API tools faq
paste
paladin316

RTF_92b1f6dbed262cd7c5d2d08d1dc47973_doc_2019-07-09_23_30.txt

paladin316
Jul 9th, 2019
2,173
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 219.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_92b1f6dbed262cd7c5d2d08d1dc47973.doc"
  7. * File Size: 267398
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "54dbf75a8d1855e7391b3cd0a561a0775bfcfe11f212c46c8ef3cdead7687fd0"
  10. * MD5: "92b1f6dbed262cd7c5d2d08d1dc47973"
  11. * SHA1: "31a5ad63ae49f2060738c75ca0d13b92b3235ec2"
  12. * SHA512: "3dcc585278a63be51c63dfabb052882f809834b306a959d78f89c016e61af0c6a648f405e8a0310def88cc7c6d24e823d8b5cf4f75b2547dfc9ffe1cd2ca1373"
  13. * CRC32: "F6E19A20"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLet2B+McI7xHe2BJaGc/96pbJHIEo3aiZM8pwBP:sxxQW3yLMc4pZIEPxV0vA/Hx"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2648"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 255 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  41. "Details":
  42.  
  43. "IP": "23.59.214.201:443"
  44.  
  45.  
  46. "IP": "69.192.108.32:443"
  47.  
  48.  
  49. "IP": "23.15.4.32:80"
  50.  
  51.  
  52. "IP": "65.52.98.231:443"
  53.  
  54.  
  55. "IP": "23.15.4.26:80"
  56.  
  57.  
  58. "IP": "52.109.92.24:443"
  59.  
  60.  
  61. "IP": "104.18.25.243:80"
  62.  
  63.  
  64. "IP": "72.21.91.29:80"
  65.  
  66.  
  67. "IP": "52.109.16.4:443"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  73. "Details":
  74.  
  75. "ioc": "rame.glox"
  76.  
  77.  
  78. "ioc": "ontent.inf"
  79.  
  80.  
  81. "ioc": "gostname.xsl"
  82.  
  83.  
  84. "ioc": "sist02.xsl"
  85.  
  86.  
  87. "ioc": "rid.glox"
  88.  
  89.  
  90. "ioc": "..3b"
  91.  
  92.  
  93. "ioc": "ist.glox"
  94.  
  95.  
  96. "ioc": "ccent.glox"
  97.  
  98.  
  99. "ioc": "adial.glox"
  100.  
  101.  
  102. "ioc": "ext.glox"
  103.  
  104.  
  105. "ioc": "rings.glox"
  106.  
  107.  
  108. "ioc": "pictureorgchart.glox"
  109.  
  110.  
  111. "ioc": "chicago.xsl"
  112.  
  113.  
  114. "ioc": "rocess.glox"
  115.  
  116.  
  117. "ioc": "rc.glox"
  118.  
  119.  
  120. "ioc": "gb.xsl"
  121.  
  122.  
  123. "ioc": "nline.xsl"
  124.  
  125.  
  126. "ioc": "content.inf"
  127.  
  128.  
  129. "ioc": "iew.thmx"
  130.  
  131.  
  132. "ioc": "rame.thmx"
  133.  
  134.  
  135. "ioc": "ieee2006officeonline.xsl"
  136.  
  137.  
  138. "ioc": "e.gu"
  139.  
  140.  
  141. "ioc": "ividend.thmx"
  142.  
  143.  
  144. "ioc": "turabian.xsl"
  145.  
  146.  
  147. "ioc": "etropolitan.thmx"
  148.  
  149.  
  150. "ioc": "asis.thmx"
  151.  
  152.  
  153. "ioc": "rop.thmx"
  154.  
  155.  
  156. "ioc": "adge.thmx"
  157.  
  158.  
  159. "ioc": "erlin.thmx"
  160.  
  161.  
  162. "ioc": "arallax.thmx"
  163.  
  164.  
  165. "ioc": "avon.thmx"
  166.  
  167.  
  168. "ioc": "ype.thmx"
  169.  
  170.  
  171. "ioc": "ircuit.thmx"
  172.  
  173.  
  174. "ioc": "g.n9"
  175.  
  176.  
  177. "ioc": "uotable.thmx"
  178.  
  179.  
  180. "ioc": "amask.thmx"
  181.  
  182.  
  183. "ioc": "set.dotx"
  184.  
  185.  
  186. "ioc": "rail.thmx"
  187.  
  188.  
  189. "ioc": "esh.thmx"
  190.  
  191.  
  192.  
  193.  
  194. "Description": "Performs some HTTP requests",
  195. "Details":
  196.  
  197. "url": "http://thecoverstudio.com/modules/jmsslider/views/img/layers/app/upjnyh.msi"
  198.  
  199.  
  200. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  201.  
  202.  
  203. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  204.  
  205.  
  206.  
  207.  
  208. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  209. "Details":
  210.  
  211. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xbe\\xcevt\\xb2\\xf3\\xd9a\\x18\\xb5c*\\x8c\\x1d\\xbc\\x8d`\\xb5\\xa7e,m\\xca\\x92m\\xb1\\xea\\x90\\x94\\x1a\\xa7l-\\x88\\x82r\\xe3ic\\xb7\\x95\\xea\\xee\".bs\\xf2\\x08\\xdb\\x0c\\xb9tv\\xc3\\x90\\x04\\x1f \\xc6\\x82\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\x9d9\\xa1\\xeb\\x1f\\x01;@\\x82\t\\x1b3\\xb1\\x9a\\xabw\\x97m\\x88y#\\xa0\\xa3\\x8ds\\xd0c`\\x08\\xe8\\xf2\\x8e\\x13\\xca\\xe5\\xe34\\xe7h\\xec\\xf0\\xe7h\"\\xf7c"
  212.  
  213.  
  214. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf7\n\\xed\\xe7o\\x04g\\xa2\\x0e|\\xde\\xdb\\x1fz5q\\xef\\x05\\xcf\\x0c)g\\x19\\x06\\xbe9\\xb5\\x85\\x13e\\x9au\\xc3\\xc6~\\x9a\\xc40\\x95\\xe6f\\xd24.\\x04x\\xbc\\x12k5\\xde\\x9c;\\x8ba1\\xb1\\xc8@\\xca\\x05\\xd6\\x0f\\x84\\xb0'\\x08fp\\xe3\\x18\\xa2\\xfe\\xfd\\xff\\xdc\\xd5)\\xb6,i\\xfau&)\\x1d\\x9d\\xced\\xdb\\x8c\\x98\\xa1y\\xe22\\x1b`\\xd3\\x17\\xfeii@\\xcf\\xf0o|\\xe4\\x99\\xd9z\\x01e\\xd98\\xad\\xcaf(\\x84rkri#3nq\\xe8\\x01k\\x16\\x1e\\xbcf\\xbaz\\xaey\\xd6\\x81x6\\xb8\\xfc\\xf6!\\x88y$\\x18\\xe31k\\x9b\\xfb\\x1e9\\xafxhz\\xca7\\x90\\x86\\x06\\x0f\nh<\\x17lvvc\\xe7w\\xf4\\xec\\xab \\xb3\\xf8>s6\\x85*\\x9b%3y\\xb93\\x13\\xc1nb\\xbe|\\xaf\\xdd\\x027\\xa3m\\xa3\\x1banb.\\x11\\xc0!>\\xae\\xae8\\xfc\\xf9\\xef@\\xfb\\xdf\\xc0^l\\xec\\xd8u\\xcb$\\x96\\x1e\\xfa\\x8e\\x1f\\xe5\tge\\xcd;!\\x97_"
  215.  
  216.  
  217. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01%\\x1a\\xce0\\x14\\x81\\x16:p\\x185x\\x05\\x85z\\xf0v\\xb5\\xd7\\xdc\\xb4\\xa1vr>9\\xba\\xf3\\xaf\\xf06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  218.  
  219.  
  220. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(_$\\x7f\\xf5\\x90a2tr\\xc6\\xe8\\xa3\\x0bx.\\x01\\x8f\\x82\\xe9c\\x95\\xaa\\xffi\\xbb4\\xe8oy\\xcd\\xe3\\x86bl\\x19\\x00\\x8e\\x17dpwy(6\n\\x010\\xc9\\xf2\\xa0cg\\x94\\xf8\\xd4\\xb5\\x1d\\xea:\\xfb\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98\\x01\\x83\\xabf\\x12\\xc7z\\\\x84-\\xea\\xe5\\xf3,p\\x01\\x95j\\xc8q1nf\\xc0h\\xa1q\\x89\\x1e\\xe5\\xae\\xd8\\x9bb\\xf1\\xe3\\xa4q\\x85,\\xc5x\n\\xe047\\xde"
  221.  
  222.  
  223. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  224.  
  225.  
  226. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  227.  
  228.  
  229. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p2\\xeel\\xa6\\xca\\xd4\\xd1xa\\xbc\\x06\\x17\\x1f\\x11\\xf6>\\xfd\\xa4yb\\xeb~\\xecs\\xe3\\x1a\\xbdz\\xf9\\xd8\\x80\\xa9\\x07/\\xa4u\\xcf\\xe7\\x85\\x90\\xf8%\\x96&\\xbe\\xa7h\\x93,\\x8eq\\xd5s>\\x00\\\\xfc8\\x06e\\x87\\x1b\\xba\\xa0\\xe3`w~\\x8a\\xe5\\xb9e\\xab\\xf0\\x10(&\\x9f\\xb4\\xa8\\x0b\\xb3\\xb4\\x96\\xcd\\xd1\\x95\\xe9\\x0f5\\xe3\\xd9:\\xc5\\x1e\\x8f\\x820j\\x97\\x14_l,g\\xcf\\x8d\\xd1`\\xc1\\\\xd7\\xeb!\\xf7\\xeds\\xb74\\x99#*\\xdc8\\xd9\\x1d\\xe8\\x13\\xfc\\xe0\\xe9t@\\xa6u\\xe1\\xf0\\xa8\\x9e\\xe88\\xea\\xc6p;\\xc0\\x1b.\\x11\\x8b4\\xd5\\xf2\\xc5\\x1b\\xa2\\xd7\\xd2e\\x12. 5\\xfa|!\\xc5\\xf9\\x10\\xd13\\xd2\\x9c+\\xb9\\xb3\\xb2\\x106\\x1eb\\xb0\\xeb\\xc6&jmv`o\n\\x7f\\x1cs\\xf0\\xef\\xf5\\xc8\\xe4n\\x15\\xd9\\xeet\\xf0\\xf5,mm9\\xd5\\x98um\\xf2m\\xfd\\xc9h\\x05vc<\\x9a\\xe1\\x0c8\"\\x80\\xd0\\xe1e?\\xfa~@j\\x9cw!b`\\\\xd8h\\x1b\\xfc"
  230.  
  231.  
  232. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\\\xe5!$\\xb5\\x9fk\\x872\\\\x11\\x7f\\x98\\xa1\\xfa\\xb22>\\x19\\x89\\xc9\\x83\\x9d\\xae\\x16\\xe5\\x89\\x91\\x9c\r\n\\x86\\xef\\xf6\\xf9\\xdb\"\\xb2\\xc6\\xae\\xca\\xfdy\\xad\\x8a\\xbc\\x93\\x14\\xb0\\xfa\\xbbp\\xca\\x90?u\\xbf\\xc0)jc-\\xe0\\xa5q\\xfe\\xf1\\xc5\\xfb\\x1a$/\\xcfh1\\xb6\\x16\\xdf\\xba\\xf4,\nx$\\xc5|+\\xb2\\xcd\\x80\\xd1\\x8ctn\\xecr0e\\xb1\\xeda\\x16\\xb3\\xf8\\x1b\\xd0\\xc4\\x11\\x06/)n86\\xf9\\xc0\\x15\\\\xa6dc\\xaa\\x02\\xfd\\x0ek\\xf3w\\xd7\\xa8>\\x17:\\x8dn\\x8esm\\x01\\x18\\x86\\xa0\\xd9_ums\t\\x90z;\\xf5\\x9d\\x80c\\xcd\\x8b0\\x05\\x12\\xa5+\\xcc\\xfdl\\xe3\\x12>\\xee:c\n\\x80r\\xc3i\\x8c8\\xa4\\xf0h\\xf6\\xd6\\xdb_\\x84\\xdb\\xc7\nl_s\\x05\\xec\\xe6k!\\xfe\\x1f\\xb4\\x0c1@\\xa8\\xe0\\xb0u\\xfev\\xce5;,n:\\xa2&\\xa4\\x9b3vs\\xcc\\xd3\\x0f\\xeb\\xf8\\x03\\xf4\\xb7\\xa9\\x7fwv\\x96\\x07\\xe1h@\\xfc?k\\xb8\\xaew\\x04(v\\x8d\\x87`"
  233.  
  234.  
  235. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01%\\x1a\\xd1\\x05g \\xc5\\x98\\x93\\xfcw^f\\xc4\\x9c\\xec\\xdbt\\xf3\\xa6oc'\\xecn\\xa6\\xa9o\\xf6\\xa9p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  236.  
  237.  
  238. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\x1c\\x05w\\x01\\xf3\\x99\\xf1\\xc5\\x07d\\xc2 w\\x16\\xcf\\xa1$\\x16m\\xd9\\xba\\x80\\xfa\\xff~\\x84\\xfbc\\xb8\\x8a\\x00\\xea\\xa1\\xe2\\x1d\\x86\\xc3\\xe7\\xc2\\xf0j\\xa1\\xf8\\xa9dn\\x14\\xb7\\x02\\xa5\\xf8\\xaf\\xeeh\\xb2\\x15\\xa3\\xe8\\xd9hb\\xbdk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9p\\xba\\xc9\\xbc\\xc0\\xb2\\xa3mg<\\xb7\\x9cg\\x16u\\xdcz\\xd2\\x1ehb\\x19t=\\x0cu|\\xa5\\x93d\\xc0\\xf0\t\\x19rf\n\\xa8\\xb2\\xc3j#\\xbf( e\\x19"
  239.  
  240.  
  241. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x15\\xd3\\x9dc#\\xee\\x9a\\xaf\\x8e8k\\xe0\\x7f\\x9c\\xcaz\\x164\\xcf\\xd1\\x12\\xf9\\x18&\\xe3n\\x9c\\x02f\\x9a\\xb5i\\xfa!j\\x0c\\xd2(\\xcdg\\xfdho\\x17\\xae\\x9b\\x975s\\x13b\\x0f\\x9f\\xce\\xa4ti\\x8c\\xc3\\xcf\\xa2r+\\x15\\xacw\\x83&6\\x83d\\x17\\xf0\\x02\\xd6\\xb58.h\\x85\\x1c\\xf8w\\xcd\\xd8\\xde\\x0e\\x9bw\nq\\x91s.\\x8c\\x98pr\\xca\\xe0\\x8ey\\\\x11\\xa8z\\x92\\xd4\\xf9\\xe8\\xfa\\xd0\\x8f\\xd7\\xad_\\xab\\x80\\x1e\\x0c7\\x98\\xc8\\x08\\x02(9lw\\xfe\\x14\\xd4\\x0cr\\xb8\\xef\\xbd\\xf8u\\x89\\xac\\x11\\xba\\xfc\\x0b\\xda\\x83_\\x85\\x02\\xe0nl>s\\xa1\\x9fl\\xf0\\x05\\x89\\xab\\x9a\\xf7\\xe65\\xff\\xfe`rj=\\xaa:w~\\x83\\xecb\\xba\\xd0\\x1bzsqul\\xdf\\xe7\\xea\\x1f\\x8f\\x08o&/\\x14\\xc9\\xec\\xb7`\\xcbq\\x1f5\\xbelv+\\x970\\x08\\xff\\x1f\\xe7_\\xe37b\\xc0\\xbe?\\xbc\\xbe\\x0b\\x15\\x1d\\x8d\\xd1\\xa3\\xf5\\xe5\\xf0\\x10\\x0f\\x93\\xfa\\x8e\\x86\\x7f\\xa0\\xd0\\xdf\\x10"
  242.  
  243.  
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01%\\x1a\\xd2v\\xf3b\\\\xf5\\xd0\\xe0\\xb3u\\x9ei3\\x84\\xabl\\x81\\xee`g\\x81\\xd1s\\x19\\xd1\\xc8\\xb4f\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245.  
