API tools faq
paste
paladin316

Docs_42586963a1334219d518c6a6c6cf08ed_doc_2019-07-20_14_30.txt

paladin316
Jul 20th, 2019
2,191
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 226.70 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_42586963a1334219d518c6a6c6cf08ed.doc"
  7. * File Size: 9401
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "13fcd7db212d0b39f22451fb3daf4d7fbb7560894bacbe5f4406dc981b7d2b17"
  10. * MD5: "42586963a1334219d518c6a6c6cf08ed"
  11. * SHA1: "6415ba0d7ff2dc67f252168565bb5be0042613b8"
  12. * SHA512: "1629e473d7836cd6da1f412ba2c1fae7d31a01ee86fd26196615078806eb5fc2639924b5bd855bfd43578d62f4cc0bce51d372a71943144930a60b1d14b15596"
  13. * CRC32: "A10ED60D"
  14. * SSDEEP: "96:meOELvL4MzN9st817GC0jkQnefws90yYIWv6eLWdHBDibwMhk7cbkOG:4eLR9Zt+s9eIc7iMbwMhkn"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  25. "Details":
  26.  
  27. "IP": "23.59.214.201:443"
  28.  
  29.  
  30. "IP": "69.192.108.32:443"
  31.  
  32.  
  33. "IP": "52.109.6.40:443"
  34.  
  35.  
  36. "IP": "65.52.98.231:443"
  37.  
  38.  
  39. "IP": "104.18.24.243:80"
  40.  
  41.  
  42. "IP": "23.15.4.26:80"
  43.  
  44.  
  45. "IP": "52.109.92.24:443"
  46.  
  47.  
  48. "IP": "72.21.91.29:80"
  49.  
  50.  
  51. "IP": "23.15.4.32:80"
  52.  
  53.  
  54.  
  55.  
  56. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  57. "Details":
  58.  
  59. "ioc": "ext.glox"
  60.  
  61.  
  62. "ioc": "ontent.inf"
  63.  
  64.  
  65. "ioc": "rocess.glox"
  66.  
  67.  
  68. "ioc": "ist.glox"
  69.  
  70.  
  71. "ioc": "gosttitle.xsl"
  72.  
  73.  
  74. "ioc": "chevronaccent.glox"
  75.  
  76.  
  77. "ioc": "rid.glox"
  78.  
  79.  
  80. "ioc": "..3b"
  81.  
  82.  
  83. "ioc": "architecture.glox"
  84.  
  85.  
  86. "ioc": "quations.dotx"
  87.  
  88.  
  89. "ioc": "sist02.xsl"
  90.  
  91.  
  92. "ioc": "pictureorgchart.glox"
  93.  
  94.  
  95. "ioc": "ieee2006officeonline.xsl"
  96.  
  97.  
  98. "ioc": "e.gu"
  99.  
  100.  
  101. "ioc": "harvardanglia2008officeonline.xsl"
  102.  
  103.  
  104. "ioc": "mlaseventheditionofficeonline.xsl"
  105.  
  106.  
  107. "ioc": "chicago.xsl"
  108.  
  109.  
  110. "ioc": "gostname.xsl"
  111.  
  112.  
  113. "ioc": "rc.glox"
  114.  
  115.  
  116. "ioc": "ccent.glox"
  117.  
  118.  
  119. "ioc": "iso690nmerical.xsl"
  120.  
  121.  
  122. "ioc": "set.dotx"
  123.  
  124.  
  125. "ioc": "adial.glox"
  126.  
  127.  
  128. "ioc": "content.inf"
  129.  
  130.  
  131. "ioc": "rame.thmx"
  132.  
  133.  
  134. "ioc": "ividend.thmx"
  135.  
  136.  
  137. "ioc": "arallax.thmx"
  138.  
  139.  
  140. "ioc": "eadlines.thmx"
  141.  
  142.  
  143. "ioc": "adge.thmx"
  144.  
  145.  
  146. "ioc": "anded.thmx"
  147.  
  148.  
  149. "ioc": "avon.thmx"
  150.  
  151.  
  152. "ioc": "uotable.thmx"
  153.  
  154.  
  155. "ioc": "ype.thmx"
  156.  
  157.  
  158. "ioc": "eathered.thmx"
  159.  
  160.  
  161. "ioc": "amask.thmx"
  162.  
  163.  
  164. "ioc": "esh.thmx"
  165.  
  166.  
  167. "ioc": "rail.thmx"
  168.  
  169.  
  170.  
  171.  
  172. "Description": "Performs some HTTP requests",
  173. "Details":
  174.  
  175. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  176.  
  177.  
  178. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  179.  
  180.  
  181.  
  182.  
  183. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  184. "Details":
  185.  
  186. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x00\\x05v'\\xcdfn\\xe4\\x99\\xf3\\xb1\\x7f6\\xdbl0z\ns\\xa5\\xfc\\xd0-\\x1bg\\x955\\x90\\x04\\xdf\\xb1l\\x18e.\\xbaw?\\x7f&3\\xf3\\xa5\\xf5+>d\\xd2\\xbb\\xb3\\xe1&&\\xe3)\\x8a\\x040\\xe0gs\\xd9\\x93\\xe7n),fg\\xee\\xe77\\xe3\\xc7\\xe2&\\xcf\\xf3j\\x1bj\\xa3w\\x08\\xa9\\x01\\x13&\\xd6a\\xfbm\\xf2\\xf7\\x08\\x9f\\x07\\x85\\x15\\x17\\x85s\\xd0d\\xf6i\\x8c\\xb2tbl\\xe1?\\xd2sz\\x82\\x03/f\\xf2\\x83z\\xd9s\\xb2\\xe05\\x82\\xa1f\\xb5jr\\x9a\\xdar\\xad\\x05\\xb8\\xa9*\\xd4\\xd2\\xae\\xeb\\xfe\\xd3\\x0b\\x15\\xb3\\xb3\\x0f\\x8f\\xec\\xa8)g\\xc7\\xd3c\\x9b\\xf6i\\x94\\xb9\\xc8\\xb5\\xe7c\\x81\\xe2\\xde\\x8d\\x99\"l\\xccx\\x08\\xcb\\xa6\\xaa\\xbbr?.\\xc8\\xac|\\xb6\\x13\\xb9\\x05w0u\\xf3\\xf0\\xa7d\\x90\\xbfm\\xb5\\xe8\\x13\\x90\\xf9\n'1\\xcb:\\xa6\\x86\\xad\\xdec\\xb6\\xcb\\xb5\\xec\\xc7!\\x94\\xbd\\xa2rp\\xa3\\xdc\\x17\\xcfk\\xa2\\xe89\\x98\\x16\\xcf\\xaf\\xe5\\xe2\\xbe\\xa0\\xf7"
  187.  
  188.  
  189. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x013\\x1c\\xbe\\x93\\x98e\\xc8\\x8e\\x84\\x97\\x00\\x86n\\x05\\xf4\\xad9\\xcd\\x8bb4\\xa4@q8h\\xb8\\xf1\\x0ch\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  190.  
  191.  
  192. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\xb2\\xe8fuc\\xfd\\x1c\\xfe\\x876\\xcds\\x95\\xe7\\x08\\x9c8\\x07\\xd1\\xfb\\xac9\\x916b\\xb1\\x91\\xce\\x8f(g\\x95\\xdbn,\\xd3\\xd9\\x80\\xaeq\\x82\\xbf\\xe1;\\x02s\\xe3\\xa6\\xc8<`v\\xfe!\\xe7b\\x93tc\\x00\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\x00`c\\xf0\\xc9\\xdd\\xbe\\x99o+u\\xfd\\xa2o9\\xf9\\x92*\\x0fj\\xc1\\xcb\\xa66\\x8c\\xf3\\xaba@\\x15!\\xdc\\xcaa\\xc6f\\xed\\xf9zj|\\xfa9\\xe4l"
  193.  
  194.  
  195. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  196.  
  197.  
  198. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  199.  
  200.  
  201. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x95\\xf0u\\xe9\\xc8\\xa5\\xc3\\xec\\xb0\\xf8\\xc2\\xf2d=\\xdc\"\\x9d5\\x86w\\xeb\\x89\\x93\\x8c2\\xfe\\xa4\\xb29\\xd7\\x9d^v\\x8b)\\x07\\x03a%\\xcf\\x19$\\xaa\\xc8\\xde\\x88\\x15\\xab\\x00$\\xe8\\xf7\\xc5\\xe4s\\xdb\\xd2$\\x88m7\\x9fp\\x99\\x85\\xa6\\xc5\\xe9\\x8ae|\\xe4\\xc3\\xb1w\\x1d'\\xba\\x14\\xb1f\\xa3\\xc6\\xbd\\x90\\xa6pgk\\x14\\xaf\\x8f\\x1e\\xba\\xaed\\x85\\xc7(\\xc8\\xf3\t\\xd3\\xb0\\xd3\\xf3\\xc5\\xd9~o\\x07\\x1c\\x08*\\x11\\xa6\\x93\\xe6\\xb0p\ne\\xfd\\x7f\\x0e\\x8bhl\\x93\\z\\xa5\\xa6\\xbc\"\\xbc\\x1b\\x1f\\xeb\\x8d\\x0c$\\x93\\xe7\\xa4\\xec\\x95\\xf0\\xf4\\xd9\\xc6\\xc3@\\xe7\\x94\\xb64w \\xd9\\x90\\x9c\\xa6\\xfa%\\xbd\\xa4\\x80\\xda\\x8e\t\\x1dh\\xf5\\xde\\x0f\\xd4\\xd6\\x04\\xd8g\\xa5z\\xb4\\x1bf\\xc0/\\xe6\\x8fl.\\xa0\\xaa\\xe5_\\x80\\xa8\\xf9\\xe7uy5\\xd1\\xb8\\x19\\xe9\\x8f\\xd0\\xc4+\\xbe\\xe5\\xb7\\xaf)\\x88ws\\xfcca\\xd6\\xfb\\x0c\\x03\\x895\\x08\\xfb\tf!\\xe5\\x17\\xf9\\x03\\xec_\"\\x8b4c+\\xdf\\xf52\\xd1"
  202.  
  203.  
  204. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 ms\\xe0\\xec\\x82k\\xc9/\\xf8\\x9c\\xc5\\xa6/\\x99\\xe0\\xb7r\\xba\\xe7\\x89\\x95\\xaah\\xeeb9\\xaa\\x84\\xed\\xc9<\\x11\\xce;\\x96,\"\\xad\\x03\\xdf\\x08\\x86\\xfdv\\xe4\\x80\\xca\\xdc\\xadg\\x94\\xb8p\\x84|\\x9a\\xfc\\xa9\\x19\\x01\\xebp\\xe5o\\xccd\\xa7ar+io\\x16\\x91b\\xa7\\x13\\xc7\\x14\\x87:\\x9a\\x97\\xd9\\xec\\x93,xq\\xb7\\x17d\\xb6\\x98\\xf9\\xea\\xf9\\xb6\\x14\\xb6\\x18\\xba\\xa9\r\\xcf\\xac\\x97\\xe1\\x92\\xb7/\\x0bt\\xfc\\x8f\\xd9\\x10m\\xd3\\x92\\x9b\\xa1\\x18\\xe5\\xfb\\xa9izr\\xb0\\xc1\\xce\\xcd\\xd8\\xb3\\x06\\xbay/^\\x1e\\xb9\\xc8i\\xe3\\xe9\\x15a\\xc9\\xa1\\xef\\xe4\\xf5\\xebp\\xb2*\\xcd\\x02te\\x7f\\xf13\\xd9@~nnct\\xfa\\xf3uh\\x07\\xb1z\\xe8d\\xfb\\xe9pdf\\xe4\\xc6\\xd5\\xb7\\x0b\\xb0\\x11\\xe2\\xe8y\\x9b0b\\xa1ztg\":\\xd8\\xe0\\xcb\\xbb%\\x9f\\x90$\\x18\\xe9ks@\\xcc\\x8a\\xc0\\x04\\xab:s\\xdd\\x1a\\xe35thf\\xf8\\x95\\x05x\\xa8\\x1cq&m\\x9a>\\x7f\\x03\\xb3\\x99\\xdd"
  205.  
  206.  
  207. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x013\\x1c\\xc05\\xf6n\\xdea\\x06tr\\x97\\x11=\\x16\\x7f\\x10\\xb3n'xx\\x8c\\xd5!\\xb8\\x9f\\xdd\t\\x94z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  208.  
  209.  
  210. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x81\\x04oj\\x1e\\x1a\\xe4g\\xb6/i\\xb4\\xf6\\x83v6\\xb2\r\\x08\\xa6\\xf4z\\xaar\\xc2\\x10s\\x7f\\xec\\xae\\x86\\xa1\\x1fb+\\xfapi\\xbc\\xbb\\xbc\\xb5d\\x80\\xac\"\\x0c\\x0b\\xf43f\\xe0\\xfd\\xa3\\x7f$y\\xceh\\x1e_;\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\xb9\\xaeb\\x8eb\\x9f\\x84a\\x94\\x9b\\x933\\xf0\\xf4\\xbcm|\\x19o\\xdfw\\xb2\\x7f2\\xf6p\\x88\\xd0%\\x92\\xf0\\xfb\\xa8l\\xe1\\x9b\\xfa\\xf8\\x8eg\\xe1+\\x7f\\xd1\\xe1"
  211.  
  212.  
  213. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xeen\\xfd\\x94s4d\\xda/3\\x15\\xb4%\\xa0\\xf7d\\x1c\\x06\\xa2m7\\xa6\\xd3\\x87\\xfdbn\\xf4\\xb7\\xf8\\x89ni\\x93\\xad\\x84\\x8af\\x9b\\x85$\\x1e>\\x89\\xf9\\xdb\\x87wr\\x9f\\x9b\\xc6\\xce\\xb7\\xb1\\xd3\\x94\\x13\\xa9\\x01\\x8cq\\xf4\\xfc\\xb8\r\\x18\\xa7^2>\\x8cr\\x05\\xad\\x7fa\\xda\\xb2+_\\xd1;\\x96\\x1d*u\\xb4\\x81c\\xd4o\\xec\\xc2\\x18\\xab\ntb\\xdc\\xae\\xd5v\\xb1\\x07\\x94@\n;\\xa1\\xc8\\x0ee\\xdc\\xae\\xc39\\xd2\\x86\\x076\\xa5\\xc0\\xf1\\x92d\\x89`j\\xac\\xebz5f\\xb4\\x0f\\x14\\xbb\\xd6\\x8d\\xfa+1\\x17\\xa8-\\x846\\xec\\x96\\x13\\xeae\\xaa\\xc0\\xd5\\x89f\\xefb\\x7f\\xdf\\x04c$4\\xc8,\\x9fcs\r`\\x93m)r>7yf\\xcd4\\x9bq\\xdd\\x92\\xda\\x08\\x92\\x8c\\xe7\\xc1\\x9a,\\x90\\x80&\\xf2\\xa8d\\x04iz\\x10jw\\x98\\xa7\\xf3t\\xa9\\xfd-w\\xd2\\x9auv\\xfb\\xb5\\xf8t`do\\xactd\\xd3\\xe2\\xca\\xe02a\\x00\\x85gn\\xa8\\x01\\xee\\x8bd\\xcd\\x88\\xc4"
  214.  
  215.  
  216. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x013\\x1c\\xc2\\xc5yy\\xc9\\xc3\\x88 \\x10\\xc8\\xc86\\xe6*k\\x89/\\x82bd\\xd8@y0\\x89\\xde\\xe1\t\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  217.  
  218.  
  219. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcbg0vj35r\\x8e\\xf3w\\x9bb\\xb1\\xe9\\xf1-\\x08\\xd8bx\\xec\\xfc-\\xb8\\x80\\xa1?s\\xa8\\xe5\\xc1\\xa6\\xb5v\\x00mm%t\\xf7\\xad/\\xdd\\xcf\\x89hj\\x0f\\x007\\x94\\xcb\\xbe\\xce\\xe1\\xdb\\x95?\\xd2\\xb8\t=\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\xf6\\x80\\x9f@\\x84\\xfah\\xac6(ef\\xb7\\xfb\\x85\\xf3z#\\xa6\\x1b\\xa5\\x150\\x04\\xe0\\xa2f;\\x8b\n%s\\x07\\xd1^_\\x88\\xc6\\xdf-\\xa2\\xa71\\xed0di"
  220.  
  221.  
  222. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb3\\xe1\\xf2w\\xd5\\xb4\\xcf\\xfe\\xc5,\\x056k\\x9b\\xa5oc\\xda\\x96%#a\\x8a\\xad\\xc0\\x903i \\xb1\\xa5\\xfb0y\\x99 \\x07\\xeay|\\xf1n\\x8e\\x03\\xdf\\xd3i#\\xb9w\\xbe\\x11\\x0f\\xfee\\xc35\\x0cpk~.s\\xe7\"\\xb0\\x83\\xfbyu\\x95\\xdb^\tt\\x9d\\xe2x!x6\\xd9w\\xcc\tu@bn\\x94\\xd2n\\x88\\x87w,\\xe1\\x87\\xda\\x11o-\\xb8zp\\xe42\\xfe\\x81\\xa1t\\xd4\\x9du\\x8a\\xb4l\\xe4k\r6\\xc1\\x0e!\\xce\\x88\\xcf\\xe7\\x9f\\xcd\\x0c|+\\xe4|\\xb5\\xd0\\x16\\xd5\\xbf\\xed\\x9cq\\xfe7\\xa7b\\xfa\\xf5\\x86\\x7f\\xcfz\\x8f\\xca\\xe2\\x089\\xbc\\x07>\\xf7\\xc1\\xd3#;\\x81ffr\\xa6\t\\xe2\\xa9\\xde\\x97)\\x9b\\xfa\\xf3\\x1d\\x00=\\xe1fa\\xb2x\\xee\\xaa g\\xd2\\xc0\\x1c%\\xe8\\xf4\\x17\\xbb\\xb2jp\\x919j\\xedpeo\\x88\\xbau\\xf7'wp\\xcc\\xe2\\xc7\\x86\\xefb\\xfe\\x89p\\xc4\\xd5\\xe4\\xa9\\x94\\xe5#;a\\xbb-&\"`\\xfc5\\xfe\\x0c\\xf5\\x89"
  223.  
  224.  
  225. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x8ew\\x92\\xa6|\\x06\\x91d\\x80\\x9f\\x92\\xc5\\x90d3(\\x94r\\x95\\xde\\xad\\xee2\\xa7t\\xc8\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  226.  
