API tools faq
paste
paladin316

RTF_9d944cd642bd8d94bec6e25aff9831a1_doc.json

paladin316
Jun 19th, 2019
2,249
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 218.59 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "RTF_9d944cd642bd8d94bec6e25aff9831a1.doc"
  7. [*] File Size: 267431
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "4d43989acd082511e4ea3ee5cb99320f3087b0342117fcdbcbc1489f0b511946"
  10. [*] MD5: "9d944cd642bd8d94bec6e25aff9831a1"
  11. [*] SHA1: "5d9a62f6fb81f7367cf5d4632024cbd9f3ec6a34"
  12. [*] SHA512: "2f66cfaa91a3a9902006b47c377f1fef3bcfe3eb92b70621e70391cefedc5287cabc3dd727d46aa7ba28613f1e23e53f6185e1442bad693be44c35c416e760aa"
  13. [*] CRC32: "A8AE0AC2"
  14. [*] SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLeWrcaqTLdsOLpGLKZrPRiCs8sT3XJBSHDXOPxU:sxxQW3yWq5LRZTRinNUhy8Tq1K"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 2360"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "A process attempted to delay the analysis task.",
  31. "Details": [
  32. {
  33. "Process": "WINWORD.EXE tried to sleep 527 seconds, actually delayed analysis time by 0 seconds"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details": [
  40. {
  41. "IP": "52.109.92.24:443"
  42. },
  43. {
  44. "IP": "104.18.25.243:80"
  45. },
  46. {
  47. "IP": "152.199.4.33:80"
  48. },
  49. {
  50. "IP": "72.21.91.29:80"
  51. },
  52. {
  53. "IP": "96.17.237.218:443"
  54. },
  55. {
  56. "IP": "72.246.43.10:80"
  57. },
  58. {
  59. "IP": "52.109.16.4:443"
  60. },
  61. {
  62. "IP": "96.17.64.28:443"
  63. }
  64. ]
  65. },
  66. {
  67. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  68. "Details": [
  69. {
  70. "ioc": "pictureorgchart.glox"
  71. },
  72. {
  73. "ioc": "ontent.inf"
  74. },
  75. {
  76. "ioc": "chevronaccent.glox"
  77. },
  78. {
  79. "ioc": "ist.glox"
  80. },
  81. {
  82. "ioc": "rc.glox"
  83. },
  84. {
  85. "ioc": "quations.dotx"
  86. },
  87. {
  88. "ioc": "rocess.glox"
  89. },
  90. {
  91. "ioc": "gb.xsl"
  92. },
  93. {
  94. "ioc": "ext.glox"
  95. },
  96. {
  97. "ioc": "rame.glox"
  98. },
  99. {
  100. "ioc": "chicago.xsl"
  101. },
  102. {
  103. "ioc": "nline.xsl"
  104. },
  105. {
  106. "ioc": "rid.glox"
  107. },
  108. {
  109. "ioc": "..3b"
  110. },
  111. {
  112. "ioc": "gostname.xsl"
  113. },
  114. {
  115. "ioc": "sist02.xsl"
  116. },
  117. {
  118. "ioc": "gosttitle.xsl"
  119. },
  120. {
  121. "ioc": "anded.thmx"
  122. },
  123. {
  124. "ioc": "content.inf"
  125. },
  126. {
  127. "ioc": "iso690nmerical.xsl"
  128. },
  129. {
  130. "ioc": "iso690.xsl"
  131. },
  132. {
  133. "ioc": "turabian.xsl"
  134. },
  135. {
  136. "ioc": "harvardanglia2008officeonline.xsl"
  137. },
  138. {
  139. "ioc": "mlaseventheditionofficeonline.xsl"
  140. },
  141. {
  142. "ioc": "ype.thmx"
  143. },
  144. {
  145. "ioc": "vent.thmx"
  146. }
  147. ]
  148. },
  149. {
  150. "Description": "Performs some HTTP requests",
  151. "Details": [
  152. {
  153. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  154. },
  155. {
  156. "url": "http://paroquiadamarinhagrande.pt/app/tyeupy.msi"
  157. },
  158. {
  159. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  160. },
  161. {
  162. "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"
  163. },
  164. {
  165. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  166. },
  167. {
  168. "url": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl"
  169. },
  170. {
  171. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  172. },
  173. {
  174. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  175. }
  176. ]
  177. },
  178. {
  179. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  180. "Details": [
  181. {
  182. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xce\\xfd=\\xe0m<\\xfc\\xb5]p\\x154\\x12^.\\x04\\xacp\\x9b@\\xfc_\\x08=%a\\x81\\x87\\x92\\x99\\x15&\\x0e@.\\x94d\\xbdvr^\\xd1\\xbc#\\x07\\x94\\x81a\\xc8\\xe5\\x86\\x10\\x873e\\xd05eb\\xd6l\\xac\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdcg\\x1b\\xd8\\xb2\\x9c\\xa0\\x97\\x983\\x1c\\xd2\\xeb\\xac\\x01\\x9a\\xa7=\\xda]\\x19\\x02\\xecu~n\\x99\\xfd\\x00b\\xf2\\x98s\\x80#vh\"\\x01\\x8b\\xc2\\xc4\\xf7t\\xdb3\\z"
  183. },
  184. {