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\r6\\xa5g\\x9a!b\\x9b\\xc0\\xb3\\xd8\\x8c\\xbe\\xd9o\\xd5q\\x9d#\\x84\\xc8@_\\x1c\\x92$\\xe2\\x04\\x7f\\x0199\\x8e\\x10\\x8dp\\xca\\xce\\xa5&\\xeee\\xcd&o\\xdd_\\x03\\x15\\xee\\xc3\\xd0,\\xbc\\x8b\\xb4i\\x82l\\x90e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2\\x85\r\\x84%\\x1c\\x83\\xea\\xaf~y\\xd8\\xf6\\xbe\\xdd\\xdb\\\\xd6\\x03\\xe3\\xed\\x03\\xfa`a\\xa9\\x91\\xc7\\xbbak\\xb0\\xae\\x7f\\xd8@\\x01\\xee2 r;\\xd2e\\xcf\\x90\\x95"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p-\\xd2\\xdb\\xe0\\xb4\\xa8_\\x08\\xc9q-\\x0f\\xc2e\t\t\\xa5<\\xad\\x15j\\x82\\x9b\\xb2j\\x1e\\xc5\\x0f\\x1d:\\xc7\\x0ep\\xc5\\x14+\\x9a\\x18\\xa3.\\x8f\\xb1':`r\\x02\\xc7\\xbf\\xed%\\xc5\\xab\\x16\\x08\\xb4\\x9bss\\xa9\\xcb\\x11 \\x984\\xb6\\x08p\\xa1|\\xc0\\x82.\\x9f\\xaf\\xdf%\\xd0cc^8\\xb6\\x16\\x1fk\\xdb\\xc0#\\x17\\xe1\\xe8\\x93\\x1ag=!\\xc6\\xcc\\xb5\\x93\\xbeq\\x96\\\\xc6i'\\x02\\x03\\x88\\xae\\xe4km\\xfdy\\xe7u\\xfb\\xd9\\x9a5y#\\xe2n\\x00j\\xac\\xe9\\xac\\x96|\\x8dw\\x92a\\xf0\\x9fjy\\xb0\\xe6\\x03 m#\\x1d\\xf5\\xd8>\\x80lm\\xee\\x18z04?\\xa0l\\x93+\\x14<\\x0c^\\x02y\\xf9\\xe6\\xfa\\xb1\\xa2\\xef\\x980e5\\xc2#\\x12o\\xd7\\xf7\\xa2k\\x8e\\xa7\\xd7i\\xf9\\x079\\xe4\\x14qfb\\x1d\\x03\\xfa\\xd1a\\xbe\\x07\\x14\\xe9\\x13s\\xf2\\xfb^\\xd7\\xb3\\x87\\xde\\x01\"m\\xda:%\\xfd\\xc7\\xfb;.k\rji\\xc7\\xbb\\x8a\\x191\\x85\\x18f\\xbbz\\xe5\\xf0i"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3z\\x02\\x12\\x97\\x18\\x98\\xf8\\xdf%\\xc9\\xbc\\xa8\\xc9\\x98\\xe1\\xf9\\x967g#&^\\x83\\xd7\\xaa\\xb9\\xa2\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x97ud\\xbf\\xa8\\x96\\xe8~:\\x88\nc\\x9c\\xa0\\x87\\xdf)\\xa5\\xbb\\x85\\xd5_\\xbb\\xfb\\x19q\\xb2\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3.8\\xe4\\xd0\\x95))\\xffkd\\xcb\\xb3)v\\x10\\x1a\\xd0\\xd8/w8o\\xaf\\xa0\\xb3)\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xf89\\xb7\\x83\\xa9x\\xfd)\\xe7lnc\\xe5\\x9fu\\x1c;\\xf7\\xc8.|\\xfe7<.r;\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x07\\xf3s\\xc0\\x16\\xd0\\xb1\\x07\na_\\xcf\\xf8l\\xb4pk\\xdf\\x0b@\\xda\\xa2\\xaf\\xe1\\xa2+\\xe24\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3p\\x98 \\x96\\xf2\\xd1\\xc3\"f!e\\xae'\\x0e6\\x99esc\\x8a\\xaf\\xe9\\xe2\\xb4\\xf4\\xab\\xa7#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xde'\\x16axz\\x1a\\x801a\\x1b1bw:\\x80\\xdd\\xf6\\x94p\\x0e\\xdbx\\x9df\\xbaz\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3gai\\x06\\xef\\xa0;_\\x9d\\xc0\\x07\\xb6\\x90\\x94@-\\xdd\\x95(q\\x91\\x93\\x03v\\xa2\\xd8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xdfd\\xccx5\\xba\\xf3`_\\xad\\xb0\\x1dv\\x1b0\\xfdr`\\x87i|j\\x96w\\xc2z\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xdd\\x15l\\xac\\xd0\\xe1\\x03\\xbe\\xa4\\xdd\\x96i\\xd8\\xbbp\\xf6y\\xd5\\x97\\xb0\\xa8\\xd0\\xf0\\x18\ri\\xad\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\\\x12\\xfa\\x17\\x08go\\x04\\x01\\xa7\\xb7gfy\\xc4jd\\xd9\\x18n)py\\x9f\\xefh\\xb1z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xc8\\xd679\\xafo\\xc8\\xad4*/\\xd3#\\x18`j\\xccz\\xca\\x06~\\x04\\x8e\\xc6\\xf3n\r\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xc9m_k&\\xc4\\x04\\xb4l\\xd4\\xfc?\\xbc\\xf5a\\xc5vgg\\x81\\x95ac\\x80,\\xb8\\x17m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x03)\\x9dy\\xdf\\xf8b\\xec\\x1ek\\xb8u\\x03k\\xfc\\x91\\xba\\xbev\\xdaq\\x1a\\xf8d\\x02\\xc8a\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3hn\\xd3\\x9f\\xa8\\xb7g%\\xccw\\xd7\\xb8\\xbfc\\xe2\\x0fii9\\x90\\xe6\\xc4\\x9b>w\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xc1\\x1ahc\\x1a\\xba\\xf0c\\xdc\\xf97b\\xcb\t\\xbcq\\xfd\\x92xqm\\xfd\\x17\\xcb\\xd6\\x0ef\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3i\\xd0\\xdb\\x1d\\xda\\x8f\\x8d\\xa5zf~a)`\\x00\\xa0o?\\xb5k\\x10\\xac\\xef\\xe1ql\\xbe\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xa8\\x86\\x1a\\xd9\\x1a\\xd31\\x81\\xedcn:\\x1c\\x88\\x7f\\x85\\x06\\xff\\xa5\\xf8u\\xec\\x08\\xb0m$p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xcd\\xfd\\xf5\\xb1xo\\x0c\\x87\\xcdehs\\xe2\\xdd\\x969\\x96\\xe6@@\\xf9\\x07\\x9f\\x85\\x13\\x9b\\x1e\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xcd\\xc4ve\\xd1\\x1d\\xf5\\x90\\x03\\x8c\\x1b\\xf3\\xcd\\xd0d\\x94\\xe1g\\xa6<&\\x06\\xe5\\xbd\\xc6\\xb8:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x05\\xea\\xb5\\xd9c\\x9d\\x88\\xb8\\xfc\\xf8\\xb5\\xd9\\x15s\\xe5\\x97gn*\\x9ff=yq\\xb6y\\xccg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x1a\\xb8\\x9a\\xe6ba?\\xd0\\x9d\\x9e)3\\xf9\\x02\\x9c&\\xf1&%&\\xaff\\xc5+#\\xb92\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3d\\x03\\x0f<(\\xe6c\\xc1\\x1e\\x19\\x99f\\xb0\\x04\\xc0b\\x9ebb\\x8d\\xa4o^y\\xbe\\xbb\\x00\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3n\\xa0dl\\xbd\\x18\\xdaf\\x1em\\xcd\\x94\\xef\\xcd\\xec\\x8a7\n/\\x10\\xa4a*\\x08*u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x01\\xb1\\xef\\x1c\\x18\\xa0g\\x00\\xe5\\x82\\xa4c\\xa8\\x83mxb\\x88\\xe5\\x98~\\xe5i\\x1c,%b\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\x82\\xdbw4\\xa0>j\\xee\\xca\\xba\\x991\\x9c\\xaa\\xa8jm\\x04z\\x04\\x0e&\\xcfam\\xd4\\xce\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xc5w;\\xc2n?,\\x97\\x82v\\xf1t(\\x8aa\\x07v\\xe34\\xbbeu\\x19p\\xc9\\x1c(\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xe2\\xe0s\\x0e\\x16x\\xe3!%z\\xfbk\\xe7d_\\xb4o\\xf8\\x83@9y\\xf9\\xb5\\x07\\x0c\\xf0\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd3\\xf9/8\\xd8\\xc8o?\\xb4j\\x1a\\x1630x\\xa6a\\xa4\\xf1\\xbd\\xfe\\xb7\\xb5's\\x8d\\xcf#g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xe0d\\x8c<s\\xc3\\xdfu;5cu\\x82\\xa8-wa\\xee\\xdd\\x08\\x9c2|-\\x809\\xcb\\x7f_v?<\\x12t\\xd2&\\x7f e\"\\xee\\xc8\\x99-\\x94\\xa8\\xb8w\\xaf-|\\xb2\\xe3\\x02\\xb3\\x7f\\x03z\\xf2\\xa9\\x85\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b!\\x0b\\x91g\\x0c\\xc3\\x1fx\\xcf\\xed\\x10\\xb5\\x17\\x91\\x19\\xbd\\x9e\\x05\\xb5\\x9crce4\\xc9 !@\\x18\\xdf\\xadz\\x1f\\xfa\\x0fp\\x1b\\x946\\xa7\\x03\\xcd\\xeb\\x08eq\\xab"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\x05\\xf2\\x99x\n;dc4\t\\x94\\x86\\x80a\\x1b\\xd9\\xd8\\xb1\t\\xe3\\x9b\\x10y?\\xfcc\\xaf*\\x93\\x12\\x02\\x98z\\xb4\\x1e\\xe5\\x8b\\xc6\\x1f\\x8e\\x99\\xe8\\x8c\\xcb\\xd5>\\x1d|\\x81\\xefe\\xda\\xb3y\\x1d\\x07\\x08\\x93\\x97g$\\x92!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8fe\\x86\\x9a5\\xc4\\xf0\\xdf.\\xf4\\xfb5id>\nix\\xbb$\\xd1bg\\xa0\\xe4b\\x1e\\xf0az\\xec\\xc4#\\xb5\\x92e\\x81\\x91\\x01\\x0f\\xac\\xf7x!#=\\x02"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xf9\\x18\\x9ea(u;>v\\xd0q\\x0c\\xc3z|\\x16\\xaar\t\\xa5\\xe5\\x83\\xcd\\xc3\\x93\\x1ep\\x9a\\xbc\\x93\\xa6\\xe9\\xcff\\xc4\\xf1(\\x07\\xb6\\x15\\x96\\x08\\x9a\\xfb\\xa8\\xfc8=\\x8c\\x95\\xad\\x0ex-3\\xd3\\xa1\\x1a\\xd8ngh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\t\\xf1\\xa8sz\\xc6/\\xc6\\x05\\x89-<\\xed\\xc9g\\xb1\\xa1\\xee\\x17627u\\x03\\xa4\\xc8\\x1dv\\xe0\\xe3\\xe6\\xfb\\xee\\xe6\\xbah\\x88\\xe5go\\x8c\\x06\\xa6\\xd6/"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\xf3\\x90j.\\x12o\\xc8\\xe9\\xe1\\xda\\xb5c\\xc9&o\\xb8\\xff\\xf5\\x93\r\\x03@e\"\\xd5\\x939\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\x9f\\xa3c-lu\\xfbm\\x94s\\x1d\\x91g9s\\xbb)f\\xd8-gm\\x00_\\xf7c\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4v\\xb51\\x96\\xc1\\xdfp\\x9cw\\xbe\\xc6\\xa1a\\x97q6\\x9c\\x8b1\\xfb\\xd76\\x9c6\\xc0\\xa4\\x0bw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\xd6\\x12\\xe2u\\xea \\x9c\\xdb% ;xqm\\xfd\\xff \\x99\\xd1\\xa8\\xac`\\x85\\x9e\\xce\\xf1\\x8e,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4i\\x85i5x\\x99m\\xfe\\x8fp\\xe2\\xc0u\\xea\\x15\\xe6\\xd2\\x9298'\\xa3\\xf0\\xd9\\xfc\\xef\\x01\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4a'l\\x19q\\xba_\\xe6\\xef\n\\xb6\\x9a\\xb2~@\\xd0\\xa2\\x80\\xd8t\\xbd(\\xd4\\x1f\\xb4\\xf7\\x1b\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\x85\\xa7o5\\xdb\\x94z\\x9e\\x94|\\xa6\\x12:da3\\x8fd\\x0b\\x90\\xf8\\xda\\xa1u\\x9b\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3&uo\\xf0\\xccnw\\x00\\xc57\\x87\\x965\\x81y\\x83`\\xa9\\xce\\xb3\\x1f\\x82\\x18q\\xc9\\x00\\xd9\\xbd\\xacek\\g\\xccti(\\xfal\\xad\\x06f\\xb7n\\xf2\\x97\\xab\\x8b.h\\xeak^\\xbai@\\xa44\\xb4\\x8da\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7z\\xa7\\xb2\\xa9\\x83t\\xd5\\xc4z\\x86/j\\xbdmq\\x00o,\\x00\\xc0(\\xd6\\xa4dq\\xea`\\xe6\\x9fk\\xbfte\\xd5le\\x98\\xcf\\x81\\xa4s\\xb8\\x9fz\\x82\\xe9"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xf9\\x00#\\xeb\\xef\\x94\\xc2k\\xca@\\x87m\\x83\\x13\\xc3\\x90\\xc2\\xb4n1$k\\x89j\\x9a\\xce\\xed\\x9e\\xd2p\\x8d\\xac\\\\x15\\xf4km\\xd6\\x1e\\xc5\\xfa\\xfd\\x84\\xe7\\xd4\\x0b\\xc1\\x02\r\\xab\\x08\\xb1\\xff\\xd3\\xcdni$\\xf2\\x1f\\x8c\\x9e\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u r\\x06gy\\xc3w\\xb4vzr\\x16ciz\\xc0\\x8b\\xff\\x03\\x9d~\\xdf\\xde\\x97\\x94\\xe6\\xf8\\xae\\x8ab\n\n&\\x11\\xfbff\"7c\\xbaw\\xbbwi\\xfd?"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xb0\\xf8\\xdd\\x95s>\\x80\\xfce\\xce3\\xdf\\x96\\xc0a\\xb4\\xea\\x15m\\xea\\xb2\\x80\\x18|\\x9cfvg\\xa6\\x165\\x95a\\xe1j\\x0c\\xc1t\\xe4\\x1b\\xcc$\\xad\\x1b\\xd2\\x8c\\xb1\\x8dw\\x92&\\xb4\"\\xf3\\x84\\xe6\\xfd\\x8a\\xdbhj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xacq\r\\xe0\\xaa\\xa3g\\xden\"!w\\xce\\x12:\\x9f \\xa0v\\xd7\\xd1\\x91\\xb6\\xd6\\xa8\r\\xfb\\xa2\\x9b-:\\x12\\x0c:\\x85\\xd6\\x9c\\xa8\\xe8\\xa7\\x96\\xc7gww\\xcc"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa\\xb7\\xa8\\xec\\xc1\\x1e\\x02e\\x87p\\xbd\\x10\\xd6p\\xa7\\xfcoe\\x17\\x9627\\x8f\\x90\\x92\\xd2\\xe7w!\\x10\\x7f\\xc6\\xb7\\xb2\\xf9\\xe6\\xd0\\x97\\xe8:>\\x97\\xaa\\xd12\\x17i\\xb7\t\\_z\\x81\\x94\\xd8\\xb9\\xd69~xm^\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd01w0\\x9ba\\x8f\\xe8\\xddp\\x9c\\xbc\\xb7\\x15\\xad\\xe8>\\xa9d\\xf9\\xd2\\xaf0q\\x0b\\x83\\x9c\\x8d\\x8e\\xb8\\xe7\\xacg(\\x00~\\xe0a\\xad\\x19acx\\xb7\\xb5w\\x12\\xf3"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\xbcb0\\xb6~\\x8by\\xab\\xf4\\x97w\\x8d\\xfd\\xde5\\xc4\\x07&\\xe7\\xc7\\x8asrkf5:\\x97wvn\\xaf\\x1f\\x8es\\xf9\\xd0\\xa4\\x00\\xc6\\xbd\\x19\\x14\\x1f\\x89\\xd8\\xefw\\x95\\x8b\\xe6\\xf2y\\xb7\\xdd\\xcd\\xfc\\xdc\\xfe\\xfa\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 m\\x96oj=\\xd39\\xf8\\xfaw\\xe7_\\x84\\x045\\xb0f\\x11\\x85k\\x81\\xe7\\xff\\xee\\x96\\xdeh\\x94\\x07\\xe8q<\\xfa\\xce(\\x82\\xaf\\xf6\\xbf\\xf0\\xaf\\x97\\xeawa\\xed\\x88"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4a\\xf7\\x01v7\\xc50\\x0by\\xe6\\xd6\\xe5d\\x85\\xdef\\x1eon \\x7f\\x1cpwkq\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12 ':,\\xef)\\x9e\\xbenbo\\xdc\\x87\\xa9\\xf8m\\x01\\xa3\\xb7u@\\xa8t\\x18vfj\\xe8gx4\\x92\\x0em\\xd9?6y1\\xbfh\\x95\\x9391\\x86\\x98\\x1dc:\\xc8\\x88\n+6\\x83c\\x06\\x9ccs\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e^cn\\x00\\x9c\\x7ffm\\xc7?2\\xe6=^w>\\xaa\\xe6\\xbb\\xe7-\\x80\\xbd`\\x0e\\xc3\\xe1\\xd6\\x16i`\\xc9\\xc9h\\xe1/\\x13\\x04\"\\x8al\\x14v\\xa1\\x07\\x8fa"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x98\\xedr\\x96\\xc0ck\\xfc\\x1f\\xd5\\xa3b=b\\x80\\xee\\xd5\\xca\\x10\\xdc\\xf1\\x8apw\\x9b\\xaet\\x077\\x89\\x9ft\\xea\\x1e+\\x03\\xff\n\\x11\\xb7\\xe5t\\xc7\\xd1\\xb9\\xcf\\xe3eh\\xcc\\xa2\\x0f*\\xc3\\xdf\\xfde\\x95\\xa0\\\n\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\x98\\xd0\\xf9%\\xef\\xf0?\\x11\\xc2\\xbc\\xc2\\x1ev\\xccu\\x9b\\x8d\\xe2\\xa8o\\x12\\x85?\\x12)w\\xf0\\xb9\\xc0\\xa0`\\xbc;*\\xbd*/\\xda\\xb7(\\xcd+\\xcd\\xa2\\xe0"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\x03\\xea\\xa7\\xf3p \\xab&l\\xe5\\xb7\\xd1\\x88\\x8c\\xb2\\x14`\\x05\\x80'\\xc1\\x93\n\\xdf\\x81j\\x9d\\xe2#v\\xf8\\x15\\xe6g\\x1c\\xa1(b\\xff\\xd5=4(\\xda,\\xf5\\xba5\\xe8;\\xac\\xdd\\x82\\x97'\\xcb\\xb8\\xe2\\xcf1\\xf9\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0fs\\x8f\\xd3m\\x9b\\x12d\\xa6\\xb6_&\\xfao\\xf7\\xb7\\xfc\\\\xd01sd3\\xdat\\xb7\\x85\\xdc\\x07\\x12\\x83\\x13m\\x00\\xf3\\xf8+\\x85\\x7f\\xd10\\x7f\\xb0\\x82\\x00\\x91"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6f\\xf8\n4/\\xd8\\xac\t2\\xca\\xaf\\xe6\\xe3\\xec\\xb7\\xe9\\x81\\xd0\\x1fa\\xae\\x0e\\xfd\\xe4\\xb1\\x84\\x07\\x92#\n\\xec\\xad\\xdb7\\xc4\\xf3\\xcfs\\xa5d)\\x0e>a\\x9c\\xb8`\\xd4\\xa21\\xf4\\x89bcd^\\xe8v\\xf3\\xedk\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l^\\xf4z\t.f\\xbbw\\x86).\\x1a\\xc1\\x90\\x12\\xab0a)\\xf6\\x18%2\\x02\\xbf\\x91\\xc9\\xda\\xad\\xaf\\xdd\\x1b\\xc0\\x04?j\\x81(l\\x0ef\\x8f`\\x08t\\xd4"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xcd\\x89\\xde\\xcd\\xb3+ \\xde\\xe2+\\xc9\\xb0a\\x1f\\x9d\\xb7;\\xaa\\xaa\\xdc?\\xf5v\\xd7\\x12\\xed\\xbc\\xee\\x80\\xd4j\\x80.\\xb2\\xbc\\x0e\\x94+\\x99\\xa8\\x9f\\xfd\\xe6\\xe1\\xf5v\\x9c\\xd5\\xb8v~\\x03\\xcf\\xcc\\x9a\\x8a\\x08*\\x1e\\xees\\x0cz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xa9s\\xe7\\xe2\\x01xrk$n\\xae`\\x82u\"\\xb3\\x07\\x8a\\xb9v2\\x05vm,<\\xce\\x8e\\xfd\\xfc\\x13\\xcc;\\xd5\\x83\\x8e\\x99\\x1a\\xab\\x8c\\xd8'u\t\\x18,s"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\x1b\\x17\\xba\\xb5\"\\x07v\\xddj\\xa0\\x11\\x17\\x02a\\x9f\\xad\\xe9\\xf8)8\\xa1jm\\x92\\xeb\\xd4\\x03\\xf3m\\xe2m\\xf2\\xec\\xe5w\\xb1z\\x8d9m=\\xe4q\\xec\\xac,\\xc1\\x99w\\xf4\\xb9m\\xef\\x18\\x88z)\\xef\\xbe~\\xbc>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ik\\x95$\\xfbj\\x8f \\x80\\xaa\\x07\\x14\\xfa1l<\\x98\\x8c\\xc0\\\\xcdp\\xc9\\x95_\\x0e\\xd3\\xdc\\x174\\xa7\\xba\\xe1\\x0f/\\x8b\\x1cu`\\xe6\\x0eb\\xd1-\\xa2"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0x\\x8b\\x12\\x1acrufo\\x14n\\x04,\\xfd\\x99:\\xdf\\xef\\x0f\\x9a:\\xeb@\\xe4\\x0b\\x02c\\x14\\xc6\\x7f\\xa03\\xf4\\x8d\\x11\\x96\\xb00\\xc5\\xcbs\\xce-\\x99\\xba\\x07\\xf0>\\x17\\xb5emlq_\\xc54p\\xd7\\xa2\\xea\\x18@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\xc9v\\x89y\"\\xa7\\xb5d\\xee\\xb6\\xef\\x8b\\xfa\\x08\\x9e\\\\xf8\\x82\\xa8\\x1b!\\xa1\\xcd\\x9e\\xe0m\\xf9\\x1a/\\xef\\x0b_\\xf3k)\\xf9f\\x0b\\xc80p\\xd7\\x19\\x99\\x1d&\\xcf"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xc6\\xd7%\\x15m\\x15\\xd2\\xe1e\\xb4'\\x81\\xebj8t\\xbb\\xba\\xfe\\xf1\\xad1\\x1dyt=\\xf8\\x14\\xc3\\x15\\xeawoe\\xcd!\\xb1\\x9a\\xc7\\xff\\xc0\\x81\\x15\\xd3\\x0c\\x03\\xfa\\xe4\\xe2\\xd2~v\\xf4\\\\xb3\\x84r\\x81\\x8d\\xd6mz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\x86=\\xbb\\x9cde&\\xed\\x9e\\x94\\x95\\xa86\\x87m\\xcb\\xa8\\xa5d6\\xad0\\x80\\x9e,3\\xbd\\xa2k\\xca\\xc69\\x18h\\x84\\xd6x\\xf3\\xdea=\\xeep)\\x01\\xe6"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04pfz\\x97\\xfbsf\\x9dvn\\xb4v*\\x0e&\\xdf\\xf9\\xadx\\x86\\xf2\\xc3\\x85\\xc0v/\\x97\\x81\\xfe\\xdbw\\xde\\x82\\xa2\\x91\r\\xdab\\x98\\xa4\\xb6\\x1f\\xda\\x8e\\xc4\\xfb9:\\x07\\xfel:?=\\x94ak\\x81?\\xc2\\x80\\xd7\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8cy\\x134\\x84n\\xbf\\xb7$\\xba\\xfe\\x8b\\xfcys\\xf9\\xff\\xa0\\x82\\xef\\x18\\xc4\\x9c\\xd3z\\x86>\\xd6\\xb5fj\\xc3n\\xaa\\xc5j\\xfb,s\\xbf\\x08\\xbfc'\\xd6\\xcf\n"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\x16x\\xdf\\xb194;\\x81\\xa1\\x13\\xa4@\\x961\\xb4\\xad\\xa6\\x94\\xd8$\\x92\\x92\\xf2i\\x11c\\x8c\\xac\\x8e\\xa1y\\xf1\\x07:\\xc8h\\xd6\\x18\\xae-\\xe5\\xdb\\x15\\xa8\\xf8n\\x8eu\\xb2\\xd3~d\\xea\\x05\\x1af\\x8f\\xd3\\xd5\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\x8a|a%\\xb5\\x05\r\\x80\\x17ocxyq\\xb0\\xb0x\\xe1e!\\xe8\\x11\\x8cf\\x07\\x85\\xcd\\xa4!\\xa2|\\xd4\\x87\\x10\\xb4,\\xb1\n\t\\x11\\x94\\x99\\xf1@c'x"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f,`\\x1f\\x8d\\x8444o\\x9ch\\xad\\x8c\\xfb4\\x02\\xc3m:\\xd3\\x18\\xd6\\xd7\\xdb\\xde\\xa2\\x0c\\xf7\\xd1\\xd1\\xb0~;\\x83j\\xbb\\x93\\xe3\\xab\\x18i\\xd3p\\xc6\\xc7\\xd9\\xc0\\xd6\\xa5uo\\x16\\xcdas\\xc9&|\\xea^\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c\\x91\\xc6g\\xf7n\\xd4\\xd5\\xf3\\xc4\\xb4\\xf6pk9\\x1fm<x\\x83@\\x12e\\x86\\xc9\\xc7\\xa5\\xec\\x0f\\xc5\\xbcn\\x84\\xf6\\xc0\\xf6\\x86\\xd3\\x031\\xba+\\xa9v\\xdf "