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x8f\\xd4\\xc6:\\xec8\\x90s&\\xaew\\x878o\\xecj\\xc4\\xf3c\\xbe-\\x8e9\\xc3\\xfev q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x08\\xeb\\xe6@\\xcd8\\xe8c\\x0ep\\xae\\xd3s\\xce\\xdc\\x84\\xca\\x1ao\\xff/\\xd9\\xd9\\x03\\xc2\\xe6\\xf1\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xd8`\\xeb\\x8a\\xf7\\xea@\\xa9\\xfdpmr`\\xc9ed\\x88 -j+\\xc3+\\x9d\\x9dl\\xbd\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3wt\\xbd\\x13\\xc7\\xe9g^\\x1c\\x0b\\x10\\x1c\\xa3\\xf3mf\\x81\\x9f;|\\xd4^l\\xdf\\xeb^5\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3|\\x15rj\\x9f\\xb0\\xed\\xack\t\\xe4\\x84\\xc2y\\xb3\\xf3\\xbb\\xff\\xc4+\\x188|\\x01\\x1du\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xda#\\xf2\\x8c8m\\xa7\\x18\\xe5\\xbb\\x97\\xc8\\x84\\xa3\\xb1r\\xcag\\xc8\\x9f6e\\x15\\xffv\\xc6u8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xbd\\x14\\xb8+\\xcb\\xaf\\xa71\\xbc3\\xa0=\t<\\xad\\xe4\\xde\\x8e\t\\x13\\x1f\\xfe*\\xb0\\xd8m\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xe8 t\\xaf\\xc4\\x9f\\xefo\\xda\\xe3\\xe1\\xa7\\xa9\\xb1\\x80\\x81\\x7f\\xc7m\\x14\\xd7\\x7f6b\n\\x8a\\xfc \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xe9\\x1ax\\x1a\t\\xa7\\xf8\\xaa\\x81\\x01p\\x1e\\x0b\\xdc0\\xd2\\xf7\\x12\\x1a\\x1c\\x0fm\\xc1\\x1a\\xe8\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xdc\\x8e\\x84\\xccn9\\xd9yrr\\xc2\\x1f\\xda\\xc9\\x17c\\xf9\\x0f\\xf2\\xf0\\x15%v\\xed^\\xf1\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3-\\xf5\\xa2\\x9e\\x8c\\xbes\\x1bu\\x04\\xb8\\xb9wq\\x9a\\x83\\xfarx\\x86\\x927\\xc4\\xf6\\xff\\xe1\\xd3\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3t\\xc5\\x94\\xd3r\\x96k\\x90\\x18\\xa0>\\x92\\xe4g\\xf7\\x8c%|\\xc2\\xbb-\\xb3ks#+\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3m\\xa6\\x85\\x0bd\\xae\\x00\\xfe\\x1a\\xdd\\xa1\\x14\\xd3tls\\xf5\\xb0\\xc2\\xcf\\xc2|.\\x84i\\xef\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3p|\\x9ef\\xf8\\x17\\xc3-\\xcbqj+e\\x1a\\x83\\xa9\\xed>e\\xe9o\\xaf\\x92\\xd9\\xfe\\xaf\\xea\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xc9\\x9d\\x81~\\xe2\\xa2\\xc0\\x0fa\\x89qj3\\xc9\\xa7j\\x92u\\x92\\xfec\\xf0\\x99j\\x96\\x02e\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3pv\\xae\\xe4r<\\xc2\\xeb\\xc8\\xe7\\xe6.\\xdb\\xc4\\x1e\\xb7^i\\x1a\\xc5\\xd7\\xfb\r\\x13\\xac\\xb8\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xfdc\\xe5\\x86'\\x92t\n\\xcd\\x7f\\xf4k\\x89\\xb9\\xf8.\\x87l(\\xf6\\x018.\\x9c\\xf9kx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x9e.\\xba\\x02\\x8bdn\\x1aa\\x98\\xbb\\x0c\\xbe\\xc3\\x03t\\x0cck\\x10\\xef\\x9av_=\\xf8\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xb1\\xe0\\xfb\\x82\\x17v\\xa5\\xe9\\x83\\xf0\\xe8d\\xcf\\x9fe\\xa8ss\\x95\\x8b\\x11\\x07s\\xa6\\x15\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x1ffvwbr2\\xc8/\\x10\\xfe\\xb3\\x10\\x85\\x9au\\xb6\\xdd\\x1d7n\\x81\\x06\\x16\\x98\\x0fj\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xb5\\xa1\\xaf\\x13\\x8a\\xa4wc\\x0e\\x1ai\\x97\\xf9g\\xbc\\xc0^\\xe9\\xe4\\xf7\\xcec\\xe5\"\\xe7\\xc6\\xbb\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3;\\xb0\\x85\\xecv\\xff\\xdc=ctl\\xccxv\\xb9\\xf1\\x9b\\xde\\xba\\xcc\\x01\\xdf\\x17\\x94r\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3`\\x80$\\x85\\xf6x\\xd8\\x01\\x17.\\xc79\\xfa\\xe9\\xf3\\xb1\n\\xef\\xc7w\\x8epa\\xedsvd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xdd\\x06\\xa92\\xeb\\x15\\xde\\xab\\xads`\\xd0\\x1d\\x16\\x81\\xbc\\x16\\xfc\\xf6\r\\x91\\xadq\\xb6\\x01\\xe8g\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc32+w\\x19\\xdd\\xa8\\xe3\\x1e\r\\xfa\\x7fc\\xabw\\x1b\\x88\\x9b\\x07\\xe8e\\xd6\\x9dz(\\xd8\\xdc\\x9da\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x04\\x83\\xd7\\xaa\\xfd\\xa4\\xcb+\\xd2\\x9a\\x02\\xda\\x8b\\xd1v\\xaa\\xc8\\x9fmi!\\xfd\\xd1\\xcc\\xb7\\xf3\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x1f\\xea\\xdc\\x03\\xe7'\\x89\\xf2x\\x0f\\xf0e\\xcc\\xb5)\\x99\\xbb\\x1e\\xc9(+\\xffo\\x0e'\\x92e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x0cu;\\x86\\xbe\\xc7\\x14h\\xf8\\x89\\xa0k\\xe4\\xbf\\x036\\xd6\\x0f\\xd8\\xe3\\xa9\\x04k\\x87z>9\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3e\\xe8\\xf6\\xecz\\x98\\xcc\\xbb\\xa5\\x0f\\x914\\xa6\\x00k\\xa5\\x88\\xa5\\xa6\\xa7t\\xd4\\x82\\xb2\\xa4\\xcd\\x98`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xf4\\xb9\\x93\\xb5\\xd3|r\\x1c\n\\xbe\\xca\\x0f1\\xa5&n\\x99c\ro \\x9amkrd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3y\\xd3\\x08~)\\xea\\x13\\xf4\\x0f\\xca9\\xc9\\x10\\xfc\\xb3\\x11\\x8f\\x93a;\\x95n\\xce\\x84\\xe7\\x13n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3<\\x81\\x88ivn3\\x1f\\xaaq\\xbc\\xbd\\xa3#\\x8f-\\xc6r\\xde\\xaahi\\x0e\\x7fn\\xfc\\x07\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x94\\x98\\xc1\\x90\\xe6\\x86\n\\x8b=\\xb0xn/\\xd5\\x97'o\\x11p|\\xa2\\xeb\\xa9+\\xee\\x8bes\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc31\\x91\\xd5\\x06\\x9a!j`\\x9d\\xfb\\xc6\\xffwnnr\\xb7\\xec\\x04\\xe3\\x96\n\\xff!x\\xd3\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x03\\xc5\\x0b\\xb2\\x88\\x1e\\xf3\\x167\\xcd3\\xaf\\xb7$\\x0fd\\x16\\xda\\x19\\xd8e\\xba\\xc5\\x0f\\xe6t\\x906\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x9a.s\\xe6\\x7f\\xa7\\xf0\\xb7\\x85\\x8ce\\xd6\\x87p\\x7f\\x11h\t\\xdf\\xf3\\xc3&\\x82\\x93\\x94\\xfd\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3w\\xb8!\\xc5i\\x91j\\x85f\\xfa\\x05\\x8c\\xf6\\xedsp\\x15%\\x88\\x816e\\xa6:'\\x8ez\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3~\\xc5\\xd6f\\xd0\\xac\\x84<?\\x1ez\\xb1\\x9d\\x82\\x1ak\\x17z\\x93?f\\xee\\xdc\\x17\\xcb\\xfbj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x87x\\xda\\xa9\\x8ax5\\xc3s\\x07\\xcf\\x0b\\xb4p\\xf9\\xcc\\xc0\\xe58\\x98\\x9e\\xfau\\xf5\\xac\\x1c\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3o\\xf0k\\x81\\xc8\\xf7x6#\\x8b\\x16\\x8b\\x15\\x0b\\x0f\\xe7\\x14^\\x8f\\x00\\x940\\x9b;\\x1fhx'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xfaq\\x16x\\xc0\\x1f\\xfa\\xe6\\xd1\\xdbo\\xc8@\\x99\\xcb\\xeb)\\xc2>\\xcf\\x9f\\x97(\\xdea\"\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3h\\xec\\xc6a\\xfb\\xb4\\x02i2\\x88fy\\xc8+\"\\xb4\\xba\\x0e/q\\xa5na\\xb45whh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x95\\x9a\\x1c3\\x9c)\\xf7\\x1b\\xa89t\\x13;\\xd6\\xf1$\\xd2\\xbet\\xfda\\x89\\x8e\\xb6\\xb2\\xe9\\xfa\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17,\\x88\\xc8\\xe5\\x8f=\\xebk\\xdc\\xbb\\xe2\\xa44.\\xf8\\xddp\\xd4&d\\x0ck\\x14\\xcf\\x95x\\xb9\\xc2\\xf5y>mg\\xf4c9\\x0b\\xa8\\x17\\xe7n\\xc6\\x07\n\\xde\\x19\\x99,i\\x93\\xb5^\\xd6\\x82\\x9d\\xa2\\x17\\xca\\xadz\\x0c\\x84\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b0\\xa5y\\x9a\\xdbau\\x01\\xa1\\x86\\xcd\\xc0\\xe4|;\\x91%\\x91\\x1dm\\xc6\"#\\x06\\xc3\\xa8r\\xce\\xb4&ypz\\x154\\x8f\\xf5\\xae\\x80k\\xfc\\xc7i\\xeb\\xe4\\x13"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3r\\x98\\xa44a\\xb9\\xdd+n\\xd1<r\\xaf\\xf8^\t\\xc9<\\xaa\\x0e\\x8d\\xa5\\xd0\\x95\\x9b\\x96\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9b\\x16\\xeb\\xcb$\"jr+\\xca\\x97\\x1f3\\xb1\\xc1\\xfb\\x10\\x9e\\x86\\xdb\\xb9\\xc5f\\xc22\\xa7\\xc9)\\x92\\xa1_7t\\xdf\\xd9\\x96\\xc91\\xa6f\\xd7\\xc7\\xde\\xc5\\x12\\xa1y^r\\xde\\x00\\xf3\\xe2\\x9c\\xb9k\\xeb\\xa3\\x84\\x98\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\xa4\\xdef\\xbe\\x05_\\x1a\\x8a\\x11\\xf5\\xaf\\xa4^\\x10\\x9a\\xe4\\xac\\x0b3\\x07\\xee\\xa9pv\\xf3\\xe1j\\xc4ry?\\xd3\\x97gk!\\xe9\\x83d\\xe7\\xbb\\xc3\\xccry\\xbb\\xaf"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h?\\xed2\\xf2<k\\xa8\\xa7\\xd4\\xcf\\xb3\\x91\\xad\\x8d/bj#\\x1f<\\xc0\\xf9\\xd5\\xe0\\x979\\x90$\\xad\\xfd\\x87\\x1a\\xd0\\xeez\\x05\\xd5\\xbb\\xa3\\x8c\\x1a\\x03\\xa5\\x18\\x0cl\\xb1a\\x13\\x88\\xff\\xff\\x98g\\xfa6\\xf9\\xb3\\xdf\\x99`\\x15\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82v\\xc8\\x15d6\\xfe+q\\x968g\\xd3\\x9b\\x0f\\x03yf\\x93\\xf2\\s\\xf1\\x93\\x9a\\xbb\\x1ctxc\\x19\\xbd\\x08\\xb9*\\x01\\x12\\xdb|\\xf4\\xf1\\x19*\\x13\\x01\\xcfm"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07y\\xcb\\xae\\x9e\\xbf\"\\xfc\r\\x11\\xf6\\xd2\\xbb\\xa8t!\\x08h=;\\xc7\\x9b\\xdbq\\x14\\xcd\\x07j\\x86\\xb1\\x86\\xce\\xfa&\\x97h\\xa4d\\xf9^\\xc7\\xd8\\x8a\\x05;\\xb3@\\x04\\xe8\\xd5\\x04~\\xf7q\\x91<\\x9c\\xd4\\xe0\\x14\\xfe\\xd6\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\xcc\\x0e\\xe9\\x8d\\xe3\\xedk\\xfc7\\xf0\\xe9\\xad\\xb0`\\xc2\\x14\\xb1\\xfc\\xff\\xed\\x96&g\\x83wr\\xab6\\xaa\\xc5\\x7f\\xa8\\xa1\\x8f1\\xb3s\\xd5u\\xbcp\\xfe\\xb4\\xe6\\x8b\\xa9"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef\\x81bo\\x19\\xeay\\xe2\\x81\\xa6\\x92a\\xea\\x99\\x8e\\xc8\\x0b\\x84\\x92|\\xae`q\\xcf7m\\xa0\\xd4\\xd1\\xd1\\xb5\\xb89dljk$\\xb1\\x98\\x95\\x8e\\x8d\\xa1;dg\\x19\\xcbpuv\\x06\\x9b?pb\\x87t\\xe2\\xff\\xf6b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t/\\x9b\\xd9\\x8e|\\xc9\\x1fm\\xd0m\\xe8\\x1f\\x8c\\x1d\\xd2\\x17*\\xca\\x9f\\xcan@\\xdb\\x0c\\xaaa%d\r\\x8br~\\xe9\\xc6j\\xee\\x1a.\\x88\\x02w\\x84)r\\xd8\\xf3f"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaat\\x9f\\x18\r\\x8dbh\\x90\\xbdgg\\xd9\\xb1p\\xb4\\x06\\\\xaf=\\xe5\\\\x82\\xad\\xb2\\xfd\\x1e\\x16\\xc5s\\xe7\\x1b\\x98v\\xadl\\xe4*\\x13\\xdf\\xe7n\\xe9\\xdff/\\xc2\\xe3\\xc7i\\xe8\\xd1!t\\x03;\\xe1q\\mrwl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\x95s\\xb43\\xf1s0\\xd3t\\xe0cj\\x90\\x0c\\xab\\x00o\\x12\\xb6e=f\\xc1\\xb9\\x99y\\xd6y\\x19\\xead\\xf2\\xdb\\xbc:n\\xa7i\\x16i\\xd0\\x83\tl\\xb3\\xb7"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xe3?w\\xd7t\n\\xa8\\x99\\xdc\\xb6\\xef\\x1d@\\xc1\\xa1#>v\\x1fz\\xbb\\x8ck&o*i\\x11?\\xb0\\xdf\\x10\\xe4\\x8fi\\x8em\\x8d\\xafx\\x85\\xe0<\\xa46d86\\xb5.\\x8ao\\x13\\x18z\\xc9\\xccd\\xbe\\x8c\\xbd\\xd48\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98y\\xf4\\xff\\xa1\\xeb\\xef\\xfeyd\\x95\t\\x8a\\xc9\\xc1\\x1e:d\\xeeu\\xc6,\\xf7?\\x00\\xf7\\x88i\\5\\xbb\\x06\\x9d\\xe5\\x7f>a\t|y\\x872\\xb2lu\\x10"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06\\x8ec!\\\\x90\\xbd\\xbb\\xf2@ue\n\\xc6\\xf2\\x87v\\x1d\\xfe\\xd5\\x80\\xc2b\\xaa\\xa7^\\xf6\\xf1\\xd7\\x9c\\x9b<\\xd2jvx^\\xef&\\xf7>9<\\x9f\\x91\\x8c\\xe6sr\\x8d0q$\\xb9g\\x1e\\xf2\\xdc\\x027f\\xb9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\xa9\\xa1h\\xa3\\x92\\xa5\\xea\\x06@~\\xc1\\xb0c\\x97\\x00\\xe8\\xec\\xe3o\\xa4#\\xec\\xdd\\x9dy/,\\x8bp \\xc1q\\x1d\\xa7\\x1d`b\\xab\\xd2\\xc1 \\x1e#\\xaf\\x82\\xbd\\xe4"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c%\\xd0\\x04c%\\xa5\\xa1\\xe7\\xac\\xdf\\xfa2\\x98a\\x02\\xb4f\\x05u!\\xec\\xef\\xd0\\xfa\\xb6\\xfet\\x86\\xf0m>\\xb2n~\"\\x19\\x85\\xa8\\xb4yt\\x83\\x87^k\\x88y\\xb4\\x91w\\x94\\x15-\\x00\\x0f\\xeb\\xf7\\x8bv6\\x15\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xe3\r\\\\xdf\\xaf\\xb9\\x0f\\x80\\x17\\xf9\\xc03\\xfer;\\x01\\xf1\\x9f\\x85w\\xdc\\xc3\\x94k\\x11\\xad|\\xda\\x99\\xc8p\\xbd\\xef\\xfd>\\xc7m\\x0b\\x0e\\x9e\\xc07\\x8d\\xae\\xf4\\x88"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85\\xda\\x01\\x85$ss\\x87\\x14\\xd4r\\xb9\\xf2\\xaf\\xb2\\xfe\\xbd5\\x1c\\x9e%j8|\\x89\\xcf\\xbd\\xb6\\xa8\\x01\\x86n\\xbd\\x1f\\x88\\xae\\x93\\x94~f(\\xaf\\xec\\x89\\xe5n\\xc9\\x1d\\xfcx\\xd7\\xe6\\xa6\\x12\\x8e\\xdc\\x0fnu\\xf1ofu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(\\x949\\xc5\\xdc\\xea|\\x9a\\xc9g\\xc9\\xd7\\xb4lq\\xca\\x90o\\xe6j\\x082\\x17\\x0f\\xbaq\\xc1,6\\xa1:\\xd6t\\xa1\\xf7n\\x81e\\x040\\x8d\\xc1\\xd9\\x02h\\x8c\\xd1"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04da\\x98\\x13\\x93\\x17\\xe5\\xf0s\\x11\\x1d\\x7f\\x996c\\xa0\\xe1z\\xcd\\x11\\xe0\\xa4?\\xddyr$\\x8b\\x88\\xf8\\xc1\\x94n\\xa8\\x1a\\xd3\\xb7n\\x08\\x8a\\xfd$\\xd3cb\\x138\\xa2|\\x86\\x02\\x15\\x06u\\xddi\\xa4\\x90\\x92\\xe1\\x8c\\x91\\xc4\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3\\xe92\\x85\\x1c\\xfb\\xcf\\xa5#\\xc7\\xe4l\n\\x13\\xef\\x84\\xf6\\xd9a\\x10\\xe8\\xe5\\x9f\\x9c<\\xc1\\x01\\x91\\xd5\\x89 j?u\\x8cz\\xf9;\\x13\\xac\\xd7\\x19\\xa8>\\xae\\xe2\\xa3"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8p`\\xeao\\xdbz\\x16\\xf0\\x9f\\xf4\\x94\\xe5\\xa84\\xb5\\x07c\\xb1\\x98'\\xd6+\\x8f\\xf4i\\x83\\xe9\\xb3\\xd7u\\x0c\\xad6\\xa8\\xce\\xe7\\xe7\\xd5\\x9e\\x0c\\x8e5\\x07\\xf6g\\x12\\x1dh\\xa7f\\xef\"\\x1b\\x0f\\xb6\\xae%`\\xf4$\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xf0@\\xaf\\xaee\\xbaio\\x94k\\x18\\xd4\\xeb\t\\x04\\xd56\\xc1/efz\\xa3&\\x93$1\\xe8\\x82\\x93j\\x908\\x18r\\x9d/p\\xb9\\xa7\\xaa\\xd0q\rfqf"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xec\\x8f\\xac\\xeb\\xe7>\\xdaa\\xcd\\x82,\\x92\\xfd\\x08\\xfc\\xc6?$%w\\x819\\x9b\\x07\\xc1i6\\x9a\\xbdg(\\xab\\x82/\\x1b7\\xe1\\xe6\\x95\\x06\\x9e$\\x86j\\x9d?\\x9fw\\xbd\\x81\\xcd\\xb6\\x16\\xfe\\xf7\\xa8/\\xe7\\xa1\\x0c\\xf7\\x12\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9)q\\x83\\x94\\xfe\\xbb\\xd0\\x93\\xda\\xc1\\xe4\\xb3\\xa0\\xc5)\\xb3\t(\\xe2\\x84\\xb7?\\x99\t\\x96(\\x12\\x82/\\xbb\\x04\\x8b\\x82c\\xebc\\x1f\\xd1\\x947\\x84g\\xea\\xf4\\x80\r"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04fs\\xf9\\x95s0y\\xff\\xc6\\x8b_z\\xc4\\x00jz\\x8c\\x01\\x80\\xf4ag\\xcb\\x8e\\xaf\\x9f\\xd2\\xfcy\\xbb\\x86l\\x0b\\xddk\\xd0\\x13\"\\xef\\x16\\xd0\\xa6\\xdf\\x90\\x19:\t\\xd7u\\xa2 #\\xd8g\\xd5\\x12u\\x17&\\xc4j!y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\r\\xec\\x84\\xfdd\\xb5\\xe9\\xf7\\x02\\x17v\\xd4m\\x1a\\x1c\\xfc\\x02\\xa4\\x7f\n\\x0b\\xea\\x9d\\x06\\xe6wm\\xd0\\xebr\\x14r\\xa2_<s/w\\xb9u\\x0cq\\xb7 \\x14\"\\x14"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\x9d\\xe9\\xe4\\x7fg\\x95\\xb8\\xf6\\x98)\\x17t\\x89\\x1e\\x8f\\x17\\xc0\\xd9\\x0cq\\xbf\\xde\\xa1\\xf0\\xb0i\\xf2f\\x9dn\\xc0\\xefq\\x83k&2_\\xddo\\xcf\\x03/#\\x97n\t\\xb2\\xe3#t\\xf0\\xd2\\xc6\\x81\\xd6\\x17\\xc2\\x19f\\xdb\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\xd0\\xed\\xb9\\xb1c`w!_)(\\x8d\\xa8-\\xda\\x13\\x18\\xb3\\x87\\xf2\\xd4\\xbc\\xab;u\\x9dof\\xce6c9\\xe0\\xe2c\\xb2u\\x1a\\xce\\x8aj;\\xaa\\xe7\\xcer\\xa6"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x0481\\xf6>&\\xcd\\x1e\\x0c\\x8cu\\xb3(p\\x05\\xca\n\\xa1(c\\xce\\xf4q\\xc3\\xa0\\xac\\\\xa1\\x8e\\x9c#w\\xb3\\xa9\\xbd\\xca\\xb5\\xbe\\xcedyf\\xdc/\\x8f\\x150\\\\x832\\x1d\\x04\\xa8\\xcd\\xdc\\xcb\\xd3\\xf9\\xc0\\x8ey;t\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xcc\\xa2\\xfa^\\x1fv-\\x89\\xa4:\\xa9\\xe7f\\xd3\\xfb\\xdel@\\x06m\\x9c\\xdf\\x88\\x17\\x9015\\xeao\\x89\\x9c\\x01g\\x9f:c\\xa5\\xa9`0\\x82f\\xc8\\xa9g\\x8b\\x80"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#$\\x17\\xce\\x9a2+|u\\xd6\\x84\\xd3\\x99\\x00\\x18\\xb6\\x89 \\xf40#!?;\\x0b#0w=@\\xa7\\x95\\xd9\\xc7d\\x0ez;\\x90\\x87m\\x92l\n\\x06\\x9e\\x85)\\x9c;\"b\\xca\\xe7y\\x0cc\\xb8\\x17cd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.p\\xb1\\xaen\\xec\\xa7\\xacpj\\xe9\\x97\\xbcyy\\xcd\\xbc\\xf0\\xf3\\xf7\\x19\\xd5\\x9d\\xac\\xf5\\xbb\\xc4\\xf3\\xd3\\x02\\xa7\\xe6?v\\xc6\\xee\\x93\\x81\\xa5\\x99\\xdf?