  185. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x03\\xe1jk~)\\xa4_\\xc6r\\xe1os\\xf6\\x8d\\x0bj\\xb3\\x9d\\xa2u\\x98\\xf1,\\xfd\\x94\\xb2\\xec\\xf5i\\x9c\\xc7\\x1a\\xd6\\x1f\\xce\\xfa@\\xce\\xe9\\xac+\\xa9\\x14\\xbch-\\x9b\\xa1o\\xeass\\xdc\\x1b\\xc3\\xc6\\xab\\x90\\xd7\\x81\\xbf\\x80\\xe9\\xbf\\xa9\\xf1i\\xdd{\\x13\\xdb\\x0b\\xe9\\xa2\\xbai\\xb3\\xe5u\\xb8\\xa1z\\xbfn\\x8d{x\\xef\\xfc\\xeenea\\x16\\x92{8f,\\xebjg\\xfe\\xf2\\xf7\\xf8\\xbat\\xd5\\xa85\\x0f\\xf4\\xacb\\xf5\\xe1r\\x15\\xca\\xd0\\xd2\\x07'3\\xf6\\x86&\\x1b\\x19\\xe4\\xffx\\xc8\\xa3\\x02\\xda\\xc0\\x13\\x8e\\x87\\x1dd\\xec\\x84\\xe2\\x14\\xa2e.ew\\xdc/2\\xc6\\xd0u\\xe1\r\\x9f\\x9e\\xbc;\\x05\\x9c\\xac/\\xcd\\x80\\xf5\\x04ln^\\x92\\x05\\xd2?c\\xe3\\x93r\\xfbk{\\xb2\\x15\\xd0\\xe2wt\\xd4\\x119\\xb9\\x1d\\xca#\\xcb#\\x88\\xd6\\xa1\\xfa\\xb8\\xe7[\\xb2ro+'\\x85_\\xe2~\\x10\\xa2\\xbe^}1\\x98r\\xf6\\x83\\x7f\\x90\\xc3\\xf6\\xf7\\xfeho\\xca\\xdd\\xc8\\x88\\x11\\xd0@%\\xa5\\x98\\xb3j\\x14#\\xbd"
  186. },
  187. {
  188. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\t\\x87q)\\xe5\\xf3\\x13\\xc1\\xdc=\\xb0\\xe1d\\x95\\x8e\\x80\\x86\\x1a\\xe7\\x96\\xa8\\xf5ra\\x1c\\xce-\\xcb\\xc3\\xe4\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  189. },
  190. {
  191. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047ay\\xe1\\x000\\x17\\xdc 7f\\xfey\\x16\\xb5\\x94\\x8e\\xf6s\\xb5$\\xa8\\x98\\x003\\xcd\\x99\\xbd\\xa6\\xce!\\x03\\x1e5\\xc6a\\x08\\x1b\\x04\\xba6~\\xcb'\\x98\\xb0\\x7f\\xa0\\xba\\x8cu\\xaa\\xc2\\x82\\x86\\xc4\\x89\\xc8\\xfc\\xcb\\xd1\\x1dl\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9u\\xacwt)\\x8a:s@\\xb8s\\xe1\\x96\\xf5\\xc3v\\xf9\\xe1'\\x16\\xc1\r\\x11\\xa4\\x7f\\x15<[\\xfe\\x9bm2+\\xe6$\\9u\\xe8\\xa8\\xd4\\x82\r\\x1epoc"
  192. },
  193. {
  194. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  195. },
  196. {
  197. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  198. },
  199. {
  200. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\t\\x87\\xb2\\xdbt\\xec\\x13\\xb0\\xdb\\xad\\x03\\x96\\x11f\\x1fj\\x91\\x8b\\xe3\\xa2\\xf8\\xf16\\xb1!n\\xf6\\xd8iu\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  201. },
  202. {
  203. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\xd2c\\xb5\\x02o6\\x9a\\xe7\\x8fi\\x19jx\\xa6\\x06mr\\xf0\\xe3\\xfd\\xa4:-\\x7f]c\\xfe\\xf3\\x07\\xa1<\\x04\\xb7\\xdf\\x1d_;{\\xa1r\\x17\\x019\\xfc\\xc8\\xbd\\xd7\\xb4\\xaf7b\\xe8\\xec\\x0fcs6\\x8d\\xda\\xedh~\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde`\\xcc\\x1d_$n\\xe4g\\xe0\\x9e[d6\\xe0\\xff6\\xf4\\x9b\\xa0\\xfb\\x82\\x85\\xb1\\x05%\\xcck\\x9efj\\xbad\\xed\\xa6\\x08\\xf8\\x9f\\x9f\\xe5\\xc4p\\xaev\\xae \\xddm"
  204. },
  205. {
  206. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw\\xa3\\xf7\\xdbx,s|\\x84h\\x92\\x05\\xff\\xbf\\x8f\\xc5m\t\\xc0[\\x1f\\xd6\\xb1\\xf2\t\\x0c\\xf8\\xc3\\xf0\\xe3\\xfb,]y\\xdc\\x1a\\xd4\\x87,cc\\x90;\\xa3w\\xb5\\xe0\\xfd6\\x87.\\xa6b\\xe6i8\\xebk\\xecjyh\\x88\\x9fqhp\\x997j\\x9b\\x9el\\x8av\\xb7v\\x19^^\\xb2\\xc5\\xf79\\xff\\x1c\n\\xddw\\xe9\\xab\\xc7\\x9d8\\x97s\"\\x15\\xfc\\xfe\\xf0(z\\xe1\\x97?\\x1c\\xd2\\x1a\\xc0\\x05\\xab\\x9a\\x08c\\xe4h\\x88\\x07k\\xbc?\\xf9m\\x96\\x03\\x82\\x83\\x86\\xae.vi\\x04\\xc3\\x84s\\xc5\\x14\\x0b\\xb6s)}u\\x82p\\xb7\\x1a^p\\xd3\\xec\\x0fn\\x8er\\xc89\\xe3uf\\x16\\xba`\\xfb~[\\xed\\x08o\\x89\\xab;\\x96o\\x8b\\xab\\x8bk\\xc4\\xc2\\x92\\xbb\\xa4\\xe6;\\x87\\xef\\xf0\\xc2\\xd5\\x98/\\xf0\\xf4\\\\xa8i\\x04\\xb9q\\xd7e\\x87\\xf4\\xef\\xd2\\xc6\\xeb\\x1a|s\\xdc\\x1e+\\xe2m\\xc1\\x9f4\\x15u\\xa7n\\xc8\\xceaqo\\xce/\\xff\\x95\\x07dsf\\xe5\\x90]\\x85\\x935\\xf0\\xf3\\xa5z\tt\\xa2"
  207. },
  208. {
  209. "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: mscrl.microsoft.com\r\n\r\n"
  210. },
  211. {
  212. "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  213. },
  214. {
  215. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x03\\x0c\\xd4\\x9c\\xcc\\xd0\\x04@\\x07\\xf0.\\xf76\\x91\\xd7\\xee\\x9ee\\xc9\\x07\\xce\\x94\\xe6<\\xe4w\\x17\\xa3\\xbe\\xe0\\xbe+d\\xe5\\xdb0p\\xaep\\xa1\\x87(i\\xca\\x8a[ky\\x83\\x8cn 8-\\xf1b\\x13c2\\xaba\\xb0]ji\\xa8\\x81h?\"\\xef\\xd5\\x88\\xcc\\x98\\x9a2\\xe7\\x97w`\\x9f~\\x15'\\xc8\\xd5\\xa0\\xb6\\xa0cz\\x1f\\xef\\x95\\xf0\\xdf}\\x85\\xf4\\xd6\\xe3\\xa5\\xd3\\x10\\xf9\\x8a\\xd1\\xa5\\xc0\\xc5p\\xd0\\x0f\\xda\\x1d\\x99\\x03!\\xedko.\\x07\\xe9\\x06a\\x03\\x81t\\xf8\\xfa\\xbac\\x15\\x1c\\xef\\xd4\\xc0\\x1a\\xaa\\x9f\\xf7z'\\xf4ug\\xe1\\xc0\\xd9\\x17\\xeaa\\xd8\\xcc\\xed\\x8f\\x81r\\xe7b\\xfb\\xd2\\xf5\\xd1td\\xf9\\xf6e1h\\xb46/\\xa5i\\xc9)\\xb4_\\x0cv\\xb9\\xfe\\x0e\\xda\\xbce\\x99\\xbb\\xf8\\xc3\\x90\\x10\\x9b\\xc0\\xee0\\xe8-/\\x18\n^\\xba\\xa5\\xe0\\x03@\\xa7\\xe3\\x19[{?\\x99\\x98\\xca\\x15\\x0e\\xd9x_\\xf5\\x12\\xab\\x93\\xbe\\xfa\\xfcyl\\x0e\\xbbr2\\x92\\xa0\\x94+\\xc0\\xc2\\xab\\xea~\\x81\\x07\\x9ak"