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2\\xc8\\x91\\xd7\\x8f\\xd7\\x06;\\x0c\\x12\\xb0\\x99k\\x9aa\r\\xf9\\xeb,\\xe7\\x8a\\x0e\\xdc\\xcat\\xcb\\x85ac\\x18y\\xf9\\x9cq&9\\xea\\xee\\x85\\x01\\x90laxx\\xecrj\\x0e\\x00\\xdf4\\x97\\xd4\\xeb=\\xbc\\xe30g\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\x96u4\\x0e\\xd0s)\\xff\\x1e<\\xd6\\x12\\xda\\xae\\xe1\\xbc\\x17t\\x8cs\\xc8\\xf0y\\xed\\xb90\\x8e|\\x0c\\xb1\\xa08\\x90ws\\xd8\\xee\\x9d\\xd4\\x92\\xa8;\\xba\\xff\\x95"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbds97!\\x85\\xa9\\xf8\t\\x18\\x1c\\xaeb\\xe9\\x12\\xdb\t\\x15\\xdf\\xa2\\x97\\xcb\\xc8b\\x07#\\x8fm\t\\xc9q\\x0e\\x82\\x1a\\x02|\\xd6\\xe8\\xde\"\\x19\\x8d\\x04\\xf8&\\x17\\x06\\xb5;z\\x1bwz\\xfc\\xda\\x12\\xe9\\xb1\\x92\\xddx=z\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf\\xdf\\x16du\\x07\\xe7x\\x17\\xe8'\\xb3>\\xf22e2\\x95\\x94b\\xc3\\xc4\\xf6\\xa8\\x1b\\xba\\x1e\\xa4\\xfc\\x07\\x16\\xf2\rj\\xa7\\xf4\\x8c6ex\\x91f\\x94w`\\xbc\\xce\\x10"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xe8\\x96\\xa3%;^i\\xc9\\xcd\\xcd\\xd4\\xc7lm'\\xc9\\xbc\\xb5\\x91t\\xf4\\xd0\\x86\\x93a\\x04w1m0\\x11cn`_\\xec\\x13\\xd5\\xffmf!\\x7f%\\xe79\\xbb\\xb5\\x86\\xa6\\x06\\xed\\x96c\\xf4g\\x0f\\x18a\\x16\\xcb\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\n\\xdbx\\xdd\\xfc1\\x18tn`\\x8c\\xdci?a(\\x18\\xaf\\xf0r\\x0e\\x9d-d\\x84zu\\xe5c\\xa8\\x00\\xfaz\no\\xcb^\\xe0\\xdbl\\x0c?~\\x7fs"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4/\\x0e\\xd98z\\xf6\\x10\\xdc\\xfcg\\xd6\\xe9\\x04\\xc3\\xc8\\xe0&\\x91\\x8d\\xd3e\\x8c\\x08\\xb7$\\xf6\\x177\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\xc8\\xd5\\x9ci\\x92\\xef\\xf5\\x93\\x00bx\\x99\\xcd\\xa5\\xfd+8/\\xca\\xc1\\x14\\x9e\\xe2\\xdb\\xb2\\xee1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8\\x7f\\xd8rx\\xc6r\\x83\\xfcg\\xee\\xc4\\xbd\\xbap\\x9e\\xaa\\xbb\\x02k\\xdf\\xf9!\\x8a\\xfcv\\x1b\\x9e\\x96\\xa4\\xc5\"\\x93\\xabe\\xeb\\x0e\\x05r\\xd0:k\\xf4z8\\xa2\\x07y\\x1d\\xff\\xdbv\\xa4\\xd2v;\\xaf\\x02\\xc8j@\\xaf\\xed\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xc65i\\xcaz\\xbfn!\\x8bgr\\x836\\xd6\\x82n\\xd3\\xdcv\\xac\\x8b$?\\xf3\\xeba\\xe3\\xd4f\\x8f\\x9c\\x10\\x8a\\x92o\\x93\\x99\\xf8\\xf2\\x88\\xbd\\x18\\xc7ug\\x197"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\xf7\\xd2\\xb2\\xbe\\x15\\x16,\\xcf\\x08\\xa0\\xc8\\x10\\xf5\\x88\"\\xac\\xb8\\x1e\\x8f\\xf8&\\xd7\\xa7\\xf5\\xbc\\x1b\\xa4\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\xbbi\\x13\\x8f\\xb2\\x1e5\\x14\\xaab\\xd88\\x9d\\x7f&\\xed4\\xdf\\xfd\\xd7\\xda\\x96\\x1b\\xa76l\"\\xa7p\\x84\\x00\\xdd\\xe1\\x02\\xe6\\x0e5\\x8dxt\\xce\\x0e\\xca\\xe9\\xbe\\x14\\x8a\\xb4\\x1e7s\\x8b!\\xbbz\\xa4\\x85o\\xac\\x8a\rf\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\t\\xd9\\x0b>pa\\xe7\\xcc\\x1a\\xb8\\xa9p\\xe3d\\x0cl\\xfa\\xb75il\\xb7v\\xeb*,\\xbc\\xe970n\\xc2f\\xb7\\xbarw\\xb2<\\xa0\\x00\\xf7\\xc2\\x81\\x92\\xdc"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\x0b2\\xe64)v\\x0cp\\xa3x^\\x8c+\\xff\\xe6\\x9c\\xa6\\xe4\\x0f_;\\xb4f\\x15x\\xafm\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4h/\\xf1\\x9f\\x8cy\\x0c\\xd8\\x1b\\xa5eb\\xa7ppeor\\xd4u\\xe1\\x00\\x80\\xf4\\xdd\\x97\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4s\\x9f\\x11\\xaa\\x1a;\\x91\\xb9&\\x8d\\x82\\xc1\\xdd\\xcb@q\\x8b\\x94\\x19\\xc5\\xb86\\xa3o\\x8d\\x92p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\xda\\x18q\\x90e\\xff@\\x871<\\xcdu\\xf5\\xc6\\xc1v(\\xbb\\x81@o5\\xfbr?\\x8b\\xde\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xfa\\xba\\x95e\\xb1s\\xd2\\xd7\\xfawqh\\x02\\x12\\xf6\\xd0\\xabb\\xd0\\xe2\\xf2\\xa0a\\xbf\\xc2@\\x7f\\x10\\x9c|j\\x18\\x87\\xf2\\x83\\xd3\\xdedd\\x10\\xc4\\x1b\\x94wi\\x19\\xa9\\xaf\\xf7\\xb4g0\\x8e\\xaf%\\x01s\rz\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\x83\t\\xd5\\xe3\\x02\\x98\\x93\\xab\\xeb\r\\x93o\\x9e\\xe1z\\xf2c\\x96\\xa6\\xb9m\\xc0mq\\x84\\x8f8\\xac\\xfe<c\n\\x10s\\xf3\\xc1g\\x83n\\xf5f\\x18\\x8cp\\x8c_\\x82"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05y\\xa1\\x04\\xb6\\x82\\xbb\\xef\\xa6\\x10&\\x07\\x81\\xae\\x92\\xc3\\xb9rv\\x15\\xbf~u\\xde\\xd1\\x00;/o\\xb2\\x7fju\\xf2\\xaf\\x8b\\xd6\\x8eu\\x86\\xef22\\x1emvrx\\x86\\xc8\\xc8\\xca\\xca\\xc8_\\xb1\\xeebt\\x98\\xef.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xe2\\x0f\\x8e\\xf6ne\\x9cj\\x86\\x859pv8\\xa4\\x96\\xcd\\xb2\\x01p9\\x9a`\\xe7q\\x04n\\xe1\\xc0\\xb7\\xa8\\xe8\\x83n~\\x9d(-\\x8a;q\\x96\\xed\\xff5\\x1e"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf\\xba\\xdd\\xff ;\\xee\\xd0\\xc2\\x02ojkm\\x97n:\\xaf\\x80\\xa4z\\xcc\\x1f2\\xfb\\xf2\\x13\\xa6\\xdf\\x8b\\x97\\xfc\\xb7a.x\\x89\\xee/+8f\\x1e\\xee1\\xde$\\xe7\ny\\xe2\\xea\t\\xa1\\x1a\\xbdz\\xe8y\t\\xaa#!\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\xa8\\xa5\\xf7j5\\xecoy\\xca2\\xa1\\x862\\xe3l7\\xe3\\x92\\x90^\\xe18\\xc8i\\xf8u\\x7f\\\\xb3\\x17\\xec\\x0e\\xfdg\\xfe\\x88\\xcd\\x8e\\xbd\\xdc?\\xd6\\xdb\\x9e\nd\\x93"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\x125\\xce$w\\x1cz\\x12\\x06,\\x08n\\x1b\\xe7yrz\\xb9\\x97\\x91\\x04\\x8b'\\x9a0\\x05\\xf5\\x0f\r\\xe1\\xd7u\\x7f;\\x0c\\x141\\x1b\\xcax\\xc2k\\xdbh\\x89\tc\\xdb\\xa4^\\xc6<\\xd7 \\x86\\x0c\\xe2\\xbd\\x88\\x8a\\x87\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r69\\x9crh\\xffo\"\\xbe\\xe1\\xe7\\x16\\x81z\\xa8 \\x86\\xd6z\\xbd\\x924\\xe5b\\xe1\\x072\\x04r\\x8d\\xd1\\x02\\x03\\xaa*\\x03\\x1e\\xe9\\x88i\\xe5\\xc7\\xa4h\\xb8\\x12"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3k$\\xcc\\xe2\\x8f$^\\xb9\\x81|hy`\\xdd\\xc4~\\xf9\\xed\\xe5\\xe1\\x08m\\xd0\\xe0ccv\\x04\n`\\xca8\\xfe\\xe8\\xb6\\xb8\\x03\\x83\\x13\\x04\\x84\\x9by\\x9ag\\xa4\\xe3*\\x07\\xbc\\xe1\\xa8`\\xcd\\xc4\\x8f\\xa7\\x0f\\x81\\x8e\\x12'\\xc9\\xb1q\\xdf\\xc5\\xd5\\xc4\\xe0\"\\x92q\\x8a1i\\x97\\xa6\\xf2\\xc2\\xaa\\xa4\\x96\tr\\xe1\\xc2x\\xda+\\xc8`\\xf5\\xec\\xa3%u\\x87\\xd3ut\\xca;\\xa5\\xc9md\\x16$*zxd,\\x085o\\xf7s'\\xa7va%\\xd4v~\\x95\\xc7\\xedt\\x9ak\\xe8\\x92>m\\xac\\x8fddwqb\\x07\\xa5\\x8f\\xfe<\\xe0\\x8f\\xaaj\\xadl\\xc0v\\xc7\\xd3\\x8f\\x84\\xf3>r\\xa4\\xab\\xb7\\xf1\\xac\\xfe\\xb8\\x05\\x89c\\xf1&1\\x9d\\x93y\\x13\\x89t\\xd2>\\x1f\\xe9\\xe25\\xc0bnrf\\xb4t\\xb34\\xa8\\xbat\\xc9%2t\\xe87\\x04\\x19\\xfa\\x9e7cx\\x17\\xf2\\xc8\\xd0\\x9e\\xd8\\xb0\\xab\\x83t\\x1b\\xa5\\xc92\\x8a\\xaek.\\xde\\x00l\\xbb\\xc0%\\x88\\i\\xb0gp\\xf8"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01%\\x1a\\xd4\\x11f\\x87\\x9bi6\\x93\\xf1c\\x84x?|f\\x0b\\xc9\\x9f\\x92\\xeb\\xd2\\xe3\\xbde4\\x9cr\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\x04\\x0c>\\xddyj\\xc8\\x042\\xbai\\xe4\\xb7\\x95?g\\x19\\xd7\\x19\\xc7\\xc6uk\\xf0\\x15\\xcbh\\x9dd\\xb5\\xb8w\\xcf\\xda\\x06\\x90\\x8f\\x8d\\x85\\xbf\\xd4\\x0e\\x11\\x88\\xaa\\x82\\xac\\xe1\\xbf\\xf2^p\\x85\\xc9\\x9c1\\xac\\xa4\\xa7\\xfe\\x82\\xaf\\xa7\\x06\\x91\\xb0\\x84cy\\xeb\\xaai\\xd3\\xa5\\x1f\\xaeda\\xf3\\x95\\x82xm\\xe6\\xf3vd\\xf5\\xd5\\xbc<+\\xba3\\xb6\\x85\\xaetil\\xe2\\xf19\\xdcnv+\\xab \\x99k5\\xf8\\xf1\\x9a\\xc6\\x80\\x8d\\xe6w\\x94\\xfb:\\x8f\\xc6r\\(l\\xec\\xe0\\xd1w\\xaa\\xfdga\\x98\\x87b\\x8e\\xa5\\xa6\\xc0b\\xca\\xdf!\\xeb\\xc9\\xd9\\x82o\\xe1m\\x8f\\xa6\\xaa\\xf6p\\x07\\xcet!\\xe7\\xb8,\\xb1\\x9e\\x84\\x06)th',\\x99\t5\\xa2\\xba\\x8bh\\x0e\\xb5\\x80r:h\\xb6\\xfa\\xa2\\xbf\\xf2\\xb0\\xc6\\xc9\\x81\\xdfv>\\xafr#\\x7fou\\xfe\\xad)b\\x00\\xc9\\xc89\\x16\\xc2>\\xf9<zi*\\xb7i\\x99'&@cl\\x14.\\xcb6\\x07\\xbb\\x90\\x0f\\xb1zv\\xd3\\xceu\\x04"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\x16\\xad\\xe5\nn'\\xba?\\xbb'\\xed\\xe9\\x0c:\\x97\\x9d\\x05\\xbf\\xd9\\xa1r\\x95h\\xab\\xb1\\x19\\xff\\x071\\x10\\x81\\xd8d\\xda\\xee.\\x88k\\x19\\xa7\\xec\\x12\\x9d\\xf2\\xc3\\xf4\\xd4\\xf5un\\xa0\\xe8\\x83\\xa2\\xf8\\x8c\\x1fa\\x15)m\\xec\\x94\\xa0c\\x9e*\\xd1&3r\\x9f\\xee\\xdb\\xebn\\xf8d!k*lq\\x1ar>6\\x88\\x92o\\xe4n\\x1e\\x0f\\xa5\\xdeb\\x05g\\x1d\\xb57@\\xf2\\xac\\x01\\x01\\xf9a\\xac\\xa2 \\xf0\\xcd\\x1a\\xdbu\\x11bj\\xbe\\xba\\xc1\\xb4\\x84j\\x0c\\x9e\\xf1\\xe4\\x00\\xb7\\xf7\\x9di\\xb1k!\\x93\\x85\\xb4\\xb83\\xc5m\\xb5\\x15\\x12\\x8a\\x98\\xfe\\xf5\\x9av;\\xa0\t\\x1b\\xa0v\\xc6\\xabg\\x80\\xe6e\\xac\r\\xc9j7\\xb7dv\\x85q&\\xbe\\xbc\\x06\\x0e,d\\xb6\\xeb)hby\\xf9;\\x89z\\xd8\\x9f\\xd7\\x84\\xc3lsc\\x10n\\x83\\xfa?\\xfe\\x129\\x9e\\\\xd7\\xe2?\\x8a\\xb9~\\xe6\\xb4\\xe0\\xbdut\\xd9\\xdfl\\xb4f\\xeakt\\xadi\\x99\\xbc=j\\xb9?\\x84:\\x83\\xddz\\x1b\\xb0"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaeq\\x14\\xee\\xba\\x01\\x8a\\x0e\\x9f\\xa2t\\x0ekp\\x16\\xd0\\x82\\xc2@\\x86\\xcb\\xdbh\\x1a\\xacb\\xb0\\xe7\\x90\\x8c\\x86\\xec\\x10\\x93\\xc7\\x15i\\x8fp\\xff\\x1bma\\xb5g\\x9c\\xef!\\xe2fh~8r\\xd1\\x17\\xdb\\xa3s\\xd3\\x81\\x070\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\x9dri\\x1b\\x13\\xebgc\\x96\\xeb\\xb3\\xa3\\xc4\\xb7\\xd1\\xbc\\xd4\\x82\\xc8\\xc3\\xba'\\x89\\xb7\\xf4\\x849\\xfc\\xbd!;\\xe0\\x8dm\\xf7c\\x02*\\x8e\\xb1j\\x11w\\xa0u\\x01\\x1e"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd*cd\\x8f\\xa6\\x14\\x90\\xcc1p\\xba\\x9cp\\xedkyy\\x8d\\xe5\\xbd!,\\xe2\\xb6\\xd4i\\x87g\\xf8\\xe5\\xcd\\x02w\\xd9\\xd1\\xfa\\xd5\\xb4!\\xebh\\x1e:\\xaa\\x9b0\\x85\\x06av\\xbe\\x1a\\x97w\\xb1\\xa3h\\x7f\\xec\\xa6\\xfa\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3^1\\xafi\\x00\\xce\\xb7\\xa2\\xf6\\xd0'\\xfd\\x1cq\\xeb\\x0b!zs\\xb5\\x18\\xee\\xde\\xfc\\x01\\x0e\\xe1\\xb1\\x87#\\xd8\\xaea\\x8c\\xa1\\xc5 \\xa3\\x89\\xa3\\xf9\\x92d\\x1c%\\xd3\\x0b"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\x16\\xc5\\xae\\xb6\\xfa\\xbe\\xc4\\xfewy$\\xf3\\xf71\\xb4\\xf3\n*'\\x8bx\\xe6\\x14\\x8a6\\xb4|sc\\x06\\x91lp\\xa0k\\x1e\\xeej\\xa9h\\xd2'\\x95cwg\\x873l\\xb2\\x93\\x01\\xc1\\x1e,\\xb2\\x19\\x80k\\xbc\\x1a\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x065\\xaf\\x04$\\x87\\xfd\\xb9bh\\xea\\x9d\\x9c\\xe8\\xc4\\xb2\\xbf\\x9b\\xd6\n\\x13\\xc9\\x17mt\\x14\\xb0\\xe4h\\xf5b\\x8a\\xf8\\x12\\xb4@\\xfb\\xbd\\xbb\\xe7\\x8e\nw\\xc8\\xe24\\xd3"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84?\\xf7\\xbd*\\x07\\xc2\\x13 \\xba)r\\x8dm\\xa3x\\xa6\\x7f\\x9c\\xc1t\\xa3\\x94\\x0b\\xba?\\x85\\x04\\xc2\\x17\\xe0.\\x8eysw\\x1f\\xdd/\\xbc\\xc7\\x9b\\xb6u\n\\xd9n\\x19\\x8f\\xce\\x82\\xdf1zqq\\xaa\\x1c\\xd7\\xc0\\xb5k-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb\\xd1\\xc1@\\x90\\x80\\xd5~\\x06\\xf5\\xa7\\xfb\\xb3\\xab\\xed\\x19y\\xdb\\xe16\\x11\\xb5\\xcc\\xff/\\x10pz\\xee\\xd5\\x02td\\xf2\\xf3o\\xbd0$xs%\\xf0\\xa4\\x87\\xbd\\x1e"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xccv\\x8a\\x1b\\xc0\\x9e`ey>\\xfc\\xa4\\x8d\\x92 q\\xc6 ~\\x8d+i5\\x04\\xcd_\\x14\\xa5du\\xb2sn\\xd3|\\xad\\xc9\\xae\\x1d\\xe2\\xe7s\\x01x\\xac\\x92\\x8e\\x98\\xc7\\x80\\xdd\\xa9ybt\ti:t\\x1es\\x9e\\xa2\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83+\\xb6\\x10\\xdeyl\\x91\\xd8jn\\xb78\\xf2\\xd5$\\xff\\x1e\\xc5\"\\x14p0\\x87x\\\\x97\\xace\\x0en^\\xa1r/gn\\xcb\\xac\\xb03\\xd2j\na\\x98"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5^\\xd1\\xc4op\\x11\\xe4f9\\x83\\xe2\\x8dgr\\x91\\x90`\\xc4\\xd5e\\xd9\\xe9\\x14\\xba2f/!\\x17f\\x80@\\x8bp\\\t\\x16\\x84\\xb7lc\\xec\\x19v\\xf6\\x81\\xb1%|\\xbc@~~3\\xbb\\x119\\x12e\\x0c\\xb5\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x1f\\xf7h\\xb1 \\xe7\\x8b\\xa7\\xd7\\x92\\x80%\\x08>\\x8f\\x0fg\\xf2\\xd5k6\\x89\\xad\\x15\\xde-\\xda\\xc8\\x00v\\xfa ra\\xea!\\xad\\xfc\\xfb\\xfb\\xc8\\xa5 35\\xac"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaezu\\xbc\\x91g\\xc3\\xda\\x0c3\n\\xa8\\xd8km?x\\\\xd3\\xe4\\xc32#\\x9b\\xb16'\\x0f\\x9b\\xaa\\xf6\\xf9\\xcb\\x05\\x8c\\xf5\\x1bfs\\xe8\\xbc\\xd9\\xe5\\xca)\\x9b\\xc3=3\\xb1\\xcb\\x03\\x9d\\xec\\xf1ql\\xdd\\xfa\\xda\\x8c\\xd1\\xfc\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2\\x92\\xae\\xeb\\x9c\\x06\\x84l\\xbd\\x8c(2\\xbe\\xbd\\xc8\\x04\\xfc\\xbc\\x98\\x82:\\x93\\x84\\xe27\\x10\\x05\\xd0\"*\\xa5\\xe7\\xafg\\xbc\\x99\\xad9\\x16\\xe6r\\x01\\xecr\\xf2\r\\xab;"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xa5\\x98\\x16\\x82!\\xd6s|\\xc7\\xbc\\x00\\xc7\\xfe\\x19s$\\x84s\\xea\\xe5\\xa6\\x841\\xbc\\xc4\\x9ex\\xc1>y\\xe2\\xc3\t\\x05a\\xe9b\\x12\\x94\\xac!q\\xa1a\\xdf\\x18\\x80\\x97g\n?i\\xb7\\x07\\x1f\\x07\\x1a\\xe4\\x04\\x00i\\xea\\xb5\\xc0m\\xc9\\xbbgf\\x93\\xa2<<e\\xe6j\\xeb\\xae\\x07\\x08f\\xe7\\x13\\x10\\xb2bl\\xb5\\xed\\xceb5e\\xd5\\xaa\\xe8\\x90|\\xcb^\\xaf\\xb0\\x89\\xbf\\xb6f\\x87\\xc7t\\xcf\\x9cq=o\\x15\\xd1\\xdam\\xab\\xf2\\x93_\\xd6\\xb4-s\\x12\\x0e\\xee\\xed\\xe7\\xad\\xde\\xef\\xd3|o\\x92\\xb24\\xa0g\\x02\\xec\\x81\\xc7\\x9a\\x03\\x01\\xech\\xaf\\xa77ru3\\xd5!\\xd6!\\x8a\\xdc\\x002\\x0b\\x8a53\\x0e\\x1c>$=\\xcdn\\xa6\\x03\\x0c\\xd59\\x11\\x06\\xad!