\\xffg\\xe7s"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xff\\xc9\\x01)u\\xc5\\xdd;o\\x07\\x93\\xd7\\x08\\x7f\\xbf\tc\\x1d\\x15(\\xa3y\\x90\\xfb`)r\\xe86\\x1f\\xbe\\xf7\\xb0\\xbb^*\\xb6\\xb8\n\\xb5\\xc2\\x004\\xfe\\x95;\\xc8\\x93y\\xe8+k\\xc3v\\xdak\\x93|d)\\xec\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\x82|\\xce\\x0f\\x9a\\xf1\\x18\\x81\\x85\\x12'\\xdb_\\x89 \\xa7\\x88\\x1b\\xa9\\x13\\x9e\\x11#\\x8d\\x8a\\xbd\\xcezh\\x8c\\xb3!\\xbdl\\xf9\\x8e\\xbc\\xfe\\x85\\xa1\n\\x94\\x89\\xdc\\x90y"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x81\\x1d\\xf9\\xe4\\x95\\xbd\\xa2\\x15\\xf0\\xbc\\xaf\\x18\\xfb\\x9a`/e\\x88y\\x90`y/\\x93\\xcd\\x86\\x81n\\xf7c\\x1b3\\xbap\r\\xd1a\\xd0\\x84(\\x11\\xe2\\xf7#\\x03,\\xc0#q\\x1a\\xd4?\\xee\\x1a\\xb4:\\xealz\\x96g;\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1o:l\\x9b\\xb1\\x11\\xa2\\x14z\\xe7\\xae\\xd9\\xcd\\xd6f\\x06\\xc3\\x1d\\x01r\\xda\\x08\\xbbod9\\xe2\\xc7\\xa0\\xec\\x12\\xc9z6\\xe9sc\\xb69!rf\\xf8\\xeac\\xddn"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xfa\\xe9h\\x90\\x98\\xbf\\x05\\xcf\\xf1\\x98u\\xfdz\\xd1a\\xea\\xf0r\\xdf\\x7f\\xff\\xd0r\\x12y\\x07\\x95\\xc1z\\x8aok\\x12\\xb8_;\\xb0\\x8d\\x0bs\\x1a)\\xc8.\\x83\\xf3\\xc0\\xf1hd\\x08\\x80\\xb2^\\xfd\\xb3)d\\xb8\\xab\\xf11=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nle\\xec\\xaed8ai\\xa5\\x0f\\xf4\\x1f\\xea\\x1e\\x87v6\\xe7\\x02\\xea\t\\xf0l+u\\xbc\\xc2\\xc2.l\\xee\\xad\\xa5\\xf0\\xc4\\xd1\\xf2lb\\x89\\x84\\xef\\xfd\\x13\\x00\\xc3"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041f\\xa1\\xb0\\xf9\\xf7\\xb1\\xc9\\x95\\x88#\\xf6u5\\x14\\xd2\\x14\\xec\\xd6\\x81\\xa0\\xa7ok\\x99\\x9e\\xbd\\xe6\\x0ev31\\x16\\x83y\"\\x0c4~t\\xa8\\xf2rk-\\x02\\xcf\\xf8\\x1doq\\xc5\\xea\\xd0h-\\xedwd\\x07\\xc2g\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xcb\\xc5\\xff5k>!s\\xe1\\xebb\\x19\\xdb\\xe4\\xb9\\xa9%\\x90f)\\xcch\\xa8\\xfe\\xca\\x1b\r\\xbd36\\xf4c\\x122&\\x9b4\\xcf)\\xdc\\x111\\x890-zh"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04dr\\xaf\\x8a\\xb9\\xd9f\\xff\\xc9\\xf5m_\\xd6\\xf2\\x85m\\xca\\xc0\\xd1\\x9c\\x1a\\xd0\\xb8\\xa9\\xa0i\\xe3\\xbd)|hr\\xa0j\\x146\\xb65\\x92\\x13n\\xbd\\x0f\\xe64\\x12\\xf3\\x980>\\xc6\\x04\\xaf\\xa2\\x86\\xbfk\\x9b\\xa0\\xee\\xa9\\xf1\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\xd0\\xce\\xcd\\xab\\xbd\\xf6\\x7f\\xc9\\x81\\xe2'\t?cc\\xb6eg\\xe6ib(@q\\xac\\xf6(\\x1ar\\x8a\\xab\\x8e\\xab\\xc8r\\xc1\\x91\\x19\\xabb@\\x92\\xd7\\xe2\\xf0e\\xe7"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5o~\\x8c-\\xe7\\xca\\xcf\\xd2\\x1a>\\x14\\xb2\\xa0s/bd\\xef\\x9a#j\\x17\\x17\\xaet\\x18\\xccr&\\xed\\x91p_\\x1f\\x8bw\\xca\\x15*\\x7f_\r\\x88\\xb3\\xa8\\x0bh\\xfc\\xd8\\xa4\\x80/\\x89\\xe7\\xf94\\x03@\\xf0+\\x16*\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93s\\x1d\\x91\\x83rm\\x82\\xc8\\x88x~\\xf1k\\x9e4\\xd5\\xe9\\xc3\\x17\\xc1nm\\xbe\\xcb\\xfd \\x1f\\xb0\\xe3\\xcf\\xa3\\x8b\\x1cu\\xc7\\x98\\xf8\\x97\\xc5\\x95\\x101s\\x99\\xee\\xda"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>8\\x96\\xeab\\x1d\\xc6=\\x94\\xe3\\x87\\x91\\xd1kptj\\x04r\\xda\\x93h\\x1f\\x8a9\\x11\\xf7^\\x906s\\x1a\\xcf\\xb5\\x08\\x9f\\xaa\\xe6|\\xa6\\xff\\x12\\xf6\\xa5`)\\x9d\\x08\\xa0\\xee\\xb1\\x1dho\\6)4\\x99\\x8eyz\\xef6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xfa\\x9bk\\x80\\xf5\\xf2^j\\x9c\\xa9<\\xa8b\\x8f\\xf9\\x9d\\xc1\\xb7pd\\x959\\xa9\\xad\\x1c\\x83\\x8fp\\xf5qq\\xa9\\xa7'&\\x04m\\xb7\\xc7\\xa5\\xad\\x19\\xf8x\\xa2"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xa9\\x1c\\x13\\x9f\\xc4,+fi\\xf1\\x81g\\xd3\\x04\\xf4\\x99\\xb7\\xf61sjx\\xc0\\x8ak\\x7f\\xbd\\xb9\\xd5\\xc9u\\xe2\\x11lw\\x8b\\xfa\\x1e\\xe6\\xc1\n\\xdb\\x11/\\xd3\t:'e\\x1f\\xa9\\x1bx\\xf1\\x0f\\xb4\\x9f\\xd3*/\\xf5d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xbb\\x89\\xd6\\xc3\\x17\\xb0ldi\\x86c\n\\x84f^\\xac`-/<kk\\xe00j\\xc0\\xf3\\xb2\\x04\\xdar\\x8d\\x9a\\xdab\\xb9h\\xa4\\x88\\xf2\\xd6\\x9d\\xef\\x08^\\xfd\\xb4"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3km\\x81p\\xff|\\xb1\\xad\\x9e\\xf6\\x1b\\xcb\\xf5:\\x93\\x8a\\x8b\\xaa\\x0f\\xc2o\\xa3x\\xe7\\xbaw\\xd3f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc39\\x13\\x84ze^\\xfb\\x18g\\xd9\\x19i\\xbd\\x0b6m,\\x01\\x80\\x10\\xc91\\x96i.\\xaf\\x8f\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3v\\x8d\\xb4\\xa0in\\x06\\x82\\x855\\xbf\\x88\\xe6\\xb0j\\x95#>g\\xee\\x1eik\\xad\\x7f\\x81y\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3k\\x0euy\\x94m\\x1e\\xc5\\xb0\\xc6\\xc9\\xaf\\xbde\\x1a_5\\xe8\n\\xa7\\xec\\xdd\\xc88\\x1e\\xc4\\xcdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xab\\xea\\xf2yg>\\x80\\x97\\xc8u\\x19\\xf0\\xde\\xcf\\x99u\\x1d\\x9f.v\\x81\\xf1.,\\x17\\x8d\\xb4\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x87\\x8dow\\x11\t*\\x80\\xf4'\\xc0\\xdd\\xf2f*g\\x8e`s\\\\x15x\\xd8\\xf0\\xdb\\x82/\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xc0)\\x92\\xb6u\\xd5\\xac\\xc4\\xea\\xf0^\\xe1\\x1d\\xa3r\\xc7\\xac\t0\\x18\\x9e\\x04\\x05hsu\\x99\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\x848\\x05\\xde\\x14\\xf0\\xed*\\xa5:\\xd5if\\xe5o\\xaa%,\\xefc\\x0e\\xd9\\x19\\xe4i\\x8fv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3m/\\x15b#\\x02\\xda\\x81\\xa7\\xe4\\x0fd\\xb3~\\x07\\x00=\\xee\\xed\\x04\\xe1sy;\\xe7\\xbd\n\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\x1c\\xc3\\xae+\\xde\\xa6\\x0b\\xfat\\xa7\\xe8\\xd85\\x93g\\xe3\\xb52\\x04(k\\xae\\x0f\\xaep\\xb1\\xc0\\xf7\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xe6\\x82\\xe4\\xa6\\x93%\\xbc\\x9c^\\xdb\\xfcz\\xb8\\xa4#>zo:\\x00\\x81\\x12\\x9e\\x92\\x9fsr\\xf9\\xa1\\x82(\\x0b\\xe8\\xb69z\\xa4\\x10\\xba\\x1faa\\xc8\\xbd\\xa9\\xb4\\xb47n\\xf8%\\x173\\xe0\\xa6\\xfe\\xe2\\x90\\xb7y4\\xc7\\xf1\\xa1q\\xf7n\\x06\\\\xaa\\xa3\\xf5\nn\\xc9\\xe7\\x9c\\xcb\\xc72i6 l\\xa2\\x8b\\xa0\nn\\x9f\\x062\\xe28\\xfex\\xd1\\x93\\xde&at\\xc2)\\x8fv\\x07\\xc7\\x07-+1\\xfe.*z\\x93\\xe1\\xd3\\x82\\x9d\\xcc\\xe87z\\xb7\\x19\\xc1\\x80e\\xf0\\xaa`l\\x8efn\\xd4mo\\xc2\\xa9/\\xb7s-\\x1fm\\xac\\x88l%\\x86,\\xcb*\\xb9y\\x8c\\xf4\\x04\\xeb\rg)\\xb5\\x0b~\\xdd\\x12`\\xce*r\\xf2\\xeb\\x1cj\\xbc``\\xe7\\xf4\\x94\\xf4\\xe3\\x94\\xf9|\\xec\\x13\\x8bp\\x7f\\xee*\\xfe\\x01m\\xa6\\x16j\\xf2\\xd5\\xcb\\x96\\x92s\\xcc\\xcf\\xb0\\xdcr\\x18r\\xd1\\xe9\\xf9\\xca\\xed\\xa4k\\xf6\\xe7$\\xc9'\\xa5 \\xebi\\xd6\\xfd\\xb5\\x89\n\\xa7\\xbc\\x80\\x16\\xc0\\xab\\xad\\xbe\\x90\\xda"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\x81-\\x83\\xfd\\x84\\xa1\\x85g\\xf23\\xe5\\xc2\"\\xff1\\xc9\\x96\ni\\xf1\\xd6lfiw\\x12\\xfd!\\x7f\"\\xcet\\xf7\\xcbg\\xa9q\\x01?k\\xbfa\\xc3\\x03p\\xc8\\xe6w8hk\\x00h\\x10o\\xfe\\x9ci6\\x13e\\xb0\\xac\\x04>@:w\\\\x9e\\xb6x\\x18\\xbdyu\\x9a\\xb25\\xca\\x13\\x97,\\xd9\\x90lxm\\xbd7~hv\\xf9\\x00<'f\\xeb\\x87\\xbf\\xf6\\xdc\\x88q\\xd6y\\xca(\\x85\\xe5\\x95\\xa2+\\xcc\\x9fzll\\xd2\\xf8\\xb0\\xdf\\xdf\\xad\\x11\\x19zs\\x1b\\xac\\xdck\\x93\\xfb\\xd0^\\xb6\\x86\\x0eb1\\x7f\\x0cv\\x84\\xdeu\\x8a\\xa3l\\xdd,?s\\x07e\\x8dk\\xe1\\xe5rc\\xe3i)--\\xe5\\xc0\\xd5\"\\xd4qo\\x11i#\\x9dw37\\xc3-\\xa9\\xd3k\\x9c\\xb361\\xd3\\xb2\\xe0\\x12\\xa3z\\xd1\\xda\\x12\\xe2\\x986\\x1e\\x99\\xf1/\\xd5\\xca(\\xbe\\x94\\xd2@\\xb1\\xd6v\\xde\\xa9l\\xffa;c\\\\x15\\xe4d\\xbb\\x85\\x97_i\\x84\\xe5\\xb7\\x07v\\x15\\xc3|\\xeb\\x96ie+\\xba\\x9c"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\xea\\xac\\x8bv\\xd3\\x85g\\x18\\xae\\xf4i\\xed\\x90\\xd9\\x1f3e\\xe9\\xe0k\\x110\\x1d\\xf9\\x95\\xf7\\xbe3f\\xfb\\xea$l*_\\x18\\xb8*\\x0b\\xce\\xfed7\\xee\\xb1\\xf0\\x11\\x9a~1ns_\\xfef\\xab\\x8e\\xd6\\x0e\\xe1\\xde\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10&\\xf9\\xac\\x1a;7\r\\xf0\\xec\\x86\\x9ec\\x1d~\\xcb\\xe8\\x19\\xc20\\x12f\\x85\\xfd\\x15\\xf6^\\x1d\t\\xc3\\x16d\\xcf\\xef\\x9fu\\xa4\\x90\\xe3\\xa1\\xb6^\\x8avo6@"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2\\xc3%.u\\xd1y\\x90\\xbd\\xfd\\x11\\xfc\\x1b;\\x1c@\\x1f\\xa4\\x88\\xa4c:\\xb5\\x8d9\\xf2\\xe9%\\xc6h)\\xe4\\xb9`\\xf2\\x95\\xff;\\xec\\xb4#\tdf\\x9d?wf?\\xcb\\xa7w6\\xfe\\xa1g\\xc0gff\\x1b\\x14\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\x04\\xacx\\x0f\\x0c\\xe1\\xcf\\x07\\x8a\\x1c\\xd1\\x1at1q\\x8dr\\x91e\\xd8\\xa1\\x0e\\x84(9g\\xf3\\xe3\\xc4\\x80f\\xd7\\xc2h\\xbe\\x1ah\\xd5\\x9a\\xdf5\\xd9:\\x9e\\xb1a\\x94"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99,\\xca\\xce\\xf7\\xc6\\xfc7\\x00\\xaf\\xb1ef\\xe1\\xf6\\x15\\x93o\\xbd\\x7f\\xed\\xa0\\xf4\\xa7\\xec\\xd5\\x81\\x9f\\x8c\\xfd\\x7f%\\x19\\x17\\xf5\\x92l\\xe8\\xd3\\xd9\\xfc\\x1f\\xd2\\xd5\\x8d\\xc1r\\xb46e\\xd4\\x97\\x06\\x02\\xd4\\xe8jz\\x81\\x9bw.\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x83\\xcd\\x8d\\x18\\x1c\\x90\\x86\\x10|:o\\x85~xmb\\x10\\xe6\\xc2\\xea\\x87\\xa8\\xa9i\\x11\\x10\\xa1\\x1e\\xe2\\xda>\\x93`\n\\xfe?#\\xba\\xc0\\xec\\x11^\\xe4\\xe1\\x82"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xdc\\xc1\\xcb\\xcd\\x0f\\x81\\x85+\\xdb\\x97\\x17x,\\x10_\\xd1\\xffz\\x81\\xa9`\\xfe\\xa93o\\xa0|\\xe8\\x9e\\x88\\xeb\\x00\\x85\\x00\\x1c\\xb6\\xda\\xae\\xad\\xa9\\xe9j\\x05\\x95\\xf9c\\x90z\\x7f\\xa4\\xeb\\xe9\\xcd\\xef\\x87k\\xa2\\xf9\\x19\\x86\\x83\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5\\xd5\\x9fm\\xd3a\\xf1\\x0591\\x89\\xf3=l\\xd5\\x1d\\x88\\x1a\\xcd\\x88\\xfa\\xc5\\xbb\\xb3@h\\x82\\xf1<a\\xe9\\x06\\xc2^\\xb7\\x93\\xbbkc\\xa5\\xc3\\xd6\\xb1 +\\xb7@^"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04bh\\x8b\\xe34`\\xf8%+\\x1f\\xf2t\\xcc\\x10a\\xb7t\\x13\\x8a\\xf27\\xf8@g\\x1d8\\xed,\\x85\\xc9*\\x06\\xe0\\x17@\\xb1\\xa9g\\xa8\\xc0\\xe4\\xcf\\x9c\\xd7\\x85d`%\\xff\\x03z\\x02\\xce\\xe2y\\x87\\xad\\x03w\\xeao\\xedn\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdo\\xa1\\xf2\t\\x9f\\xee\\xa9\\x16\\x1f\\xc6\\xc1\\xa0\\x86\\xb0\\xb6\\xf9\\xb9\\xc4z\\xa7c\\xac\\xef\\x84\\xcb\\x038\\x9c\\xef\\x0c\\xddy\\xbd\\x0c\\x9f\\x88\\x8a\rv\\x17\\xa7h\\xa2\\xddok\t"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xefi\\x8c\\x7f\\xf4\\x82.\\xfd\\xab\\x97\\xe1\\xdd\tx#\\x823e\\xa4l\\x86zq\\x15\\xcf\\xc7\\xa0\\xc8\\x0f\na/p\\x88\\x1bbr?\\x18\\xd9m\\xc0\\x88\\xffi\\x95\\xfe\\xaak\\xfa\\x9bn>\\xcd\\xe7k\\xba\\xda\\xb2ez\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f\\x1a\\x1d\\xe2\\xf6\\x9e\\xe2\\xcb\\x976\\xdc\\xc3\\xc5\\xafk\\xa7|\\x12kx\\xa4\\xa8i\\xb2\\x92t\\xff\\x14\\xc2\\xc4\\x8ev\\xa3\\xf9\\xec*\\x92\\xcf\\xc7\\xe5t\\x1bo\\xd9\\x80#\\x89"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\"\\xe2u\\x8ax\\xa0\\x14a\\xad\\xf0ym\\xe5\\x08'#\\xf5\\xd4rn\\xc9\\xffw\\x9fc\\x90~\\xaf3j\\x9a-\\xca\\xf0\\x91\\xff\\x95$>\\xe4\\x12w\\xd4\\x12\\xdb\\xcc\\xf4e\\xc3\\xab\\xa6e\\xbb\\x04\\xc9\\xf7\\xfe\r\\x17c>\\x01\\xbdb\\xf3c\\x9e\\x1e\\xdbauno\\x15\\xc9h\\x96\\xda\\xac\\xfb\\x83\"e\\xb1\\xf6\\xb7\\xc1\\xcd\\x83l<n!\\xc0v\\x0cj8_\\x10ry\\xb4\\x0e:\\xc8\\x95\\xafz\\xd6\\xb9e\\xa7\\xc4\\x97\\x8b\\x7fj:\\x08\\xa8\\xbf\\xeb\\xc5\\xb11\\x14\\xdf=\\xfc@\\xc9\\x88wt\\x8eh\n\\xfd\\xe1\\xa5\\x9b\\xb8\\xb9\\x80\\x9c\\x03<\\xb0\\xee\\xf1\\x92j\\xfe\\xdd\\xa5\\x0c\\xcca\\x99@j*i\\x98\\xde\\xe2\\x82\\xea\\x88\\x1c\\xcb\\x92\\x98\\xcb\\xe3\\xebs\\x90\\x19\\x1f\\xf2+\\xbf\\x01\\x04\\xc7\\xcduu\\x9d\\xcb\\x90q\\xab`\\xa3~\\xdd\\xe3\\xedj\\x84\\xb4\\xcfd\\xd2/\\x18\\xa0\\xd3\\x8d\\xaa\\xd6\\xafyb\\xea\\x05*\n\\x9au\\xa8kyj\\xf0\\x93\\x14=%\\xfa\\xe0\\xbe\\xc4k!`\\x02\\xd3q\\x911\\x8f\\xc5"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xf1g\\xf8\\xda\\xc6?\\xbe\\x0b\\x86\\xd8\\xce\\xa57\\x1c;\\xbb\\x96@\\xf9q\\x1cc\"\\x9b\\x01\\x01\\xc1\\x85\\x1c#\\xf8\\xb2a\\x9a\\x11\\xe5\\xf7\\x88i\\xe5\\x1fz\\xae\\x0cu\\xee*@\\xda\\x15\\x93\\xaf,\\xcc\\xdc\\x87\\xe5t\\xe9\\xf1 \\x17\n\\xf7n\\x865g\\xec.\n\\x00b\\xd0cys\\xd4\\xc7\\x9f\t\\xb4\\xc0\t\\x1e\\xc0\\xa1r\\x10\\xf5\\xa8\\x05x|\\x9c\\xc8\\xb0\\xcd\\xef\\x8f\\xac\\x87\\xc7\\x81v\\x84%\\xe8<\\xe3\\xbc\\x07\\x87\"b#\\xb9\\xe4c0\\xe5\\xe3\\xe3@\n\\xfb\\x96\\xc8\\xfe/-\\x83\\xab\n\\xe4\\xfd\\xbd%:\\xe1q\\x959\\xd1\\xc1g\\xa9\\xe3 \\xd4\\xfa\\x05\\xf4j\\xd8>\\x82\\xab\\xec>\\xed\\x84z89\\xec:0c9\\xaa\\xa6\\xd8\\x94\\xf3\\xbe\\xec\\x95\\xf5\\x85j\\x96\\xfa\n\\xe5\\xd2u\\xcf\\xcd@ii2\\xf5!\\xf8\\xdf\\x08\\x9c>\\xd4\r\\x01(k\\xfd\\xd6\\xc0\\xb4\\x87n\\xf5\\xdd\\x19al!\\xc7\\xac\\x8f\\xbcp\\xe9\\m\\x19\t\\x05\\1>\\xea\\xcd@\\xef\\x9ahl33>\\xda\\xb7\t\tr\\xb7c"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047m p1v\\xd4c\\xac\\xa7\\xf9\\xff\\xe7\\xeb\\xad`\\xddc\\xa4\\xfa+j\\x94\\xcf^\\x98\\x9c\\xafsb\\xean\\xed\\xce\\x11f\\xc0o\\xb3\\xdfwt%\\x0c\\xcd\\x98\\xec\\kv\\xef\\x1b\\x1e\\x04\\x94\nb\\xddi\\x14\\xb3\\xcd\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x80\\xaf\\x10\\x8c\\xc6\\xc9\\x86\\xb3e8u\\xee\\x1be\\xfc\\x8a\\xed.a\\x10e\\x8d\\xd8\\x95\\x0e\\xb6\\x9f`\\xdc\\xd5d\\xa3\\x9a9\\xf4\\xd3?\\xef\\xc9\\xa8\\xec\\xd9\\xf2\\x10\\xabp"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p`\\xa4\\xf4\\xa6\\xe3\\x7fa\\xde\\xd9\\xde\\xd3\\xcf\\xa3\\xf2\\xa2\\xf3&\\xa0g\\xc5'y'\\xbd\\xe5\\xa1\\xc7\\\\xb9\\xc3\\xad\\xc8\\x93\\xc9\\xf3\\xf4\\x01v\\xfe\\xeb\\xd6+\\xc8\\x98\\x1f1\\x82\\x1c\\xc3\\xe6\\xe5`\\x1f\\xc7\\xc8\\x00~$(\\x92\\xa6\\xd0^\\x9bu\\xb9\\x8c\\x87v;\\x93$\\xb5\t\\x17\\xbb\\xe3\\xf76\\x12\\x8aj8\\x9c\\xc9\\x08\"\\xefql\\xdf~nm\\xf3@ok\\xd0\\x82m\\x06l\r*\\xeav\\x12\r#@\\xfb\\xf4\\\\xcbfl\\xbe\\xb2\\x99\\x85\\x9b\\xb5\\x94\\x8e%y5%\\x84wm\\xf0\\x97\\xd3,\\x93\\xf3\\xf9\\x93#\\xabn\\xc4\\xd0\\xe4\\x1e(\\xcc\r\\x01&\\x86\\x1c\\xe3b*\\xed\\xd25n\\x85\\x86\\x1dy\\xdc\\x96.kp\\xc0r\\xeb\\xfeo\\xac\\xdc\\xdb\\xb2\\xdf\\x99\\x99u'\\xe5\\x10u\\xd9\\x8d;\\xe0\\x9bg\\xc00z\\xefr\\xaa\\xf9\\xa7\\xec\\xa1w\\x83\\xa7&\\xb3\\xcb\\xb2e\\x8d\\xa6\\xa2\\xd5\\x84\\xd6\\xfco\\xa9\\xa6v\\x86'$\\xdag38\\xc8\\x88\\xa5(i\\xe2?, +\\xee\\x98\\x11bt\\xdb1\\x96\\x9c\\xb8"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xe9\\xbb\\x80\\x8a)2g\\x8b\\xa1jy\\xf6\\x14j@\\xcb\\x01\\xa3u\\x9e;|\\xa8\\x1c\\xfd\\xac\\x95\\xc2\\xb5\\xf3\\x13`\\x86y\\xc0\\xb1\\xd4\\xaby\\xcbbo\\xe6\\x05/\\xc2p\\x10\\x13^ \\x04\\x01\\x95&\\x84\\xde\\x8b\\xb1\\x90\\x92p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\x17\\x13\\x00%@\\x11p\\xb0\\xf4\\x0e\\xafw\\xba\\x8a\n\\xf8ho^\\xddrvtk\\x84\\xb1\\xb5\\xef\\xff\\xbf\\xc9\\xaf55s\\x1c\\x9f\\xb8g\\xce\\xdd\\xe6p\\xe9k\\x19_"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\xa5\\x83\"\\x1a\\xdez\\xa0\\xc3\\x1cv\\x05\\x02x\\x913\\x1de\\x1f\\xb4z\\x99s\\x82\\x05\\xec\\xcd\\x02/\\\\xdb\\x0c\\x85\\xdex\\xc4l\\xe8\\xc1i\\xe73s\\xe1\\xf8\\x00\\xe5_e\\xfe\\xb5\\xb0\\xfe\\x8b\\x05k%g\\x15*\\xf1\\xf8\\xf1\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5\\x13\\xf08\\xf0l\\x90\\xdf\\xc1\\xaccl\\xae\\x81`\\xf9\\xff#\\x84\\x0f(\\x8f\\x0e\\x06_\\xde\\x1fyw\\xf3x\\xa4\\xe3\\xef\\xeb\n\\x86\\x0b\\xd1\\x8f\\xc8\\x0e\\x07\\xaf\\xd1\\xb7"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb2\\xc9?8\\xe8\\x02\\x9d\\xa4\\xf4w\\x82\\xfb\\x9exj\\x12\\x91\\xa0\\xf6\\x85|\\xf8\\xff\\x90(\\x83yu$$x~k\\xc4\\x9b;.