  216. },
  217. {
  218. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\t\\x87\\xf6\\xb4\\xee\\x07\\xb7\\x05q\\xa5\\xaa\\x82\\x899\\xcffd:\\x1fug)\\xb0\\xe6`>\\xbe\\xc9bd[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  219. },
  220. {
  221. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\xda\\x8a6\\xb9\\xbf\\x12\\xad\\xf2\\xfa\\xc0\\xa0\\xdc\\xb54\\x12\\x89xl\\xca\\x9a4\\x93\\xdey\\xc5\\xbe\\xf1'\\xc6y\\x82\\x9d\\xf7y%\\x02\\xd8\\xb9\\xbd\\x86ap\r\\xbc>m\\xd0\\xbe\\xa32\\x16\\x19\\xd9b\\xdf\\xe7fp\\x97\\xdc6|s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xdd\\xfdx\\xbf\\xbd\\xbe<\\xed*\\xff\\xd5\\xa5n6<\\xb0\\x14p\\xb8\\xcb\\xf9\\xc1adi\\x0b\\x0b*&\\xc6z\\x94t\\xa5\\x8c\\xae\\x96\\x88\\x06q\\x93\\xcd\\xe2x\t\\xcb\\xaa"
  222. },
  223. {
  224. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfd]\nm\\xbb\\xe2m\r\\xa0\\xbcz\\xf7l\\x7f\\xd5\\x07pm\\xc3\\x05\\x9cr\\xa6\\x96._%\\xea\\x0e\\xd1\\xbc\\x8c\\x15\rid\\xad\\x99\\x0c\\x10\\xce\\xe1\\xf5\\xf9\\xe8\\xa0v\\x7f\\xbd\\xd8^m\\xa9\\x97\\x18\\xf1<\\xf7{\\xd4\\xee\\xb1\\xce\\xc4\\x96\\xcf\\xa2\\xdd\\xfe\\x93]m>n:\tf\\xdf\\xac\\xabk\\x87n\\xb8\\x156\\x02*\\xa4\\xd8\\xd8\\xf1\\x8e\\xf9\\xb1\\xb2qvt\\xa7\\xff\\xdc\\xa4\\x18\\xacb\\x8bm\\x12(i\\xc9t\\xab\\x8e\r\\xd8\\xd3\\x90\\x16\\xf3\\x08\\xed\\xd8\\xb8q\\x16\\xe2\\xc2|\\xb3\\xac\\x93\\x9a\\xdb3:\\xad\\x84p\\xd6+y\\xe7>t\\x9bw\\x8cr\\xc5\\xd9\\x01h\\xba\\x8cl\\x11\\xf6\\x89\\xe9\\xa1]\\xde]\\xed\\x12\\x00\\xfb_\\x0f\\xdbr\\xcd8?!\\xb2\\xc8\\xcd\\xb5\\xfch\\xc4\\x86\\x8at\\x8a\\x18\\x82~\\xa3\\xb1jz\\xaft\\x87\\x91\\xa7f\\x1a\\xbe\\xe8m\\xb9\\x0b\rs]ac\\x9eno}\\x7f8v\\xac\\\\xd31\\xe3\\xa6\\x81\nz\\x16\\x1df6\\xa6\\x82\\x80\\xea\\xef\\x04\\x81\\xf0\\x7fa\\x16\\xb1i;\\xbc\\x1a\\xb0\\xd2r"
  225. },
  226. {
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\x12\\x1e?v\\x11\\xbe?\\x13\\xeb\n\\x8de\\xd4\\xd0\\\\xfe\\xc3*\\xb4j\\xffz\r2`n\\xe8\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  228. },
  229. {
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04dt\\xe8x\\x07v\\xc9\\x88\"\\xe0\\xe9czo\\xc0~j\\x02\\x1d\\xc6d%d\\x84\\xf2\\xe2s\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231. },
  232. {
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\x8b\\x07\\xac\\xd9\"w\\xcbqjo\\xbbm\\x1c+\\x10\\xd5\\xcb\\x94\\xb6\\x00\\xba\\xe8\\x1c\\x8e\\xc2h\\x95\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234. },
  235. {
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xb1\\x84\\x98\\x95\\x85\\xe8f\\x8ad\\x87\\xce\\x9c\\x89\r\\xb4\\x91\\xe4\\x19\\xde\\xa4c\\xa02\\xb89\\x8c\\xbb\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  237. },
  238. {
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\x9e\\x1c\\xd1v\\xb6k\\x96 \\x8d@\\xc8\\xc5\\x9b\\x15\\xfcrc\\xac\\x94\\xc0\\xc4uf\\xa3\\xc9\\xb9\\xb0\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  240. },
  241. {
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xa1z\\xc6,\\xd3\\xd7]9\\xb9\\xb9\n\\x9e$%] t\\xe7\\xed\\x03\\x9c\\x99\\xbd\\x0f\\xc0\\x85\\x81\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243. },
  244. {
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04a\\x1dk\\xe1\\x98\\xf7\\xba\\x18\\x17s\\xfc\\xbf\\xb4.\\x12\\x89z\\x89\\xe2\\xee`\\xd1\\x00q@m_\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  246. },
  247. {
  248. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04z\\x14p\\xb7:\\x19\\xef@kp\\xa0\\xb6\\xa4\\xff\\x1b#\\xf0}\\xff&n\\xa6gk\\x89\\x8b\\xe9\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  249. },
  250. {
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04d\\xd5b5\\x9d?(\"\\xf3cg\\x81\\xbd\\xb1\\x1f\\xb6\\xe1\\xfa\\xde\\xa6\\xe75y\\xad\\xd8\\x932\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252. },
  253. {
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x041\\x83\\xe8\\xd2\\x13w\\xe2\\x15m+\\x93c9\\xc9ah\\x0e\\xf7\\x8a:bf\\xe3\\xbd\\x96\\xba\\x07\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  255. },
