.tmp",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC65A.tmp\\mlaseventheditionofficeonline.xsl",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67B.tmp\\content.inf",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC6FC.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68B.tmp\\HexagonRadial.glox",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68C.tmp\\Crop.thmx",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67A.tmp\\rings.glox",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6AD.tmp\\Element design set.dotx",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67B.tmp\\Dividend.thmx",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC72D.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68B.tmp\\Content.inf",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68C.tmp\\Content.inf",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC65A.tmp\\Content.inf",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6AD.tmp\\Content.inf",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC73D.tmp\\content.inf",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67A.tmp\\Content.inf",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC82B.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC87A.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\chevronaccent.glox",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC72C.tmp\\APASixthEditionOfficeOnline.xsl",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC73D.tmp\\View.thmx",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC89A.tmp\\Berlin.thmx",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\Content.inf",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC82A.tmp\\content.inf",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC82A.tmp\\Metropolitan.thmx",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC918.tmp\\TabList.glox",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC72C.tmp\\Content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC918.tmp\\Content.inf",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC948.tmp\\architecture.glox",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC968.tmp\\gb.xsl",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC988.tmp\\content.inf",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA08.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA68.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9B8.tmp\\InterconnectedBlockProcess.glox",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC948.tmp\\Content.inf",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9D9.tmp\\harvardanglia2008officeonline.xsl",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9B8.tmp\\Content.inf",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC988.tmp\\Frame.thmx",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC968.tmp\\Content.inf",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA29.tmp\\content.inf",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAA8.tmp\\PictureFrame.glox",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAA8.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC7D.tmp\\Basis.thmx",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC89A.tmp\\content.inf",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA29.tmp\\Quotable.thmx",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9D9.tmp\\Content.inf",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3A.tmp\\content.inf",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3A.tmp\\Savon.thmx",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE38.tmp\\Equations.dotx",
  896. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE77.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD7A.tmp\\Banded.thmx",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE38.tmp\\Content.inf",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD6A.tmp\\BracketList.glox",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC7D.tmp\\content.inf",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDCA.tmp\\ThemePictureGrid.glox",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED7.tmp\\CircleProcess.glox",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD6A.tmp\\Content.inf",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEC7.tmp\\gostname.xsl",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED7.tmp\\Content.inf",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDCA.tmp\\Content.inf",
  910. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEC7.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF55.tmp\\ConvergingText.glox",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD022.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF55.tmp\\Content.inf",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF75.tmp\\Headlines.thmx",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD12D.tmp\\content.inf",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD7A.tmp\\content.inf",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD249.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD12D.tmp\\Wood_Type.thmx",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD18C.tmp\\Circuit.thmx",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD219.tmp\\Badge.thmx",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  932. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF75.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  935. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD48C.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD219.tmp\\Content.inf",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4CC.tmp",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4DC.tmp\\content.inf",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4DC.tmp\\Parallax.thmx",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD720.tmp",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD77F.tmp\\Feathered.thmx",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD7B0.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD740.tmp\\content.inf",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD740.tmp\\Slate.thmx",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD7A0.tmp\\iso690nmerical.xsl",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD7A0.tmp\\Content.inf",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD8CA.tmp\\content.inf",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD90A.tmp\\content.inf",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD8CA.tmp\\Damask.thmx",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD18C.tmp\\content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD90A.tmp\\Droplet.thmx",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD77F.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA16.tmp\\content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA05.tmp\\ThemePictureAccent.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA16.tmp\\Main_Event.thmx",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA65.tmp\\Mesh.thmx",
  966. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA05.tmp\\Content.inf",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB8F.tmp\\Insight design set.dotx",
  970. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  971. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB8F.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE2F.tmp\\gosttitle.xsl",
  977. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECF.tmp\\chicago.xsl",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECE.tmp\\ieee2006officeonline.xsl",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE2F.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  983. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEDF.tmp\\turabian.xsl",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEBD.tmp\\ThemePictureAlternatingAccent.glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECF.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF0.tmp\\Content.inf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECE.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF20.tmp\\TabbedArc.glox",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEBD.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF6F.tmp\\VaryingWidthList.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF81.tmp\\content.inf",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF81.tmp\\Vapor_Trail.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEDF.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF6F.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE05C.tmp\\RadialPictureList.glox",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF20.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF70.tmp\\iso690.xsl",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE05C.tmp\\Content.inf",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE32C.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3D9.tmp\\pictureorgchart.glox",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3D9.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1018. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS88A57195-0B55-4D8A-82F6-CD6981FF7D11.tmp"
  1019.  