\\xe3$o\\x02;1\\xb3qk\\x05y\\xc1a\\x05\\x1c\\xdd\\xb6\\xe8\\xf9\\xf2\\x0b#b\\x87\\xc8\\xc3\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xc8\\xbb\\xcf8\\xd2z-\\xd6\\x80\\xee\\xd5\\xac\\x0f0\\x1c'\\x7ff\\xa2\\x9f(\\x87\\xcba\\xa8\\x1e\\x08\\x9cc\\x83p\\xeby\"\\xe3dt0,\\x1d\\xa7\\xa1\\x1cc\\xba\\xeb"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|j\\x9e\\xd7\\xd3\\x8f-\\xed\\x7f\\xe8\\x13\\x05\\xf8$o(\\x97\\x02\\xed\\xfd\\x0bd\\x02\\xb7\\xfcap\\xb8x\\x01\\xc0go\\xf7\\xe4m,lx\\xc2`\\xbbni\\xe2\\x19\\xe5\\x7fqs\\xdf\\x86\\xb4\\xc5d\\x18\\xac\\xa8\\xea\\xa8\\xba\\x12\\x0er\\xb7\\xfc\\x9c\\x9c\\x19\\x89u\\xd8\\x93^\\xd9y\\x10.\\xc4u\\x17\\xe6\\xc3:\\xb1:@\\xb2so\\xbbp\\xd8\\xeco\\xd4\\x02rd\\xe3\\xa4\\xcdd\\xe6/~\\xac\\x9c\\xb6\\xc9\\xbc_\\xb2\\xe9\\x8e\\x87\\xa4(\\x7fi\\xe3kc\\xac.\\xb8cr\\x0c\\x94\\xc8*g$\\x05\\xea\\xc2z\\xcb\\xe3b\\xbc\\xa2\\xd4\\xa8n\\x88\\xc5\\x9c\\xe1\\xf2\\xd8l>dr\\xafz\\x15\\x88\\x90.4\\x01bbt\\xe7u\\xf7\\x7f\\x00\\xa6\tu\\xcb\\xd3\\x83()&+\\x91\\x97\\xe1r\\xfep\\x80l\\x9bqep\\xd8\\x9c\\x14\\xeak\\x0eqo\\xfa\\xc5s\\xcfk\\x84\\xb6\\x05\\x11\\x9e?\\xba\\x07'\\x0c\\x17\\xff@u\\xf3\\xa5\\xa4\\xa0\\xc5\\xb4\\x92\\xbe\\xe6\\xd6j\\x90q\\x8a)\\x1c\\x97\\x1fq\\x0e\\x1a\\x1ff\\xda\\x9a7"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\x86\\xe5d2\\x97\\x14,d\\xeb\\xd6\\xd2\\x89\\x85\\xa4\\xb9mi\\xc7fu\\xf9\\xf5\\x029+\\xdf1\\x92b\\xc0t\\xcf~\\xf7\\xb7^)\\xd8`e\\x0b\\xc0\\xe0\\xc4\\xf9\\xad\\xb4\\x0b\\xdb\\xe7:ar\\x10\\xa29y&\\xaa\\xe8\r\\xf7\\xa1i.\\xa8\\x8e\\xd8\\xb1\\xcd\\x03h\\xec\\xcd\\xb2\\xc6\\xf3\\xa3e\\xa6\\\\x96\\xd9\\xe3\\xe8h4\\xcef\\xf8\\x0f\r\\xf0\\xe3\\xab\\xf7\\xce\\xe4 \\xa1\\x1dt\\x11\\xb1+\\xbd\\xa6\\xe2x\\xfa\\x15\\x94\\xb8z\\xd1f\\x9b\\x81\\x8e'z\\x9b\\x83u\\xce\\xd1.\\xa4\\x1fur\\x00jmdz\\x170\\x84y\\x8e\\xb2\\xc7y\\xba\\xb5b\\xd3#\\xf0\\x11d#\\xbd@\\xe0\\x13\\x90h\\x8f=\\x16\\xf0\\x9c83jb\\x95\\x9dc\\xd7\\x10\\x86\\xf6qs=u\\xa3\\xb28\\x02\\xf1w\\xfe\\xa8\\x98\\xfb\\x1b\\x12\\xde>\\xc5q\\xb88\\xa6\\x95\\x1c\\#\\x06\\x0b\\xd2\\xc0\\x9d\\x9ak\\xeb\\x00j\\x9a<k\\xa3>\\xean\\xb7\n\\xf2l\\x17\\x8b\\x17x'm\\xbf\\xe6\\xc9\\xc05a\\x83\\x0f\\xf5\\xcd\\x08\\xb8p="
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\x01%\\xf8)\\xe0*\\x9c\\x91\\x15\\xfc\\x1a\\xb81m\\xcf4!\\xfc\\xd8\\x92n\\x95\\xa3w\\x91e/b\\x00k\\xd3\\x01\\x05\\x83\\xbb\\x9a\\xa4\\xb8\\xe1\\xfd\\xac\\x969:7\\xab:\\xad\\xf2c\\x0f\\x82\\x97\\xc3\\xc9\\xf8\\x03\\xb4w\\xd3\\x88\\xa1\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\x84\\xaa\\xe4w\\xb2\\x8c\\xd4\\x82a|\\xd3du\\x83=\\xce\\x10\\x1e\\x084\\xfap\\xf1+j_jxk\\xc2'\\x97\\xa3b\\x06\\x98p\\x05\\xc2\\xef\\x17\\x7f\\x97<\\x10\\x18"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xb6h.or0<\\xcbe\\xcb9)\\x968pk\\xc4\\xae\\x93qq\\xed\\x0f\\x81\\xcd\\xc0t1\\xf5\\x0e\\x84a\\xfa\\xd6@\\xcf\\x01t\\x05\\xf6\\x86\\x9f\\x14t\\x14t\\x9bc\\xa4\\x84?x\\x1d\"\\xed\\x1e\\x0bh\\xad6\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xe0\\xe0\\xcci\\xa4k`\\xcd\\xbf\\x103\\xf2\\xab\\xad\\x19q/\\xaf_\\xdb\\x7f\\xa0=-.\\x00\\x01\\xaa\\xa4\\xba#\\xc9'a\\x8f\\xd5\\x19\\x95\\xe4\\xcdv\\x83\\x1bz\\xc0"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\\xa4\\xab\\xc6x\\x00\\xf7\\xf2\\x99\\x8c\\xf6\\xbe\\xd7\\x90\\x84\\xc4uh5\\x9e\\xc5\\xe7q)dpb\\xccq\\x07)7\\x86ew\\xc27\\xf4\\xef\\xcb;\\xe4u\\xf8g\\x15ei\\x8d\\xa9l\\x00b\\x1d\\x04qf\\xc6\\x9dc=i\\xbe\\xf9\\x88\\xc7\\x88tt\\xfd\\xbf\\xf6\\xcb\\xb5\\xf2\\xde\\x10\\x15\\xb3\\xd1\\xd1bg\\xd6\\x1f\\xc6\\x1e\\x1d\\xd6m\\x906u\\x9a\\x90f\\xc2?(0\\xde\\xe4\\xca\\xeb\\x1b\\xf3\\x93*<\\xda\\x0e\\x8e/c\\x19\\x1e\\x82\\xa1f#f\\xbd\\x8bc\\xc2>o\\x07+\\x93\\xc2\\xdc\\xc3\\x01\\xa0o\\xa0c,\\x1c\\xd8r\\x1e\\xbc\\xfb\\x15fc\\xa7\\xec\\x11\\xc1c\\xdf2$\\x94\\xfa@b\\x84`\\x82\\x85\\x14\\xcec\\xab\\xa7\\xa4\\xfb\\xbd\\xd8\\xaf\\xc2 k\\x8b\\xc9 \\x84\\xb1\\xce\\xdd\\x18\\x08\\x15b\\xb0\\x0en\\x11e<\\x90\\xdcx\\xee4\\xe3\\x9d\\xe1\\xec\\x04j5\\x05\t\\x00\\x91\\xdb\\xbd\\xd0\\xe9\\x00\\xab\\x87\\xc4\\xb2c\\x07\r\\x90\\xf5\\xb2\\x93\\x89\\x82x\\x8b\\xb5i\\xf6\\xbevc\\x9a\\xd1\\x1d\\xc52o\\xdc>\\xafwe"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xe1\\xb9\\xd4q=\\x84\\xf2\\xe1k\\x18?u\\x8frjsu\\x07\\xd4fp\\x0b\\xb7%\\xaa\\xda\\\\x08\\xbem\\xc0\\xdbx\\xde\\x19*>\\xc6r\\\\xcbc\\xbc$\t\\x9a\\xcb\\x19\\xa0\\x82,\\x96\\x97)\\x06\\x00gd\\x05orm\\xaa\\xf0\\x12\\x1bm\\xa0\\x1a\\xed\\xb6\\xfa\\x8e\\xee\\xe2\\x17\\xe6y)\\x04\\xf9\\x10szt\\xd2\\x010\\xb4\\xe7\\xe1\r\\xf1\\xc1'\\xcd\\x98\\xfd\\x9b\\x0e\\x81\\x85\\xe6\\x92ly\\xd3\\xcd=\\x19\\xf2;>\\xd7\\xae\\xc3r\\x82\\xed\\xc4\\xbf\\x9b\\x90(nm~br\\xd4\\xaed\\x84k\\x1d\\x86\\xacy\\xf8\\x8c\\x88\\x90\\xce\\xdb\\xa0rc\\xb1d\\x17\\xb5\\xc7\\xae.\\xd6\\x86'nja\\xfat\\xf8\\xb2\\xe1\\xf8\\x04\\x03\t*w\\x83v\\xd0\\xc9*|\\xfb\\xea\\xf9\\xe1\\xbc\\x9f_\\x91`\\xe9\\xdb`\\x19zb\\xbf\\xfex\\xde*\\x9f\\x8f\\xaf\\xf16\\xadr\\xb2`\\xc5m\\xa1\\x9di2\\x85v\\x87\\x06\\xa3\\xc1b\\x1b\\xbd\\xea\\xfd\\xa0\\xfe\\xd9j\\xa4\\x04\\x10e\\xea\\xf3\\x0f\\x97\\x91m\\xf1h<\\xc5\\xa2\\xddea\\x18vg"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>ck\\x8b\\xb5f\\xfe\\xd8\\xa5\\xcd4\\x06\\xa3\\xf5\\xa4\\x1e\\xa4\\xeduiz\n\\xdc\\xd4\\xaeu\\xcf)m\\x16\\xdf\\xd8!\\x870_\\xa0s\\x7f\\x15 :\\x91\\xed\\x0f\nfg\\xe1\\xa6\\x84\\xe8\\x02\\xecs\\x14\\xc7\\xd4\\xec\\xe7\\xc8y$\\xeb\\xa8j\\x1d\\xcb\\xa9\\xe0\\xe5\\x82k\n\\xa7\\xbd\\xc5\\xbf\\x0e\\x0e\\x87\\x8e\\x9b\\xae\\xf0&#5\\xc2\\x83\\xf8i\\xc1\\xb9\\xd3\\x8e\\x00\\x1996-\\x1ag/\r\\x9b30\\xe8&\\\\x9d\\xa7\\x875\\xdb\\xd5\\xc74z\\xe7xz%h:\\xf2\rh0ik\\x93\\xdd*9\\xa9\\x023bx\\xa1\\x95\\x9e\\x91\\xa0\\xff\\xbc\\xe7\\xda3zn\\xb9b\\xa5av7c>o\\x96e\\xad\\x8c\\xf5\\x18\n\\x18\\x19\r3m\\xd0\\xaa\\xf4n\\x97$\\x11\\xcd\\xfd~|!\\x07\\xce\\xfd\\x95\\x0fl=\\xd0l\\x85\\xc1\\x8a\\xf9t\\x14\\xa8:\\x97\\x7fs\\x07\\xfc_\\xa3\\xd36*\\xbeo\\xcd\\x91\\xa5|\\x85\\xabs\\xba/nj\\x8a\\xee\\x83\\x18\\xd1\\xb0\\xe18\\x8a\\x18h\\xa7\\xffy'\\xcd\\xce\\xd2\\x97v <"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\xff'\\x07\\x0e\\xf7\\xfew$lp@\\xb9\\x17\\x0ee\\x82\\xb0w\\x96\\x84\\xef\\xdb\\x88|\\x17\\xde\\x98r\\x80\\xe4\\xdc\\x1ed\\xbc2\\x85\\x0e\\xe6\\xde\\xafpb\\xef\\x1e\\xa4\\xe0\\xe5\\xc5\\x02\\xfb\\x8ag\\xd6\\xca\\xe1\\xda\\xffo\\xf1\\xaf\\x12l\\xd3\\xcc>\\xa1\\xee\r\\x01\n\\\\x86\\x99\\x1c*~\\xe8bl\\x88\\xd2+\\xfa\\x02\\xcd\\x88q\\x1ex\\x9f\\xd4c5p\\xb7\\x8dgjw\\x98|p\\x1c\\xcf\\xf1\\xda\\x81\\xedmr\\xc7s;\\xd4hp\\xb1\\xa4\\xb5k\\xb4\\xa7\\xc1\\x155\\xfa\\x8d\\xa0\\xab\\x0bpj\\x04\\x19~\\xd9\\x7f\r\\xdc-~g\\xfb\\xcfs\\x1c\\xac\\xba/\\x80\\xf2\\xe5)\\xdf\\xb11\\xb6\\x8e\\x159k\\xfc\\xc5\\xa5\\xd0oa\\xea\\x84\\xfb\\xdae%\\x9b$\\xeb\\xa9\\xc2\\xf7\\x8f\\x0f\\xbe\\xcbu\\x17b2a\\x1d\\xb6\\xd4\\xbc\\xcf\\xa0\\xc1\\xa2\\x10\\xbeh\\xb98w>\\x1fc\\xeaf\\x8a)\t\\x15\\xc1b\\xd1\\xc5\\x10\\x87\\xf8#2\\xb8\\xe6\\x11\\x95w~\\xcd\\x1f\\x87<\\xff\\xe0\\x01\\xca\\xcd\\xf7\\xcb\\xa7\\x04\\x97\\xcff\\xaa\\xefi"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xc5+\\x0c\\xf1%\\x1fa\\x1f\\x7f4\\xb4\\xbd\\xcb/\\xb3\\x18\\xaf\\w\\xcf\\xa8t)\\x04/&\\x9e\\x9a\\xdf\\x9ar3\\x84\\x90\\xbcu\\xcc\\x86ii\\xbdpjd\\x07f\\x02\\xcf\\xc4bs=^\\xc7\\xe9\\xeau\\x93\\x89avw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\xfee\\x9d\\xbf\\xeej\\x04,o\\xd0\\xe96\\x029\\xfd\\x8a\\xee+\\x830\\xc0j\\xa4w\\x8d!\\xe4\\x1a\\\\xbb\\xbd\\xb9v\\x18u\\xad\\xfc%\\xf5n\\x1b\\xa4iw\\xbd"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\x8eg\\x95p\\x96\\x8c'\\x03-pi\\xc2xv\\xfa\\xd1d\\xfd\\x94\\xc6`\\x1et*\\xf1\\x060\\xa8\\x92\\xa7\\x13\\xf8\\xd6\\xfa\\xb1\\xbb\\xed\\xc4\\x85\\xbby\\xdd\\x88\\xcb\\xac\\xa35\\xbb\\xc3p(\\xdd\\xb0\\xf5\\xb9o\\xe5\\xe9\\x07\\x8d\\x1ec=8\\x95\\x1d\\x14\\xb9!p\\xd5\\x9c%e\\xd3\\xf5g\\x07i\\xa8\\x92\\xbc\\x10\\xb1\\x89i\\xcb~\\xad\\x17\\x15)y44\\x024\\xf8\\xcey\\x0e\\x04v\\xc6\\xf3\\xf5\\x03\\xf8\\xb3\\x8fq!;\\x98\\xb9\\xb6\\xbd\\xac\\xa0\\xe0\\xd5\\xbd\\x18?\\xa4f\\xa2\n\\x89\\xa9\\xb7f\\xd8g\\xe7f'1\\xea\\x1c;\\x89\\xae\\xd3\\xfb\\x1c\\xfa=\\xa1\\xa7\"\\x96\\xa4\\x1a\\x03\\x9e\\x87\\xd1\t\\xa1`n\\x058n\\xb7\\xeccl\\x9e\\x9d\\x8a\\xc0\\xdap\\xe7\\xb5\\xb2.k\\x13\\x97\\x9b\\x91\\x93\\xb6e\\xce\\xc8\\xb59\\xf7\\x82y\\xb7q\\xb3\\x17\\x88\\x05\\xf8\\x86l\\x12\\x19i\\x87g j\\xbb\\x87x\\xe6 \\xc7!&\\x1amf1\\x9f\\xc4\\xabf\\xd3\\xedh9\\x86\\xcc\\x1a2\\xd7y\\xfe\\xc3\\x0f\\xf18o\\x8c\\xc6ut\\x08"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\x80\nu!\\xf5 s\\x98\\xc6\\x1d\\xe3z\t\\xd7&\\xda\\xd6\\x89k\\xf4\\x8b\\xafmg;\\xb6\\xec\\x06\\xa5k\\xc5\\xa2\\xb3\\xd9a\\x9bc\\x1c\\x843\\xc8v\\xd3i=|e\\x07\\xf73\\x81\\xee\\xe8ay\\xe4\\xa91\\xc8\\xe9&ny\\xcf\\x84\\xfc\\xa5snl`\\xfa\\x08\"j\\x07&u\\x10\\x0e:\\x8c\\x9c//qr\\xf5\\xb1o\\xa1<\\xearh\\xab\\xfa7\\xf4\\x10\\xbf\\xf5~\\x89:\"l\\x8b/\t\\x03\\xadr\\xf0.\\xac\\xe3l\r\\xb8 \\xc4\\xf5\\xe64\\x87\\x00xp\\xe6o\\xe4\\x9fhi\\x87&\\x90\\xa2\\xf4\\xe3\\x10l\\xba)\\x08l1\\x98\\xbf\\xf0~^\\x85\\xa1j\\x90#\\xbe\\x0ba\\x95\\xcbt\\x9a\\xcd\\x99\\xbd\\xf2\\\\xd0\\x92\\x1d\\xcf\\xe0z\\xff\\xa6\\x15\\x16\\x93\\xd9\\xe6=v\\xe5\\xee\\x1e\\xccy$\\xef\\x1a\\xb3\\x9a\\xa1&@q\\xc7\\x02\\xe2\\x96d\\x85j\\xda\\xe6\\x8e\\xdfgq\\xbb\\x19\\xa2\\xb8\\xafe1\\xce\\x84\\x9c\\x05i\\xfd\\xbf\\xb3\\xe8\\x0e\\xf0\\x05\\xc5<#\\x02\\xc0\\xdc\\x03\\x897o\\xa7\\xf0q\\xb2"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:+\\xd3<\\x05\\xb5\\xe5dj\"\\xd0\\x19\\xff\\xc3\\x0c\\xc32\\xcd\\xbb\\xf9\\xd6ao\\x8a\"\\x06:i\\xca)\\x9f1-7\\xb1k\\x0be\\x04>\\xc9\\xa0\\xc2\\x98\\xa1\\xa0\\xba\\xba\\xfc\\xecwk\\xa3\\xf9b\\x82.\\xf3\\x9e\\xc8\\x8b\\\\xcb3\\xa8q=l\\x9c\\x1e\\xbb|\\x14_\\xace\"|\\x0cnp;\\xbd\\x83\\xa5j\\x89n\\xf0\\x0e8s4\\x14\\xb5\\x84\\xaec\\x07\\xe6\\xb5\\x11\r\\x06\\xd65\\xaam\\xbb\\x1bo\\xb9 \\xd5\\x8c?\\x83\\x15\\xd8\\xf2s\\xcc\\x87\\xef\\xaf\\xf8\\xe0\\x02b\\xcf\\xb0q\\xdes\\xac\\x115\\xccg^\\xef\\xba\\x7f\\xb4\\x1es`\\xde\\xb6ca)p\\x9f\t9umxv\\xd2\\x04\\xd2c\\xeb\\xb5\\x06g\\xb8\\xb7\\xb5\\x15\\x9f7\\xad\\xfbz\\x86=j\\xb5\\xd7v\\x07\\x17\\x0crr\\x07\\x96\\xc4\\xd1~\\xe6l\\xe3u\\xa4\\x94r\\x87\\xf1yt5\\xc2\\x19\\x97\\xb01\\xca\\xf7\\xf6\\xf5\\xdb\\xea\\xf5w\\xca\\xc4\\xab\\xac?\r\"\\xe8e\\x16\\x06@\\x97d\\x17\\xbc\\x90\\xc3\\x9f\\xda\\xbf*e\\x87\\x16\\x9e\\xcc"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108\\x124\\xc2yrn\"1r\\xac\\xd1\\xd0\\xce\\xa4\\xaaj*\\xc1\\xb3\\x7f\\x05$\\xeap\\xdeh8\\x9c9\"\\xb8>\\xd9\\xad^\\xebn\\x96\\x9f\\x96\\x92-\\x12\\xead\\xc65\\xf1\\x06\\xe0\\xd5n\\x89\\xb8\\x83\\x9e\\xac\\xb1*\\x17\\6\\x8e\\xd4\\x80\\x9b!\\x12d\\x0e\\xe9xe\\x98\\xf1\\xe3\\x9d\\xcd\\x90\\x0f\\xc75\\xa8c\\x94f'\\xc1\\xfc\\x01<y\\xd8f\\xc2\\x89x\\x1ci'\\x88\\xff\\x96\\xe6\\x01\\xf5\\xb7\\x8b\\x89\\xb7\\xed\\x05\\xb4\\xab |\\xf1\\x19\\xb3\\xd5)\\x7f\\x13q\\xc4\\xe5m\\xc0h\\x19\\x1c\\x9b\\x88.\\x129\\x86\\xef\\x99y\\xbc\\x1a/\\xe0\\x0b\\x96\\x8c\\xcc;\\x13qhhg\n\\xca\\xa9\\x0e\\xec\\x9c1\\xf0\\x011.'\\x1fu^a\\xa8\\x82\\x90\\x92\\x1d\\xe3\\x02\\xf6\\x1a\\x0b\\x8d\\xfa\\x07$w&q\\x9f\\xd1\\xe9j\\xdb\\xb7\\xc9\\x0e\\xd3\"h6\\xa3\\x1fb\\x07!\\x1b\\xcc=\\x81\\x91\\xbc\\x12z'\\xedn\\x03\\x86\\x9be5tc\\xb8qsu\\x08u:\\xb1\\x1a\\x843\\xb4\\xbd\\xbc\\xcb@\\xaf&f\\xa0m\\xe7\\x80\\xc9\\x87"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x892\\xc4\\x1aq\\xb5\\xd7\\x1a\\xb5:\\xc1\\x80\\xe0\\xdd\\xf0\\xfa\\xd4\\xabd &m\\xd8\\x93\\xee\\xfb\\xc1\\x97\\x871\\xa9\\x08\\xf7'\\xfb,\\xac\\x99\\x17^\\x19\"%\\xf2\\xe7zb\\xcf\\xe5~\\xb0e\\x0f\\xfb\\xd8\\xae\\xe5\\xa6b0\\x0e\\xdcpf\\x1a%\\xbc\\x0f\\x1f\\x05@tbi+3k\\x1f\\xe0\\xec\\xe4\\x1b\\xe4\\xb3nj\\x0cv4\\x0fk?>\\xd3\\xd9\\x8a\\x19n7\\x9b\\x05\\x8de\\xc4\\x83\\xc0\\xe3\\x81\\xf57n\\x99\\xb1\\x1bc\\xe3\\xa4\\x99\\xc1p\\xef\\x8e\\xe7b\\x11\\xf9\\x16\\xc3\\x12\\xe6\\xc0\\xb6\\x02\\x10\\xa2@\\xdd8\\xefs\\x86\\xf3<\\xbb\\xb4\\xb4\\xff\\xe1\\xd8/\\xbb\\xb2p.u\\xbb\t5\\xec\\xba\\x80\\xe4\\xa4\\xaa\\xadl\\x9d.\\xc0\\xda\\x14,\"\\x0bz\\xe0\\xa6\\xe9p\tvaxb\\xf1\\xc7f\\x15\\x02\\xbb7gm\\xbei\\xec\\xf0\\xd9\\xef\\xab\n\\x11\\xc5r\\x88\\xf3\\xaf\\xd4\\xb75\\x89\\x8c?\\x83\\xaa\\xcc\\xf3(\\xcb\\xfd\\x0c\\xc8w\\xf8t\\xc7\\xd9\\xce,\\x1f\\\\x93\\x9cf\\x83\\xaa\\xa6\\x1e\\x0f\\xc4\\x1c\\xb4\\xf6dl$"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=\\xe8\\x86\\xd3\\x9a\\x81\\x0cg\\xf0j*`\\x88\\xc8\\x9ei-e\\x1e'xr\\xba\\xf8\\xaf\\x94\\xe2\\xe4r\\xfa6\\xcc\\x7f\\xa7vn\\xc2\\x1a`\\xf2=t\\xcd\\xf8\\xe8\\xe1y\\xbfl%\\x80znf\\xae\\xe8\\x12\\xe8k\\x92\\xaew\\x10/\\xc0f\\xb1b\\x08\\x84)\\xbc:v\\xf3\\x1egj\\xe9|r=w\\xf8\\x12,k\\xfd\\x003\\xf1u5\\x89ss\\xbet>>\\xab\\x83t\\x08s\\xb8\\xd1\\xc22\\x86\\xf6;c\\x97\\xc9\\x9er4\\x85\\xd2\\x81\\xc2`\\xd4\\xe2,\\xc0c\\x1cpx\\x8c2\\xe6\\x8c=\\x02\\xec\\x10\\xfee\n\\x1d\\x11\\x16<|q2fm\\xdf\\xa3\\xaen\\x08\\xf4\\xa5m_\\xb5\\xbc\\xc1\\xe8)!g\\xf9oy\\xd7\\x11\\xc9o\\xdc\\xdd\\x16\\xb4\\x1a\\xbb\\xf2\\x0b\\xbc\\x8e2*\\x04/\\xd0\\xf3\\xba\\xa2j\\xb1\\xea\\x89\\xcdc\\x1f\\x14\\xc9f#\\xfflg\\x11\\x9fp8\\xf0\\x8d\\xfe3\\x12\\x04f\\xfc\\x98##9\\xa9\\x81\\xde\\xa19\\xbc\\x17yrk\\xc0\\xe8\\xad\\xd0n\\x91\\x03v\\xee\\xa3c\\x15\\x08\\xa7\\x9e"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4.\\xe4>\\xbc\\xe0q\\xdc\\xe0\\xb3\\xd9a\\xa7&>\\xaa\\xf5z\\x92\\x00d\\xb3\\xa6\\xd5u\\x0cc5`o!*\\x857\\x02\\x1cq\\xbd\\xf1\\x82u\\xcb\\x17\\xdaq\\xdb\\xcf\\x18y.\\x01\\x04\\xde\\?\\xa3g+h\\x01;\\x93\\xb8#\\x9bl\\x9fh\\xdd7)3\\xedczr\\x87\\xf2o\\x87\\xc0\\xbc\\x941\\xea\\xdf\\xe0\n\\x8f\\xe0\\x9c\\xb3\\x10$\\xa3\\xcd\\xfe\\xef\\x91\\x9d\\x9e\\x15_y\\xd5\\x88j\\xff|\\x01\\xd9l\\xaa)\\xf2\\xd7\\xfaili\\xc3\\xc8\\x9fe-\\xbcl\\x03\\xcd.\\xfe\\x00)\\x08\\x0c\\xf4\\xcb\\x0b@e\\xa8\\xa7~\\xda\\x01w\\x94v\\x10\\x9f`\\xf8v\\x0c\\x06x\\xbb\\xc9i>\\xc1\\xfd\\x00y\\x83f$\\xd2\\xaba \\x0e4t;7\\x99\\xbfp.\\xfa\\xbb\\x84\\xec\\x0e\\xc1\\x8c\\xa0\\xb9=\\xbf\\x98h\\x8e>\\xfa~\\x93\\xc0$\\xf4m\\x17-b\\x17\\xa5l\\xffq;\\xe0\\x02z\\xd5\\x15\\x05\\xec\\x9e\\x8c\\x867xrb\\xae\\xces\\xb6\\x91(f\\x1d\\x7f%8j\\x1a\\xd8w\\x0b\\xc7\\xa1\\xaf\\x1f\\xa5\\x9f\\xbd\\xd8"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa\\x19\\xf2\\xf3>\\\\x8f\\x83/\\x18\\xf8\\x03=\\x15\rp\\xd3\\x03~k?\\xd0\\xc9\\xfb\\x18\\x08z'\\x9c\\xc7\\xac\\x8e\\xaf\\xed^:\\x82\\xb1\\xef\\x99\\xed\\xdf\\xb4\\x0byb@\"6x\\xce\\xfda\\xbc\\x12)\\x83\\x0b$<\\x05\\xf7i%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000oy\\x9b|@\\x15\\xf4\\x08\\xaa\\x11n.m.