  256. {
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xb6\\xf4d\\xab\\xa9-z~\\x94\\xa8\\x109:\\x11\\xf5e\\xaa)\\xb6\\xd5\\xfc\\xc94\\xc0\\xaam\\xfc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  258. },
  259. {
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04f\\xb4\\x83\\x84x\\xe6\\x1a\\x1bk\\xb0\\xbd\\x84[\\x9f\\x92*<maz\\xcb\\x84\\xe60&sm]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  261. },
  262. {
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xd5d!$\\xd4hp\\xd9\\x81\\x10/\\xb5i\\xba*\\xd5a\\xba\\xbf\\x99hgm\\xa0\\xf1\\xcb\\x9f\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264. },
  265. {
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04e\\xd8\n\\x85\\xd8\\xf9\\x04=\\xb8ki\\xb9\\xb8o\\xd6\\xf6\\xa8>\\x1a\\x8cj\\xb3a\\xb0\\xfb\\x02\n\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  267. },
  268. {
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04b\\xd3'\\xbc\\xb4p\\xd7\\xc5]\\xe9\\\\xbe\\x83`1'67\\x1e\\x1f\\xac\\x83-\\xa7\\xde\\x81\\x9b\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270. },
  271. {
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xf4\\xdf\\x87\\xa9\\xfc\\xf9bm\\x88\\xed\\xde\\xb7(\\x9a\\xa6\\xac%\\x05z\\x8b\\x1e_ut\\x01s\\x0e0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  273. },
  274. {
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\x06({\\xce\\xc7\\x1f)\\xce\\xb6\\xe8k\\x81\\x17]+\\xb7c\\xec.\\xcbpgt\\xef5\\xa6|5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276. },
  277. {
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x04\\xf4\\xe1\\xf8\\x14\\x1a\\xca\\xff\\xa8f\\xa9j\\xb4\\x86\\x9d\\x88\\xe7\\xf3\r\\x1c\\$\\x14k\\xcfe\\xba\\xdf@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279. },
  280. {
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0caf\\x11&e\\xa9\\xeb\\xce\\x07p\\x9d\\xbfd\\xca\\x034+\\xfe(e\\xbb\\xc2\\x9b\\xe9y\\xfd\\xf4\\x9d\\x19d\\xd1o\\xe7\\x08\\xd0&$\\xbb\\xd3o\\x07dc\\xae\\x1f6\\xd0\\xc6\\x1f\\xf81-i'\\xdc\\x0b\\x9f4\\x1dx\\x85l\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\x8e\\xc9s\\\\x9cd:i\\x08=\\xd2\\xb2y\\xdd{a{zv\\xb0@55\\xc6\\xbd\\xf6\\xd3\\xa6r\\x90\\xf6\\x8e\\xe3k \\xdd\\xea\\xe0].n:\\xf3\\xf8)\\x13d"
  282. },
  283. {
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xe9\r\\xa7z\\xb8\\xd6fh\\xc6\\xe6\\xd0\\x13\\xa2\\xb5\\xd3o\\xb0f\\xbf#\\xadv\\xfb}\\xdck\\x9e\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285. },
  286. {
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08a\\xac\\xfc\t\\\\xa1\\xab\\x01g\\xa9\\xd7\\xf7\\xd6\\xd3>\\xcd\\x0b\\xed\\xbe\\xca\\xda~\\xb7\\x86\\xdc\\x1ad\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288. },
  289. {
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xc6\\xbc%\\xc4\\x078d\\x158~l\t\\xbd\\xef\\xc9x\\x15\\xf0\\xc5nv\\xd8.\\xe2\\xca\\xc4}\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291. },
  292. {
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08n\\x97nf\\xb9n\\xc7k\\xb1\\x87j\\xde0\\xd2\\x91$\\xe0\\xfb\\xc9\\xfepo\\x84t\\xba\\xed\\x8ey\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294. },
  295. {
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xe3\\xb19\\xa2o\\xfeq\\x14e\\xd5\\x9d\\xea^65\\xd5\\xa1\\xe1u:xh\\xeb\\x98\\xa7\\x80@i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297. },
  298. {
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\tk\\xf9\\x7f\\xf2z\\xfb\\xce*\\x98\\xcb\\xef3a\\xa9\\x19\\x0c\\xd1\\xa8=\\x02,\\x0c`\\xa2\\xa1\\x7f\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300. },
  301. {
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xe9|\\x96!\\x88\\x84\\x8a\\xd1p\\xdda\\xff\\xbel\\xbb\\xe0}\\x14\\xd8\\xce\\xbc\\x86vs9}65\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303. },
  304. {
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\x1c\\xd2s\\xb7\"n\\xe7x\\xff\"\\xfe\\x93\\x07\\xc6o\\xfc\\xa3{\\x99,j}a\\x00\\xae\\xe3\\xe9\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306. },
  307. {
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xd0\\x1c\\x9e\\x19\\x84c\\xc1\\x8f\\x8e\\x980 l}btv\\xab*\\x0b\\xa14 \\xff0\\xb2\\xa2\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309. },
  310. {
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\x06\\xa5$\\x80a\\x0f;\\xb0jg[\\xbc7$g\\xc4\\xd6\\x02\\xdb\\xc3\\x10\\xcd6p\\x1b\\xfb\\x11\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312. },