\\x98\\xf3\\xac\\xa0<\\xd0\\x10\"y\\xf5\\xecr\\xcc\\x91\\xfa\\xe3\\xeb4\\xaf\\xcd`\\xb84\\xb2\\x03n\\x94\\x8c\\x84\\x9b\\xc9\\xb9\\x8f\\x96e\\xd9\\xe2u\\x8e\\xb2\\x81\\x9br\\x13q#\\x8c\\x92\\xe0/\\xb1\\x81\\xbbc$\\xeaj':\\x7f\\xdc`"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\xe5\\xe5\\xc3\\x11\\x18eh\\x97h@\\xfc\\xcb\\xd0\\xd9\\x92\\xf965\\xb7d\\x9eu,o\\xd1\\x1e\\xfe\\x84\\xa9x\\xbf\\x03\\xef|\\xc2\\x9d\\xa6\\x14\\xc4ft/\\xffm\\x86y\\xa1,v~\neo\\xfd|\\xf1\\xf8\\xa0\\x9f\\xe2\\x82\\xd3\\xc3\\x17\\xa8s\\xcco\\xe4\\xd1/$\\xe1\\xa5\\xd8\"\\xda\\xbc\\x08`\\xde\\xd1 \\x87*\\xdct\\xe9\\x9f*#+\\xa8\\xebv3\\xf3h \\xd0\\xd1zk\rc\\x1e\\xdd\\x08\\x0eb\\xe9\\xb2\\xf3\\x8f'\\x99\\x1fah\\xc4\\xd3l\\xafj\\xa9r\\xe8j\\xd3\\xb7\\xbc\\xd5\\x85\\x87\\xdd\\xb8\\x9d\\x9f\t\\x82i\\x15\\xda\\xdf\\xec\\xd4y\\x99po\"\\x80\\xa2\\xe3\\xb1vsn\\x17/\\x00\\x13\\x1f\\x8c\\x8c1\\xa6\\xd7!k\\xca\\xad\\xd3m\\xbeb;\\xa6q\tq\\x135:\\x8e\\xf8.qb\\xa2\\xad\\xe9=4\\x86q\\xc6\\xb3\\xee\\xee\\xab#\\xc0\\x07\\x99\\x93\\xde\\xb5z\\xe4\\x07<4!\\x94\\x1f\\xa13\\xec\\xc6\\xf0\\xd8f\\x1fhj\\xd0p\\xec\\xa9\\x8f\\xca\\xe2\\x04\\xc9\\x94u3m\\xa9um\\x03fc"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010tgi\\x0b\\xe9\\x1f\\x15\\x89n\\x07\\xa2<'_\\xe7\\xa1$\\x9a\\x8cd\\xf2\\xd6~\\xe3\\x1c$*\\xca\\x9f\\xb8\\xe3\\xf6\\xe3\\xdfg'\\xcb\\x91\\xfe\\xcf\\x98\"\\x8f\\x1b\\x1db_\\x96\\xe9\\xcc^\\xdcp9n\\xf4\\xd0\\x8fv\\xaf\\\\x99\\x87\\xae+\\xacu\\x00\\xca\\x81\\x1dd:\\xcas\\xc1\\xb7\\xd8\\xea\\xb7\\xf2m\\x1blm\\xaa\\xad\\xf6z\\xb8\\xc4\\xc9\\xce6\\xf0\\xc5\\x1d;f\\x0e\\xb0\\xcb@\\x81\\x05eeq\\xb19`(\\xe2j9\\xefk\\x82\\xedq\\xdc\\x9e\\xf0a\\xaa\\xc4f\\xe61t\\x85v\n.\\x9b\\x9e/f\\x0cg\\xb5\\x86\\xe8\\xe0\\xd9\\x1e\\x82\\xe9\\x12\\xa3j\\x8e\\x92\\xc8\\x85uk\\x1cz\\x12f5vo/\\x9e\\x91/\\xdd\\x80f\\xd2\\x12\t\\x88\\x0e\\x99e\\x88\\x97\\xc2j\\xb0\\xb2\\x9e~\\x01\\xa7n\\xa82\\xd2u\\xe2\\x8d_\\x8d|\\xcc\\xbf\\xff\\xde\\x81\\xca\\xee\\xd3\\x97j\\xb3\\xd4ug\\x08\\x00\\x9b\\x16\\xa4\\xf0\\x81?\\xc4\\x92y9\\xb9'-\\xa6\\x1e\\x90~\\xde\\xb5\\xa9\\xe9\\xb20\\x02\\xca\\xa5\\xe6^^w\\xd1$h\\xcd\\xdc"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$^\\xa9\\x7f\\xc0w\\x9d\\xc1\\xb3\\x82\\x9a&\\xa4\\xf2\\xf4>7\\x8d@j\\x84#\\xbd'%_o\\x8f\\x05\\xd9\\x92\\xa5;\\xd1q\\xdb\\x9b\\xb9\\xde\\x1c\\x17\\xe0\\x8e\\xfc!(\\x981\\xfd\\xbdo\\xaf\\xe5\\xad\\a\\x18_\\x9c\\xd8\\xcaj4j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#p\\x7f^:\\xb3\\xee\\xb9\\xa6c\\xc9g\\xa6,\\x83\\xc2\\xb1q\\x99\\x9a\\xc7\\xf36\\xcf~4\\xb2\\xa2\\xaa\\xdc\\xb0\\xe0\\xd2\\xfb\\x18\\x1d\\x13\\x0b\\xb7w1\\x998\\x8bui\\xe6"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\x19\\\\xae\\xf4|5)\\xad&\\x8c\\xeb\\xcc\\xe4\\x89*p_$e\\xbf\\xbe\\x0e6\\xd9\\xd7\\x14d\\x9emw\\x92benyi\\x90<\\x9f\\xb5\\xa0s*'\\xc1h\\xc9a\\xade\\x1f\\x02\\xf5\\x99d\\x86\\xb9\\xd5\\x05r\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\xcc\\xc8\\xc3*u\\xda\\x8a\\x910\\xb1\\xa3\\xed5e &q\\xdd\\x97u\r\\x18aq?\\x96\\xa2\\xdd\\xd7\\x148\\x88/\na\\x0e\\x94\\x8f\\xdf\\xb8\\xf2\\x84\\xa7_\\x0ce"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f\\x1ap\\xdc\\x1dl\\xb1\\x90\\xeaz\\x80\\x17z\\x16\\x0cl\\xe3=\\xb5p\\xff\\xc2.#8\\xf0\\x00w%\\x053xq\\xd5l5\\x93\\x1f\\x89\t\\x15)\\x00|\\xfbr\\x06\\x88\\xeas\\x9bv\\x9eh($\\xfb\\xbe\\x86,\\xb7)&\\x99\\x08p\"\\x9d\\xea\\xe1\\x94\\x16\\x1a\\xc3\\x02\\xf7i\\xac\\x82\\xae\\xd7\\xcf;\r\\xc3\\x0b\\xfd\\x8f\\xea\\xfa\\xcc\\xb4\\x16\\xd6\\x0f+\\x03\\x1at\\xc6qm\\x03q\\xd4\\xff\\xe32\\x00\\xe3o\\xa8\\xb4\\xf5l\\xa7\\xb0\nct\\xed\\xca\\xa2\\x87b\\xa2o\\x7f\\xe6\\x83\\xac\\xd9\\xaa\\xb2\\\\xa6\\x87\\xf7\\x8e\\xe3xk\n:\\x11?\\x82*\\\r\\x1f\\xf7\\xc1a\\xcc\\xcf|n\\x1bp\\x9c\\xad\\x16pj\\x04\\xc8\\x8f\"\\xe4\\x1e\\xe3\\xf7\\x1b_\\xae\\x91\\x96\\x10\\x19\\xd8f\\x7f\\xc3')\\xca\\x80\\x1d\\xa5n\\xb6\\xd6u5e\\x116\\xf2_\\xb8s\\x97\\xd6\\xefnb\\x08_s\\x986|d\\x97t\\xb9=5\\x86\\xb7l!4\\xde\\xc4\\xd3y\\x1a\\xba\\x1f\\xf8\\xa0y\\x92\\x81$\\x9b\\xb1\\xa0d&\\xc9-\\x11-g\\x82"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l:x\\xd5\\x959\\xea\\xd9'\\xc8\\x80/\\xc3\\x80.1_~\\x12\\xb1\\xc8\\xafn\\xfd'c\\xd2\\x08yp\\x1c\\xb5z\\x91\\xb9v\n\\x9a\\x88;\\x86\\x8ak\\xcc&\\xed\\x8fy;\\x1e\\x80\\x08\\xf7\\x13\\x80o\\x11\\xc5\\xbb\\x94\\x99\\xdd\\xa9\\xda\\x1f\\xab\\xb9z,y\\xf4\\xbd\\xd9y\\xdaa\\x9b\\x89t\\xc9q\\x888\\xfb@2\\xad\\xcai$\\xad\\x93\\\\x93\\xfd\\xa1\\xa3\\xc7-\\xfc\\xea:\\xc3i-\\x00\\xb4\\x14\\x95k'\\x00\\x8e\\xcch\\x8f\\xd7\\x1d\\xf16>\\xb6\\xa8\\xab\\xb1\\x11b\\xa6-\\xd5)\\xc3\\xa1\\xc8\\x838\\xab=s&g\\xf6\\xa4rtfz\\x91\\xecw\\x90\\xcc\\xbenk\\x88+b\\x81!\\x0cu\\xde\\xd5\\xe3\\xd7\\xb4z\\xee\\xdf\\xa7\\x18\\xc3\\xac\\xd5\n\\xe9\\xb8\\xa4'l!\\xea\\xcc\\x8e\\x00\\x92n,\\x84\\x0c\\x94\\xba0\\x03se\\xc4\\xc1x\\xeei\\xde\\xd4\\x02\\xb9\\xc8\\xde\\xc1\\xcd\\x13\\xb7\\xa6*\\xe7\\xc0\\xf8\\xd9\\xc1\\xb2\\xdf\\xa6|\\xc7!.\\xf6\\xbd\\x05\\xcdx\\xd2\\xf1\\xd5:\\x7fc\\x1d;\\x84b\r\\x19i\\x95cb\\xfc"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xec\\xa4\\xba`\\x13\\xdd\\xf1\\xcd\\x1f\\x17\\xff\\xc7b\\xd3\\xafn\\x0e\\xe0\\x11\\xb6\\xfft\\xbd\\xa2g\n\\xb86\\xd4\\xc5\\xc9\\xb9,\\xc3\\x9e\\x99\\x99u\\xdd \\xa7\\x8d\\x0e\\xc0\\x91f\\xe8_q@zcm\\x9dk9\\xafy^\\xbf\\x13\\xf5\\xc3\\x87\\x1atd\\x8ajt\\x13\\x138\\x82\\xc9\\x13\\xea\\x98m_\\xf0\\xc4\\xcbr\\x94d\\x0ba\\xb9\\xb7fw\\xec\\x9c\\x8a\\x80\\x89\\xa4\\xf69r8o\\xees\\xcc\\xd6\\xb7k\\xc1y\\xec\\xb1\\xa3\r\\x01\\xb2\\xa7\\xbb\\x0c\\xd7\\xb0\\xa3dc\\xf4\\xfau7\\x7f\\x00\\x07r.\\x11\\xba\\x14?\\x08\\x9cv\\xb5<\\x7f\\x8c\\x0b\r\\x02\\xed\\x94\\x99r\\xcd5\\xddg\\xc6\\xab%g\\xf7t\\x1d\\xbfzl\\x15\\x03_$\\xa3\\xb4\\x1fy9\\x01\\x87\\x0c\\xed\\xe6\\xbe\\xc4\\xa3\\x15*\\xdc4\\xd8\\x04\\xf2n\\xd6\\xf7v\\xeb\\xed\\xae=x\\xa5\\xad\\xc2\\\\x00\tok\\xc7x\\xf2jh\\xf8\\x03\\xb6\\xe7\\xa2\\x99\\xd5t\\xc7\\xf9c\\x814\\xda\\xba\\x82b\\x82\\xca\\xa6d\\x86\\xb8\\xa9o\\xca\\xe6d\\xcf'ek\\xd74\\xbf"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1\\xc7\\xcf\\x055\\xa2j\\xec\\@\\x94\\x88\\xe8\\x81\\x1d\\x1b\\xf0\\x88\\xd9\\xa6\\xa2\\xbao \\xf7\\x7f\\x91)\\xab*\\x9f!v\\xcb\\xdc\\xda\\xfa4z\\xee\\xe9\\x02\\x05\\xa4i\\xb9v\\xb9\\x03\\x855t0)6\\x02\\x00uc\\xb1\\xc6\\xab\\x7f\\x8bv\\x19~\\xa4\\xa0\\xad\\xc2\\x9a\\x19\\xa9\\xa7\\xd4\\xbe\\xcf\\xd5b\\xd7\\x0b\\xdf5 n\\xba\\xaazyi?j\\xc1\\x89\\x1a-\\x95\\x81\\xca\\xb5*\\xd6\\x9d\\x92#hf\\x19ib\\xc1\\xa7x\\xf0\\xb8#>g\\xd6\\xf8el% \\x86`\\xf1@\\xcb\\x93\\xef=\\xcf\\x8e\\x14t\\xd3u\\x0bna-j)x\\xd5\\xa6\\x0c\\xe7,\\xa3\\xed\\x1bo\\x02\\x03\\xc4\\xc7,\\xedr/>h\\xcc0o\\xd8\\x92w\\x80\\x7f\\xa5\\x05\\xe4\\xa5\\x19'\\xb7\\xbf\\xd4\\xba\\x99h\\xd6\\xb4s8y\\x02\\xd7\\xe6f\\x1dbh\\x19\\x80n\\x81\\x8b\\xaez\\xfa\\xe9xi\\x88\\x01\\xbf\\xac0\\xba\\x98u\\xbcyn\\xc7\\xc3\\x97\\xcf\\xa7m\\xf1\\x8axm\\xcdx\\xf2ar\\xcc\tzw\\x1a\\x9c\\xe6\\xe3\\xd0\\x19\\xa8m\\xd8"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2\\x86\\xd9\\xdd\\x02m\\x8d\\x87\\xe8ip\\xb6wd~o\\xd5\\xed\\x91\\x0fa*\\xdf\\xe8\\xd7\\xb4\\xb7%\\xac\\x16\\xecb\\xdfd\\xb8k\\x0e\\xe7\\xaa\\xff\\xfd\\xf3\\x14\\xe4\\xc5p\\xc9ylu\\xed\\x1e\\x03\\xaca\\xc0\\xbek\\xc9\\xbf\\xcf\\xdan\\x92\\xa6\\xf4\\xefbj\\x16\\x03\\x9e\\x18\\xe1\\x14\\x18\\xd6>\\x0b\\x08\\xffmxw\\x80\\xdd\\x1c;>\\x88\\xe4\\xfd 1\\xd4o\\xdd\\xe8\\x84\\xb6\\xed\\xc2\\x1c\\xcde\\xaa\\xd06\\xfe\\\\xe6>\\x8d\\x148jeq\\x13\\xb2cy\\x8c\\xb5\\x16d\\xf0\\xf4\\xf3vr|\\x0484\\x85b\\xac\\x88\\xf3\\x0c\\xa8\\xc7\\xf2/\\xdf\\x06!j\\xb2\\xec\\xed6s\\xd8q\\xe5b\\xf6\\xcb\\x9e\\xfd\\xe8\\x16\\xbd1\\xb2\\x13g\\x1dk\\xf6\\xab=\\x7f\\xb8\\xda\\x82s\\xcbt?\\xc0\\x02\\x8b\\x9f\\xd7t\\x0b\\x80\\x1d\\xb8k\\xe5\\xb2\\xc5\\xd1v\\xd6\\x12\\xeb\\xb0v\\xce\\x97n\\x01v\\x9a\t\\x89g\\xd3:jxd\\xc1b\\x10\\xa3\\xd0/\\x0e\\x94\\xd3\\xfd\\xbf,\\x8d;\\xd9#\\xf8\\xc4i\\x87df\\x0b&\\x9f\\x8b\\xaf\\x88\\x06d5\\xd3\\xae"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9a\\x1bls\\xa5\\x8f\\xe5\\x9b\\x96\\x10f\\xb6xa\\xa3\\xdda!\\xcb\\x1e\\xd4\\x1a\\xcbq\\x9bw\\xd7\\xbfd\\x08r\\xb3\\x82\\x16\\x98'g\\x19`\\xd2x\\xac\\xfa\\x9a\\x06xy\\xb7g\\xc4\\x81\\xac\\x18\\xc8o\\x05\\xfc\\xe1\\xed\\x95\\x0c\\xbcd\\x8c&\\xdfy\\x85\\x1b\\xbd\\xee\\x84\\xd8q\\x84\\xf5=\\xc1\\xed\\xa0\\x10\\xeaw\\x0cl71\\xed\\xf0\\xd3qe\\xf1\\xd9\\xed\\x99\\xefc\\x1b\\x10\\xf7kv\\x03\\x15b\\xd8\\xb9j\\xfc@\\xb3\\xf2\\xa5\\x7f\\xc1\\xd9\\xf1\\x81\t\\x04\\xff\\xa1vag*\njt.\"\\x14\\xdd\\xe3\\xab\\xd5\\x82\\xe3\\xbdw/\\x01p\\xe0\\xc8\\xf1\\x92f\\x9b\\xe4\\xab(\\xc0\\x89\\xb1\\xa5\\x06r0\\x92i\\x84|\\xc9\\x0e)\\xeaqrwvd\\x07\\xa7\\xa4\\xcd\\xfd\\xf1\\xfc\\x8e2\\xe1\\xf42y\\x0f\r\\xc62\\xb9db\\xb1(\\xb847\\x99\\xeeq\\xa9\\x8a\\xe7'p_._\\x1cy\\xec\\xdb,4\\xe0\\xe1\\x87\\xf1<!\\xf3\\x11q\\x1b\\x93\\x18%f,\\x7f>`\\x80q\\xee\\xec\\xf9\\xa9a\\x1d#)\\x1el\\xcf9&"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1\\xfc\\x9e\\xcds6\\xcby\\xab\\xbd\\xf5\\xcc\\xbc\\xc7\\xaa\\xf9\\xb0\\xb6\\xfe#\\xab\\x8a\\xaa \\x05\\xbc\n\\x87kl;\\xfcg\\x93\\x9a\\xa7\\xa3sr\\xdf\\xda\\x89\\xb5\\x1f\\xb4\\x1f=w\\x13\\xf1\\xc4\\x8e\\xc6\\xb8m%\\xb3rb\\x836\\xdd\\xd3\\x95|mx\\x7f\\x08\\xff\\x11\\xd0\\x04\\xe2a\\x00\\x90\\x80m\\xfe\\x95\\xc5\\xb0\\x1d.\rvjm0\\xf3\\x9e\\xb6\\x8bv\\x98a\\xa7\\xc7\\xf5*3\\xf7\\xb3\\xcar\\xac\\x85\"2\\x0cts\\xb5\\x1e\\x1el;r\\xfd\r\\x9f\\x838\\xb3;\\x92\\x9d\\xfa\\x8cl\\xad\\x0e\\xe6\\xcd:\\xf1\\x80\\xa5x)b\\x85<be\\x92>s\\xa9\\xa2\\x8c\\xa8\\x10\\xf5hc\\xe5\\xdb\\xb8..\\x92\\x8e\\xf9\\xe4@\\xba\\xf2\\xc8/r\\xca\\x02\\xeb\\x94\\x0b\\x89\\xb9/.g\\x19#\\x12\\xdb\\x08|\"i\\xc4\\x8cd\\x08\\xfdg\\xb1\\x9fks=\\xc8a\\x80\\xc4\\x10g\\xcap\\xb08j\\xcb\\xab-#8>%\\xf4i\\x15z\\xe7p;\\x07\\x19\\xe3\\xe5\\xca?\\xc7\\xa6e\\xc3\\xab\\xd2\\x04\\xaf\\xf1\\xe6\\xaf\\x1c\\xdf\\x15\\xff~"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\x85\\xd4\\x1f7/g\\x12\\xbe\\xac\\x87\\xbf\\x13#\\xcb\\xd8\\x97\\xd7\\xa0\\xbe>b\\x0c\\x87\\x92h\\xf61\\x9f\\xc9\\xb5\\xedh\\xa9\\x08;n3\\xf6\\xe1\\xc5\\xa4o\\x03\\x8du\\x05\\xd5,\\x8e#\\x03=4y\\xb4~`\\xfd\\xae\\x9f\\xad\\x87;g\\xdfa\\xcf\\x95\\xfcl\\x17\\xae3\\xdb\\xa82\\x05=a8\\x86d\\xd1\\xb3\\xa8\\xb4\\x1b.\\xa4f\\x81yl\\xa9k\\x0b\\xf9\\xe6\\x96\\xb7#\\x00d\\x85\\xab\\xae\\x8ey*i\\xd4\\xd3w\\xe7=\\xb1\\x96`\\xc5\\x157\\x97\\xa2\\xffey\\x02\\xc4\\xb7\\x82\\x8d\\xee\\xc7\\x06\\x168\\xa1/\\xcf6)o\\xfd\\xeah\\xd0-y\\x8e\\xb3u\\xb7e\\x13\\xfa\\x8fc\\xcdey\\x98\\xf7\\xe4=\\x89\\x88\\xb7\\xfd=\\xd2\\x11\\x8b?\\xcb\\x19\\xf9\\xa9d\\x14d\\x10\\xbe\\x88,\\xa3\\x86s\\xe4\\x9eol\\x04 \\x06<#\\x85n\\xfd0x\\x85w`\\xcc\\x97\\xf9\\xef\\xea\\x1fc\\xfc\\xb0p?\\xfc\\xd8e\\xa1\\x88\\xbd\\x13g\\xd3\\x0b=\\xf1\\xc3&\\x8ct\\xe7\\xc4<lij\\x0c\\xbf\\x9bb\\x11\\xb5\\x0bv\\x82"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\x9d\\x1d\\xa6\\x94x\\x00\\xc8\\x0c\\xc0\\x1a\\x10\\x032\\xe7\\xb5\\x04\\x9d\\xc35\\x83\\xb2\\xbb<x\\xb7\\x84\\xbe\\xc8\\xe8!eu\\xbez&\\x7f\\x9e\\xba\\xb0\\xc1\\xd4w\\\\x99\\x03:\\x16\\x96gd\\x82\\x89\\x9d\\xc9\\x15\\x84\\xa62p\\x8agju\\xb0\\xe9\\xb4r\\x05\\xf6\\x8e\\xa9\\xfb\\x17j\\xedzy&\\x19eu\\x04\\x02\\x14\\x97@\\x0b\\xc2\\xfbl\\xda\\xe7\\xdb|\\xf4p\\x06m\\x8b\\x9bar\\x83\\xfa\\xaa\\xf6\\xe0\\xe7\\xba\\xf2\\xeb\\xfd\\xcdt\\x9c\\xfetx\\x15\\x0cr\\xfe|7\\xeb\\xcc\\xd5j\\xe2c\\xa1f\\xee\\x97\\x10\\xa9\\xdc\\x85>t\\x86\\xbb\\x16\\xe9yq\\xe1\\xb8\\x13i\\x05f\\xb7\\xba>\\xc5w2\\x04\\xea>8\\xa3c\\x8e6\t\\xfec\\xd0u=\\xba\\x93p\\xe0\\x18\\xfa_7|\\x1a\\xfe9t\\x98\\x19&\\x99h\\x95\\xfc\\x8a\\xa65\\x05\\x0b\\xf1\\xf6\\x95\\x8a\\xc9\\xe8\\xfe\\x00\\xbe\\x1ek3\\x98(\\x08\\xf4\\xff\\x99\\xcb\\x8c\\xd8~\\xea~\\xefd\\xe4'\\x94gg\\xd5\\xd4\\x140\\xa7x\\xd8\\xa4\\x8e\\xa4\\xa7\\xae%\\xd5\\x94z\\xf8"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y#\\xbd\\xd1\\xb3z\\xeeb\\xdf s\\x9b5\\xdbdo\\xd3\\xfa!\\xaf\\xfe\\xa8\\xad\\xda\\x8f\\xa2\\xd6\\xb4$\\x8cv\\x96u\\xf6\\xad\\xb1\\xd3,\\x14\\xc7h5\\xe7;\\xfa\\xdec\\x02\\xfb\\xf0%\\x17\\x18\\xb7\\x07n\\xba\\xa8\\xa9x'\"\\xd9n\\xfed| \\xc3\\xef\\xb6\\xcb'\\xa2\\xc0h\\xde\\xb2r\\xb3;j\\\\xc1@\\xe8 \\xa2\\x93yx\\xf8\\xd1&j1h\\xf0\\x8f~ir\\xf1ljt\\xe14\\xaa\\x18k\\xd5\\x05\\x94\\x1e\nm\\x9c\\x0c\\xef\nxl\\x92\\xe9\\x9e\\xa2h\"-\\xd6\\x9fpd8\\xf7mh\\xb7\\x18\\x07\\x89:\\x83\\x17\\x0f\\x8e\\x9e\\xc5\\x88w\\x19\\x8dp?\\xd5lq\\xc3\\x8al\\xd0(\\xb7\\xdet\\x00\\xddv\\xef\\x1d\\x9d\\xf9k\\xaf \\xf5\\x10\\xdf\\x81\\xd6v_c\\xbb\\x10*\\xceah&\\xc18s_\\xdd\\xf4\\x90\\xf0.\\xbf\\xd9l\\x80\\xb3t\\xfde^j\\xc9g\\xe6\\xc7\\xc7=\\xf7\\x1b\\xd9i\\x92\\x15\\xf8\\x8c*\\\\x07\\x0f\\x96\\xbd\\x01yo\\xa6vd\\xe1\\xf4\\xb9r\\x1d\"h%ea*"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1b+\\xa0\\xc8m\\x04\\xfc\\xce\\xfe\\xc8#e\\xd7\\*\\xb7$<\\xf7\\x8c\\x1d\\xef\\xc8c\\xe9\\xf8y\\xd4\\xf3\\xd6\\x82\\xed+\\xf5\\x8c:\\xa9\\x0ff\\xa6\\xc2z\\xf6\\xa0\\x8bly\\xd8\\x02@\\xe2\\xd7\\x9d\\xf9o5i\\x89\\x92\\x8cl\\x12\\xd59d\\xb3\\xcb#\\x0bo,\\xac\\xfa\\x18\\x8b\\x8d\\x97\\xec\\xcbw\\xd1\\xb6\\xb2\\x88u\\x13\\xbe<!\\xb7h1\\xe14\\xb3%\\xffm8\\x90\\x1a\\x97\\x9c7\\x981\\xb2\\xd7m\\xba\\x97\\xfe\\xc7\\xdb\\xff\\xf9\\x8f\\xc6\\x9c\\x8c\\x13\\x81\\x8e\\x93o)\\xf1\\xcf\\xe5\\xa5ne\\xaf\\xaa\\x13\\xef\\x96\\x1bp\\xe5n\\xad\\x9f2`l\\x1d\\xf6'\\x912\\xfb\\x82 \\xdd\\xf3\\xd6q\\xb1i\\xe1n\\x8b\\xa2\\h@\\x91<\\x9e\\x04\\x9d\\xf2h\\xfe\\xbc\\xd3\\x8d3\\x84\\x062\\x13\\xc8\\xebe\\\\x9f\\xb1|\\xf7\\\\x86~\\x81\\x82\\xac\\x93e1\\x97\\xab\\x95u\\xbec\\x03\\x80y\\x08\\xc2\\xa6o\\x99\\x8f\\xc3\\xa3\\xbcer\\x0cs\\xd0\\x00\\xbb\\xe86\\xc3\\x9e'\\xf4\\x07\\xc6e\\xe1\\x9b\\x18i\\x1f9\\xcc\\x8e\\xb9\\xe6"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x0f(\\xfb\\xd2\\x07'\\x86 \\xb3\\xc3\\xb7'\\xde\\xd2#:;?\\x06e\\x15ltv\\xd1\\xb8\\xb4\\x97\\xf6\\xc7\"o\\xc5\\x169\\x9bs1\\xde\\x13o\\x84=\\xdc\\x13z& \\xea\\xde\\xa7\\x1a\t\\xf7\\x83s\t\\xc4\\xc2\\x82\\xe5z\\x19g\\xabh%\\x97\\x00\\x07\\x9fq\\xcfgv\\x1a\\x1e\\x96\\xaba\\xd2;.d\\x1bp\\xca\\x88\\xf9\\xfbo0\\xc2\\xf4w\\xf8cl\\xe2oc\\x87\\xc6\\xa5\\xd3\\x9e\\xb7\\x9b\\x174r-\\xcf\\xc4\\xfeez\\x1ed\\xd3a\\xdb\\x97\\xc6\\x88\\xa0\\xcd\\x07\\xd1y\\xb8\t\\xca\\xd3t\\x13\\xab>a\\xa0d_p,\\x97\\xb9 \\x85(1\nija\\xc0\r\\x7fc\\xc8\\x04\\xc8h\t\\x0f\\xc9\\x98\\xf5\\xdf_)!\\xdb\\xd1\\x8e\\x06\\xbb\\x8dxgy)\\xf1\\xcaa\\xbct\\xc5\\xf9\\x8c\\xb9,\\xdd\\xf9\\xbd\\x154\\xb9\\x18>s\\x90\\xdeq\\xe0i\\xcc1\\xaf\\x04\\xcf\\xef\\x8c\\x9fq\\x07r\\xcf\\x0b\\x8f\\x81\\x1e\\xc5x.