(b2\r\\xdcb\t\\x18\\x0b\\x01\\x88\\xa9\\x9b\\x92\\x8fy\\x1e\\x8fqrih\\xc5d$\\xbf\\xef\\xe7\\xa9\\xcc\\xdf\\x85^"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xef\\xab\\xc5x\\xa6\r\\xcd\\x18\\x88::\\x96h\\x16\\x96u#\\xc74\\x05'\\x92\\xde\\x9fgmrx\\xc7\\x8dc\\xb2\\xbc$\\x0bh\nb\\xb5 x<\\xdchujm0\\x88\\xbdt\\xd6\\x1f\\xb9\\xe6kd\\xe8\\xa9yk-ch\\x97\\xf5\\x9d\\x1b033\\x18rl\\xfbb#\\xd1\\x88\\xcd\\x13\\xb4\rq\\xc6\\x05\\xce\\x85\\xd3n\\x0b\\xb2w_\\xa6n\\xefd\\xcf\\x14~\\xc0a\\xba\\xe3\\xd8(5\\x8b+\\x9c\\x92\\xc96ta\\x9b\\x81\\xed\\x87p\\xa4\\x92\\x99\\x85z\\xa6\\x15\\xdbcs\\xb7l\\xedp\\x02\\x81\\xa2\\x02k\\xc8\\x9c(.\\x15\\x01\\xb5!\\xae\\x14\\xb3c\\xaf\\xc9\\x99\\xdd\\xac\\xf9\\xbc;\\x85\\xf9\\x94\\xefk1\\x18\\xa1n\\x07\\x1a\\x93\\xc8z%\\xb1\\x14>y=\\xe5\\xd3\\x8f\\x15\\x17\\xf1\\x1ez\\x17\\x80\\x1e\\xc9\\xa8a;\\xb0\\x13\\xa2\\x1ew\\xf4\\xf7\\xf2\\xceyj\\x88\\xec\\xcc3\\x9ab\\xa4\\x0f\\xe3\\xc8~\\x03v\\xd9\\xa7\\xc6\\xa1k\\xfb5\\x8d\\x0e\\xb6\\x1b \\xcd\\xfdx\\xbc\\xc6\\x05\\x11zb\\xc7\\xd3;"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0105\\x15\\xe1a <\\xc0t\\xc6\\x11\\x00j\\x8e\\xb7s\\xf5\\x96\\xc4\\xb3\\xbdho\\xf2\\xec\\xff\\xbc\\xa5\\xde\\xb4\\xa4\\xd5\\xe0\\x97\\xfe\\x1a\\xf8o\\x97\\xf8/\\xebn\\x99$?\\xc0\\x8eu\\xec\\xeen\\xb2b\\xf3*\\x05c\\xf0g/\\x07\\xdf\\x88\\xac*\\xcb\\x17\\xdf\\x9c\\xfa\\xcc\\xc9>h\\xd5\\xfd4\\x0er\\xd3\\xc9 v\\x13\\x0cs<eq^\\xad\\x03\\x7fu\\xe0\\xb9?/r\\xe94b\\xfc\\xf9\\x83'\\xecn\\x96d\\x97\\xdai\\xf5\\x15c\\xf7\\xf7\\xf2\\xd1\\x03l\\xda\\x1d\\xf3\\xc5\\x07g\\xdf\r\\x19\\xb1\\x1d$\\xc9y|\\x90\\x9fk\\x8b\\xe8\\xe28\nw\\xd7\\xeb@\\xeb\\x17\\x7f\t\\xde\\xe2\\xa6c\\xe4\\xe7wk\\xb9\\xfdv\\xa6\\xd7\\x13=\\x9a\\xb9\\xde%\\xb2t\\xb6\\x8e\\xa5\\x81\\x1a\\xf0\\xe5\\x97\\xf7\\x82\\xcf\\x05(\\xc2\\xdf\\x00\\xdbo\\xa2\\xf4j\\x16\\xab\\x1f\\xa3\\xbbl\\xf3\\xbd2l\\xc9\\x14\\xe3|r\\xc6\\xf8\\xff\\xad6\\x96\\xe5\\x1e\\xb2\\x92q\\x89/e\\xb4\\xae\\x9c\\xd7y&\\x86a\\x86\\x13\\xfe>\\x18z-\\x00\\xcca\\x118\\xc6q"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14\\x0eqo\\x98\\xe5hs\\xba|\\x95\\x9c\\x16\\x88\\xf4\\xad\n\\xbax\\x03\\x10\\x02f\\xc1\\xf2t\\xf7\\xe7\\x96\\xdb\\x13w0\\x97\\x87\\x0fi\\xd6g\\xe4\\xd2\\\\xb1*\\x89\\xc6'-\\x9d-h\\xb3\\xb1\\x1c\\xb6\\xb0g!yw\\xfc\\xd2\\xf0\\xb1ei\\xf4\\x9df$r\\xb9\\xf5ec\\xde\\xbd\\xfb\\xe4m\\xa3zy\\xd2\\x1b\\xf2\\xe2\\x01\\x81y\\x15\nc\\x88\\xa6(\\xa1d7#\\x13\\xd9\\x93\"ai\\xfc\r\\xcf\\xdd)y\\xb2\\x86\\xdd\\xce=\\x07\\x96\\x0e\\xde14\\\\xff\\xc8\\xc1.\\x9d\\xb0\\x9a\\xacu\\xa3\\xe6\\xd5\\xfb!\\x03\\xc7\\xaf\\x0c\\x8c\r\\x07%:#\\xcd\\x12\\x0b%\\xcfvs^\\xe4\\xb9\\x02\\xe27\\xa4\\x96$(d\\xa9\\xad\\xd9\\xc8w\\xbe\\xa3\\x81\\xb8h\r\\x0f\\xf9y,m\\xdb\\xcd#\\xe3c-_p\\x072\\x08\\xd8\\x0fx\\xea\\xb0\\xb3\\x9f\\xd5\\xe29\\xcb\\x9d\\xdd=\\x10jl\\x87\\x9b\\x10\\xd0\\x8a\\x8f\\xe1%\\x05=\\xb4bo\\x87\\x9a\\xeaj\\xcb\\xba\\xc6a\\xb5\\xb2_\\xd0\\x1c\\x97t\\xcc\\xf0vsnopvk\\xf9r"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xf6y\\xc4\\xbf\\xc8f\\xfcj\\x80\\xae\\x0cs\\xb5\\xc4wz\\xc5+r\\x84\\xebkf\\x86\\x14\\x9b\\x97\\x06y\\xa9j?uv\\xdeh\\xeb\\xe1\\x88\\xa6\\x0fh\\xd1o\\x86\\xcb\\xb4\\xb5\\xea\\x1azxpr\\x8d\\x99\"b\\x1fj\\xcdb\\xe4nk\\xb2\\xbb\\xc0l7\\x19\\x86t\\xb1/nzl\\\\xdda\\xefc\\x83\\xbek\rcr\\x9a\\x0b\\x86\\xe5\\xbfz\\x90\\x88\\x97\\x19\\xb4\\x1f\\x033/\\xc3x\\xab\\x05\n;\\x9az\\xc7\\x0c\\xd3\\xb8\\xbc\\xd9\\xb1\\x92q\\xa0\\xfe\\xd4\\x17\\xd2\\xcdp\\xed\\xce\"g\\xf14\\x90\\x8e\\d\\xac|9\\xdc\\xd1u4\\xd70\\x9b\\xad\\xcf2\\xc5\\xfavn\\x1a\\xdb8|b\\xaeb\\xa9\\x08\\x90p\\x13@\\x82p\\xf7v\\xa1\\xc9\\\\xd1\\xf0\\xd8i5\\xea\\x85\\xcc-\\xd9\\xbf\\xa9\\xb7\\x0bs\\x94\\xca\n\\x86b\\x12,|\\x12\\xdeb\\x00\\xe3opr\\xb8\\xf3n\\x16\\x0e\\x01\\xeb.\\xa71\\xe5\\x17q\\xef\\xa9eb\\x19\\xf7\\xc9\\xab\\xd8\\x8d\\xf1-\ti\\x9d\\xc1`\\x92\\x1cm\\x97n\\xc1\\xd6\\xa9ms\\xeb\\x08"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\xaf\\xac\\x8bj\\x8b\\xb2\\x8d\\xc6\\xb4\\xe5\\xfe\\x96!~\\xfa\\xf5\\xbez\\x1a\\x8a\\xe2\\x1d\\xf7x\\xca8\\xdew\\xce\\xea\\xb1\\xde\\x9c\\x7f\\xaa\\xf26b\\xa6\\x9f\\xef\\x990\\xb2\\xda\\xa6\\xf1\\xb7\\x05\\x057\\x9b\\x90\\x1c\\xe6i2\\xd8\\xd1!\\x88\\x896\\xb9\\xec\\xa7v\\x87wv\\xb0\\xe63\\xb3\\x9a\\xd2u\\x8a\\x0cl\\x04\\xdah\\x0ev\\x85uqr\\x8c\\x14\\x163\\xd1\\x0ch\\x01\\x00\\xc8\\x80\\x14\\xe4p\\xb0u\\xc9\\xf5\\xfa+g\\xe1\\x15n\\xd1\\xfb\\xb0e\\x00\\xfbrn\\xa9\\xf0\\xe9\\xa9\\x92\\xaf7\\xaeao\\xbd\\x12\\xd5\\xfc\\xea\\xb9\\xd4r\\xc7q\\x82?/=\\x9e\\xf9\\xd9u\\x86\r\\xca$9p\\x91\\xabg\\x81\\x008\\xcf\\x1dc\\xf7qw\\x18\\x1c>q\\xef\\x112\\xb7i\\x12c,v\\xfbo\\xde\\xc7\\xb2\\xe1\\xaa\\x8c\\xfem\\x19\\xac)w\\xe5h?wn(\\xb51\\xff\\x03\\x05\\x8d\\xed\\xdcx\\xf9\\x88\\xddd\\xe8\\x91\\xe7w\\xe5\\xa2\\x9d^^\\xfa\\xa0\\x05c\\xd0\\xc2\\xda\\xd2\\xec\\xa6\\xd1\\xcby\\xb6!\\xe7\\x86\\xb7\\x01\\xd0\\xd6\\x13"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05\\xb0\\x13\\x07c\\xad\\xf6\\x13\\xd7\\\\xc8\\xd9\\xab\\xf0q\\x82!\\x17\n\\x9d\\xde\\xc8$qv\\xdcn\\xce\\xf9\\xcdem\\xe6\\xd6\\x19\\xfd\\\\xd6\\x0b\\xfd\\x9f\\xff;\\xc0\\xe1l\\xc8e\\xe0\\x1c\\xd3>c=\\x99bth\\xa2s\\xf5\\xa6!d\\xf6\t\\xf1\\x97`\\x89\\xcb\\x94\\xa5\\xdf\\xcf\\xca\\j^\\x1b\\x0c=($>_a\\xec\\xd1n'\\x8c\\xe8\\x93\\xba\\x85\\xb8\\xeb5n\\x01z\\x9b\\x97\\xbf\\xbc$%\\x8b\\x80`\\x0c\\xccu\\xa7+\\x0b\\x1atj\\x89\\xf4\\xfd\\x83\\x87a\"!\\xd5\\\\xcbi\\x12\\x97q\\xdc\\x95\\x80\\xd6\\xf7yre\\x850\\xbe\\xa25\\xb3ee\\xd1\\xdex\\x8c_\\xe5\\xb96\\xc9\\x1b\\xca5>c\\x93v\\xd6\\xbb\\x08\\xd6\\x88\\xc9))\\xa5\\x0e\\xd9\\xa9\\x8f\\xa3\n\\xf8g\\x90\\xae)\\xd8\\x1fx7\\x9e\t\\xa7\\x882p\\xc1\\xbd\\xaan\\x07\\x8d\\xa47\\xab\\xe8\\x8a\\xc0d\\xb8iw\\xbc\\x97\\xa6s\\xd4\\x00\\xd8\\xadh$\\xfb\\x02w\\xcc\\x1a?\\xe3\\x08r\\xb2\\xdd\\xe2y\\x1f8\\x0c\\xf4\\xb1`\\xf8"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff\\xe6$\\x13\\xb6\\xe8\\xcdd\\xc1\\xcb\\x87r\\xb5\\x12\\x82\\xf2\\x19\\xe2\\xb8\\xb0\\x04\\xf5\\xea\\xee4\\xa4\\xc7\\xe8z-\\xa07\\x80\\xfa\\xa0\\x97\\x16g\\xc2%eh\\xdb\\xc0s\"\\xb3\\xa1p\\x89\\xf6jnwoq,\\fm/%h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005xc\\xfc\\xd5\\xdfwa\\x02\\x84wt\\x01\\xc4\\xb4<xx\\xd1j\\xa3=,t\\xab\\xa2\\xf2\\x1d\\xb1\\x87b:\\x9b\\xdb\\xcf\\xbf\\x919\\xd8\\xd4\\x8a(\\x8c$(\\xafn\\x89"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19m\\xe9\r\\xe0,\\xb5\\xf8\\xb0\\x1d`\\xe6\\xa0\\x12\\xa6\\xad\\xed\\x9a\\xb4\\x8e\\x02r\\x82=\\xf8k\\x89\\x93o\\xf4ee\\xe6\\x12\\xd4\\xf0\\xd6r\\x81\\xa1)\\xf0t\\xe4\\xaa9\\x10x\\xee;$\\x8a,\\xf48\\xea\\xb5\\xeed\\x06\\x84g\\xfc\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7r\\x99m\\x03#\\x85\\xf5\rt.\\x87p@\\xdb\\x93!#\\x16\\x1e?q\\xd0\\x1b\\xc6\\x9c\\xd4^\r\\xe9.\\xa6\\x8c\\xbd\\x86\\x84\\x97\\xd4\\xd3\\x84>\\xc1>\\x8b\\x0c\\xbe2"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\x0eh\\xfb\\xb0g\\xbb\\xb3\\xbc\\x9eadhdjy\\xf1\\xads\\xa3,(\\xd0=1pc\\xaa\\x95)\\xed4\\x1e\\xbc\\x08\\x9c>\\xad\\x15|\\xe5\\xae\\xc0.>v\\xa0u\\xbeyj\\xaep\"s%\\xfc\\xa6\\xd3\\x12\\xe00\\x1a\\xf5i\\xa8\\x8dt\\x0c\\x05\\x98\\xfa\\xab\"\\xfc\\xbc\\xb14v\\x0b\\x8d\\xfb\\x0b\\xdd=t\\xedt\\xf7\\x8f\\xd9\\xbc\\x083\\xc8\\x007u\\xb2\\xd8\\x00$\\xbc\\xff\\xc5<`\\xf6\\xc1\\xdc\\xe1\\x0cu\\xe4\\x7f\\xa2\\xc5d6\\xc8ro\\x96\\xe5g\\x92b\\x98\\x12\\x9c^\\xda\\xd5h/\\xe3\\xbd\\xe0~\\x9a\\xad\\xc9\\xaf\\x98\\x1c\\xcc\\xa0\\xc1\\x9ae\\x96\\xe0\\xdb\\\\x05\\xa13ks\\xf4\\xad\\x9f\\x80\\xee\\xd4#\\x8e\\x9d\\xb9\\xc5\\xf0\\xb8s\\xec>t\\x9a&\\xcb\\x84\\x0e\\xa8\\x11\\xc2f1amm\\xfe\\x9c\\x91\\x994\\xf9\\x11\\x80\\xca3\\x1fb~\\xd36\\xad\\x96=\\xb1\\xa8\\xe8\\xf0\\x15\\xcb\\xf0\\xa22z\\xaf\\xa9\\x12\\x99\\xbd1' \\xa9\\x87\\x0fp\\xf5\\x92\\x01\\xad\\x9d\\x1d\\x1a\\xc0\\xba\\x16\\xfb\\xb8m\\x81\\x9c\\x91"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\x12\\x95p\\xfb4\\xa6p\\x94\\x16k&\\xb1\\xee\n\\xef\\xd2\\xa9\\xb3\r\\xe4\\xcf-\\xd5\"\\xeb\\x89\\xcc\\xabs\\xbc\\xa3\\xb8,\\x83av\\x95g6\\x80nr\\x1cg\\xbc5@\\x86\\xfc\\xcd\\xa0\\xb5g\\xc7m\\xf5\\x92;\\xc7u(ce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000'3\\xfe\\x19\\xb2|\\xb3\\xc9\\xd1d\\xe0\\xb5\\x1b\\xcc\\xc4\\xde\\x8a\\x02\\xab\\xbe\\xd4\\xe6$p\\x9ed\\x86z\\x8f\\xaej\\x93\\xf4\\x15\\x93\\xb1\\xe88\\xa3\\xd0r\\xe1\\xf3!4"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7e\\x92\\xe3\\x06*\\x043\\xbe\\xd6\n\\x8d\\xf8/,\\xb6j\\x9d\\x81\\xd0\\x0c\\xe2\\x1dxb\\xa6\\xe7\\xaac\\xee\\xe8hh\\xb1\\xa7\\xba\\xa8\\xb9\\xcf\\xc4\\xcd6%$>\\xa3\\xa7\\x1b'\\xaaz\\xda\\x80\\x94\\x7f\\xe0\\xd1\\xbec\\xf0\\x91\\xd9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6~\\x0c\\xcd\t\\x00`\\x06j\\x98\\x92\\x17a\\xc4@m\\x944#\\xcb\\xd1x\\xf6sp\\xa3\\x82\\x195\\x1a\\xc1\\xb2f2y\\x1f\\xb2\\xe3\\xc3t(/\\xc8\\x1bq\\xac\\x18\\x95"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~\\xce\\x90\\x83\\x80\\xaa\\x88\\xc0\\x8f'nc\\x16\\xa3\\x8ce\\xb4\\xbai\\x82\\xa3\\x8b\\x94p\\xd55@\\xa3y\\xc2\\xa1z\\xa5e\\xc5\\x17\\xeb*\\x139gs\\xb5\\xf4r\\x84\\xebl4\\xb6\nd\\x97\\x85e\\xb32\\x84\\xc8z\\xa8z\\xec\\xb3&e\\x1c\\xdc\\xaf\\x8fz\\xfab\\\\x94\\x8b)\\x0f\\x89o\\x7f\\xc69\\x11($\\xae\\x96\\x81\\xfbr\\x8a id\\xac\\xe7\\x8f\\xe4\\xd8\\x88i7\\xbd\\xb2\\x0b\\xe1\\xd9l\\x9f\\xc2\\xc5\\xf9~\\x90g\\xfa\\xce\\xde\\x1c\\xab\\x1f\\xcc|\\x02\\xa7\\xf8y\\x83\\xf6v\\xac\\xe9mp\\x8aea5>.\n\\xffj\\xcd\\xed\\x92\\xf4\\xb0\\x0e\\xc5\\xec\\xfbz\\a\\xb3\\x02i$\\xfb\\xb5|\\xbcksr\\x15\\x81\\x85\\xf8\\xa4\\xd7c\\xe0\\xdb(+\\xa7mm;an\\x89c\\xdf\\x12z\\xf6\\xb7-\\x95.w\\xd0\\xcf\\xd0\\xb9(<\\x94\\x04\\xfc\\xe1\\xc0\\xf8\\xea\\xa8cx\\x04\\x04\\xd7\\xc7z+\\xbcs\\xb0\\xa8\\xcf\\xad\\x01\\xcc\\xc1k\\x9c\\xe3:\\xce`\\xef\\x82\\x01\\xddc\\xe7:\\xdb\\xe4d4\\x8b\\xc7\\x98\\x87\\xea:"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\x8f;\\xf7\\xad\\xc3t\n.\\xbb5:\\xadp\\xdb'\\xdc\\x95\\xf6m\\x98n\\xa8\\xdb\\xb5\\x85\\xfa\\xb6/\\x95\\x1ea\\xbe\\xf4\\x01y\\x18\\xe3\\xa0\\xb9'\\xbf\\xa7\"\\xe5\\xc8\\xcbi\\x03\\xc9\\x1fu\\x08\\xb6\\x02i,\\x8b\\xfe|'-e\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6\\xd3\\x93\\xbd\\xb6\\xcd&\\x08\\xa9\\xc6hp\\x89 \\x1f\\x1a\\x18\\xe5\n\\x8e\\xd7\\xd6\\x92&q<\\xf1s\\x7f\\xba$\\xb8\\\\x9b?\\x97\\x0e1d\\xef\\xf2c\\xfd\\x93?"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\xe0\\xd56g\\x80ck\\xe5q\\x830\\xdb\\x08\\x08\\x0f\\x17\\xa6k\\x9e\\xa34\\xc8\t\\xc2\\xd3\\x983l\\xba.\\x96\\x85\\x19\\x90b\\xad\\xbc\\x86\\x97g.dgp\\xafm\\x95\\x84s\\xfc\\xcc+_\\xd9\\xc5\\xe1\\xd6\\xf6\\xffh.\\x86\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!\\xd8\\xf9l\\xf1\\x15\\xa4\\x18\\xd7\\x00\\x98\\xd02\\xafzh\\x8c^'\\x90\\xaa\\x14\\x91q\\x14\\xd4\\xf5\\xea=4=\\xact)\\xe0\\xc7\\x9d\\xebep\\x15\\xcf\\x03%o\\xb4\\x7f\\x04"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\fpa!?\\xe4\\x87\\xdb\\x08-\\xb0\\xe1npq\\x18\\xa6\\xa3gg\\x8c\\xd642\\x8e\\xd8jy\\xa2\\x172\\xb2\\xf2\rz\\xa2z\\x18\\xc3\\xdb\\xfecx\\xdc\\x00\\x80\\x15\\x170\\xe3\\x127ht\\x06c\\xe1n\\x8f\\x16\\x8fq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\x8f<\\xb6a\\xc9u\\x83\\xcb\\x9ckk\\xa5z\\xa9\\xa0\t\\xcf\\xf7\\xa8\\xc8d\\xc2\\x8a\\xfbi\\xc6\\xc5\\xbc\\xfbpz\\x90z\\x9dhy\\xcd\\x9brs@:\\xcdo\\x1e"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\x93\\x9d\\xd82\\xe5kz\\xea\\x1e&\\xe5\\xde\\xb7\\xc78?\\xc9\\xb4#\\x82\\x08\\xc4\\xba\\x93s\\xd6o\\x11\\x177\\xf1\\xafj\\xc9\\xe6,o\\xcb\\xf3q\\xb6\\xf0\\x9f\\xd6\\xfe9\\x9f\\xd9sx\\x93\\x1a\\x06\\x9cw\\xbd\\\\xe5\\xf1\\xea`\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xc7fp\\x7f\\xfd\\xdc\\x9c\\xc5:\\xe4\\x87\\x94\\x1aq\\xb8\\x88\\xe0\\xbf\\x8f\\x1ep\\xb9\\x80\\x88$\\x7fu\\xef\\x0ft\\x84oq<av_\\x92;sm\\xcfzm\\x878#"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xea\\xad\\x8f\\xb0\\xb1\\xf2\\xab\\x01(\\xc2 \\x83)\\x16r\\xc4!z\\xe9x\\xcd\t\\xaby\\xee2_a'\\x15\\xff\\xda\\x90\\x9d\\x86\\xa9\\xa0\\xe3\\x8a\\x7fv\\xca\\xdb\\x1e\\xd5\\xa2\\xe1\\xd5\\xebh\\x82\\xb9\\xe8\\x92\\x12\\xe2a\\xd3x\\xdb\\x1a\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bv\\x8b\\xf7o\\x95\\x85\\x19z\\xe2u9u\\x0e0\\x7f u\\xf6\\x9a\\x8f6\\xb1\\xc5`\\xd0\\xb5n\\xed\\x1f\\xc6\\xd5\\x89?\\x1c<y\\xdd\\xdf\\xbc\\x90,\\x9e\\xe4\\xda\\xe8\\x81\\x0b"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xd4\\xd8\\x93q\\xa1\\x00\\xdd\\x9a\\xdb9\\xf7uz\\xa6x\\xd5\\xf8\\x17\\xe5\\x9f\\x93\\xb2j\\x92\\xd4\\x99\\xfd\\x12\\xc0#q\\x82z\\xf3\\xad\\x8cj\\xca\\x19-\\xf05\\xee\\xba\\xca\\xb5\\xa50\\xee$u\\x10\\xda\\xe1\\xe4z`\\x8a\\x08a\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xb7\\x90\\xf6\\xa0\\xafy\\xe5\\x7f8\\xda\\xdda\\xec\\x82/>\\xfbzlz\\xc9j25\\x19\\xff\\xd3=\\xb5\\xe3|0igidq\\x97\\x7f\\xe3\\x16\\x83\\x01ve\\xe1'"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mj\\x0c\\xcd\\x8cc4\\x84\\x9dr\\x00\\xe7\\xaaq\\x04gt\\xfd\\x1d\r\\xd9\\xd5ab\\xcd\\x8bxa\\x95\\x08!\\xd0\\xe93\\xfelr\\xe3\\xad\\x8es\\x0b\\xa1\\x16\\xa5#\\x07\\x08 \\xad\ri\\x0b\\x83n\\x8ey\\xfa8\\x85\\xce\\xbd\\xbc\\x9d\\xa0?\\xbd\\xbar\\x88\\x7f\\xc3#\\x03\\xb31~c)\\x8a\\x00c\\xfe\n~\\xc9\\x8db\\xbf\\xbd\\xad\\xa2\\x80\\xd89\\x94\\xc9%\\xd3\\xe1\\xbd\\xa6\\x8c\\xf3\\xe10\\xb2\\xd8\\xbf\\xe4\\xef\\xd0\\x87\\x86n\\xc9e\\xa1m\\x08\\xa4\\xb5\\xd2\\x19\\xf3\\x08\\xe6\\xcf\\x12\\x01\\xdfd\\x8f\\x95_\\xf2b|s\\xc6\\x9d\\x0e\\xb9\\x0c\\xc2\\xbe\\xe7jk\\xd0\\xe7\\xff\\x95\\x03\n\\x80=\\xb2j\\x13\\x83\\xb1'o\\xa0r\\xc3\\xa6\\xa9p\\xf0/p\\xb8 \\xb2d\\xd4\\x114\\x80._\\xb4\"\\xcfh85\\xf3\\x13\\x8de)t\\x9b\\xdah\\x18z\\x13\\xbco\\xb0\\xc6\\xd8\\xdc\\x8e\\x9a\\x94\\xf9 \\x08\\xedy\\xff;\\x9e\\x00\\xaf\\xe5\\xaa\\xa0\\xbe\\x9e\\x80\\x94l\\xd0;\\x13\\x00\\xee3\\xac\\x8b\\x7f*\ne\\xcf\\x84\\x1c\\xc8\\xe5&gqo\\xa2"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\x87\\xb2j\\xb1\\xad\\xf5\\xf9kko\\x1e\\x84y\\xcdp\\xc7mm\\x0b\\x10\\xa0\\xe0?\\x80\\xdb_@\\x96@\\xfa\\xa03\\xe6nx\\xa96\\x15\\x9d\\xbf\\x16\\xf0\\xe4\\x93\\x11b&h+\\xa1\\xe8\\x94/\\xd8\\xb4\\xc6kz\\xdf3\\xa6q\\xf4\\x86i1\\xbfl<w?)\\x0e\\x823ecp\\xbc\\x1d\\xeb\\xbf\\xd6w0\\xf4\\x1do\\xd7\\xc5x\\x1bhdvh\\xcb\\x14\\x8b\\xb2\\xe5\\x95z\\xcb\\x85a\\x03\\x9b\\xdc\\xc2\\xfdd&\\xfa,\\xabe\\x90b\\xab2e\\xfd\\xb0\\xb6\\x01\\xf2\\xfck\\x91\\xd0\\x15\\x9fs\\x06\\xfc\\xc1\\xe3p\\x1e$\\xf0\\xdb\\xb7\\xb0\\xae\\x0e\\xe2\\xa4\\x86\\xa4m7\\xfa\\xd9\\xd9.\\x1c+h\\xc0\\xf3\\xbb\\x1cl\\xfe\\xb7\\xe2\\xfb\\x11\\xfe\\xddy(g\\x19j\\x9f\\xc0r\\xa2\\x88\\x89\\xca\\xc6s\\xe6a\\x16?s\\xeb\\xd8\\x7ft\\x16\\xab\\x08\\x00h\\xac\\xf1\\xe7<\\xaad\\xd0\\x1f\\xa3\\xb4a\\xda\\xae\\xb4\\x1bo\\xa8b\\xd6iyi\\xce\\x04\\xaatan\\xee\\xcd\\xf2\\x95~.\\x0c\\xa4k\\x13c\\xbcf\\x838z`\\xc7\\x89\\xef\\"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xf0\\3\\xad\\xf6`no\\x95\\xa4\\x96\\xb9\\xd7\\xd5\\x9cv\\xd1\\x14\\x1e\\xaf7d\\x92\\xce\\x0be\\xda\\x888\\xfd\\xc9t\\x9c\\xe8\\x85\\x91\\xda\\x97\\x15x\t\\x88\\x9b#\\xf6\\x80o\\xe2w\\x99\\x9f\\x06\\xb6\\xce\\xb7\\xb1\\xc4\\xf6\\xf8\\xfe\\xae\\xb2\\x18\\x81\\xa4\\xa0\\xf9z\\xaf\\x9al\\xd07\\x9c\th\\xad\\xb5\\xa5\\xa1x\\xba\\x9d\\x8d\\xa1`\\x97\\xca\\x96\\x1b\\x14\\xaf't\\x9c\\xdbu\\xa4-\\x84\\xef\\xaf\\x95i\\xf3\\xfaqba\\xdc\\xb0\\x1erxnb\\xa9\\xf6\\xbfv\\xa8\\xd8\\xaf\\xc1\\xe6\\xfb\\xf4\\xb2w\\xfc\\xabr\\xc1\\x9d\\xc8\\xb0\\x1a\\x9cx\\x1f\\xc8\\xf4\\xef\\xdf+\\xbf\\xb1\\xf7#2\\xa0<\\x98\\xd1\\xf2l\\xe6\\xa4\\xda\\xf9\\xf8\\x8d8\\x9a\\xe6|\\x1d\\xacq\\xfa\\xb2\\xf0c\\x8c\\xef\\xfc?