  313. {
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\xe1\\x9f\\xf1\\x88\\xd6j\\x0f8\\xd4\\xf3\\x03$q\\xc3\\x07m8\\x19\\x9d\\x14t\\xfb\\xd5\\xf4\\xc0\\xe3\\x04y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315. },
  316. {
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08\\x87:\\x80[\\xb1<%\\xba>nklu\\xe6\\xa0\\xdek\\x01\\xe6)\\x1e\\xb0\\xe0\\x8e\\x0f>b\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x08@\\xaa\\x90\\x07\\x1f`\\xe6h\\xb9\\x17\\x99*2\\xbbqa\\x96x\\xe4\"\\xa8jf\\xa3\\xac\\xdd\\xdax\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xa5\\xfb|\\xe8<\\x851\\x14h\\x88#\\xb8\\xf6(\\xeb\\x83m\\x86~\"=\\x10d\\xf3\\xf4\\x14\\x9cr\\xd3oe\\xd7\\x96(\\xca<\\xb9\\x81\\x82gt6\\x91\\x1d\\xae\\xaa\\xe1\\x83\\xd1(s(\\\\xff3\\xd5,(\\xe1&\\xed\\xb79\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xe0\\xc1es\\xe3~\\xa8\\xcfvf]\\xad\\x9a\\xdc\n\\xd5\\x97\\x82\t\\xec\\xc74#\\xbcxvd\\xbe\"\\xcf\\x19_\\xa2\\xdf?qc\\xab\\xbfyv\\xc9@\\x9d\\xef$\\x90"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xbby^(q\\x84\\x15\\x01\\xbfeg\\x8d)\\xd8q\\xad\\x81\\x96\\xdb\\xfb\\xae\\xbclxoe\\x11v\\x06\\xb8_\\x92r\\xb0\\xe1\\x82\\x04\\xbe\\xaf/\\xb9\\x11\\xb3\\x16\\xce\\xa0^\\x99\\x15$\\x8f\\xba\\xc1\\\\x8b\\x8c\\xc3\\x03\\xbe\\xe7\\xa56\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x13\\xb1\\x11\\xfa\\xcf%\\x8bx\\x86\\xf0\\xcd\\xef$r\\x1f\\x81\\xabq9\\xa4\\xe7\\x8e\\xe3\\x91\\x15\\xbf\\xea\\xd2\\xa6\\xb7\"\\x0f\\xfc;9f}\\xaaq,9\\xef\\xc9\\x12\\x12\\xe8\\x92"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xe5j\\x0b\\x04\\x9d\\x88z\\xb1,\\xc0\\xc6\\xc9\\x80\\x17\\xf3o\rw\\xb0\\xa9n1\\xc4ry5\\x1fd\\x0e\\x96\\xa1\\xac\\xa3\\x8d\\xd71\\xccp\\xd2vz\\xe6%\\xd1\\xeci\\x8f\\x851\\x18\\xe3\\x97\\xf3i\\xc1\\x1a\\xe4\\x11oc\\xcd\\x02\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xecv\\\\xfb\\xa1\\xfd\\xd3\\xc1\\x82\\x8e\\x11\\xcaa-\\x93xd\\xcf\\xa4\\xd34\\x1c`g2\\xf4\\x89)qi\\xed\\x16\\x1d\\x13g{zy5\\xbbkc\\x86\\x0fq\\xe2k\\xfe"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\x91(!f\\xb5\\xf8v\\xc1\\xa2\\x17\\xef\\xc8\\x8bf\\xa2\\x84j\\xf0\\x0ex\\xbf\\xa7\\xa7\\xf1[f\\xe9m\\x92lu=\\xa8\\x1a\\x88%\\xa8\\x8fj]=\\xab.fw\\xb0\\xc2\\x82\\x81\\xb5\\xaa\\x88\\xec\\x0c\\xc8!\\xf2t\\x8bz\"\\xb5h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xfb?i%p+\\xa9\\x96\\x954tkv\\x90\\x89\\x16\\xc6\\x19\\xcc!lc\"\\xf9\\\\x00{\\xe4a\\xad\\x8f@\\xaa~>\\x86\\xc7(p\\xdb\\xe9/\\x81\\xdd7|u"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i`\\x1a7\\xef\\x04\\xaa\\x9d\\xf4\\xbd,s^\\xd4s\\x02~\\x92^\\xe9\\x9awm\\xc8\\x8e\\xc8me\\xfc\\xa9]m\\xbd\\xf1\\x05d\\x95\\x98\\x7fd\\x1ft\\xd3\\x03g\\xc0\\xbd\\xe1\\xbeq\\xd3c\\xd3\\x94u\\xf0\\x16\\x8f;$\\x8d\\x9d\\xdb\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1g\\xa9\\xa2c}\\xb9\\xca\\xf0\\x00\\xb2\\x8a\\xa6\\xec\\xc83\\xce\\x84\\x0f\\xc2\\xaevw\\xecg\\x92\\xe1)\\xcdc\\x14\\x02}\\xae^\\x13&vw_ u;=msmg"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04}p\\x914y\\x13\\x10\\xd3_\\xb9\\xc7k\\xcc_\\x06<\\xb3xi\\xfb,w\\xbb\\xd6\\xc4zs/\\xa0s\\x88\\xcf\\xc9\\xccs\\x0b\\x00s\\x04/\\x91\\xba\\x88\\xdf\\x90\\xe5bgim\\xba.(\\x07xl4\\xa1\\xd6a\\x01\\xba\\xc1\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\x88yu#\\xb5\\x9b\\xedfi~\\xb0\\xff-\\x06yy\\xd1\\xda\t\\x01+mh\\xdcg\\x9c\\xee '\\x03'\\xba\\xbd\\xcej\\xcc[\\x8d\\xfd\\xd5\\x9f\\x9a_%w^\\xa7"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\x17\\x1c\\xbe\\xf1q_\\x85~\\x9a\\x0bl\\xe1\\xa4\\xf1\\xa0\\x15\\xad\\x15\\xbe,(\\xdf\\x16\\xfc=o;\\x9d\\xc7v(1\\x88\\x8b\\xb0!y\\xeb\\x14\\x15\\x06\\x02#\\xe2g\\x17\\xabu\\x1e\\xdcx\\xfd\\xdcq\\xf8\\x05a\\xc2\\xc1\\xd6\\xb93\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ro\\x02^\\xd4\\x92\\xa7h\\xec/y\\xcf\\xf15w\\xdc\\xdc~uf\"o\\xe6\\xbc\\xe0t\\xade\\x08z\\xab\\x1f\\xce\\x82\\x982jq\\xff\\xb8r;\\x13\\xa1\\xfe>\\x1f\\xa9"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\xb4$r\\x1f\\xb4\\x8f(\\xb3a\\xac\\xf0\\xcf\\xab\\xc5\\xd0y{z%\\x10\\x19e:wag\\xd4\\xcc\\xcerx\\x89}1n\\xd2\\\\xe4=}\\xf0+\\x18\\x9bl8\\xd4\\xbd\\xb1\\xc7:\\xc3d1v\"\\xfcy\\x99\\xe0/p2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\x84\\xde\\xf3lx\\xac\\x1cv[\t\\xe3p\\xb83\\x9b\\x13\\xa5\\x19\\xcb\\xe2v34\\xa8\\x8fk\\xfa\\x86x\\x9c\\xe1\\xb6\\xe2\\x8fg\\xca\\x14\\xe2\\x8c\\xbe\\x08o`y\nwo"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\x0b\\xa45\\xe3l\\xc8\\xc6\\x8f\\x1b\\x91\\x99m\\x80\\x8c\n\\x85\\xb0\\xaa\\xb6\\xba\\xdfa;\\xcb\\xab\\x9d\\xb2|\\x7fkh5\\xf5\\xf1\\xf4\\xd8\\xa7\\xe1n\\xa3\\xc8\\x90\\xdd\\xa7o\\xf3\\xbda\\xb8\\x87\\xf2\\xbe\\x0e\\xa8;\\x8fm;\\x93d\\xbd5\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3-\\xc0?