\\xe3\\xe3\\xb4\\xe1a\\xd3\\x88q\\x94+\\xfe\\x8a\\x07\\\\xdb\\xf5\\xf2\\xe5\\x83\\x8d\\xca"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xf3\\x89\\xd7\\x13\\x04\\xb8\\xeb\\x03\\xbe\\x7fw\\x10\\x7f\\x12e\\x03\"\\xbc\\x97\\x13\\xf3p\\xe2ne\\x97\\x1d\\xeek\\xa2\\x14aa\\xee\\xffl\\xaa\\x7ft\\xfe\\\\xc2n\\xbf\\xb3\\x85\\xc6\\x02r\\x9e\\x0f\\xb2\\xdfjt\\x85\\x8b\\xad\\xfc\\x8f\\x99\\xc2\\x10\\xa3\\x94\\xf9z\\x07|%\\xfc\\x0b\\xf9\\x8b\\x9e\tn\\xb3z\\xdd|p8lp\\xc5\\xff\\x1c#&\\xff\\xff\\xcfan9+o\\x7f\\x18\\xec\\xa0\\x9b\\x8d\\x870\\xae4\\xa4\\xf2m\\x9f\\xc3\\xa0\\xf6\n*\\x10\\x17+\\xed\\xdc#\\x94\\xcbx \\x00\\xbbu\\xcf\\x7fd\\xa9nv\\x1d\\x06\\xe8bk\\xc5~\\x1f\\x9c4\\xc8\\x11\\xa1\\xc2\\x87\\xe4\\x9e\\xf3\\xd8\\x8d,8\\x1f\\xe7:\\xc5\\xcc\\x95t\\x0f#\\xc1\\xb1w\\xbe\\x18\\xb3\\xa8\\xddw\\xce\\x8e.3\\xe6\\xe8p\\x8fk\\xaai\\x15\\xf1\\x04\\xc2\\xbe\\x9fsa3\\xb2e\\xe5\\xd4\\xcet\\xc6v\\x12\\xa0|\\xbb<\\xf9h\\xce\\x1e\\x14\\x08\\x10&\\x9e\\xfc\\x12\t\\xf7\\x12\\x07\\xab\\xec\\xcb\\x92#n\\x93\\x89rs*\\xaa\\xfa\\x97\\x97r\\xe8\\x91\\xbc9\\x1b\\x80"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\x95\\x8bl\\xcd\\x82\\x8b\\xf7\\x9f\\xf4u<h\\x0e\\x92hi\\xc0t=\\xdb%f\\x9e\\xe0\\xe8\\x17\\x859\\xb9\\x04\\xdci)\\xe9\\xfab\\x9e\\xe4\\x8d\\x85<\\xc8\\x16of\\x99q\\xa5\\xa6\\xa8\\x0b\\xd1\\x9b9\\x8a\\x89n\\x9e\\xa9\\xd9\"\\xe93\\x8a\\xfb\\xd8\\xad&\\x9a\\x10\\x9a%\\xaa\\x0b \\xbf\\xa5\\xb9|\\xe4\\x00\\xa9\\xfa\\xa3\\x05c\\xf4w\\xd2x\\x8c\\xd9\\x11\\xcf\\x16\\xabdq\\x84%:\\xaad%\\xf9\\xba\\x82;\\xfd\\xc9\\xda\\xe36\\xc8\\xb4\\x07\\xf3\\xdc<h\\xa7\\x83\\xc5\\x10yx\\xa0\\x987j\\x87+\\x8b&\\xe1\\xb7xr\\xffz&\\xf3\\x8f9\\x92\\xa7\\xc8)g\\x84w\\xbc\\xd0$\\xb0\\x96\\x07k|e\\xaa\\xf6\\xee\\xfe\\xf2/\\x95\\x00y/\\xb6x7\\xf1\"\\xbf\\xcf\\x96\\xa6\\xa4j\\xa1\\xae\\x1dd\\xcd\\xa5\\xb7\\x8a\\x0f\\xceo3%\\xac\\xb5\\x872\\xfe\\xdd\\xb3\\x1a&\\xfb\\x93q\\x90s\\xcb$\\x16&\\xac \\xe6\\xb2\\x9ft\\xda\\xf4c\\xa2\\xbb\\xae\\x15pl\\xcdw#\\xe9\\xd1k\\x1bif\\xed\\xa9\n\\xa7\\xfb\\xee ^m\\xa7"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ye\\x87\\xa2\\xf9r'\\xe6/*2i\\x8c\\x06.2\\xd6>g\\xa8\\xc15fh\\xb5\\xac\\xc1\\xaa\\x7f1\\x1b\\x0f'\\xb1k\\xc4\\xb8p\\x9f\\x17bc\\xf17~u\\x80\\x12\\x98\\xbfi\\xb3\\x16\\x1e\\xeb\\xd7a\\\\xdb\\xa3\\xf8bg\\xee\\xc4\\x12\\xe6\\x10\\xbc\\xdb\\x01\\xe4\\x82_c#\\xa4\\x9f\\x1alifl\\xc7\np\\xa8\\xfb\\x88d\\xe7/o\\x83\\xfegwweo\\xa6\\x04\\x14\\x14\\xf9\\xd6\\x94\\x1d\\xd3@\\xc3\\xdd\t \\xca\\xda\\x97w\\xa4\\xea\\xee\\xff\\xc9)\\x82\\x93\\x10u\\xaa\\xb8k\\x1a\\xb6c\\xfet\\xbc\\x83\\xa6\\x1d_\\xc2\\xa8\\x91k\\x91\\xc4`cb@\\xc49\\x9dw\\x94x=k\\xad\\x08d\\xa5\\x16_9\\xd7\\x16\\xedz\\x19\\xa0\\x98i\\xf7\\xc8\\x17m\\x16\\xe1\\xc1\\xe1f\\xbe:\\x8e\\xa0\\x94\\x1d\\xf1\\xd1\\xc9\\x0c\\xeb\\xd1\\x0f\\x89`\\xdaf\\xf1i\\x91z\\xa9\\x858e(xb4\\xf8\\x01\\xda\\xca_\\x02\\xfe\\x1b\\xf3m\\xea\\xcbo\\xebh\\xd1`cp\\x87v,s&z\\xa0\\xday\\xfa\\x07\\xd8\\x92\\x8c>k"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\x00 7\\xe1t\\xd1\\xa4bh\\xecj\\iv_5w\\xb5*#%\\xb9g\\x98g\\xb1\\x89\\xc2\\xe8\\xccg|0<2?\\xfa\\xa2\\xf9\\x10rs\\x91h\tgw\\xbej\\xdd\\xac\\xf2*bfq\\f\\xb6\\xf2\\x9cl\\xeb\\xafd\\x0c\\xce\\x86\\x97\\xa6\\xb8\\xe7\\x98\\xf6r2\\x07 \\xdew\\xf3\\x96!\\x92\\x88lr\\x9f\\xef\\xa3y\\x19f\\xebi4\\x8f\\x10\n\\xec:b\\x82p\\xb2>\\x04\\x11n\\xdb\\xc3\\xed\\x14\\x0f\\xed\\x0f\\x80\\xa4lq\\x98\\xc1\\xeb\\x05u\\xb4a\"<\\xe3\\xf5b#d\\xabu\\x8d\\xd1\\xe3p*\\xcc\n\\x11!\\xbc\\xd2\\x92j\\xb5\\xe0\\xd2\\x81\\x8473>\\x17\\xf054\\xb6\\xa3cy\\xee\\x85a\\x88\\xef\\x9b\\x1b\\x1b\\xb4s\\xd0\\x03*5\\x12\\xef\\x12\\xb8t*b&\\xc29\\xecs0i\\xaby)\\x0f:\\x16\\x94\\xdd\\xc0\\xe0v\\x88m\\xb3\\xf8\\x19\\xdc^|\\xedl@\\xa3f\\xe4\\x9ay\\xd9bm\\xfap\\xfd.p(_\\x86\\xf9\\xb0\\x98\\xb8\\xd7q(p\\xe2wc\\x8c\\xaa-\\xc3\\xb2"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\xcc\\xfd`\\x16r\\x14\\x91\\xb1\\xb4\\xd1\\xd6v\\xc8\\xf2\\x8b6\\x03\\x17>xi\\x1f\\xc5\\x80\\x7f\\xb4\\xec\\xedm\\xa0\\xa6\\x99\\xd5r\\xec\\x90\\xa9z\\xd2\\x7f\\xb7q\\xac\\xdf\\xc9j,\\xeen\\xc7\\xedd\\x9buy\\xb1\\x05\\xeb\\xcfr\\xfb\\x08\\xe4\t\\xa4m\\xcf\\x97\\xa5\\xd1\\xc1\\xf2\\x93+\\x1e\\xbb*m\\xf0wl\\xf3>g\\xf9\\xd6\\xea\\xd4\\x19\\xbd;\\x89ic\\xbe\\x02\\xb4i\\x06gti\\xdf\\xada\\xc3j\\x0f\\xde\\xf5m\\xf7t#\\xdc\\xb8\\x10\\xf0p\\x0e\\xbd\\b\\xe1q?r\\xc5g\\xd5\\x12\\x97\\xb6\\x046t\\xb3\\x989\\xf0\\xdb?\\xa2\\x03pu\\x1c\\xc5j\\x98#\\xed\\xcd\\xb1$k\\xadc\\x1d\\x9b\\xd4os\\xbe\\xe8\\xe0b\\xe635\\xfbm\\xc1\\x08)\\x97\\xdfr\\x9d\"o\\x02\\xbc\\xd1\\xa1\\x88\\x085\\xbe\\x95r\\x86,\\x8e\\xff\n\\x9a\\x1d\\x83h\\xb4&\\xe9\\x8d\\xcc5\\x824 3\\x9b\\xba\\xba\\xf9\\x14u@\\xdb\\xa1%b\\xf1\\x8a\\xbe\\x00y\\xd4\\xf7\\x1ft^\\x98\\xee\\xd6\r\\xc1\\xf2\\xddf\\xb7\\xffj\"f\\x14"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9\\xa4\\x9e\\x87\\x16\\x9f\\x89u\\xeax\\x8d\\x1e\\x128\\x94\\x9f\\xed\\x0c\\xb2\\xf6\\xac\\x01\\xcd\\xa6\\xde\\xd5\\xb6srvoi\\xa8j\\x05~2\\xe7\\xa1n\\x12/\\xf7i\\x95\\x15\\xfb\\x0c_g\\x84`\\xc4ny\\xb4\\xe7\\xb1o\\xd9 b\\x18\\xc9\\x03b\\xd0s`\\x7f\\xb3\\xbc\\xf7\\xb7)\\xa1\\xe3bd\\x19\\xa1\\xce\n\\x93\\xee\\xd6\\xc4\\x82k\\xf1()\\xae\\xc6\\x00ysq\\x0few\\xe8a\\x0b\\xba\\xe0\\xe8\\xa0\\x86d\\xf4f9\\x95%\\x02\\xf3\\x11\\x13\\xf7>+\\xb1\\xdc\\x94\\xa5m\\x82ys\\xabum2\\xfb\\x7f\\x8f\\x87\\xa9\\xb7\\xf0\\xe2\\x12\\x82\\x8c\"\\xd7\\xd5j\t\\x04\\xd2ax\\x0b\\xf3\\xc1:~\\x1c\\x8f\\xcf\\xa4\\xc8\\xff\\x14\\x86\\x84\\x99\\xb2+o?\\x8e`\\x87\\xcc\\xf4\\xe5\\xeft\\xcf\\xd6\\xe7\\xf9d\\xd2\\xf0\\x99\\xce\\x98>;b\\xd9&\\xb7\\x1c\\x1d\\x15\\x9e\\x08#v\\xfd\\xe7\\xab\\x9e\\x17\\x08\\xe6\\xb8\\x7f\\xd7\\xd0\\xe9\\xa3 \\xfe&\\xe0\\x89\\xedj\\x1b\\x18*\\xb7\\xa8w9\\xef\\xf7\\xe1\\xfbw\\x8e\\xf6\\xda\\x83\\xefk\\xefi\\xef\\x86w\\x8e+\\x90"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\xd7\\xa7$$d\\xa8\\x00\\x9b\\xafp\r\\x82y\\xcd\\xf0l\n\\x90\\x8fk\\xe7&e\\xd3\\xeb\\x07\\xab\\x00\\x9d\\x9b\\xfd\\x1a\\xc5\\x90%\\x05qd\\xb9#\\x8d+\\xb8\\x93uz\\x1c\\xa9.\\xeb\\xc3b\\xd8\\xf4\\xfaq\\x1bbw\\xb6v\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ubojz\\xdfl#u\\xe5\\xa3\\xb8\\xff\\xf9\\xf3\\xcd\\x00\\xc0;\\x1b8\\xc2w\\xcb\\x19i\\x8em\\xb3e\\x7f+\\xc3\\x08\\x0e\\x85\\x05\\xaa\\x90\\xe2g\\x96\\x80\\x7fo\\xa69"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9w\\x0f\\x83:\\xf0su\\xb6\\x1bp\\xb7f\\xad\\x83\\xb6\\xba\\xfd\\xfb\\xb9\\x95\\xe3\\x8d\\xc9z\\x88\\xf4\\xac\\xac\\x92:2\\x87u\\xb1\\x92\\x97x\\xcc\\s\\xbc9k\\xe4f7`\\xb1\\x88\\xe5f\\x90l?\\xc0'\\xa5\\xc7\\xe0\\xd2\\xca\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\xb8dk\\xd3\\xe5\\xe95\\x932\\x90\\x9ec\\xf3n\\xb5_\\xaf\\xb2^t\\x12\\x046.r\\xce\\x1dnib\\xd38\n\\xb0\\xd9\\xa3\\xa7\\xa7\\x98\\xa5\\x81&c\\xb2\\xfa\\xf8"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83k\\xe7i\\x1b\\x92\\x9d\\x04\\xb3\\xaa\\xd6\\xbc\\xb4\\xf4\\x06\\x81t\\x1a;i\\xddvd\\x846y\\xf8\\xacm*af\\xcaw\\x108r\\xd9\\x00\\xcfhf\\xd8\\x16\\xc4\\x01o<:\\x7f\\x8f\\x82y\\x9fq2e\\xdb%=2\\xeeo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdol\\xbf\\x96\\xab\\xde\\x95\\xaf\\xc7\\xbae\\x9d\\x0c\\x10\\xd3\\x9e-&\\xd9\\xa9\\xc3-\\x85=\\xc4\\xe4\\xe9\\xb9\\x9f^\\xc1\\x18a\\xaa1\\xf3\\xcf\\xc5\\xaa\\xf3o\\xf6\\x9c\\xabe\n"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\xf0\\xeb(p#\\xa1\\xab\\xcaz/\\xbel#/=v\\x84\\x1a\\xb0xm\\x8ent>\\xec?\\x96\\xe4*\\xd2\\x8f4@u7#\\xe5\\xee0f\\x11\\x9b:4\\xe7\\xa2\\x80\\x00v!\\x02q\\x97a\\x1d\n\t2u\\xb9@\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\xc7\\x05^\\x99\\x9a\\x11z\\xcan\\xec\\x13\\x9b\\x05\\xe2\\xee\\x9e\\xd1\\x18\\x14\\xb3\\x03\\xf3\\xbb\\xd4\\xf6\\x13\\x17\\x01\rn\\x03\\x18\\x00\\x87po1\\xf4\\x03;a\\xa9~\\x89\\x8ed"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x07\\xd3$+\\xf6o\\x00\\x95\\xa9y\\x8cpi\\xffs<\\xc8\\xf4\\xfd-\\x11\\x0f-\\xf13n\\xeb3\\x0fw\\x16d\\xa2\\xca!\\x819\\x0c)/\\xe3%\\x91\\x14i\\x8d\\x92\\xd9\\xf1(-z\\x10q|c?\\xab\\xab\\x9d\\xc7\\xc0\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\x9f<\\xa6\\xf2\\xcf\\x9f\\xfc\\xe4\\xa2\\x10\\xb0\\xdf\\xa0\\x1f\\xe5\\\\xa1\\xcek\\x93\\xa7\\x93\\xd9\\x08\\xcbj8\\xa4\\x0b\\xd0\\xbc;f\\x92\\xf2\\x03\\xcdr\\xeb\\x0b\\x85\\x1b\\x030v\\xfa"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x934\\x85\\x02w\\xda\\x8a\\xc8\\xd5t\\x9fz\\xb38x\\x95\\x7f\\x1c\\x16\\x07\\x1c\\x8b\\xc6\\x8a\\x84\\xf6\\x15\\x95\\x0f\\x0f\n\\x038\\xa1\\xdb\\xf3\\x19`g\\xe3\\xa3\\xd7\\xf3\\xcbj\\xe64\\xa9\\xd0\\x9d%;6d\\x98\\xf9\\x91!\\x1ca0\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6\\x14r\\xd5\\xfb\\x1f\\xa75uw\\x08\\xd1\\xe0\\x1e\\x81\\x91\\x98\\x14\\xfc\\xb1\\xcd8xs$e\\xa9\\xdc\\xb4\\x9b\\x90os^s\"\\xe7q^ \\x06\\xc5\\xef\\xd3m<>"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xbd?\\xbbhu.\\x80\\xbe\\x12\r\\x00\\xccex\\x0bu\\xf9i\\x0c*\\xd9\\x8a\\xbd=\\xd9#\\x10\\x96\\x87\\xdf\\x84\\x8ez^\\xe2\\x1a7\\xe7\\x13\\xaf\\xe3b\\xbe\\xd2o\\xacy:(x\\xae\\xec\\xdeoy\\xec5\\x9a\\xd8<\\x15j\\x1ajz\\xc57p1\\xdd/_\r\\xb4g\\x0f\\xc71\\x04hp\"u\\xba\\x03qtudb\\xb3\\x16x\\xa4\\xce\\xe5bd\\x9b\\xdd\\xe3\\x04\\xc1\\x17\\xdfc\\xf4\\xee\\x83w\\x9br|\\xd6e\\x00p\\xee\\xb09\\x89?`\\xde\\xc5\\x1e\\x16ja\\x12\\xf3\\x88\\xbfv\\xdd\\xab\\x82\\xec\\xc0k\\x80\\xd5\\xc4\\xc8\\xc0rj\\x07\\xc1\\xb2tw\\xa3\\x1e\\xe6\\x9ch9\\xca\\xcd\\x90\\x81\\x9e\\xf60\\x86\\x18\\xae\\xd7\thr\\xec\\x9f\\xc7\\xbbg\\xcc\\x16on!\\x01\\x7f\\xc7d\\xdav\\xaf0\\x83\\x8e(\\x17\\xe0\\x7f\\xa4\\x0b\\x9fls\\xe6\\xbfia\\xa0\\xd1\\xa4\\xd9\\x14\\x97\\x8a)\\xb4k\\xe9*y\\xf8\\\\xdd\\x869ynf\\x89\\xb1\\xa9j\\x7f\\xdf$9\"\\xc3\\x003\\x06\\xb4\\x99\\xf3`\\x03\\xd2\\xb7\\xcc"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xf3\\xadtq\\x98k\\xcb\\xaf\\x8f\\xd6\\xbc!\\x9c\\x0fx\\x1at:\\xdfg\\x15;\\xf0\\xfb\\xb3*r\\x92\\xeaj\\xdc2\\xdb\\xb6\\xa1\\xe1\\xf6\\xa5xih\\xe5\\xdd\\x9a\\xe0\\xec~\\xf3\\x85\\xd4\\x8a\\xa8\\x90\\xdea\\x04!\\\\xd3\\xc4s\\xd4\\x02\\x17\\x17&4gh\\xf1(@skw4\\xce<\\xa3s\\x04$\\xb8\\xdc\\xd8\\x8c\\x18\\xbb\\x98\\x99x\\x95\\xf7(\\x89\\x90\\x16\\x9fs7\\x98j\\xe4\\xb6%\\x88\\x9f4v!\\x88\\x14\\xea;\\xa8f\\x82\\xb7b\\xca\\xc5\\xa3qf\tj\\xbeen\\xac\\x0f1\"\\xa3\\x0coa9e\\xe2\\x86\\x82su\t\\x1e)\\xaez\\x0e;\\x04\\xc1`\\xe4^\\x8e\\x93l\\xcfo\\xc4\\x14q)\\x9a)7\r\\xd6\\x05\\x03\\x9d\\xb9\\xb7\\xd4k%\\xad\\xa1iv6\\xe0\\x96\\x86\\x10@\\x03>\\\\x94\\x1dyw\\x9do\\xf9\\x18\\x8f?b\\x1d\\xe8\\x9cf\\x1c$\\x1d\\xad\\xcfo\\xc34\\xfd\\xdfh\\xe6\\xbe\\xc9\\x0f@\\xd3\"\\x16\\x99\\x80!\\xb4fk\\xcd\\xe5!\\xd3\\xb3\\xeb\\xe0\\xc4\\x88xz\\xef\\x0b\\xa5\\xd0u\\xc9\\xe1\\x0e"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xf8;\\xb5\\xa3\\xeedbr\\xf8@=?\\xf4\\x86q\\xa9\\x1bo\\x9c\\xbf\\xf8\\xf1\\x0b\ny\\xe8!nkf\\xf6s\\xe7hu\\xbc\\xbb\\xda\\x06\\xceo\\xb8\\xc0\\x05k\\x8azq\\x07\\xbe\\xb4\\xaab\\xe3\\xb54\\xd5\\x83\\x14p\\x8a4\\xb3,4iw\\xde-\\xadf\\xe7\\x97\\x88=\\xdeo\\xa4\\xf9\\x18!+\\x00\\xcfb\\xff\\xae<8q1\\xf0\\xfb*1\\xe2\\xe6.qoob\\xc1\\xce\\x90*\\x97;\\x94\\x01*\\xc7/\\x15,\\xbc#\t\\x1b\\xf4\\xbd\\x93\\x17\\@\\xd5\\x15\\xc5\\x16a\\x0e\\x9b;\\xcf\\xbf\\x0b\\x84\\xfc\\x96\\xfb\\x12\\xcc\\x11r\\xd8m\\x86y\\xf1\\x00\\xaey\\xd77\\xb7\\xe1\\x96\\x05\\xc2x\\xbc~\\xd9\\xb6\\xb6*\n\\x89\\x0c\\xc9\\xd0h\\xbes\\x8d\\xa1\\xb0x\\xdc\\xdf\\x15\\xfdn\\xcc\\x91\\xf9\\xd5ay\\xe4\\xac\\xc6\\\\x18aq\\x08\\xda\\x7ff:i6u5#\\xb8+\\x88x_w\\x8e\\xec\\xd7\\x19*\\xd8\\x04\\xd8?a\\xbfpyt\\xf1\\xb4\\x89c\\x99\\x8fel\\x99\\xe9\\xc7+\\x9d.pvn\\x9d\\xad5"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\r^kuc\\x07\\x85q\\xd9\\xe9+\\xebs?\\xcee\\xac\\x89\\x14\\x97u\\xb5\\xe2l\\x99\\xa0\\x9c\\xa9\\xe0nf_\\xcf|\\xd9\\x9f\\x1a\\xcd\\x9e\\xda\\x93p\\x19\\x06\\xe6gf\\x1exf\\xa7k\\xae\\xf8\\xc6\\xa5\\xc5\\x07\\x9f\\xc4\\xec\\xees`rx;\\x03i\\xb1\\x89\\xe9\\x0b\\x81\\xa5\\xd7\\x11\\x9c\\xaa\\xfbn|k\\x90\\x06\\xa1\\xf4\\xde\\xd3\\x14d\\x97\\x1b8(n\\xdb\\x008\\x8f\\x12ub3@\\xdf\\x1e`z\\x99\\x1f\\xe2\\xcep\\x14\\xc1\\xb9\\xa1\\x82\\x89u\\x01j\\xca\\x00\\xd4`\\xc0\\x88\\xb2\\xa6\\xcf\\x8f\\xc8\\xb3\\xbf%a\\x93\\xf8pg\\xa6mcp6\"\\xaazh#\\x146a\\xb5\\x82\\x18\\xabe\\x0ey)\\xe1\\x89\\x9cz\\xe7\\x91u\\xcbj\\xd9(vn\\x1dr!\\xba\\xe5\\xd1\\x9c\\x18\\xae\\xdd\\xffw\\xa3z\\xc6\\x02\\x05\\xcb\\xea:\\xf0\\xfd\\xeel\\x9eo\t\\xb7\\x88\\xc2vc\\xa1\\x15t\\xc3/\\xe9\\xfc\\xd9\\xdc\\xfd\\x1d\\x86\\xf8\\xa1sw\\xa60\\xa0\\xb3g\\xc3\\xdf\\xc82c\\x05\\xc5\\x99\\x18d\\x93\\x86\\x12\\xad\"e\\xeb\\xcf"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!q\\xe3\\x87\\xec\\xaf\\x9d\\xaa\\xd6\\xfd\\x9c\\xce\\xa1\\x87'd\\x142\\x1cf\\x81\\xf7ti\\xdbv7\\xe3\\x0c\\xd4\\xbe\\x95x\\xc9\\x19\\x11\\x86\\xaew\\xd5\\x88^\\xf3\\x99\\xb7\\xa9b\\xb9\\xcf\\x1egqz\\xec\\x17\\x95\\x99\\xa1\\xc9 \\xc4\\xf8\\xca4\\xbb\\x04\\xe4\\xca*!9\\xc0r\\x12\\xcd\\xcd\\xcet\\xd7sk\\x90gst\\x13\\x857\\xaam\\xef0>\\x05`\\xb5\\x9bsj\\xb3\\xb7k\\xcd\\xd1\\x0f\\x03p7\\xaf\\xf8\\x16\\x15\\xc4r$w\\xd5\\x14\\x90\\x10\\xeb\\x8br?\\x9f\\x93\\x97\\xa9i/\\xc7m\\xa4\\xf1\\xd4\\x06\\x98\\xd1)xo\\x8f1b\\x08\\xa1)\\xeb \\xe5r\\xa4a\\x1b\\xed\\xe9\\xdb\\x8b\\xb6\\xd72~\\xae\\x11b\\xdc\\xce\\xdc4\\xca:d\\xd5b7\\xa9\\x80\\x99\\xeb\\xd1\\xea\\x126\\xba\\x89=/\\xe1h\\x90w\\xa5\\xf2\\xbe'\\xee\\x12\\xc7\\xc1/bc\\x88,\\x1e\\x7f\\x1c\\xed\\xe5\\xa7xcoii\\xa2iw\\x95\\x02\\x04\\xa3\\x85y\\xe8sw\\xbfoak\\x99_\\xfd\\x81\\x13\\x88x\\x96\\xecvb!\\xcfu\\xfb"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010swg\\xabg\\xab\\xad\\x06\\xd5\\x86\\xae\\xcd\\\\xb4\\xf9\\xda\\xb2\\x03\\xe1\\x91\rk\\x10\\xe5z\\x01\\xefq\\x89,s\\xf4\\x1f\\xb9\\xab\\x90\\xa5\\xba\\x99\\xaa\\x02\\xfc\\xcc\\x9bu\\xc2\\xfc\\xf8\\xe7\\x99\\x99\\\\xb6r\\xec\\x8c\\xdd\\xcc@b\\xca\\xf7\\xd1\\x97\\x1b\\x8f9!\\xfdsv\\x8c\\xef\\xa5i\\x01z\\x9f;\\xbe\\x81\\xd3\\xa0#\r\\x9b\\x91ap\\xe2\\xaa\\xba\\xd6ut\\xfe\\xfem\r)\\xe6r\\xa5i,\\x0c\\x93\\xa8\\x1e\\x9d\\xfb\\xe2y\\xa1#a5\\x8f\\x107\\xe9q\\x05)\\x8b\\x8a\r\\xe5k\\x97\\xe0\\x91\\x1a\\xbc\\xc2\\xd4@\\x19\\x8e\\xe5\\xf9|\\xee.\\x1c\\x13h\\x9d\\x02\\x87g9\\x83\\x05\\x81\\xd5_e\\xf6\\xa2,\\xd1\\xe6\\xca\\x9d\\x16\\x9cj\\x9de%\\xa5\\x8a@it\\x84\\xcf/\\xd1f\\x90\\xbb\\xb02\\xf9\\xfad\\xe5\\x81\\xc9\\x1173?\\xf2\\xa9\\xb7\\x15l\\xfd\\xc3q\\xd5h-\\\n\\xaa\\xfb\\xa1\\xc7q\"\\x00\r\\x96-\\x056\\x18\\x1f\\xcfs\\xb1\\x9ci;\\xfa\\xa6\\x96\\xd3\\xd6p \\xbb\\xff\\x1b\\x03\\xb8\\x08\\xffl\\xfe\\xf1|s\r"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x93\\xe4u\\x92\\x11\\x05v\\xcd\\xbe\\xc8\\x01\\xdenh;j`e\\xa3h\\xce\\xec\\x94\\x88\\xf9/\\xfb=\\xd0p\t\\x7f\\xe2\\xe5\\xf0\\xb3\\xea\\x0c\\xfers\\xd6xp\\x99\\\\xcc\\xb2\\xa6\\xea*\\x92\\xb6\\xbc\\x1eh\\xb3\\xa9\\xf7\\x9c,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xed\\xd1\\xe4n\\xf0\\x13\\xf6\\xb9\\x1c\\xea\\x94:qz*\\x7f\\x96n\\xd9\\x08\\xfbr2i\\x83og\\xa0,\\x81\\xaby\\x1b\\x04y\\x1d\\xe4mm\\xad\\xa4c\\xc3,#\\xfc\\x05"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc\\xd0 \\xc2\\x05o1\\xae*r\\x96m\\xe9\r\\xb7\\xc9\\xfa\\x95e\\x8c\\x9e\\x94\\xb9\\x90l\\xf2y\t\\x94q\\xbcm\\xd0\\xa7\\x1e\\x8b\\xf7y\\xb1z\\xa2\\xc0\\xe0\\xdf\\x06o\\xc8\\x05j\\xd2\\x0f\\xa1\\x0fm\\xe3\\xe9\\x88\\x9ac-\\x1a\\x8d\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\xf1l\\x87\\xac\\xbbpbom\\xf9w\\xb9 3\\xee\\xc8ut\\xc6k\\xf0\\xce\\xa18\"\\xfd\\xb8r\\x15\\x03<\\x8f\\xa9\\xa7\\xf8\\xaczn\\xde\\xef\\x1dyh`\\xbfj\\xe9"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=t\\xaf3\\xb3n\\x136v\\xc2r\\xbb\\x1da\\xf1\\xb2\\xde\\x83i\\xacc\\xa6a~\\xd1\\xa3\\x96s\\xfeu\\xa0 \\xa2\\x17\\xa6m\\x13tyu\\x87\\xc5\\xbc\\xd7\\xf2?