\\xbd`\\x12rneuh\\xeb\\x1e\\x9b%\\xb7\\xaf'\\xdc\\x92c&\\xc8q\\x17k\\xcdu\\x10\\x93\\x14\tl\\xde\\x19g\\x0b\\xa0g\\xc6f<$\td\\xdf\\xb4k\\xea\\x7fba\\xdd j\\xccn\\xc4\\xe6\\x9f\\xfco\\xd04\\xb0\\x94$t\\x90\\xeb\\x1d\\xfd"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x7f>=\\x87o\\xb6\r\\xc9\\xb5b\\xc3j\\xc0\\xb7\\xd5\\xd7u\\xdb\\x13\\x1e\\xe9\\x97\\xe2\\x9b2d\\xe5\\xa1\\x9d\\x1ah\\x996\\xa4\\x92u\\xd6\\xebm\\xc8\\x88\\x060>\\xbcg\\x9b\\xd8\\x97\\xf7\\xf7\\x08!x\\xc3\\xff\\x865\\xfd\\xa7\\xd9f\\xbb\\xa8\\xff\\xe3e:\\xb2:~\\x9f\\x0c\\xf1g\\xff\\x82\\xa6\\xd4\\xa6e\\xdd?\\x03r\\x90\\xf5q_\\xec\\xc1\\xc5\\xf3c\\xa3\\xb3\\x85z\\xfc\\x88\\xfb\\xa2\\xdf\\x0b\\xefu7\\xc9\\x90\\xde\\xaa\\x99\\x12o\\xde\\xc1\\xa5udb\\xaa\\x0c\\x9e\\xbcw<\\x02nb\\x0fit\\xe0\\xfd\\xc9\\xc25\\xcf\\x00\\xb01\\xfb\\xf9q8\\x1d\\x86\\x90\\xb1\\xfb\\xc8\\xea\\xa8\\x8dq\\xaat/\\xf8\\xd9\\xdf0\\xcc\\xf7\\x97\\x94\\xc6g\\xaf\\xf5\\xfa\\x16\\xcf\\x0cf4\\x9c\\xd3\\xb6uc\\xab\\x8d\\x19\\xc1\\xd9\\x1f\\xe9ay\\x0e\\xe9\\xb9\\x8f\\xd7\\xd6\\x1dj\\x1d_\\x0c\\xafx\\xfc\\xff\\xf0@\\xde\\x06\\xcf\t\\xf7-\\\\xf6x\\xd1\\xb2\\xf2^\\xaadp\\x8c~\\xd2\\\\x0b\\xd1\nkx=\\x109\\x9c\\xb1\\xcf\\xbe\\xc8\\xe3\\x17;\\x95"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0et7`%\\xfa\\xeb\\xd7\\xb1\\xd7o#\\xb6\\x00\\xf1\\x14\\x8e\\x0e\\x19\\xd7w\\xfc\\xb4\\x93\\x8b\r\\xd9\\xc0\\xfes\\xad\\x8e\\x15\\xb9;\\xaf\\x81\\xc4\\xc8\\xf3\\xdc\\x10\\xc1m\\x9f*\\xb0\\xa32\\xab\\x1e\\xae2\\xd7f'l\\x0c\\x1a\\xc0\n:\\xaf4\\x97\\x9b\\xcd&\\xa5g~\\x8c\\x1b\\xa3.\\xaa\\xf6\\xf5\\)\\xaf2\\xe9\\xcfz?\\xe6\\xb59\\x05\\x93\\xf4z7\\xc9+\\xd7c\\x9f9n\\x04mp*\\x03$\\xc9\\x8e\\xc2\\x12r\\xc5\\xe3*|6\\xd9e\\xfa~m\\x12_s\"\\xafv\\xd5dryy\\xc2\\x87\\x11\\x0b7\\xd6bs\\xff\\x92\\xd2\\xd6\\xf6f\\xc8k46\\xa2k\\xc5i\\xadw8\\xc1\\xc0)\\x1f1\\x95\\xc0s$\\xf3\\xad-\\xd5\\x1b\\xc7\\x85>\\xdf\\xbf\\xe1\\xa2\\xb7\\xecwn\\x8b\\xc8?\\xc9\\x8c\\xdf\\x86ti\\x88\\xf6\\x07\\x12h\\xa2tig\\x13\\xb6j\\x86\\xd6\\x08\\xf2o0\\x08\\xa8\\xeb\\xf8q.sa5\\xb3u\\x95\\x84n\\xadmf\\xf5\\xf0\\xda\\xd4\\xb0\\x18\\xdb\\x0cxnoq9\\xc7\\xae9\\xe4\\xa5"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\x1d\\xdd\\x8d+p\\x8dj\\xafj\\xb9\n\\x8b\"\\xd6\\xa0\\xaf\\x0b\\xf2'm\\x8f\\xf8\\xddzg\\xdf\\xb68-\\xd7\\x94t\\x1d\r\\x96\\xc1\\xfby\\xb4\\x98g\\xb6t\\xe0&6\\x9b+n\\xc2\\xb7\\x13\\x03\\x18\\x87\\xa7x\\xba\\xd2\\xf2an\\xd6b\\xd9v\\x9b\\x94\\x17\\xc6e\\xfb\"\\xb0\\x11xtc\\x1c\\xbfhd\\xff=\\xbb\\xc3\\xda?\\x97\\xc3w\\xea.4\\x87m \\xbckj\\x8f\\x0ewk\\x05o\\xe1r\\xde*y1\\xf1\\xef\\xeer%\\x1d\\x82 \n\r\\x08\\xf2b\\xaa\\x91t-|\\x87\\x94\\xda\\xe4\\xbb\\x16\\x8d\\xbc\\xa1\\x97\\xb6\\x9e\\xefm\\xc6~\\xe6\\xcc\\x8e\\xe6\\xae\\xa0\\x1er\\x89\\xa6\\x04\\xa3\\xc1n:\\x15\\x8b\\xca!\\x1b?\\xe3$_\\xf1\\xb8\rg\\xa5\\xc4\\xa7\\xf8\\xb9\\xde\\xeb5\\xc8\\x1e7m\\x8f\\xddw\\x12\\x9fsn\\xa8\\xf8j~\\xc1\\x99\\xf1\\xb7\\xa7\\x81\\x95\\x82\\xf9\\xb3\\xe9\\xb0\\x9b+\\xd4/ui\\xc2\\xbb\\x02,\\xa8\\xfd\\x12\\xb5\\x97)\\x1d\\x97h\\xf5?\\xa7\\xc1\\xf9\\x7f\\x11r\\x9a\\xaf\\x96\\x86\\xe2\\xe2\\xaen"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8l\\x81\\xc8\\x1axk\\x08o\\x89\"\\x01\\xae\\x83\\xe2\\x8f\\xb5\\xa5\\x90pj\\xea\\x92\\xcd\\x1e,\\x9d\\xa8-\\xd6*;\\x1fdf\\xfe\\xfe\\x9e\\xf9$\\x01&\\xa9\\x8c\\x1cp\\xecfki\\x8a\\x96\\xbc\\x0b\\xa5\\xfc\\xbb\\xe3\\xee-f\\xae\\x80@\\x95\\x8d\\xa3\\xb5\n\\xddkw\\x86%\\x7fr\\xaf,\\x0e\\xf9\\xec\\x99\\x19\\x86\\x07\\x8d\\x1e\\x80\\x91iqv\\x1fh\\xa9\\xc2m\\x01\\xe5\\x07\\xee\\xde\\xebj\\xcc)\\xc5\\x91egy^\\x89\\xaa\\x80^\\xda<\\xef\\xac\\xcc\\x1b\\xc8\\x8e#r\\xa1:^\\xa4\\x95*\\x00\\|!\\x02\\xe55\\xdd\\xf1\\x93\\x17g\\xd3\t\\xfab\\x12\\xd8k\\xb6mow\\xf6\\xb3\\xb2\\xe3\\x9fj\\xe1\\xeb\\x04v\\x8d\\x17\\xcd1d\\xbc\\xc697\\xcf\\x94\r\\x03\\xb9\\xf5y\\xb3_\\xff\\xa3\\xd8\\xa3\\x03\\xe2\\xfb\\xb3zu\\xa3v\\xc6\\xb7;\\x8b\\xce/f\\x89)\\xb6\\x07\\xf9\\xcc$\\x17\\x9a\\xf8g\\xe5/jbs\\x9e\\x82\\xb9\\xde\\xf5g\\x01\\xfam\\xbe_3\\xb7\\xd3\\x89\\x08\\x12\\xae\\xecu\\xbaz\\xe2\\xba\\xea\\xe8\\xf0\\x16"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08e+\\xba%?\\x01\\x1c\\x98\\xf0l\\x12\\x1b5\\x1e\\xcd3md\\xaa\\x80\\xa9\\x03\\xc0'=\\x90\\xff\\xa1\\xf5su\\xbcz\\xa6zk\\xf3\\x05|\\xf1\\xfb\\xb7\\xee\\xc3\\x1f8w#;\\xcej\\xb3\\xe2\\x16s\\xfa0\\x9dr\\x91\\xa8;0\\xc6\\x9eo)\\x8b\\x0euz0\\xe3\"4a\\x00\r\\x83\\x7f\\xe8\\xb3\\xe2\\xb3\\xb1o\\xa7\\x05\\xbfemx\\x1a\\x97\\xfe\\xab\\x92\\xd2z\\xf0=\\x99\\xbf\\x90\\x08\\x1ee\\xb7>'\\x87e(\\xba\\xf0\\x05\\\\xa1s\\xd59|\\x89\\xd0\\xf30\\xf2\\x89~\\xb9\\xb6\\xd5\\xb6\\xb1g\\xac\\xc4\\x91\\x90\\xb3\\xce\\x0c\\x1a\\xb1_\\xe3\\x84\\x16_j;\\xca\\xa3\\xac\\x87\\xf1\\xc5\\x07\\xdd2\\xdc!\\x8c\\x17\\x8a\\xd8\\xdf\\x97mg\\x19g4 \\x0e&\\xd8\\xfd\\xf7y\\x16\\x15\\xe0\\xc7y\\x87uj\\xc5?\\rp\\xdd\\x8f\\xfc\\xeb\\x04\\xfa\\x12\\xa9\rk\\xa7\\x9f\\x17rn\\x1bl\\xba;\\x1a<,\\xc9\\xd87vh\\xf6u\\x08\\xb9\\xfb\\xb7%\\xbct\\xc7e\\xb8%>\\x82u2\\xc04g\\x0b\\x1d\\xd2\\xd9\\x81"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd45\\xf33\\x86\\x81\\x83\\xf9\\xff\\xeb\\x80\\xef\\x9bj\\x9ez\\x91\\xef\\xcak\\x0e\\xf8\\xd0\\xbb\\xf2\\xf3#\\xd0\"q\\x98\\xb5c\\x01\\x8e\\xfe\\xc5\\xe1 y\\xb2\\xd8:\\xbf\\xa6zn*\\xe6evwl\\xf9\\x82\\x0b\\xf8!\\x97\\xd2^\\x10\\x1a\\xce\\xaf\\x8fpx\\xa6#\\x94\\xbe\\xbfd:0\\x99\\xf3\\x81\\xe4\\x1d\\xc3\\xf1\\xc8\\xea\\xadyg\\x19\\x87\\xd2\\xc4\\xa0@\\xe0\\x83o\\x9fx\\x8d\\x8a\\x07is\\x8033\\xdd\\xbb\\xfaw`\\x9b)\\xa4\\xaf&y\\xbf\\xb4\\xcb\\x86\\x87\\x11\\x06b''\\x9azm\\xd6\\x84\\x03\\xdc\\xe4\\x1fi\\x94\\x97\\xf5\\xd5\\xec\\xd1l\\xbf\\xdei\\xc8\\xd5e\\x13d2\\xf9\\x1c\\x08\\xc2\\xb7\\x8b(\\x1fw\\xaa\\x14\\xf1p\\xff\\xb3m\\xffe\\xae\\xe5i\\x7f\\x0c\\x06\\x8f\\x04\\xe1\\x1b\\xbbf\\xdbp\\x9d\\xaf`\\xb35\\xe5\\x16v\\xea(\\xcf\\x1f\\xd6tz\\xf8lpd\\x0bn\\xfe\\x89\\xed\\xf1\\xfc\\xc3\\x0f9\\x81\\xdb4\\xb2\\x06;2\\xb1\\xce\\x93\\xaed*\\xf7\\xf9\\x91\\xf6i.\\x87p\\xe3\\x15\\x8b\\xf92\\x17\\xd3\\xdb\\xb5\\xe5"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xf0kap\\x7fbg\\x90\\xa2\\x1dq\\x0e\\xa2\\xab\\x84\\x8a=\\xb3i\\xca\\x9a'\\xb7g\\xd1eb\\x12n\\x04+3e\\xa2\\xfb\\xde\\x9f8\\xd3\\xc1?\\xf7\\xdby+\\xa6w)\\xbb\\xd4z\\xbb\\x83v\\xa1l\\x90\\x89\\xdc\\xbd\\x8e\\x92\\xb9\\x9f\\xb25x\\xa6ga\\xfc\\xa2\\xfa'\\x17%\\x1d\\xb5\\xda\\xdb\\xf1sw=\\xf2\\xed~\\xc2\\x9b\\xc7q\\x86\\x9c*\\xbeyj\\xec\\xc1.\\xb9\\x84\\xc8\\xbar\\xa8w\\xa2\\xefz\\xe4:p2\\xe70\\xda\\x8b=\\xff9`\\xcd\\x16p\\xf4\\x83i\\x93\\xf4lkyx\\xcc\\x98\\x9e\\xf8md\\x08\t\\x9fm\\xb1\\x06\\xc7\r\\xd2\\xe69\\xe3\\xb4\\xee\\xe2t\\x0bk\\xceu\ng\\x97\\x0e\\xaf\\x04\\xc2\\xd3'\\x9an\\xc9\\xd1\\xb0\\xb8\\x1d\\x02\\xdf\\xe8z\\xcb\\x9d\\xc6\\x1f\\xdex\\xf5k\\xce\\x0e\\x0e\\x8a\\xff\\x10\\x069\\xeb\\xc4\\xe7\\xd37\\xe9\\x0b\\x81\\x8d6\\xdd\\x10+\\x83\\xc0\\xc4rs\\xe6\\xcc\\xc0i\\x80\\xdf\\x86\\xed\\x04=`\\x14\\xda\\x8c\\x0e\\x88s\\x05\\x1cf\\x18\\t\\x0b;c\\xc5\\x8d?y\\xb7?w\\xd0."
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1\\x8c\\xc9\\xc1gg4\\x18\\xe9\\xb0\\xb6>\\xcf\\xfa\\xc5\\x18\\xde:\\x848\\xd2ybu\\xbew\\xa0\\xa3=u\\xf5\\x87\\x8e\\xb6\\xfc64\\xef\\x98\\xc6e`\\x959\\xb3\\x17\\x92i\\x84c\\x94\\xf9\\xd36\\xec\\xa6u\\xcdng\\\\x1b\\x9a\\xfe\\xb2$e\\xed\\x81\\xa2\\x06\\x82\\x01\\x7fuk0\\x08\\x8a^\\xa2\\xaa\\xd8\\xa5t\\xfa\\x17\\xf0j2\\xf1d1\\xbb\\x02\\xaew\\xad1\\xb3q\\xda\\xe4ug\\x1f\\xbe\\x1f\\xd0\\x98\\x97\\x17\\xa3\\xde4\\xd5\r\\xc4^?4\\xe2.u#\\xe6\\xbc\\x99\\x142l\\x930\\xe8\\xdb\\xc8\\x81h\\xde\\xa1\\xb8k>h\\xe2\\xb4q\\xe2bo\\x8fzlv\\xdb\\xaf4\\xc8\\xc1\\x1ee`b\\x89\\xf1\\xcb\\xcdd\\xee8\\xc1i\\x86\\x07\"\\x93\\xfd\\xc7\n\\xc0h\\xf7\\x87\\x8b\\x93h\\xf7\\xfb\\xf7\\xf6\\x0bo\r\\xa64\\xee\\xf9!^\\x8el\\xb7+\\x83+$c\\x043\\xb5a\\xce;eul\\xbf\\xa7\\x0f\\xf4\\xd3\\x06\\xe8\\x14hk9\\xf2d\\xed3\\xca\\xd0\\xe4h)\\xa6~c9z\\x14\\xa0\\x8a \\xf9\\xbf"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbb\\x96\\x9bq\\xd0\\xa8\\xc3r\\xb5\\x16m\\xad\\xc9\\xd0q\\xd7j\\x0b\\xbdfn\\xbb\\xf5;\\x9cv\\xcf\\x14\\xd1qqz\\xa0\\xd3\\x0c\\xdd-\\xe3\\xf2\\x0e\\x10e\\xb1)k\\xf6\\xf4g\\x03d\\xf3\\x94u\\xbcy'a$\\xbe\\xb7`\\x86\\xb0\\x7f\\xa05\\xd7\\x0c\\x02k43\\xb2r\\xf0\\xba\\x8d\\x80\\x03\\x9c\\xd3,c\\xf5\\xeea\\xc3\\xeb\\x12\\x89\\x02g\\x0e\\x8f\\xe3\\xba\\xa0\\x1a>t\\xb7\\xa1\\xfc6\\xf7\\x133ofyve\\x0b\\xe1:\\x04za\\xc4\\xa9/\\x892\\xedc\\x00#\\x18~\\x8adw\r6\\xb5\\x03\\x01\\xfb\\xa5\\x86\\x98\\xeb\\xa1\\x11-|d\\x9f\\x92\\xea\\xd4\\xf6^\\xce~\\xfe\\x0e\\xb1\\x12\\x87\r\\xff\\x9cs\\xb2p\\x02\\xcc\\x9c`t\\x0b\t\\x110\\xbc\\xfb\\x99\\xc4`\\x83\\xbdx\\x84\\x0f\\xed\\xc5\\x13\\x1f\\xe3\\x01\\xdc\\x1a\\xcd\\x03\\xdf\\xca\\xdd\\xbb\"\\xe2 \\xd1xgo\\x02\\x0f\\xe6\\x0e\\xbc\\xab\\xff\\x11\\x9c(\\xb0\\x90\\x10\\xe4\\xeb\\x87\\xbb\\xe3\\x90\\x83\\x96\\xe7\\x867\"\\xd1z\\xbd\\xbal\\xb7\\x9bc`\\x91&4s\\xb1\\xa0\\x9c"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\xe4s\\xc5s\\xca\\xd3\\xa5\\xf0\\xa8\\xe1\\xe7\\x1b\\x90\\x82~#\\x08\\x8c\\xf3n,<\\xf8\\xe1\\xf2\\x1f\\xd6u\"9\\x94\\xc7\\xd1|\\x13\\xf9\\xd2\\x07\\xe6\\xa1\\xa5fv\\xbf\\x86l\\xde\\xa2,\\xb6\\xa00\\x0b\\xcb%\\x14np\\xa0\\x9b\\x8a$\\xa9\\x80\\xfc\\xd9\\x9f3k\\x80\\xea\\xb8d\\x1bv\\xe0\\xe9\\xa1ogm~\\xc4-\\xe1\\xa7\\xd6\\xa7\\x9f\\xdf\\xd5\\xbe\\xfa\\xf9\\xcec)\\x8c\\x8d\\x80\\xf7pb\\xa6h@\t\\x87jro\\xe6\\xdc\\xc5\\xcc\\xe8\\x18\\xf8\\xba>9\\xb2m)\\xd7g\\x85\\xc47\\x16\\x8a\\xdak\\xadwm\\x92v7u\\xf5^iby\\xf9\\xebk\\x92\\x03\\xf4qr\\xfep\\xbb\\xb9:4r\\xc7j\\xc2\\xa44\\x8b\\xcf\\xc0\"\\xef\\xaa\\x1e.\\x96\\x14m\"\\x05q8=k)\\xb0\\\\xday\\xe9\\x1d\\xf0\\xea\\xdd\\x8b#r\\xce\\xe5w\\xe6\\x188\\x9cy\\xd4~\\xde4w\\xb2\\xc5s\\x7f5.t+\\x93\\xf7\\xc98\\xb3\\xf2z \\x0e\\x88ha\\xda_\\x08\\x19\\x8e$\\x00-y\\xfc\\xdf\\x13fio\\xff\\xf1\\x8e"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xf8\\xb60\\xa5\\x9c6(\\x9aco%\\x06\\xb6\\xd2\\x19p\\xf8\\xe9r\\x9acu>u\\x18#rb\\x93f\\xf9\\x08\\xbb\\x9e\\xd2\\xd5ws\\x7f)j\\x8e$\\xb1\\xa69\\xb2yp\\x0fw/ \\xee\\x07x\\x9c\\xc3\\xa0s+\\x96\\x93\\x00\\xd4\\xaeb>\\x8fi\\xf4/\\x0f\\xe3!\\xc8f\\x9c\\xd9\\xa6\\\\xea\\xa4sh\n~t\\x15\\xb3&\\xf4\\xb3sv\\xd0$b2\\xd0\\xb1fp\\x1a\\xa6$\\xa1\\xec\\xb7,\\x85\\xf9\\xde\\x95v\\xba\\xf4\\x99?\\x1e\\xf1\\x1d>\\x0ex\\x9dk\\x05\\xad7\\x171\\x83u\\x91\\xc4bxpp\\x14x\\xbf-w\\xd1\\x04\\xab^\\xda\\xcf\\xc8/iz\\xcch2\\x9fbh\\x83\\xec5\\x1ch\\x8c\\x19\\xaf>\\xa5\\xa7b8\\xe1\\xaaol\\x97k\\xebtk8\\x08\\x97l+'\\xb8\\xa2d-\\xcf\\xbe\\x10\\x8c\\x98\\xabe\\xf4\\x84z\\x8f\\xe7\\x03\\xaf\\xe1\\x1d\\xad\\xf2m3z\\xa8\\xa3\\xd4g\\x0bk\\x01\\xa3_\\xed\\xa6\\x1e\\x1f6\\xca\\x92\\xac\\xef\\x81\\x85\\xcb\\x98k4+\"\\xeb\\xca\\x99\\x14t\\\\xae\\x9f"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\x1b\\x005zp\\x0c\\x1be\\xcf\\x14\\xd1\\x1dg\\x04\\x9dv\\x0b;0\\xd5:k\\xad\\x08!u^\\x9b\\xe9\\xbe\\xe6\\x02\\x9cf\\xc0p$\\xd6!\\x85r\\x1cy\\xe6\\xe9\\x07\\xb6\\x84\\xe0w\\xcc\\x08,7\\x93\\xce\\xe2h\\xd0b\\x9b\\xae;x\\xc6m\\x9a?\\xff90i\\x06h\\xa0\\xf3\\x01\\xf4\\xa8.\\xf1\\xd4qf/\\xb0a\\xad\\xcaa\\x9bn8q3(s\\x1f(\\xb6\\xc1\\xe9\\xda\\xfe\\xd9\\x00\\xd6\\x89\\x08\\x9e\\xb0\\x8a#q\\xa0.^\\x14\\xae@\\e\\xc2c\\x97\\xd5\\x0e\\x80t\\x99\\xa4c\\xd6'\\x91\\xe7\nk\n\\xf4\\xbd\\x86t\\xa3>\\xf4\\x12\\x18\\x87\\x04\\x9a\\xab\\xcf\\xec\\xc3\\xe9\\xe9\\x8ds\\xcd\\x93_s\\x1ce\\x97\\x16\\xa3\\x81\\xad\\xdb\\xa2xw\\x1a\\xf6t\\xb4\\x10c\\xbe\\xe0\\xcef\\xc8\\x848\\xabt\\x04\n\\x11k^\\\\x1184\\x98\\xdbz<8\\x8c\\xd5\\x9b\\x9f\\x84n7\\xf6i\\x98\\xfb\\xad:c\\xe2\\xb8o\\xdf'\\x92\\xf5\\x1c8\\x9c\\x15w\\xf1l\\xf3\\x18\\x13\\x81\\x19\\x7fl\\x14\\xa13\\xad8\\xa2\\x8bt>"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\x08\\xe7vf\\xed\\xad\\xd7\\xbd;63\\xab\\xda\\xe4\\x191\\xea\\xc3\\x88p~\\xe2\\x83\\xccrf\\x02\\x81\\xd1m\\xf2\\xeb\\xdd9\\x82nvc\\xe4\\x14o\\x97\\xe7#4\\xde>\\x9f\\x8a\\xb6\\xa1\\x07\\x03\\x1b\\xaf\\x8e\\xba:\\x9af!\\x074\\xc3\\xa2'\\xa1`k\\xa2\\x13\\xe7\\xa9\\xb7\\x87\\x1d$d,\\x00\\xf3\\xfb\\xa6y\t\\xa9\\xe2\r\\xd6\\x8ck\\x16\\xfd\\xaf\\xb49qq-:\\xd1\\xa8;\\xcd\\x08\\x1c<f\\xea\\xb4\\xfbp\\xfb\\xe6#\\x01\\xaf\\x1c$\\x8byy\\xe3\\xdf\\x14j\\xed\\xc5\\x11\\x84\\xd6\\x9e`,\\xe4\\xa5\\xa7\\xe8g\\xf5\\xa9^\\x91fm\\x85x\\xf8.\\x1d\\x10$\\x0f4&hp\\x8f4e\\xec\\x8c3\\x93\\xb33e\\xd7;f\\x0ei\\xe1\\x814\\x05=\\x81mo\\xf5\\x97)\\xe8lj\\xeb\\xd2\\xa7\\xf6\\xc5\\x933 \\xeav\\xba\\xf0\\xaa\\xb51\\xbc\\xb4\\xf7z\\xe1\\xd4:\\x06\\xa9\\x0c\\xf3\\xba\\x85\\xf2 \\xc1t\"\\x9b\\x15l\\x94\\x93f\\xf0vh\\xad\\xe7i\\x0c\\xdc;\\x97\\xe0\\xc1c\\xc8d;\\xc1\\x8b\\xb4ur\\xb3\\x8c"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\x88\\xf7w\\x8cu<\\xa6\\x99\\x02\\x87\\x01d\rwq\\x01\\xef_\\x11_\\g\\xbc\\xee\\x1f\\xa9\\xa5ef\\xf4\\xf2\\xc3\\xd2y\\xbb\\xd4\\xfd\\xa0?\\x7f\\x0e$\\x84\tep\\xe9\\xe1r\\xda\\4\r\\xf0hj\\x13a\\xb2(\\xf2\\xd4r\\x01t\\x16\\xd3\\x98\\xed\\x8d\\xab\\xb1\\xc6o\\x8a\\xa3\\xf5\tzn:\\xb3\\x1c\\xf0\\x95$\\x02k\\xb7\\xea\\xe3\\xa2\\xa0\\xe1\\xc7f\\xd5\\xac\\xf1\\xcb\\x01\\xd3'\\xf3\\x9b|\\xc3_\\x83p/\\xcf\\xa1\\x13w\\xa2\\xfd^\\x9e(&\\xd7\\x83\\x82\\x85\\xa4\\xcdf&hv'zy\\xa8\\x13\\xbf\\x13#\\xbb\\x0el\\xc0)\\xaf\r\\x14-0\\xe9\\xcc\\xa2:\\xb5\\x036\\xd1\\xd8\tw\\xdd\\xd2\\xeb\\xcc\\x1d\\xb5\\xd2\\x13\\x87\\x06_\\xca\\xba\\xf7d!1v\\x06\\x1f\\x0e@(\\xc1\\x1anv\\xab\\xf0zx|\\x03\"y\\x88w\\xfb,\\x94\\x85\\xc7go6\\x15\\x06_\\xf8_;\\x11\\x9e3\\x97\\xed\\xd5w\\x97?\\x8d^\\x98\\xeb\\x9cz\\xf5$_\\x17\\xbae\\xc8\\x0et\\xdf0\\x9b\\x15#amg\nd"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89ge\\xfe\\xeb\\x0en\\x05\\x13j\\xf9\\xf5\\x951\\xb3\\xc3\\xbb\\xc2\\xf8~\\xe76\\x9e\\xfd\\x07\\xca\\x99_\"f)|\\xb5pb\\xcel\\x8a\\xfe\\xa2u\\x9dde;\\x19\\xf1\\xae\\xd8\\x98bu \\xefve\\x14\\x8c\\x0bk\\xc0\\x04$\\xa3\\x07\\xb4wl\\x9eq\\x93\\xcb\t\\xe3\\x87\\x08v\\xbb$l\\x8bx\\xff\\x9e\\xe2@\\xe4\\xd4g\\xbca\\xd3!\\xa5s\\xa5\\xce3\\x9e\\xd2/\\xed,\\xff\\x92\\x85t\\xc8\\xc3ry\r\\xc22h\\x1al\\x85\\xf6c\\xe7\\xd1u\\xf2\\xfc\\xe5\\xa0w\\x1c\\x16s \\xfc\\x9f\\x16\\xe0\\xacwo\\xc3\\xf7\\x94c\\x8d \\x9d@w\\xb7\\xf1f\\xf2`h\\x18mp\\x8a\\xbc:'pa\\xa8\\\\xed>-\\x14\\x99_\\xcc\\xa9\\xc1\\x19\\xc5\\xf1y\rw\\x89z\\x1f;\\xb6\\x0e\\xb8\\x90\\xdc/9\\\\xd2\\x94w\\x07\\xd5'\\xb4y\\xacy\\x1e#5@\\xfc\\xa2\\xd9a\\x9c\\x9c\\xf6\\xc9!\\xe57\\xf6j\\xfa%\\xef1\\xdf\\x98\\xfd\\x0en\\xa2\\xe1z\\xcdc$\\x91/\\xe6\\x18\\xc9\\x94\\xe3"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\x10\\x95/dq\\xac>\\\\x9b\\x1b*\\x8e\\xc8\\xd8p\\xe9%4-\\xfck\\xca\\xa9\\x90\\xd4\\xcd\"\\x03m\\x8f\\xe3(dyx\\x0b\\xec\\xc8\\xa9\\x00b\\xd2\\xf2\\x96a\\xb3d3`\\x19>r\\xc2i\\xaa\\xb4\\x00\\x0cn\\xcb\\xe4z\\x8b\\xaa\\xc2\\xc0,\\x0c\\x14\\x08f\\xaa\\x97y5\\xea\\xf0\\xbe\\xe9\\xaf1\\xab\\x97c\\xe6\\xc8\\x12n\n\\xbco\\xe6\\x8b\\x9btl\\xe6\\xb1\\xe7\\xbbl\\xd1\\xbf`,f\\x16\\xc9\\xda\\xf4?