\\xf3\\x81*\\x1e\\xe2d\\x16z\\xb1v\\xcc\\x7fw\\xc8a \"\\xa9\\x89\\x0e\\xdb\\x0f\\xa3\\x9e9\\xfa\\x1es\\x8b\\xf9\\xceh\\x13ulz:]\\x7f-`\\xc7\\x98\\xb2"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04wr\\x069d\\xf7\\xab\\xd6\\xfd\\xa5\\xf9\\x8d\\xda\\xce$i\\xd82\\xb8\\xe9\\xea\\xe2\\xbc\\xdc\\x1f?\\xb81\\xa4\\x16t*\\xd9\\xbd\\xfb\\x82\\xfc\\xcf-pb\\x88w\\xaa\\xf8\\xcf\\x81o\\x18a5\\x81\\xad\\x93jz\\x9c\\x15\\x9f\\xbe\\xaa+\\x02\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!.2\\xfa\\x17\\xe3#(\\xfd\\x85\\xc8\\x19\\xf8a\\x18\\x16\\xa8\\x1c)\\x05\\xd3\\x1f\\xc0rz\\x16=7z#j\\xb3\\x8c\\xb9\\x15~pi\\x82rp\\x07\\xda\\x13f@hp"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\x96o\\xa8l7j\\xdf\\x86\\x928p\\xdd\\xfcf0\\xa6\\xa72u\\xa5nt\\x8e\\x10\\xd0w\\xa9\\xd2x<\\x94\\xfe\\xfc\\x8c\\xf0\ra\\x8d\\xf9\\x9b+\\xacx\\x0e\\xe8\\x94r\\xea\\x03#f\\xda\\xe9\\xfb\\x9ayp\na\\x07s\\xa7[\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\x93]\\xa5\\xff\\xd4\\x05\\xce\\x0ea/\\xeac\\xe61y\\xe0\\\\x83\\xc5%\\xcd,\\x8bq:ni\\xc0{h;;x\\xe32\\xb6\\xe1f+|\\x05j^v\\x010h"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d>r|{o\\x82\\xf4\\xec\\xdb*\\x9f\\xd6\\xe1\\xe2\\x9d`\\xc7\\x96\\xa1~\\xcd\\xe7\\xe2\\xbc\\x95\\xdc\\xe8\\xad\\xce\\x96\\x8f5\\xe14\\xb5\\x13oh\\xf1\\xec \\xeb_\\xf6\\xc3nl\\x96>\\x04\\xa8\\\\xbf\\xb1i\\xce\\x11dui\\xefc\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_\\xa1\\xb4,ah\\xd5\\xb6<c\\xfbb`\\xcd\\x87\\xa0t)\\x82\\x1d<}\\xd7]\\xd5\\xd8\\xafs\\x89j\\xf0w\\xceb\\xc0\\xd6f\\xf4\\xae\\x86\\xe4\\xa5\\xe6_\r\\x9a\\xea\\xe9"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\\xfc:\\x99\\xacy5\\xb1\\xaf\\x11\\xb2\\xc6w\\x8bl\\x10lw\\x8a\\xcd\\xdbu\\xccp\\xd2j!\\xcax=\\x98=\\x93\\xa3\\xcd\\xa5ii\\xde\\x0c\\x90\\x05\\xd01l`\\xf1\\x14\\xb2#{\\xaa\\x8a\\xf9\\xcd\\x1e\"\\xfa\\xff\\x11\\x104\\xcan\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004k\\xa8\\x81\\xe6qx\\xd5\\xafp\\xccin\\x96\\x86\\x16>\\xf5\\xaa\\xac\\xa5i\nea\\x1a\\x9c\\xaa\\xb8\\xd9\\x99\\x16z\\x90q\\xaf\\xc9\\xe3\\x03.b\\x9e\\xbeg7nk\\x81"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8s3\\x10o\\xec\\x0e\\xc57\\x051\\x8a\\xce\r\\xf9\\xfbb\\xb8s\\xd1\\x98\\xbd\\xbf\\xa2\\x8e\\xe9\\xf7\\xf3\\xcbz)#\\xd7\\xb1\\xd0j[\\xeb@d\\x8a\\x95\\xf6\\xd3\\xae\\xb7\\x92\\xb5}]f\\xf6ln\\x1d\\xbaotxgx\\xeb\\x03\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000xs\\x12\\xb3\\xbe\\x122\\xd5\\x87~\\x1e\\xefh\\x91\\xc39\\xeft*\\xe1\\x13kz\\x91\\xce?\\xc6\\x85\\x9b\\x18\\x03\\xf7\\xa2\\xb3\\xfbb\\xde\\xaa\\xe4\\x12a'$\"[\\x8e\\x9c\\x88"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xd8\\x9aj\\xdf\\xc2\\xbf\\x9d\\x8al\\x90\\xbb\\xa2j\\xa0\\xbbw\\xb9\\xe3\\xce\\x1e\\x14\\xf4rf\\xb9\\xed\\xf0\\x9e\\x02_\\\\x05-\\xbdn\\xa9os\\xec|\\xd6\\x06\\xa4\\x9dk2\\xd0nc\\xcam\\xb3\\x8d\\xf5\\x90\\x89\\x96\\x9f\\x91-\\x8b\\xdd\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xffr\\xc5\\x86\\xe3m\\xe9\\xc5o\\x19\\xdd\\x1bry\\xd5\\x13z\\_n2\\x8a\\x933\\xce\\x17\\xc1\\x13n\\x0b4\\x8f$\\x13\\x1d\\x98\\x01\\xb81\\xe3\\x7f\\xc7\r*\\xdf\\x98\\xd1"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>p\\x97\\x85w\\x0f\\xce\\x1e\\xcb\\x13\\xd9\\xaf\"\\xee\\xaa\\xa5\\xb2p\\xc9h\\xfa\\xc2e\\x03*\\x15\\x1eu\\xc1\\xf1\\xbe\\xa1\\xe1k6\\x91\\xe8=\\x15\\xaclj\\x1fje\\xc5zako\\xd7\\x88c\\xc3\\xb8a\\x8c\\xd4\\xee\\xf5h\\xc9\\xa2\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xbc\\x86vh\\x8b\\xaa\\x84^\\x88\\x15\\xcd\"\\x8c\\x84\\x03\\x14\\x01\\x9dh\\x94;\\xa1\\x0f\\xb7}v\\xe2\\xa1\\xd8\\xa2h6\\xe2d\\xca>\\x84plb\\xb5\\xad\\xc0\r\\x15w\\x07"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bo\\xe4\\xfb\\xb3q\\x86)\\xf4j\\x9f\\xc7\\xd0\\xa4h\\xf5u\\xe6\\x8c\\x13\\xcf\\x83\\xd3\\xd0n\\xa3\\xb4h\\xbc}\\x81\\x93\\xf3\\xd6u\\xd2\\x0ew\\xe7\\xcb\\xfc-\\xaa\\x16kg\\xe3o\\xaa\\xf6\\x8a\\xc4\\xb0~\\x81\\x81\\xa0%6j\\xc7\\x1a\\xd6\\xdf\\x90h=\\xffoo\\xd4\\xa8\\xe1|\\x18\\x1ai\\xd8|:;-\\x124\\x89,#3a\\xb0{\\k\\xbe\\xc3\\x04\\x19\\xdd*e\\xb7\\x9e\\\\xfe\\xff\\xb5\\xa7\\xdfv\\xae\\x1b\\xc9\\xa1\\x97\\x86\\xe8u\\xb5\\x188\\xab\\xbf\\xdc1\\xc1\\x94\\x9d\\x8f\\xa96\\xd3\\xd8\\xb9\\x1b!