  1020.  
  1021. * Deleted Files:
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAB9F.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TarABA0.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC4BE.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC4BF.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC65A.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67A.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68B.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67B.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68C.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6AD.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC72C.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC73D.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC82A.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC89A.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68C.tmp\\Crop.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2F5.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC948.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC918.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC968.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC988.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9B8.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9D9.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA29.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAA8.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC68B.tmp\\HexagonRadial.glox",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD7C.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67B.tmp\\Dividend.thmx",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC7D.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC65A.tmp\\mlaseventheditionofficeonline.xsl",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC67A.tmp\\rings.glox",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE2B.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDB0.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3A.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\chevronaccent.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC73D.tmp\\View.thmx",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD7A.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD6A.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC364.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD27.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDCA.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE38.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC918.tmp\\TabList.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD5A.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC72C.tmp\\APASixthEditionOfficeOnline.xsl",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC238.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEC7.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC948.tmp\\architecture.glox",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED7.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2A6.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF55.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9B8.tmp\\InterconnectedBlockProcess.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF75.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD9E.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC968.tmp\\gb.xsl",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD3A.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC988.tmp\\Frame.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC4FF.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD12D.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC82A.tmp\\Metropolitan.thmx",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD219.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC237.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC89A.tmp\\Berlin.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC9D9.tmp\\harvardanglia2008officeonline.xsl",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD6B.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCDCA.tmp\\ThemePictureGrid.glox",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD6A.tmp\\BracketList.glox",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCAA8.tmp\\PictureFrame.glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD5.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC3.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC7D.tmp\\Basis.thmx",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCE38.tmp\\Equations.dotx",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD4.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCED7.tmp\\CircleProcess.glox",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC6FC.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE1A.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC6AD.tmp\\Element design set.dotx",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE09.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD3A.tmp\\Savon.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE2A.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF55.tmp\\ConvergingText.glox",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC53E.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC4.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCD7A.tmp\\Banded.thmx",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4DC.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC031.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD12D.tmp\\Wood_Type.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD219.tmp\\Badge.thmx",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA29.tmp\\Quotable.thmx",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF75.tmp\\Headlines.thmx",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC649.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC82B.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC87A.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD740.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC431.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEC7.tmp\\gostname.xsl",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD77F.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDF9.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD7A0.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD4DC.tmp\\Parallax.thmx",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA08.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD90A.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA05.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA16.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA65.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD740.tmp\\Slate.thmx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCA68.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD77F.tmp\\Feathered.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB8F.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD022.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD8CA.tmp\\Damask.thmx",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD249.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD7A0.tmp\\iso690nmerical.xsl",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD06.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA05.tmp\\ThemePictureAccent.glox",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD9F.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE2F.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA65.tmp\\Mesh.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD48C.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD18C.tmp\\Circuit.thmx",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC72D.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDA16.tmp\\Main_Event.thmx",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB8F.tmp\\Insight design set.dotx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4CC.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECF.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECE.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEBD.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF0.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEDF.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD90A.tmp\\Droplet.thmx",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD720.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF20.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE2F.tmp\\gosttitle.xsl",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF70.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF6F.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF81.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE77.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD26.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECF.tmp\\chicago.xsl",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEBD.tmp\\ThemePictureAlternatingAccent.glox",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDECE.tmp\\ieee2006officeonline.xsl",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD7.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF6F.tmp\\VaryingWidthList.glox",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE32C.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD6.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD28.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD39.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDE8.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEDF.tmp\\turabian.xsl",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD8D.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3D9.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE05C.tmp\\RadialPictureList.glox",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE32C.tmp\\sist02.xsl",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF20.tmp\\TabbedArc.glox",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF81.tmp\\Vapor_Trail.thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3D9.tmp\\pictureorgchart.glox",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF70.tmp\\iso690.xsl",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD6C.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD8E.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDC2.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD7B0.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDB1.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\~$ny_1d546363eed006d85eda8a04d1dc9083.doc",
  1188. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1189. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS88A57195-0B55-4D8A-82F6-CD6981FF7D11.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS41D2FFB0-E75E-4604-B311-C6C4B22E5F06.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS7B201B9D-C28B-4EE0-B93F-42E45F89A359.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRA2F3.tmp.cvr"
  1193.  