\\xbb\\xfd\\x0bf\\x0bs\\xdb\\xf0yx\\xe1\\x1d\\x08\\xf1\\x98gn\\xb6\\xa18\\x0b\\x95m?\\x12\\xc2\\x83\\xe2\\xa7\\x06\\xb4\\xef\\xd0&\\xd3\\x8a:\\x9d\\xa1\n\\xdb,\\x14\\x12\\xf08u|\\xbe\\x00\\xf9\\xcf(\\xb8r\\x99\\x07v\\xb9*u\\xb8\\xebzl\\x98\\x80\\x877#\\xdeo\\xafl9\\x1d\\x9e\\xe3\\xeazus%\\xfc\\x9b7\\xb2\\xce\\xd5q\t\\xe6\\xcef\\x0bf\\x80>\\x9f\\xf3\\xce4u\\x9e\\x87\\x92\\xb7\r\\xc2\\xe0.+6e\\x92k\\xc2r\\xfb\\x95\\xebmz\\xc1\\x88\\xd0fc_g\\xb6\\x1f2\\x07\\x89g\\xf7\\x16u_\\x89\\xa8\\xca\\xa3tafi\\xc5/<\\xa2k\\xf4k_l\\x1d.\\xaf\\xd8\\xc0\\x02\\x08\t\\xe4\\xcf\\x07\\x0fw\\x1c\\xa5\\x1ad$\\xa6\\xcd\\x11\\xcc\\xbbu\\xf5\\xd0n\\x8d\\x8a\\xb8\\xf5\\x16+\\xe2u\\x10\\xfbk\\x8f\\xcb\\xe5\\xc0\\xaa4\\xf5h"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~p\\x7f\\xc9v\\xee\\xe6\\xf0l\\xa9\\xfa\\x15r\\xd5<\\x13d$\\xe2\\xe4\\x04\\xc5\\xe0\\xa2\\xedw\\x83\"%.@\\x10ly\\x85fkh\\xa6@\\xd8j\\xa7\\xf6<w\\xf1<\\x8br/\\xb4)\\xcfv\\xf8ecr\\xfd\\xcfh\\xac>4\\xf0\\x1c\\xb6\\x13\\xadpy\\xb8\\xb8\\xa5\\xa4\\x01!\\x83\\x90\\xd3\\xee\\x0e\\x1e+\\x95\\x021,e\\x08\\x1a\\x10\\xfb\\xd4\\xfb\\xe9;)\\xfe@\\xd9\\x816\\xe3tj\\xf1v\\xc3\\x93j6%z/\\x1c:\\x1a\\xb7\\x93\\xd7\\xa4bj\\x07\\xa7\\x9bgk\\xbe\\x9d\\x07\\xac \\xaep\\xa1!\\xb1q\\x9d\\x1d\\xc9/2q\\xd4\\xbe40@\\x8a8&\\x88d\\xbe\\xfex\\x0c\\xa0knwwhnu\\xb3\\xef\\x16\\xef_\\xd7\\x17\\x9b5\\xcae\\x85\\xeb\\xe3\\xa9??\\xb6\\x92\\xba\\x1d\\xa1\\xc8\\xdb\\x8f6\\\\r\\xa3\\x08\\x07\\xba\nbf\\xbbj4\\xbd\\xd4!l#\\xa9\\xc5\\x93/\r\\xca\\x98\\x0f#\\xc1\\x83<\\x1b\\xccf\\xc3\\x12zv\\x88~\\xa3)\\xde \\xbalj\\xbc\\x13/\\xd4\\x11\\x87\\xb59"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>\\x927c\\x8b\\x12kc\\xc0>\\x8f\\xac\\xf6\\xd6\\x04f\\xc0\\xf7\\xd1\\xd6\\x8f\\xe8\\x14\\x9c%\\x1d\\x16g\\xed&\\xaaf\\x9d\\xd8\\x9a\\xba@\\xfa\\x1a2!fn\\x82tr\\x0c\\xd4\\xd8\\x9b\\xc5o\\xa0\\x14tn\\xfah\\xc1.\\xa5\\xb9\\x01\\xd1y\\xae\\xf9\\xcb\\x83\\xe2\\xd8\\x93\\x0e\\xe64y\\x8a\\xb9\\xcf\\xe3\\xfb\\xd6g(\\x19o~\\x99k\\x7f\ncx\\xfd\\xa7\\xaf=\\xcb\\x13~\"i7f \\xd7\\x8d\\xb4\\x87&\\x9am\\x9f\\xbe\\xfe\n \\xbe\\xd4m\\x1a\\xd0\\x80\\xc4\\xa8\\x9act\\xa3\\x06\\x90\\x95\\xffw~\\x83m\\xcd\\x99\\x18\\xffqs\\xf53c@\\xeb\\x03\\xe0\\xa2\\xe4u\\xd5\\xf6j\\x94_\\x88i=\\xd3\\x1a\\xb75\\x88\\x18o\\xf1\\xf8\\xc2\\x10\\xbc\\xa5\r\tml \\x10w\\xf5i9\\xc3i\\xc4\\x90\\xbd\\x92@\\xfcp\\xe7^%\\xa2\\x84\\xfe\\xf5\\xd3\\x1f\\xabp\\x8c\t\\xe4+dl\\xaez\\xe1\t\\x86'\\xd0w\\x1ec\\xaezp\\x14\\xbc?\\xfek\\xb0ld\\xa4\\xcfv\\x8e\\x10\\x87\\x05\\x0c\\xa0\\xc9w\\xff\\x1c\\x11\\xf8m"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xafk?q/\\x8bw50\\xc3`\\x94\\x12\\x8f\\x0c\\x99\\x1d%\\xba\\x1f\\xdc\\x8e`=\\xeb\\x8b\\x98\\x11|%\\x0f3\\xe6ug\\xb5\\x17\\x14\\x10\\xbfx\\x8ba\\xb3\\x80yk\\xcb\\xc1\\xc4\\xdc\\x88\\xa3\\xfbt\\\\xab\\x9f\\xb3\\xb7i\\xe4\\xd6\\xb7\\xadj5.\\x99\\x9c\\xb3\\x83\\xffw\\xce*@\\x1a\\xbd\\xfe\\xaes\\xfeo\\x7f\\xf4\\xae\\x18\\x97uu\\xcalmhw\\xdb\\xae\\xb5\\xb0\\xf2g\\x0f\\xf9\\xbekk\\x11\\xe3\\xd1\\xd6\\xd7y\\xec\\xba\\xad\\xabz\\xae\n\"8@<\\x9c\\xf1\\x84\\xe5\\xc8\\xd2\\x96j\\xad\\xcb\\xb7y\\xd4\\xab\\x8am\\x83y\\x87\\x051t\\xa5\"0\\x8c\n\\x83\\x82\\xd3\\x03\\x16\\x11e\\x95c\\xd1\\xa5\\xdd\\xa2*-\\x9e8\\x8e \\x05j\\x862\\xa9\\x0f-\\xb2\\xe9\\xc3f\\xf9ma\\xa6zy\\xf1m\\xf4\\xb9\\x97\\x92.\\xe1\\x1c\\xcc\\x99qn\\x1e\\xda\\xb8\\x87`\\x04\\x92\\xae\\xb7\\x1e$\\xd4\\xd9p\\xee\\x9e\\x1f\\xc19|\\x11\\xa6.\\xe40\\xeeh\\xae\\x15kcv\\xa8\\x867=\\xc9\\xa0\\x7f\\xdd\\xfbfh\\x1ei"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\x0e\\x9cc\\xd5\\xc3\\xbd\\x0e\\xbc\\xa3\\xf9\\x0fn\\xf5\\xaa\\xd4\\xb0\\xce\\x7f7w\\x0f<\\xbb\\x8f\\xbb\\xbf\\x81\\xff7\\xd2\\x91\\xa8\\xfa\\x95i\\xee;^\\xa1\\xe8ofsrby\\xef\\xcct\\xee\\xb8k\\x88\\x841+\\xf8_g?\\xd5m\\xbb\\xff\\xce\\xdf\\x1f\\x88\\x06d\\xbd\\x8a\\x1f\\x07\\xf2\\x9a\\xe5\\x9e\\xbc\\xc7\t\\x13x6\\x19\\x83&\\xffv\\xf0\\x1dw\\x1b\\xb4\\xa0r\\x1eus\\xbd\\x95\\xd2\\x13\\xcc\\x08\\xa3\\xf2\\xa8m\\xc0\\x05\\xb2\\xc7\\xd8\\xf7\\xed:/\\xd2\\xc0:\\x11\\xac\\xb0n!x\\x0c\\x1fb\\xbc\\x81m\\xa6\\xa4\\xec\\x1a,\\x15kve\\xc2h\\xeacj\\x11o,\\xe0+\n\\xb7\\xd3p\\xb3\\x06kjp:\\x87\\xd5\\xc9\\x14vg\\x99\\x96\\xe0\\x8bt'\\xac\\xcdq~\\xaa/3\\xca\\xa7\\x19\\xc1\t_\\xd1\\xac4\\x1b\\xebl,.\\x07\\xc4\\xe5\\x08\\xd8\\xf6\\xf9sa\\xb7w\\x9b\\xa0go\\xf7\\xe2\\x95\\xb2\\xdf\\xfci\\x7f\\xd7\\x83s\\xf7k5:\\x83rg\\xfb\\x0b\\x9bl\\xaf\\\\x00'\\xd6\\xc3\\x03\\x04<\\xe5x5\\x8dxw"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\xb9\\x9d\\x8f\\x8e&\\xf3l\\xaa\\x99\\x93c\\xf0sxh\\x15\\x94\\xa6\\xe4\\xe1m0i\\xf3(\\xed\\x8a8%pw\\x11)$\\x12\\xee\\xa7%\\xe9@\\xdd\\xa4\\xa1\\xfa-\\x01o\\x85>\\xc2\\x05\\xc4\\x16\\x1e\\xd9x\\xf9\\xea\\x18j1bt\\x8d\\x12\\x08\\xf5\\xd5un+\\xfbg\\x17\\xf4\\xe9\\xb0\\xcd\\xf7\\xc4d\\xf0\\x04\\xe9l\\x19|\\x85\\x13\\xca\\x96\\\\xd4\\xc5\\xdacx+\\xf1:p\\xde\\xae\\xd8\\xab\\xfc+\\x15\\x94\\x06\\\\xbb\\xb8/\\xe9\\xf1\\xd8s\\xea\\x9f\\xd3u\\xea\\xabm\\xbb\\x94\\x99\\x11i)gc\\x9bp5\\x82\\xed\\xb6\\xd8\\xef\\xda\\xec\\\\xd8\\xcc\\xb6\\x9a\\xb7\\xda\\x16f\\xe8\\xa1\\xd9#\\xb9\\xf6\\x8bz\\x14\\x0b5\\xbf\\xccy\\x9dd\\x8d\\xe7u\\xa9\\xeal\\x1d\\xdb\\x95dn\\xb2\\x0b\\xc2\\xd3\\x13y\\xd9\\xdd\\xee\\xc0\\x00\\x13(\\xd7ll\\xbf\\x08\\xa76\\xae\\xc4r\\x16v!\\xc2\\xdd\\x01m\\x041\\x98\\x07\\x12\\x00\n\\xfd$\\x9e#tkwh\\xc8\\xc4\\x9a\r*\\x13\\xb0r\\xeb\\xa6m\\x9c ~\\xff\\xe1^\\x87\\x17\\xdb\\x81"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07j\\xe4\\xf3o\\xa3\\x0b\\x83u\\xe1\\xf3\\xec\\xfa\\x96\\xda)\\x82/\\xd8s\\xf4\\x06\\xf4\n\\x1f\\x8e\\xc8\\xc6(6e9\\xa2\\xfd\\xd6\\x9c\\xb5\\x95v^\\xd9\\x92!\\xfaj\\x94l\\x12\\xeaxc\\xccm*\\x85\\xf3\\xf5!+\\x8a\\xac\\xfb5\\x7f\\xb8\\x0b\\x8dij\\x80\\xb8\\x06\\xdc\"\\xb3\\x90\\xb2ocp\\xddgy\\xcdo\\x18n/^%\\x17s`3\\xd9\\xde\\xab\\xdf,m\\x87/\\\\xfc\\x0e\\xb9\\x0esz\\xeb\\xad\\xd2\\xfe\\xdb\\xae\\xf8\\xc6`\\xfc\\xf0c\\x0c\\xb3\\x07\\xa9\\xfa\\xc0\\xf6g\\x82\\x01\\xe1@\\xce\\xab\\xa61\\x92\\x01\\x1c\\xe0\\xcc\\xf4/\\xb0\\x9e\\xbe\\xd8i\\xcb\\xed\\xaf\\xc2\\xe9\\xc7\\x1acs\\x81l\\x18\\x8ce\\x106\\xc5;\\xbfv\\x86t~\\xec\\xeckd\\x89d\t\\x16e\\x01e\\x82v\\xc9|a\\x9bf*1;\\x14\\xfe\\xbas\\xd3vgj\\x05m+\\xaa\\x11e\\xf6\\xaf\\x05\\xc5\\xb7/\\xc9\\x935\\xf0\"x\\x8d\\xdcy,\\x8fu\\xd6%\\xb0\\x9e\\xc72\\x90'5\\xe4\\x0b5kzh\\x15f\\xd0;\\xe0\\x94\\x981"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\xf7\\xfc\\xff\\xe7\\x88o%'\\xbf\\xab\\xa3\\xfb\\xf5`\\xc4x!e\\xd2\\xe8\\xad\\xbdz\\xb9i\\x14\\xe5\\xa4^ro\\x1b\\x9e\\x1c\\x9ck\\x1dw\\x84z\\x8b\\xc6\\xfc\\x81\\xbf\\xe5\\x14\\x99\\x1d\\x1f\\xb2`\\x00\\xee\\xd3\\xcaa\\x18\\xae\\xf3\\x1b6`\\x11\\x96yy2\\xe2\\xdfwe\"\\xe2\\x86p@n2\\xcb\\xbf\\x0cts4\\xf5\\x8e-\\xf7\\x13\\xdfh\\xde\\xa0\\xbe\\xd6\\x14\\xf1\\xa1\\x01\\xe6\\xd6\tg\\xc5%\\xe6\\xcb%\\xa8\\xf4\\xf9\\xb8\\x98\\x19bn\\x87\\x86\\x1f\\x95\\x95\\xec\\xb4+\\xcdc\\x06y\\xd8t\\x12ja\\x92\\x98si\\xd2v\\x8a\\xff!\\xb8w\\s\\x1e\\xe7\\xba0\\xce\\xc5\\x1c\\x00\\x0c\\x9d\\xf8\\xb2\\xf4s\\xfd\\xc7\\xc5ad\\x97|x\\x93\\x0f\\x1da\\xb8\\xbap \\xbf\\xe8bxz\\xb4\\xa7la\\x18<\\x08\\x80*\\x7f~8\\x18\\x0f\\xaf@\\x9ea\\xf6\\xc7\\x98\\xc7i!\\xd2v\\x99a\\xc1\\x92\\xa6\\xd0\\x05\\xf5d\\xc9\\x85\\xb9\\xdf\\x1b\\xcd\\x8d\\xf5\\x10\\x82\\x0fiyp.liu?i\\xd5me\\x8f\\xb3\\xbd\\x9e`"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\x06!\\xe9kw\\xcf\\xbc|\\xdc\\xe4g\\xe0m\\xfb|\\xba\\xfd\\xb6\\xbc\\x84f\\xbba-\\x84\\xb4s^\\x91\nf\\xf5\\xf62\\xc9#\\x98\\x1a4\\xbf\\x05\\x93\\xb36\\xd1\\xc8q\\xba\\xa7\\x91=\\xa4y\\x8b\\x96=t\\x02\\xc9\\x7f\\xb8\\xf9\\xfeg\\xe9\\/z\\x04~m0\\xac\\x870\\x8b^\\x92\\x9d\\xd9\\xcb\\xbd\\xa8\\x84\\xa7x\\x14\\xe031\\xf0'=@q\\xfe\\xb8\\xf7\\x05\\xd7\\xf0k\\xa6\\xebxp\\xfc\\xb9\\x85n\\xf7\\xe7\\xb2\\x03b2c\\xad(\\xa5#\\xaeq\\x11.yu\\xb8\\xf7r\\xca\\xf2t\\xda?l\\xf1\\x82\\xf3\\xd4m\\xb6\\xa3\\x02\n0\\x9f\\x93\\x8c\\xc9\\x0b\\xcdt\\xa3\\x0c\\xb2-\\xfdawa\\x9d\\x91b\\xee\\x92\\xd0a\\xcc\\x8f\\xf99\\xe8u\\xda\\x10g\\xfc\\xb2tw7\\x91?\\x10\\x85\\xdfi\\xb1q\\xa5j\\x14w\\xd8ff6\\xfdq\\x17\\xe4\\xcf\\x86opb\\xb8o\\xdf2$\\x11\\xaet\\xad\\xe2\rn\\x18\\xae\\x1f\\x13\\x7f\\xed7\\xb2\\x98\\x95\t\\xa5\\xe0(\\xfc\\xb2\\x1a\\xb8\\x03\\x15)\\xf6\\xbe\\x95\\x9e\\xdd\\xdf\\x8c"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\x01\\xef9\\x8e\\xe0\\xc0\\x0f;8\\x87\\xac~\\xe3\\x07(\\xfa6tu\\xc3\\x9a\\xe9!\\xffkza\\xf1\\xee\\xa9m\\xee\\x84\\x86i\\x01<s\\x891y\\xb9\\xa3\\xb5\\x16\\x8ef-\\x81\\xc1\\xb1p\\xc5\\xe4\\xe5(\\xbc*&\\xb8\\xe4bb\\x99\\xb6\\x1e\\x07\\xb4k\\x07z\\x8a7\\x0f5x\\xac\\x98_\\x08\\xaf\\x06\\x821\\x1e\\xaa\\x08\\xbd\\x06q\\xe2\\x10>\\xf2u6\\x17\\xfc\\xf2\\xe1\\xc1\\x14\\x92\\xc0\\xd4f\\x06\\xc9\\xcc\\x8c_\\xfbf\\xe7\\x975\\xe0\\xd1m\\x915\\xc3`\t\\x8a\\x05\\xf58fw\\xef2\\xfc\\x90\\xac\\xe4\\x98b4\\x86\\xc5\\x94l\\x9b\\x7f\\x1d\\xbc\\x01\\x08#\\x9c?\\xdb\\xcf%\\x8e\\x01\\xefb\\xf5\\xf6z\\x9e\\xbb\\x1f\\x90\\x05s<\\x1e\\x19\\xd4t\\xf4\"\\xf7\\x00\\x0c!0p\\x98\\xda~iz\\xf6fu\\xf0\\x9f\\xfd\\xba\\x8a7\\x0f\\xbf\\xf5\tpp\"\\x91!\\xf5\\x84\\xcb\\x8e\\xb9w\"\\xab\\x03\\x18dt\\xae\\xc9\\x80b#1\\x08\\x94\\xcd\\xa6\\x1cmx\\xe2\\x0e\\xfas0\\xd0\\x14\\xc7\\x06\\xb3\\xd3\\xa3\\xedb\\xb6\\xcc\\xe9\\x03"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\xb8\\\\xdc\\x11 \\x93\\xe4\\x11 zj\\xcf!\\xc2\\x9c\\xd9\\xc4\\xb7\\x80\\x99\\xb6j\\xc49\\x9ek\\x15\\xd1\\xda\\xb1\\xe4\\x8e\\xb5\\xde\\x81/\\x03\\xc8\\x85\\xaa\\xae\\x88\\x9e\\x0eo\\xfb*\\xad\\x93\\xd2\\xdfa+f\\x9d>\\xee\\xb7\\xac\\x12\\x94\\x1a\\xb8!\\xc7j)k\\xfdk\\xa9$^\\xa2\\x16\\xcf\\xf1w\\x9b\\xba`\\x00:\\xa8\\x94\\x7f\\xb6v\\x14\\x07e'\\xff\\x87<\\x8d\\xed\\\\x84\\x00\\xbc\\xd7\\xde\\xe1f\\xb6\\x94\\xd4ov\\x9b\\x15\\x9e\\x99y\\xd3\\xd9o\\xfd`\\\\x02#4\\xccs\\xf80\\xc6/\\xaf\\xc2\\xaap#\\xe7\\xb4e8f\\xbdc:\\xab\\xe0l.i\\xe5izr\\xcca4\\x06s\\xb7\\xbe41\\x16\\xae\\xcc\\xa5\\xf2\\xcd\\xe4fz\\xd0\\xfa\\x0f\\x08\\xbf\\xaf\\x1f\"\\xe4k*j\\xeb\\x88\\xb5\\x90v\\x05\\xbb\\xcela\\x8c\\xaf\"qz \\x16\\x97e\\x17\\xc87\\xc6\\x98\\xe1\\xd6\\x106\\x92&\\xd5r3r>\\xcc\\x0c\\x1c,\\xf3e\\u\\xbfp\\xae\\xc8v\\xa5+\\xf6\\xc7<\\xc3\\x99\\xff\\xa9\\xa1\\x01$\\xfa:^\\xaa$g\\x84\\x84\\x0bm\\xcc"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103hh\\x00y\\x00\\x99\\xc7\\xf6\\x80h\\x80\\x13\\xc7*\\xf2w\\xad:\\xfe\\xdf\\xbe\\xe0\\x11qw\\xf2r\\x96@\\x85\\xe0\\xaaw_\\xc9\\x94\\x86n.d\\x18\\x9cv\\x17\\xb9ve_f\\xd6?\\xbf)?p'fa\\xe4\\xc0\\x0b\\x89\\xaf\\xdb)\\xbb\\x8bn\\xf9\\xd6s(\\x86\\x82\\x15\\xcc\rg\\xa3\\xa6yh\\x92s\\xa5\\x1a\\xd9\\xe77\\x99\\x90\\x9cu\\x1a\\xc5\\x7f\\xae\\x1f?\\xd9\\xb6\\xb8z\\x945-3\\x8d\\xf2!\\x95kz3\\x80\\x85\\xb1`\\xe8dv#|\\xd7o\\x1f\\xcd\\xa3\\xde?i&\\x81\\x83c\\x93\\x9d\\xe1?f\\xaf$l\\xa3\\xcf\\xa8\\xf4\\xec\\x0ej8+\\xdft~\\xc4\\x8e\\xe3\\xbah\\xa3\\xb1\\xe3\\x0b\\xaa\\xf3\\xe0\\xef\\xdbh\\xfet\\xd6^\\x83\\xad\\xf8\\x8f\\x8f0\\x87\\xe5\\xdb\\xe80\t\\xf4\\x1a\\xc5\\x7f5\\xea\\xf7p\\xd3i\\xb0'g\\x1f\\xad q\\x06\\xbcp:\\x1c\\x9f.\r\\xb2!m\\x9al\\xf5co\\xd6\\x92\\x02*\\xac\\x89j\\x8c#\\\\x9f\\xf8\\x1e\n\\xdfwd\\xb2\\x04\\x80\\xe2\\x89\\x99@zb\\xd1l\\xe3\\xe7"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\\\x8f\\x96\\xfc\t\\xf3\\xf6\\xd40\\xf9)\\xc0\\x92\\x11b\\x7fx\\xf9\\xd4\n\\xad\\xed\\xc1\\xe1,tv\\xf81\\x8f\\xf2$\\xe2bs$c\\x89=\\xd4q\\x88\\xf7s\\xaf5\\x14\\xd8\\xff\\x96\\x9bxw\\x99j(\\xbe\\xa5\t\\xce\\x96\\xe7\\x94\\xa2\\x80\\xa3\\xe9\\xb0\\xb7or\r-\\x7f\\xe0l\\x07gn\\xbb\\xd8ia~\\xa7\\x10\\x89\\x00%\\xe9\\xad\\xfd)\\xacl\\xf8\\xf8\\x19\\xea\\xb4s\\xc64\\xfe\\xcf\\x19\\x06\\xd9\\xb2q_\\x05\\x03\\xf5\\xc9y\\xdf\\x9a;\\xa7\\xc0\\xe6\\xea\\x8c\\x14\\xdb\\xaa\\xe8oz\\xadm\\xf7\\x92jq\\x06sz\\x16\\x18\\xe1v\\xd7>\\xaaq\\xe7\\xeaw\\x17 \\x9ci\\xc3l\\xd4^\\xb4\\xe6r:-\\x11\\x1d\\xe1\\xc6\\xd4\\x030\\xa5\t\\x9d\\xba\\xf8\\xf4\\x00f\\x9b\\xd0\\x12\\x05\\x83ly\\xf9\\xdb\\xbd\\x8d\\xbf\\xbe\\xb4r@6y\\x17\\xfbv\\xc8\\xfbo\\xe5x\\xd5\\xd6\\x86q\\xc1\\xe9\\xa6\\xfa\\x1e\\xd0\\xb6\\x85ln\\x86il\\xd8\\x9f\\x07\\x18\\x90\\xf4\\xfb_\\xa0\\x95\\x10\\xb9el\\x00\\xd3\\xd5\\xa71\\x82\\xd2%m#aj"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xbd\\xc9\\x1a\\xbbk\\x0b\\xac\\xf8\\xb3f\\xa0\\x90`\\xd5dj\\x03 lj\\xae\\x927\\x8c\\x0bjg&\\xcb\\x14+\\xc3\\x13\\x1f\\xffbn3\\xfd\\x8c^z\\xb7\\xa53\\x03\\xa4\\xfe\r\\x8c\\x88\\xaf/n3\\x97\\x00\\xc6l+\"\\xfen,\\xeb\\xa5\\xa7\\x8f\\x87\\xff\\x0cobpe\\x06\\x06\\xe4\\x1f\\x04\\xbc\\xc8gf\\x05g\\xc9uh\\xc9\\x18\\x9e\\xb0a\\xc4\\xc9\\xf7ld\\x81l\\xec$+\\\\xcf?\\xa5\\x0c\\x0b\\xd0\\xac\\xd2\\x98\\xdbp\\xd7x\\xc2\\x9d\\xc2\\x94hm\\xbe\\xa1\\x90\\xd7\\xc3\\x95\\xfc\\x8f\\x03nu\\x01\\xc9\\xf4\\xdbw8\\x8e\\xfem\\xd52v\\xdb\\x0e\\xbfw\\x80\\xa9\\xc1\\x10\\xde\\xdc\\xf6\\x80w\\xb4\\x88\\xa9y\\xea\\x1d#+\\xad*\\x14\\xd7\\x07~\\x043\\x90a\\xd2\\xcd\\xfcy\\x1a$\\xae@9\\xe5p=\\xf2e\\x0f\\x00ev\\xf388b\\xd3\\xe3\\x89d\\x841\\x9b\\xb60*\r\\xd4\\x98\\xc1\\xf2\\x91\\xca\\xe8\\xa8\\xa9\\xde7@\\x1a\\x88\\x81\\x88\\x84\\xa4\\xd0\\xc2us\\x95\\xe3-\\x0c \\xf7e\\xa1y\\xb9"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01%\\x1a\\xeajo\\xa6\\xfdtln\\x1a\\x8e\\xb3\\x9bm\\xa0p\\x8f\\x06\\xaa\\x0f\\xd5\\xea\\x8c\\x93)#\\x1f\\x9b\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xa4mtqa\\x0c\\x8b4\\x99\\xe4j\\xe8\\xc6\\xffqfc\\x99=7\\xa1\\xb8v\\xf1)l\\xaf\\xb2m\\x8bv\\xb4\\x8d0\\x8d\\xa2%?j\\xd0=\\xc5n\\x12\\xb3k\\x87u\\x13\\xac\\x14\\x0c\\x1c\\xdb\\xedk\\x88\\xfda\\xa2\\x8df\t\\xb1\\x03\\xa0h/\\xb9\r\\xb9\\xf7\\x17\\xb7\\xe5b\\xd4foj\\x11rt\\x11v`\\x1e\\xb60\\x00\\x9bj\\xc7\\xda\\xe3ykjy\\xdd\\x91\\xc5#\\xd0\\x7f\\x1b\\xed\\xe8\\x94\\xa1\\xc2m\\x1b~\\xec\\xbe\\xfc\\xec\\x1a\\x95c\\x16\\xaav\\x92q6\\x80\\xf8\\xd9k\\xd1\\x9c\\xf1_\\x12o\\xba\\x8d\\x14\\x1d\\x95\\x0fx\\xf2\\x8c\\x8eq\\xca>\\x90\\xc9\\xfehs\\x92\\xe2\\xa5\\xcbt\\xad\\xf7\\x13t|\\x17\\xd9\\xddm*_\\x00\\xa1\\x1e\\x89\\xf9bi@z\\xeec\\xa2\\xfb&\\x0f\\xa9s\\x1f\\xf2$\\xfcv?3=\\xff\\xdcn\\xf8\\xae\\xcc\\xe7w\\x99a\\x94'\\xa9\\x1f\\xee\\xf7\\x92pb\\xbd\\xfc?:\\x97\\xed\\x03\\x83\\x1fpbc\\xba\\x8b\\xa1*rk5\\xed\\xe1\\x97\\x9b\\x0b3\\xd4"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`n\\xa2\\xf3\\xbd\\xeb\\x81\\xd9\\xd3\\x13@~\\x9e\\xfc\\xd4\\xcd\\xc0\\xd9?e\"\\x149\\xbc\\xf0\\x91\\x95\\x87\\x15@\\xa7\\xa22\\xaa\\xd4;\\x13cd\\xc1\\xc4\\x90`y\\xc3\\xe0\\x8a\\xfb\\xa9\\xc4\\xc4gi:\\xa8qd:\\xc3\\xf0\\x13\\xde\\xb7\\xcc\\x025d..\\x92:\\x14\\xc9c\\x92\\x81do\\xfb\\xe8\\xc7r\\x9dsz\\xc1y>~'\\xc0\\xfe\\xdc\\\\x89\\x90\\xae+d\\xcfq?\\x14f\\xf6\\x8b!\\xeety \\x0e\\xdd\\xe5\\xff\\x8dpw\\xccj\\x9cvi\\xf7$h\\xa1\\x10\\x86(?\\xc7j\\xd1k\\x19\\x94\\xfc\\xde\\x11&\\xca\\xd4\\x1d\\xed\\xef\\x9e\\x82+\\x04\\xd2.\\x93e,,\\xee\\x99\\x99\\x12\\xc9\\xab\\xb2<\\x07\\xa5\\xbd\\xdbin\\xc1\\xec\\xee\\xb3\\xedc$\\xbfi\\xb8\\x06\\xb3me\\xf9,\\x7fac\\x80\\xb1p\\xa0\\x17\\x94\\x08\\xa4\"qa\\x00\\xd7b\\xe2\\x1a\\xd5\\xd0\\xbe\\xa4\\x1f\\x11t\\x0b\\xf3\\xc3a\\xec\\x9au\\x0f\\xee\\x16q\\xd0\\xe5\\xeb\\xd3\\xb5w\\xb9\\x93>\\xe2&)\\xfc\\xf8q%\\x02/\\xd0d\\x9e/`p\\xc6\\x8b\\xe2"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x94xh\\xf8>gr\\xfc:\\x9e\\xd4z3s\\x85\\xac\\xb84\\xb6\\xe3dvu\\xab\\x93\\x1a\\xf09\\x87\\xdf\\x08\\xc9\\xc06;\n\n\\xc0?|\\xce\\xe3\\xe1\\xfb\\x89\\x1a\\xf3'\\x1e\\x8d=\\xee\\xbdh\\xe9\\x86\\x04i\\xfal\\x0c\\xdap\\x10\\xc2t\\xe1\\xa5`\\x05~\"\\x96\\x86\\x05\\x85\\xfemi,v\\xc6\\xbck\\xe3\\xd8x1\\xcd_\\xc3\\xcd\\xb4)\\x19\\xac?\\x83:\\xd468s\\xa7y\\xfa\\x86\\xde\\xa4@\\xeb_\\xf2h*\\xbdgt\\xb5|\\xb9wb+\\xc8\\x1e\n\\x07\\x7f\\x16\\x88\\xde\\x99\\xc6\\xb6)rx\\xbf\\xb2\\xa2 k\\xfd\\xa3\\x1de\\x8d<\\x0f\n\\xb9\\xaa\\x99\\x8f\\xeb:\\xcd\\x04\\x83s\\xf8\\xb7;j\\x9b\\x08@#\\xdb=\\x1e\\xecm\\x0b\\x87\\xe4j\\xd8tv\\xf9\\xad\\x81\\x06fy\\xa8?\\x03\\xf7\"\\xc9\\xd0\\xf7\\xdbz\\xa4#\\x15\\xd4\\xee\\x93h\\x9d\\x87\\x8f\\xbc\\xecz\\x1d\\x17\\x0b\\xbc\\x9e\\x8d\\xa6\\x1f\\x10\\xbc\\x12\\xbc\\xd0\\xfa_c\\xa7\\xca\\xac\\xa9b\\x8a\\xbd\\xad\\xdf\\x01\\x95\\xde\\x92\\xd3(\r"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  674.  