\\xac\\xbe\\x00\\xc8\\xe7\"d\\xd1\\xd7,u\\xd4dr\\xc2\\xe7\\x12\\xf7r\\xa9p\n\\x08~\\xccf\\x96l\t#\\x13\\xd1\\xa4\\x1d;\\xc4\\x9a\\xb5\\xbd\\x03l\\xb4\\xf9\\xea\\x06:wd\\xc3\\xfb\\x89\\x8f\\xd8\\x16\\x10t\\xaco\\x94v8\\x03\\x97\\xfb\\xab2\\x83\\xc9!\\xa2n\\xf2u\\x1a\\x9fd\\x7f\\x881\\x0bo\\xcc\\xb8\\x10uq\\xe3\\xc0\\x05\\xc4\\xa6>e\\x9f\\xc2\\x07\\x8e\\xcf\\xcc\\x9e\\x8e\\x93\\xf6\\xd8\\xeby8\\xf2up\\x07g\\xab\\xbb0\\xaf"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\xd7{\\x85'\\x99\\xe1\\x9e\\xb2hb\\xb7^\\xa7|\\x19\\x9e\\x89\\xf0\\xe2\\x94pn\\xbf\\xb3\\x0fl\\x11k\\x0es\\xa5\\xce\\x98\\xac\\x84\\x9f\\x19\\xefg\\xac\\x07\\xbbd\\x01\\x9a\\xc2\\xe3\\x16\\\\xf4hc;c\\xf7\\xaa\\xd1$h\\x9an`w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x97c&u?\\xb4\\x07\\xdd\\x19\\x05>\\x15u\\xa9v\\xf3\\x0b\n\\xb2\\xe4\\xdboin\\xa6\\x8ea\\xffp0t\\x8e\\xc74\\xdfzg\\x97\\xc4h\\xa9\\xc2\\xf0\\xff\\xd4\\x96\\x92p"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\x90\\x19\t\\xe6\\x02\\x14/\\xf9\\xea\\xf0\\x1ehpp}\\xb8\\x87\\xf8\\xf06\\xc9\\xbe\\xd5\\xfbtpy[\\xdf\\xb6\\xf7\\xdfw\\xf0\\x98\\xcew\\x98.\\x89tt\\x1e\\xae\\x81\\x88/z2&\\x193\\x84%3\\x903\\x94\\xd0\\xe0\\xab\\xc7\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfcl}\\x89\\xaf\\x8a\\x96\\xd9\\x1a\\x995dl\n\\xe3\\xfe\\x17\\xf8\\x91dk%\\x886\\xdf`\\xb0\\xf2>c\\xc6o\\x0e\\xd1_\\x14=r\\xea\\x1c\\x81\\xfcn\\x9a\\x9f\\x9dvx"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xbale\\xb5f\\x9e\\x8a*\\x93qm\\xb1\\xb4\\xb9h\\xf2\\xb6\\x9afv\\xaf\\xaf\\x99q\\xc49\\x1d\"\\x126@\\xc5\\x9b\\xe3\\x82 }>v\\xff*\\x1f\\xbb}\\x82\\xc2r\\xf8>\\x07c{\\xa3(\\xf1\\xf6\\x88s\\xb7^z}\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xb9q\\xeb)\\xf2b\\xe7od*\\x1fj\\xf3u\\x8a\\xeb\\x1c\\xbef\\xa1\\x81c\\x9b\\x97\\x89a \\x98\\xfdb\\x99h\rkgj\\x17qx{\\xa4\\x84\\x95\\xf9\\xee \\x1a"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2>z\\xfa\\xafg\\xafw'/\\xdd\\xd0\\xb5\\xe9\\x90\"\\x9d\\x12 \\x04m}9\\x07\\xef\\xba\\x19%\\xa8\\xfa]\\xf3\n9\\x93\\xb6\\xdaa\\x11\\x86h\\xec=+\\x93\\xd3\\xb7\\x01b3^\\xfc_\\x86\\x99\\xb4ru\\xa0\\xd9\\xa6\\xba\\xaa\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xac\\xed#\\x9cz\\x04\\x8d\\xab\\x1b\\xa0\\x9ei5^\\xee\\x83a\\xa0\\xd2*fj!\\x98z\\xdb\r\\xed\\xd9\\xe7\\xc2k\\xe8\\xa0o\\x01\\x12nj\\xab4f\\x87e\\xb0@("
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\x99}\\xebux\\x08\\xb1\\xa4\\xa8\\xa7\\xd9 \\xdd\\x19\\xb9\\x85m\\xb0\\x17\\xd6\\xe9\\xde\\xb2\\x1d+\\xc2\\x7f\\xeb\\xd4~_\\xf8\\x15o\\xe1\\xf9\\xc9\\xa6\\xee\\xee\\x84!\\xf0\\xf9oa\\xd8x\\xdd\\xbd\\xf9\\xb1th4\\xe5\\xe5 \\xcd\\xbc$f\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\x18\\xae],\rv#\\xf6\\xe3\\xe6\\xee4\\xa7\\x86\\x11\\x99\\x18\\x9b\\xady7\\x1f$\\xdck\\xc8\\x0b\\x06\\xb8@\\xdb\\x9a2\\xc5\\xae;oor-/\\x8f\\xdch\\xb2\\x15\\x00"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae6\\x018\\x11\\xce\\x1at\\x17\\xe8\\x93\\xfe\\x9c\\xd9\\xbe\\x8b\\xa0\n\\xce\\xbe\\xf6\\xdb\\xdf#\\xff\\xeb\\xf4\\x10\\x02\\xfe\\xb8h\\x1f\\x98\\x9b\\xad\\x85+\\x00r-\\xfb<\\xc0\\xd4\\xd00mb\\x00+g\\xbc\\x83\\x82\\x14}\\xee\\xaa\\x8dkd\\xcae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}8\\x06\\x80\\xf2al\\xd6\\xa2\\xda\\xa6\\xd6\\xe9\\xddn\\x04=\\xa9lti\\x99h>r\\xfa\\xbc\\x12\\xbcky\\xd5r\\xb6\\xce\\x13\\x8c\\xf6\\xdd+\\x12k\\x07\\xf2\\x12#\\x8f\\xf3"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x02\\xbc$n;\\x94\\x12k\\xbd\\x1d\\xb65r\\x08gwm\\xec\\xd2\\x83\\x16\\x91\\x84\\xa2ru0^\\xa8&\\xfb\\x81c}\\xc8%\\xdc\\x1d\\xe6\\xd7\\xd1\\xc1\\xc0\\x0c~#`\\xcf\\xab\\xec\\x1a\"\\xe1u/\\x9f\\xa45\\xfe\\x05f\\x8d(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\xa9\\x89\\xe5\\v\\x94_o\nm\\xec\\xdc\\xf8\\x8a(\\xef\\xae^=\\x96a\\xe4\\xca^\\xa8\\x8c\\x96\\xdd\\x8de\\xb0\\xc0n\\x86\\xb9\\x14\\xb1\\x1fi\\xb2\\xa7\\x192\\x9d?