  1194.  
  1195. * Modified Registry Keys:
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\+dk",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\62BE5B",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\62BE5B\\62BE5B",
  1208. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1507. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1805. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1806. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1807. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1819.  
  1820.  
  1821. * Deleted Registry Keys:
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\+dk",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\#xi",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\62BE5B\\62BE5B",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1830.  
  1831.  
  1832. * DNS Communications:
  1833.  
  1834. "type": "A",
  1835. "request": "indaiacollection.com",
  1836. "answers":
  1837.  
  1838. "data": "46.105.57.169",
  1839. "type": "A"
  1840.  
  1841.  
  1842.  
  1843.  
  1844.  
  1845. * Domains:
  1846.  
  1847. "ip": "46.105.57.169",
  1848. "domain": "indaiacollection.com"
  1849.  
  1850.  
  1851.  
  1852. * Network Communication - ICMP:
  1853.  
  1854. * Network Communication - HTTP:
  1855.  
  1856. "count": 1,
  1857. "body": "",
  1858. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1859. "user-agent": "Microsoft-CryptoAPI/6.1",
  1860. "method": "GET",
  1861. "host": "ocsp.digicert.com",
  1862. "version": "1.1",
  1863. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1864. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1865. "port": 80
  1866.  
  1867.  
  1868. "count": 1,
  1869. "body": "",
  1870. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1871. "user-agent": "Microsoft-CryptoAPI/6.1",
  1872. "method": "GET",
  1873. "host": "ocsp.msocsp.com",
  1874. "version": "1.1",
  1875. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1876. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1877. "port": 80
  1878.  
  1879.  
  1880. "count": 1,
  1881. "body": "",
  1882. "uri": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/fwovksuqpshrym8.msi",
  1883. "user-agent": "Windows Installer",
  1884. "method": "GET",
  1885. "host": "indaiacollection.com",
  1886. "version": "1.1",
  1887. "path": "/modules/jmsslider/views/img/layers/dir/fwovksuqpshrym8.msi",
  1888. "data": "GET /modules/jmsslider/views/img/layers/dir/fwovksuqpshrym8.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: indaiacollection.com\r\n\r\n",
  1889. "port": 80
  1890.  
  1891.  
  1892. "count": 11,
  1893. "body": "",
  1894. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1895. "user-agent": "Microsoft-CryptoAPI/6.1",
  1896. "method": "GET",
  1897. "host": "crl.microsoft.com",
  1898. "version": "1.1",
  1899. "path": "/pki/crl/products/microsoftrootcert.crl",
  1900. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1901. "port": 80
  1902.  
  1903.  
  1904. "count": 4,
  1905. "body": "",
  1906. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1907. "user-agent": "Microsoft-CryptoAPI/6.1",
  1908. "method": "GET",
  1909. "host": "crl.microsoft.com",
  1910. "version": "1.1",
  1911. "path": "/pki/crl/products/microsoftrootcert.crl",
  1912. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1913. "port": 80
  1914.  
  1915.  
  1916. "count": 1,
  1917. "body": "",
  1918. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1919. "user-agent": "Microsoft-CryptoAPI/6.1",
  1920. "method": "GET",
  1921. "host": "crl.microsoft.com",
  1922. "version": "1.1",
  1923. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1924. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1925. "port": 80
  1926.  
  1927.  
  1928. "count": 1,
  1929. "body": "",
  1930. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1931. "user-agent": "Microsoft-CryptoAPI/6.1",
  1932. "method": "GET",
  1933. "host": "crl.microsoft.com",
  1934. "version": "1.1",
  1935. "path": "/pki/crl/products/microsoftrootcert.crl",
  1936. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1937. "port": 80
  1938.  
  1939.  
  1940.  
  1941. * Network Communication - SMTP:
  1942.  
  1943. * Network Communication - Hosts:
  1944.  
  1945. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!