\\x87r\\x00\\x82\\xe3\\x88,r\\x9e\r-\\x9b\\xb7vv\\xbb\\x1b\\xad\\x9e\\xe4\\x94\\xf0\\x13\\xa6)\\xeb'\\x83\\\\xbcj=d\\x05\\x9fd1\\xcd\\xa7|\\xcb\\xb4\\xe0|i\\x15p\\xf4\\xad\\xbe\\xf1\\xfe\\xc4\\xbf\\xd6\\xc4\\xaf\\xee\\xde\\x97\\xc5\\x88ny\\xaf\\xd2q\\xc7s\\x9c6\\xab\\xae\\xd5z=\\xcd\\xbcx\\x81\\xe6gp\\x18|\\xfc\\x04\\xed\\xe4\\x01\\x03\\xbf'v.\\xd3\\xbc\\xa2(\\xcdkyzb\\xf6o\\xe8\\xd0\r\\xc9#_\\x03m\\x1f@\\xa8i\\x9et\\xd3t\\xc8\\x18\\x87\\x93\\xd3\\xb3\\xa4\\x9a\\x19\\xe6\\x11\\xfb\\xa3"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x11\\xde\\xb1\\xa6_cj(\\x97\\xd4\\xb8\\x11\\xb4\\xa2-qcy8\\xb0\\x80\\x14\t\\xed\n\\xe1d\\x8d\\xee\\x9c\\xfa`.\\x95\\xf8\\x1au\\xecj-.\\x07\\x18y\\xc7\\xc9\\xeb\\xf0\\xea\\xd5$bf\\xbf\\xa6\\xfe\\xe1d\\x07\\x19\\xed\\x8b\\x01\\xa0\\xdb\\xaf\\x7f8&\\xfe\\xfe\\xbf\\x83\\xbb\\xd1\\x7f\\x12\\x11dg\\x08l\\xa3\\xd6\\x9e\\xeb\\xe4dbd\\xf0\\x8b=fhy\\xcd\\xe9\\xd3\\xb4q\\xef\\x05_yfg\t8\\x99\\xfa\\xd8x\\xf1<do\\x8c\\xdd&%trcl\\x0ew\\x7f\\xc9\\xe2\\x1f\\xbb\\x94\\xcc\\xa8\\x01kmnt\\x02n\\xe6\\xa6\\xbb/x\\xaa\\xaa\\u\\xc7\\x89\\xa5\\x87\\x8e\\xdd\\xd5\\xabvu),\\xe3\\xb8\\x81*9g\\x94\\xe8@c\\xe1\\xe0\\x03\\xe4.\\xd2\\xaa\\xfd!\\x0f\\x9d\"\\xbfn\r\\xbe\"p\\x05\\xaa. \\x8c\\xc94\\x92\\x8e\\xc4f;~\\xa7\\x1f\\x89\\x88\\xd9\\xacds\\x1f\\xb2w,\\x95\\xd8\\x0c\\xe2\\x05\\xee\\x07\\\\xadd+vv\\xe8\\x84o\\xab\\xe9\\xf8\\xf0\\x18\\xfa\\x93\\xb0=\\x99b\\x86q\\xads\\x8ar"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xe7\\x88\\x8f\\x92p\\xac6\\xda\\x97\\xae\\x8c\\x13u\\x9d\\xd1*\\xb0\\x82\\xa8\\xe6\\x9f\\xec\\x9b\\xb7\\xb7\\x05r\\ \\x0b5/.\\x\\x0e\\x84\\x10\\x95rc\\xb2v\\xd3\\x99|\\xe7\\x8a\\xc9%#g\\xf7\\xfdt\\xb5\\xb8\n\\xb6\\x97\\xd4\\xc9\\x9c\\xee\\xe0\\xa6\\x84\\xb9'z\\xed|p\\xf8\\x0e\\xb1|\\xb7o/\\x94\\x14w\\xd2\\xa1lb\\xb8\\x1e\\x1c\\xe9\\x07\\xb5\\xa5\\xa2&\\x8f\\xfa%,c\\x06vykkd\\x0b\\xdc\\xf0\\xef\\xe4\\xf0\\xc1\\x84\\xdb\\xa3\\xf2\\x08\\x83q\\xdaa\\xe0\\x9c:\\xe3\\x0e\\xd1\\xe9;\tzlr\\xf3\\xde\\x1f\\x1a\\x0e\\x1a\\xe6\\xd7\\x96\\x84\\xc1\\xa1\\x1c\\xab\\x96\\xb5\\xed\\x9a\\x12f\\x1b\\xaf\\xbe\\xee\\xbcg\\xeb\\xa9\\xae\\xa974\\xdf\\xa5\\xb8\\xee\\x8d\\xa7;7\\xbd\\x11\\xbe6!\\x81-\\xdf\\xa1\\xc7\\x18\\x1f@\"\\xd6at.q(5\\xcc\\xe3\\x82\\xda\\xae\\x0b\\xd3\\xdfd\\xb4\\x1br\\x13\\x89bx=\\x9c\\x7fl\\x85\\x0cu\\x16p2\\xf6\\x12)\\x1d\\xeb\\xd4^\\x90\\xc2\\xfe\\xf3f73\\x1ad\\xb3i\\x00\\xa0\\x7f\\x15\r\\x99"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010br\\x848\\x8dp\\x17\\x81s\\xe2\\xa1\\x11\\xf8\\xe4\\xe8\\xa5m\\x92\\xbc\t\\x82\\xc9\\xbbg\\xdds\\xb0\\xb3\\xfe2\\x84\\xd4\\xc8\\xc2\\x82\\xe2\\x19_\\x8f.5\\xae!\\xeeq\\xcb`c\\xfe8l&x-@t\\xb1\n\\xc8\\xfe\\xb9\\xeeh\\x15m\\x80\"-\\x99\\xc7\\x1dm\\xe6s#\\xb5v\\xc9*q\\xee\\x19\\x91%\\xe2\\xf9\\xcd\\x80\\x9b\\xb4\\xa9\t\\xd1\\x1a\\x82j\\x9a\r\\xe4\\xb6\\xfa\\x08!\\x1b\\xf2\\x81q\\xe0f\\x03\\xab\\xaf\\xe2^p\\xf7\\xb0\\xa1*d\\x97\\xf3y2\\x80\\x98x\\xeb\\xdcei\\xa7$\\xb8\\x13\\xc8\\xc4\\xb5\\xc2\\x05f\\x94(d\\xf5\\xed\\x0c\\xb6\\xd3%91\\xaa\\x0f\\x12\\xcc\\xbev\\x8e\r\\xc0\n\\x85\\xf4\\xe2\\xd9\\x0b\\xb1z\\xff\\xc4\\xee\\xbf4g\\xedc|2\\xc9\\xb3\\xbd\\xf2\\x98v\\x1e\\xcf\\xf7\\xa1\\x10\\xb9z\\x9c\\x9c\\xc8\\xc5\\x1b1\\xe1\\xa8u\"\\x18# a\\xa7\\xe8h\\x17zuvpj\\xff\\x8d\\x1ce\\x89|\\x9dfs\\xdf\\x02\\x80\\\\x17\\xf2i\\x16\\xb3\\x80\\x836<\\xa8\\xfe\\xf0\\xf8\\x8a7\\xfd3q\\xad\\xfe"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xc7\\x9d;\\xd6\\xde-\\xf6\\x12*n \\x1bm\\x97@\\x07\\x8e~\\x87aem\\xbd\\xdc\\x9b|\\xee \\xa0un\\x92\\x0f\\xc6=\\xa3d\\x92\\x9c3v7\\xfa\\x96\\xf9-\\xff\\xc7\\x8dy\\xe8\\x18\\xb5\\x03,5\\xe2$q\\xba\\x80\\x855\\x1cof\n\\x14xx\\xb9\\xf4\\xc7\\xfa)b\\x10\\x9bv\r\t\\x8e\\x05\\xdb\\x125\\x1c\\xd2\\xd9\\x95\\xeb\\xac\\xc1\\x91\\xb1\\x11\\xa2\\x9f\\xe5\\xa5\\x10s\\x84\\xe4\\xe4m\\xad\\xcc\\xe5\\x01\\x94g\\xd6\\xa2|\\xf4\\xc1\\x8a\\xe0\\x9f*\\xa8\\x18\\x0e\\xa8k\\x83\\x07\\x9c`%m!n\\xda\\x03\\xd1m5\\xdc\\xc4\\xae\\xa4\\xbfg\\x0e4t|7\\xbc9ct\\xf4\\xfb\\x05\\xc0\\xd2!o\\xad7\\xb36\\xb8\\xa87\"\\xc1\\xd2\\x97z=\\xa9\\x1d\\x9eh\\xcfb8\\x1a\\\\xcb\\x00\\x1c\\x0elk\\xb7n\n\\x1f\\x0cru+\\xeb\t+%\\xcd|m\\xe7\\x11i\\xee\\xf9\\xf6y\\xcc@js\\x81ih\\xd3\\x02\\xb8\\x7f\\x8bo\\xc4\\x84y\\xd8>ss\\xeak\\x97\\xe2@\\x15$\\xb9\\xaaa\\x18a\\x93\\xb9\\x19+^"
  685.  
  686.  
  687.  
  688.  
  689. "Description": "Creates a hidden or system file",
  690. "Details":
  691.  
  692. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  693.  
  694.  
  695. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  696.  
  697.  
  698.  
  699.  
  700. "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
  701. "Details":
  702.  
  703. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  704.  
  705.  
  706. "FireEye": "Exploit.CVE-2017-11882.Gen"
  707.  
  708.  
  709. "McAfee": "Exploit-CVE2017-11882.yx"
  710.  
  711.  
  712. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  713.  
  714.  
  715. "Symantec": "Exp.CVE-2017-11882!g2"
  716.  
  717.  
  718. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  719.  
  720.  
  721. "Avast": "Win32:ShellCode Expl"
  722.  
  723.  
  724. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  725.  
  726.  
  727. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  728.  
  729.  
  730. "AegisLab": "Hacktool.MSOffice.Generic.3!c"
  731.  
  732.  
  733. "Tencent": "Office.Exploit.Generic.Pals"
  734.  
  735.  
  736. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  737.  
  738.  
  739. "Sophos": "Troj/RtfExp-EQ"
  740.  
  741.  
  742. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  743.  
  744.  
  745. "DrWeb": "Exploit.ShellCode.69"
  746.  
  747.  
  748. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  749.  
  750.  
  751. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  752.  
  753.  
  754. "Ikarus": "Exploit.CVE-2017-11882"
  755.  
  756.  
  757. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  758.  
  759.  
  760. "Avira": "EXP/CVE-2017-11882.Gen"
  761.  
  762.  
  763. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  764.  
  765.  
  766. "Microsoft": "Trojan:O97M/Obfuse.AE"
  767.  
  768.  
  769. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  770.  
  771.  
  772. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  773.  
  774.  
  775. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  776.  
  777.  
  778. "ALYac": "Exploit.CVE-2017-11882.Gen"
  779.  
  780.  
  781. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  782.  
  783.  
  784. "Zoner": "Probably W97NativeOnly"
  785.  
  786.  
  787. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  788.  
  789.  
  790. "MAX": "malware (ai score=100)"
  791.  
  792.  
  793. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  794.  
  795.  
  796. "AVG": "Win32:ShellCode Expl"
  797.  
  798.  
  799. "Qihoo-360": "virus.exp.21711882.d"
  800.  
  801.  
  802.  
  803.  
  804. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  805. "Details":
  806.  
  807. "target": "clamav:Rtf.Dropper.Agent-7062673-0, sha256:13fcd7db212d0b39f22451fb3daf4d7fbb7560894bacbe5f4406dc981b7d2b17, type:Rich Text Format data, version 1, unknown character set"
  808.  
  809.  
  810. "dropped": "clamav:Rtf.Dropper.Agent-7062673-0, sha256:13fcd7db212d0b39f22451fb3daf4d7fbb7560894bacbe5f4406dc981b7d2b17 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp, type:Rich Text Format data, version 1, unknown character set"
  811.  
  812.  
  813.  
  814.  
  815.  
  816. * Started Service:
  817. "osppsvc"
  818.  
  819.  
  820. * Mutexes:
  821. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  822. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  823. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  824. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  825. "CicLoadWinStaWinSta0",
  826. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  827. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  828. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  829. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  830.  
  831.  
  832. * Modified Files:
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_42586963a1334219d518c6a6c6cf08ed.doc",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_42586963a1334219d518c6a6c6cf08ed.doc",
  835. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF09C19B14-D859-44D7-AD83-D1C8176F4915.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  837. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  838. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  839. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  840. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7031.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7041.tmp",
  843. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF2B69D2C-EAEF-4A96-B5B9-8D98160833EC.tmp",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_42586963a1334219d518c6a6c6cf08ed.asd",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  846. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA4F512E4D720AB5A.TMP",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\cab80EC.tmp",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cab80FD.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cab811D.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cab819B.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81AB.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81FB.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8259.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8316.tmp",
  856. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  857. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8420.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8470.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8471.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84B0.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84C1.tmp",
  863. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  864. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  865. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8571.tmp\\architecture.glox",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8570.tmp\\Equations.dotx",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD855F.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85A1.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8571.tmp\\Content.inf",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8572.tmp\\CircleProcess.glox",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85C2.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD852F.tmp\\sist02.xsl",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD855F.tmp\\Content.inf",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8572.tmp\\Content.inf",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8570.tmp\\Content.inf",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8630.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD852F.tmp\\Content.inf",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8641.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8651.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8652.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A2.tmp\\ThemePictureGrid.glox",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A1.tmp\\ConvergingText.glox",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A2.tmp\\Content.inf",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8740.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A1.tmp\\Content.inf",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab87DD.tmp",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8916.tmp",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8975.tmp\\pictureorgchart.glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89A5.tmp\\ieee2006officeonline.xsl",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8975.tmp\\Content.inf",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89F4.tmp\\mlaseventheditionofficeonline.xsl",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8A54.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A66.tmp\\gostname.xsl",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A43.tmp\\harvardanglia2008officeonline.xsl",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A55.tmp\\chicago.xsl",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89A5.tmp\\Content.inf",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89F4.tmp\\Content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD4.tmp\\iso690nmerical.xsl",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A55.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD5.tmp\\ThemePictureAlternatingAccent.glox",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AF5.tmp\\TabbedArc.glox",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A66.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A43.tmp\\Content.inf",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD5.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AF5.tmp\\Content.inf",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD4.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8BF0.tmp",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8C6E.tmp",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8C9F.tmp",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8C7F.tmp",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E67.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E56.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E68.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E57.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E99.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E79.tmp\\HexagonRadial.glox",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E79.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EBA.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E9A.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8ECB.tmp\\chevronaccent.glox",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8ECB.tmp\\Content.inf",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F49.tmp\\BracketList.glox",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F49.tmp\\Content.inf",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F79.tmp\\ThemePictureAccent.glox",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F99.tmp\\InterconnectedBlockProcess.glox",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F79.tmp\\Content.inf",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F99.tmp\\Content.inf",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FF8.tmp",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FF9.tmp",
  949. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9009.tmp\\Element design set.dotx",