  675.  
  676.  
  677.  
  678. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  679. "Details":
  680.  
  681. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  682.  
  683.  
  684. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  685.  
  686.  
  687. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  688.  
  689.  
  690. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  691.  
  692.  
  693. "Cyren": "CVE-2017-11882!Camelot"
  694.  
  695.  
  696. "Symantec": "Bloodhound.RTF.12"
  697.  
  698.  
  699. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  700.  
  701.  
  702. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  703.  
  704.  
  705. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  706.  
  707.  
  708. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  709.  
  710.  
  711. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  712.  
  713.  
  714. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  715.  
  716.  
  717. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  718.  
  719.  
  720. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  721.  
  722.  
  723. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  724.  
  725.  
  726. "TrendMicro": "Possible_SMBCVE20170199"
  727.  
  728.  
  729. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  730.  
  731.  
  732. "Sophos": "Exp/201711882-P"
  733.  
  734.  
  735. "Avira": "HEUR/Rtf.Malformed"
  736.  
  737.  
  738. "MAX": "malware (ai score=83)"
  739.  
  740.  
  741. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  742.  
  743.  
  744. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  745.  
  746.  
  747. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  748.  
  749.  
  750. "GData": "Exploit.RTF-ObfsStrm.Gen"
  751.  
  752.  
  753. "AhnLab-V3": "RTF/Malform-C.Gen"
  754.  
  755.  
  756. "McAfee": "Exploit-CVE2017-11882.ah"
  757.  
  758.  
  759. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  760.  
  761.  
  762. "Zoner": "Probably RTFObfuscation"
  763.  
  764.  
  765. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  766.  
  767.  
  768. "Ikarus": "Exploit.CVE-2017-11882"
  769.  
  770.  
  771. "Qihoo-360": "susp.rtf.objupdate.gen"
  772.  
  773.  
  774.  
  775.  
  776.  
  777. * Started Service:
  778. "osppsvc"
  779.  
  780.  
  781. * Mutexes:
  782. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  783. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  784. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  785. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  786. "CicLoadWinStaWinSta0",
  787. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  788. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  789. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  790. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  791.  
  792.  
  793. * Modified Files:
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_92b1f6dbed262cd7c5d2d08d1dc47973.doc",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_92b1f6dbed262cd7c5d2d08d1dc47973.doc",
  796. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFC5D80F07-49F5-48D6-A88C-1503B85AF8CA.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C0E0C17-72A1-4D16-BA4D-38F86E04C1ED.tmp",
  798. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF01D6339-68B5-44EE-A150-0AE17AAA05BE.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  800. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  801. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  802. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  803. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab720A.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar720B.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8054.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDEC.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDED.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDDC.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8C.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9F.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8B.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBA0.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDDB.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8D.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9E.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB3.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9D.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB4.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB2.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB1.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBC5.tmp",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCCDF.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD2E.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD4E.tmp",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD4F.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD60.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD427.tmp",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4B5.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD543.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD563.tmp",
  832. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  833. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD7F4.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD882.tmp",
  836. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD883.tmp",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD910.tmp\\Basis.thmx",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD950.tmp\\sist02.xsl",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD910.tmp\\content.inf",
  841. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  842. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD950.tmp\\Content.inf",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD98F.tmp\\PictureFrame.glox",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9EE.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD98F.tmp\\Content.inf",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF9.tmp\\pictureorgchart.glox",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF9.tmp\\Content.inf",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB48.tmp\\Crop.thmx",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBD6.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB48.tmp\\Content.inf",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB58.tmp\\Content.inf",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCB2.tmp\\TabbedArc.glox",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCB2.tmp\\Content.inf",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD70.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD01.tmp\\RadialPictureList.glox",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD01.tmp\\Content.inf",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDCE.tmp\\gb.xsl",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDDF.tmp\\Badge.thmx",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDCE.tmp\\Content.inf",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEAB.tmp\\Berlin.thmx",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDDF.tmp\\Content.inf",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF68.tmp\\ThemePictureAlternatingAccent.glox",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF68.tmp\\Content.inf",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE0FF.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEAB.tmp\\content.inf",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE259.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE269.tmp\\VaryingWidthList.glox",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1DB.tmp\\content.inf",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE269.tmp\\Content.inf",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1DB.tmp\\Parallax.thmx",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3E1.tmp\\content.inf",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3E1.tmp\\Savon.thmx",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE52A.tmp",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE664.tmp\\content.inf",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE665.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE664.tmp\\Wood_Type.thmx",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE750.tmp\\Circuit.thmx",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE761.tmp\\gostname.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE761.tmp\\Content.inf",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE7EF.tmp",
  898. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE750.tmp\\content.inf",
  901. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE939.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE938.tmp\\content.inf",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE938.tmp\\Quotable.thmx",
  905. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA43.tmp\\content.inf",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA43.tmp\\Damask.thmx",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF36.tmp\\ThemePictureGrid.glox",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF36.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEF75.tmp",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF061.tmp\\Insight design set.dotx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF061.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1AB.tmp\\ieee2006officeonline.xsl",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BC.tmp\\content.inf",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BD.tmp\\APASixthEditionOfficeOnline.xsl",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF23B.tmp\\content.inf",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1AB.tmp\\Content.inf",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF24B.tmp\\content.inf",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BC.tmp\\View.thmx",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF25C.tmp\\turabian.xsl",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BD.tmp\\Content.inf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF398.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF23B.tmp\\Frame.thmx",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF24B.tmp\\Vapor_Trail.thmx",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF3A9.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DB.tmp\\content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DA.tmp\\TabList.glox",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DB.tmp\\Dividend.thmx",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DA.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DC.tmp\\content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DC.tmp\\Metropolitan.thmx",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF25C.tmp\\Content.inf",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF58E.tmp",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF59F.tmp\\rings.glox",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF59F.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF5A0.tmp",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF756.tmp",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  949. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF871.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF873.tmp\\InterconnectedBlockProcess.glox",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF873.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF872.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF8F4.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C3.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C2.tmp\\ThemePictureAccent.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8E3.tmp\\HexagonRadial.glox",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF8F5.tmp",
  960. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF9B1.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C3.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C2.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8E3.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF9B2.tmp",