  951. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9009.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D7.tmp\\content.inf",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D6.tmp\\gosttitle.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D7.tmp\\Frame.thmx",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D6.tmp\\Content.inf",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  960. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A0.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94EF.tmp\\content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94EF.tmp\\Dividend.thmx",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95DB.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962A.tmp\\content.inf",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962A.tmp\\Parallax.thmx",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9977.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D5.tmp\\Headlines.thmx",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D5.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8C.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BCB.tmp\\Badge.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BCB.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C0B.tmp",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C99.tmp\\Banded.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C99.tmp\\content.inf",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D45.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D66.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DC4.tmp\\content.inf",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DC4.tmp\\Savon.thmx",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E04.tmp\\content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E04.tmp\\Quotable.thmx",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA587.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5F5.tmp\\content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5F5.tmp\\Wood_Type.thmx",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB19F.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB21D.tmp\\Feathered.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB21D.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC01.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8E.tmp\\content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8E.tmp\\Damask.thmx",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1C0.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC24D.tmp\\content.inf",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC24D.tmp\\Mesh.thmx",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDEEE.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B4.tmp\\content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B4.tmp\\Vapor_Trail.thmx",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE6B1.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8A6.tmp\\Insight design set.dotx",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8A6.tmp\\Content.inf",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx"
  1016.  
  1017.  
  1018. * Deleted Files:
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7031.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7041.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_42586963a1334219d518c6a6c6cf08ed.asd",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444fn=Basis.eftx",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444fn=Basis.xml",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444fn=Basis.xml",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8470.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD852F.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8570.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8571.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD855F.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8572.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8471.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A2.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A1.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8571.tmp\\architecture.glox",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8316.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8572.tmp\\CircleProcess.glox",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\cab80EC.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD855F.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84B0.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8570.tmp\\Equations.dotx",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8420.tmp",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8975.tmp",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD852F.tmp\\sist02.xsl",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89A5.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84C1.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A2.tmp\\ThemePictureGrid.glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD86A1.tmp\\ConvergingText.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8259.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\cab80FD.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89F4.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A43.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A66.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A55.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD5.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD4.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AF5.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8975.tmp\\pictureorgchart.glox",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8641.tmp",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A66.tmp\\gostname.xsl",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD4.tmp\\iso690nmerical.xsl",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A55.tmp\\chicago.xsl",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AD5.tmp\\ThemePictureAlternatingAccent.glox",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89F4.tmp\\mlaseventheditionofficeonline.xsl",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AF5.tmp\\TabbedArc.glox",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A43.tmp\\harvardanglia2008officeonline.xsl",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD89A5.tmp\\ieee2006officeonline.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8651.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8652.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8740.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85A1.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8916.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab87DD.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8630.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8C6E.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab85C2.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8C7F.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E79.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E67.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E56.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8ECB.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E68.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E57.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8E99.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E9A.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F49.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E79.tmp\\HexagonRadial.glox",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8C9F.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F79.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F99.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8ECB.tmp\\chevronaccent.glox",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9009.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81FB.tmp",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F49.tmp\\BracketList.glox",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cab811D.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FF8.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FF9.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F79.tmp\\ThemePictureAccent.glox",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F99.tmp\\InterconnectedBlockProcess.glox",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81AB.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8BF0.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D6.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D7.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9009.tmp\\Element design set.dotx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8A54.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D7.tmp\\Frame.thmx",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EBA.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90D6.tmp\\gosttitle.xsl",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab819B.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94EF.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94EF.tmp\\Dividend.thmx",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94A0.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962A.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962A.tmp\\Parallax.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95DB.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D5.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D5.tmp\\Headlines.thmx",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9977.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BCB.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BCB.tmp\\Badge.thmx",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8C.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C99.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C99.tmp\\Banded.thmx",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C0B.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DC4.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E04.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DC4.tmp\\Savon.thmx",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E04.tmp\\Quotable.thmx",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D45.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D66.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5F5.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5F5.tmp\\Wood_Type.thmx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA587.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB21D.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB21D.tmp\\Feathered.thmx",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB19F.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8E.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC8E.tmp\\Damask.thmx",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC01.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC24D.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC24D.tmp\\Mesh.thmx",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1C0.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF2B69D2C-EAEF-4A96-B5B9-8D98160833EC.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_42586963a1334219d518c6a6c6cf08ed.doc",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B4.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0B4.tmp\\Vapor_Trail.thmx",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDEEE.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8A6.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE8A6.tmp\\Insight design set.dotx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE6B1.tmp"
  1179.  
  1180.  
  1181. * Modified Registry Keys:
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\|e1",
  1183. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2A8F09",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2A8F09\\2A8F09",
  1206. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1208. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2A8F09\\47CE1D",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1804. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate"
  1814.  
  1815.  
  1816. * Deleted Registry Keys:
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\|e1",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\!*/",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2A8F09\\47CE1D",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2A8F09\\2A8F09"
  1843.  
  1844.  
  1845. * DNS Communications:
  1846.  
  1847. "type": "A",
  1848. "request": "holmnkolbas.com",
  1849. "answers":
  1850.  
  1851. "data": "104.250.180.44",
  1852. "type": "A"
  1853.  
  1854.  
  1855.  
  1856.  
  1857.  
  1858. * Domains:
  1859.  
  1860. "ip": "104.250.180.44",
  1861. "domain": "holmnkolbas.com"
  1862.  
  1863.  
  1864.  
  1865. * Network Communication - ICMP:
  1866.  
  1867. * Network Communication - HTTP:
  1868.  
  1869. "count": 1,
  1870. "body": "",
  1871. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1872. "user-agent": "Microsoft-CryptoAPI/6.1",
  1873. "method": "GET",
  1874. "host": "ocsp.digicert.com",
  1875. "version": "1.1",
  1876. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1877. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1878. "port": 80
  1879.  
  1880.  
  1881. "count": 1,
  1882. "body": "",
  1883. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1884. "user-agent": "Microsoft-CryptoAPI/6.1",
  1885. "method": "GET",
  1886. "host": "ocsp.msocsp.com",
  1887. "version": "1.1",
  1888. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1889. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1890. "port": 80
  1891.  
  1892.  
  1893. "count": 8,
  1894. "body": "",
  1895. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1896. "user-agent": "Microsoft-CryptoAPI/6.1",
  1897. "method": "GET",
  1898. "host": "crl.microsoft.com",
  1899. "version": "1.1",
  1900. "path": "/pki/crl/products/microsoftrootcert.crl",
  1901. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1902. "port": 80
  1903.  
  1904.  
  1905. "count": 2,
  1906. "body": "",
  1907. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1908. "user-agent": "Microsoft-CryptoAPI/6.1",
  1909. "method": "GET",
  1910. "host": "crl.microsoft.com",
  1911. "version": "1.1",
  1912. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1913. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1914. "port": 80
  1915.  
  1916.  
  1917.  
  1918. * Network Communication - SMTP:
  1919.  
  1920. * Network Communication - Hosts:
  1921.  
  1922. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!