  966. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADC.tmp\\CircleProcess.glox",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADD.tmp\\ConvergingText.glox",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADE.tmp\\content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADD.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADC.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADE.tmp\\Mesh.thmx",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  977. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  979. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-BA9D-8ABA640D770B.tmp"
  980.  
  981.  
  982. * Deleted Files:
  983. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab720A.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar720B.tmp",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  995. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD910.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD882.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD883.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD950.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD98F.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF9.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB48.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB58.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD98F.tmp\\PictureFrame.glox",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8054.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD910.tmp\\Basis.thmx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD7F4.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD950.tmp\\sist02.xsl",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8D.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAF9.tmp\\pictureorgchart.glox",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDDB.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB48.tmp\\Crop.thmx",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCB2.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9EE.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDB58.tmp\\chicago.xsl",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB1.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD01.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDCB2.tmp\\TabbedArc.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDCE.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDDF.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD01.tmp\\RadialPictureList.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBC5.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9E.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEAB.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF68.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDDF.tmp\\Badge.thmx",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF68.tmp\\ThemePictureAlternatingAccent.glox",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBD6.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1DB.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE269.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDDC.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDDCE.tmp\\gb.xsl",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB3.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDEAB.tmp\\Berlin.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE269.tmp\\VaryingWidthList.glox",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3E1.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD70.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB2.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1DB.tmp\\Parallax.thmx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE0FF.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3E1.tmp\\Savon.thmx",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE259.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE664.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE750.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE761.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE664.tmp\\Wood_Type.thmx",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE52A.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE761.tmp\\gostname.xsl",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8B.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE750.tmp\\Circuit.thmx",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE938.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE665.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE938.tmp\\Quotable.thmx",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE7EF.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA43.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEA43.tmp\\Damask.thmx",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE939.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF36.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF36.tmp\\ThemePictureGrid.glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDED.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF061.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1AB.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF061.tmp\\Insight design set.dotx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BC.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BD.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF23B.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF24B.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF25C.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEF75.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DA.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DB.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DC.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1AB.tmp\\ieee2006officeonline.xsl",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD2E.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF398.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF3A9.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BD.tmp\\APASixthEditionOfficeOnline.xsl",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9D.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF59F.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF23B.tmp\\Frame.thmx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD563.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF25C.tmp\\turabian.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD4F.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DB.tmp\\Dividend.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD543.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF58E.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF5A0.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DC.tmp\\Metropolitan.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4B5.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2DA.tmp\\TabList.glox",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF59F.tmp\\rings.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF24B.tmp\\Vapor_Trail.thmx",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDEC.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1BC.tmp\\View.thmx",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF10E.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF873.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD427.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C3.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C2.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8E3.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF873.tmp\\InterconnectedBlockProcess.glox",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF871.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD60.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF872.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF9B1.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF8F4.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF9B2.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF8F5.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C3.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8C2.tmp\\ThemePictureAccent.glox",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBB4.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF8E3.tmp\\HexagonRadial.glox",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADC.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB8C.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCD4E.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADD.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADE.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADC.tmp\\CircleProcess.glox",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADD.tmp\\ConvergingText.glox",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB9F.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCBA0.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFADE.tmp\\Mesh.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF756.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_92b1f6dbed262cd7c5d2d08d1dc47973.doc",
  1134. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1135. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-BA9D-8ABA640D770B.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C0E0C17-72A1-4D16-BA4D-38F86E04C1ED.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF01D6339-68B5-44EE-A150-0AE17AAA05BE.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR6120.tmp.cvr"
  1139.  
  1140.  
  1141. * Modified Registry Keys:
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\al,",
  1143. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1A13AFE",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1A13AFE\\1A13AFE",
  1163. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1409. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1755. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1756. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1757. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1766. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1778.  
  1779.  
  1780. * Deleted Registry Keys:
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\al,",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ 2+",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1A13AFE\\1A13AFE",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1805.  
  1806.  
  1807. * DNS Communications:
  1808.  
  1809. "type": "A",
  1810. "request": "thecoverstudio.com",
  1811. "answers":
  1812.  
  1813. "data": "164.132.235.17",
  1814. "type": "A"
  1815.  
  1816.  
  1817.  
  1818.  
  1819. "type": "A",
  1820. "request": "vemvemserver.duckdns.org",
  1821. "answers":
  1822.  
  1823. "data": "205.185.125.42",
  1824. "type": "A"
  1825.  
  1826.  
  1827.  
  1828.  
  1829.  
  1830. * Domains:
  1831.  
  1832. "ip": "205.185.125.42",
  1833. "domain": "vemvemserver.duckdns.org"
  1834.  
  1835.  
  1836. "ip": "164.132.235.17",
  1837. "domain": "thecoverstudio.com"
  1838.  
  1839.  
  1840.  
  1841. * Network Communication - ICMP:
  1842.  
  1843. * Network Communication - HTTP:
  1844.  
  1845. "count": 1,
  1846. "body": "",
  1847. "uri": "http://thecoverstudio.com/modules/jmsslider/views/img/layers/app/upjnyh.msi",
  1848. "user-agent": "Windows Installer",
  1849. "method": "GET",
  1850. "host": "thecoverstudio.com",
  1851. "version": "1.1",
  1852. "path": "/modules/jmsslider/views/img/layers/app/upjnyh.msi",
  1853. "data": "GET /modules/jmsslider/views/img/layers/app/upjnyh.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: thecoverstudio.com\r\n\r\n",
  1854. "port": 80
  1855.  
  1856.  
  1857. "count": 1,
  1858. "body": "",
  1859. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1860. "user-agent": "Microsoft-CryptoAPI/6.1",
  1861. "method": "GET",
  1862. "host": "ocsp.digicert.com",
  1863. "version": "1.1",
  1864. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1865. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1866. "port": 80
  1867.  
  1868.  
  1869. "count": 1,
  1870. "body": "",
  1871. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1872. "user-agent": "Microsoft-CryptoAPI/6.1",
  1873. "method": "GET",
  1874. "host": "ocsp.msocsp.com",
  1875. "version": "1.1",
  1876. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1877. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1878. "port": 80
  1879.  
  1880.  
  1881. "count": 13,
  1882. "body": "",
  1883. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1884. "user-agent": "Microsoft-CryptoAPI/6.1",
  1885. "method": "GET",
  1886. "host": "crl.microsoft.com",
  1887. "version": "1.1",
  1888. "path": "/pki/crl/products/microsoftrootcert.crl",
  1889. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1890. "port": 80
  1891.  
  1892.  
  1893. "count": 1,
  1894. "body": "",
  1895. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1896. "user-agent": "Microsoft-CryptoAPI/6.1",
  1897. "method": "GET",
  1898. "host": "crl.microsoft.com",
  1899. "version": "1.1",
  1900. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1901. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1902. "port": 80
  1903.  
  1904.  
  1905. "count": 4,
  1906. "body": "",
  1907. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1908. "user-agent": "Microsoft-CryptoAPI/6.1",
  1909. "method": "GET",
  1910. "host": "crl.microsoft.com",
  1911. "version": "1.1",
  1912. "path": "/pki/crl/products/microsoftrootcert.crl",
  1913. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1914. "port": 80
  1915.  
  1916.  
  1917. "count": 3,
  1918. "body": "",
  1919. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1920. "user-agent": "Microsoft-CryptoAPI/6.1",
  1921. "method": "GET",
  1922. "host": "crl.microsoft.com",
  1923. "version": "1.1",
  1924. "path": "/pki/crl/products/microsoftrootcert.crl",
  1925. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1926. "port": 80
  1927.  
  1928.  
  1929.  
  1930. * Network Communication - SMTP:
  1931.  
  1932. * Network Communication - Hosts:
  1933.  
  1934. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!