\\xfez"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x1f\\x1f0\\xc6\\xf9e`\\x00hu\\x8c=r\\xbd\\xc0\\xb4ae\\x10\\xc5&\\xbd\\xd1\\xbfb\\xd0\\xd1\\xa1\\xf1\\x84\\xec\\x19\\x03>\\x88\\x9c\\xc2\\x17\\xae/%8\\xb9.q\\xa3\\x0e\\x99_\\xb4\\x97\\xd2.lr$\\xcf\\x98i\\xa0m\"y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@y\\xf9g\\x97\\x86\\xab\\x88k^'i\\x0bg\\xf7'\\xf99\\x1d\\xb7d\\x18\\x99\\x9c\n\\xbdyx\tc\\xd0\\x1e\\x17\\x1e\\xbe\\x13\\xcf\\xd1&\\xa4o\\xeb\\x06\\x1f\\xbb\\x94\\xbc\\x03"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\x83 a,\\xe1\\xa7\\xfd\\xe8\\xbc*p5\\xe9zrs\\xd8\\xf4\\x85pp[o\\xa66\\xb4o(\\x9f[\\xe1j\\xcafs8\\x9e\\xad\\x9b\\xb2\\xe4\\xb8?j\\xec\\x9d\\xa4\\x1ds\\xeb\\x8e\\xf7\\xd5\\xd8\\xce\\x0e\\x02c)s\\xaft\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k<\\\\x01\\xae\\xb5\\x02\\xee$\\xb2\\x00y5\\x91\\xd8\\xaa\\xf4*\\xaa\\xc9bj\\xcd\\x11\\\\x10\\xc3\\x13\\xe4y1\\x96\\x14\\xbf]}\\xb8\\x0e=jd\\xd9\\x86\\x06\\xb3\"&\\x8e"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 w\\xa4\\xfei\\x91\\xf4\\x1b\\xb4+(9s~%\\x1b\\x81\\x81c\\xd8\\xec&\\xd7\\xfc\\x11n\\x87\\x95\\x92\\x92\\xe1\\xe7uae\\xb6\\x90\\x19l\\xfa\\xb7\\xba\\x84\\x1au\\x00\\xe8\\xbd\\xb0\\x04cs\\xf4\\x12b?j\\x02\\xc7~a\\xeb\\xd5\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\x15bv\\xe2\\x93\\xce\\x1enn{\\xb7\\xebuv\\xa6a\\x01\\xb8\\xa2\\xa2\\xa7\\x9c\\xb3\\xb9\\x873\\x9e\\xe2\\x8b\\xc7\\xa9v\\xf5l\\xe3\\x87u9s\\xab\\xf6\\xf5#\\x93\\x0f#\\xff"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\x94\\xb2\\xca\\xe3\\xe6\\x8c\\xe9\\x05h\\xc9\\xfb\\x9f\\x91u\\xe5w\\xcf\\xda\\xa8\\xc9\\xa4\\x11a\\xb04<\\xbc\\x97\\xd2x\\xec\\xa6i\\xe3\\xcb\\xa8}4\\xa7\\xb0\\x1ci\\x87\\x16vj\"\\x90s\\xeb]\\xae\\x0f\\xe1r\n\\xdf\\xfdfdf<\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\xe3z\\xa5\\xa3s\\xe4\\x19h[z\\xa65o\\x83:\\x17l\\x99\\x91\\xbd\\xf2\\xfa\\xb2\\x10\\xd6\\xf9\\x99\\x8b\\x08ef\\x97\\\\xd1/a\ro\\xca8\\xc54\\xb2\\xa4&\\xc2\\xd1"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd75\\xa3\\xac\\xfe\\xddhtl\\xbe\\xf1\\xe8\\xfai\\x84\\xb4v\\xdd\\x86 7\\xe6\\xf5?\\x18\\xfdr\\xd0\\x81em\\x83\\xc1>\\xb2\\xf7_\\x85\\x8b\\xe1|\\x8f2\\xe2|\\x83\\xf4\\xaf(\\xf7w\\xf2m\\xa1:\\xab\\x9c\"[>m\\xe7\\xf8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdc{\\xf3\\xd3`\\xb5\\xb3n]\\xee\\x0c*\\x17\\xc4\\xed3\\\\xf3p\\x941\\x8d \\xf2\\x03\\x88b\\xd8\\x13c*\\x01\\xcf\\xcb\\xd7d[\\x7f\\xbb\\x81/j\r{6yv\\xef"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010qdx\\x19\\xc3p]\\xb77\\x01e\\xb3\\xfcew1\\xf9\\xbb\\xb7\\x89\\x9dq\\xa5=\\x9a\\xc8>\\xea\\x82\\xa5\\x86\\x00\\xb0l-\\$\\xfcs\\x82\\x1ei0\\xf2^,\\xe5\\xa8\\xfa\\xed\\xca\\x07m\\x88\\x98\\xb9\\xf53p\\xfe\\xe9r\\x01\\x90\\xbf\\xf4\\xae5\\xae:\\x8b\\xdf\\xa0\\xe8\\xaa\\xe1\\xd27\\xcc\\x8f\\xfbl\\xb1/\\x1f5-\\xc8\\xaau=\\xb8d\\xf9i\\xb0i2\\x9d\\x9d\\xaa\\xea\\x82\\xf2\\xb8.\\xaa''\\xe4\\xe93\n@\\xf7\\x8f\\xc2/\\xd6\\x07z\\xe5\\x98y\\x0cd\\xfd\\x0f,\\x9bh\\xb8\\x8a\\xb7&j\\x8e\\x9b\\xc2{\\xc8\\xa8\\xd1fa3g\\xf3e\\x94\\xde\\x8ef\\xcb%\\xba_\\xe37w\\xa3ubj@\\xbf\\xea\\xb7(\\x1b\\xc1\\x1c;\\xd0\\x95\\xf7}\\xe5o)\\x97\\x14\\xb2y\\x1c\\xdet\\x06\\x95\\xb2\\x98\\xa6\\x1f\\x98m\\xc3b\\xaa\\xed\\xb7'\\xef\\x9dcg\\x08\\x8f\\x05\\x8c7e!\\x8cb \\x9fa\\xed\tf\\x00b$m\r\\x9b_\\xa5\\xf9\\xd6\\xaf\\xd3l\\x12\\x9e\\xdb\\xf5$\\xcab\\x93\\xb5\\xf8\\x9c\\\\xe5r=\\xadgk"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xc3\\x05\\xc8+\\x08\\xcf\\xaf_\\x1c\\xa8\\xcf\\xdd\\xe3\\x1e\\x1a\\x87\\x11\\xcb\\x06o\\x94\\xb2\\xcfg\\xc6\\xa9\\x80am\\x1czpo\\xb6\\xb1$\\xc0e\\x92\\xdc\\xda\\x8dc\\x01\\x7f36p\\xac\\xe6\\x8c\\xac\\xda+,\\x1c\\xeb\\xaa\\x16b\\xae9t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xf0k\\xd6\\x8d(n\\xdex3\\xf6\\x96t\\xb8\\xb6\\xeb\\x1e\\x1bj\\xab\\x83\\xddg\\x14\\xf5\\xe8z\\xb3\\xf9\\xa5es\\xaa\\xca\\xea\\xbc\\xbf\\x08\\xeb_@\\xfey\\x9fe\\xc9s\\xa5"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\x15\\xf7\\x93\\xdd\\xd0p\\x94\\x87t\\xc4\\d:\\xfe\\xb0\\xff)\\xd3sw\\xc5\\xda\\x84h\\xbb<\\xa6\\x97\\xdc^\\x90q\\xd2\\\\xf8\\xa7\\x86%\\x96^\\x16\\x8e\\\\xa8\\x9e\\xd3\\x12\\x00\\xa9b\\xf6\\x9fz\\x0c\\x1e#[e\\xa4\\xf7\\x90\\x9ft3w0\\xff\\xdc\\xc9\\xb8vg\\xe2\\xf5&y\\xf4\\xf2\\xfd\\xc5qi\\xae\\x93\\xfd\\x83\\x10\\x15][\\x8bfk\\x9c\\xc9\\xf1g\\xfd\\x84o\\x1d\\x92\\xc0\\xeeo\\x87\\x91\n\\xba\\x0bc\\xbb\\x13\\xbf\\xc14\\x99\\xd8\\xf8\\xe2\\x10\\xea@\\xef{\\x83\\xe4$q6z%]\\x9fb\\xdc\\x04\\xef\\x1a!@8\\x84~\\xe3/t\\x96x\\xca3(\\xa7\\xe1$\\xe4i\\xb0\\xca\\>\\x89@\\xb9\\x9d=\\x07\\x05\\x06\\x1c\\xceg\\x7f\\xae\\xbbl\\x83\\xa9\\x84\\x97\\xa9s0\\xb2\\xdb\\xc4(\\xeb\\x14_\\xc4\\xea\\x90\\xe2e%w\\xae\\xbe\\x8b\\xd8<`x3d4\\x13\\xd7\\x8f\\xa6\\x88\\xd6\\x85j\\xb9\\xfe\\x1bf)\\xa6r\\x07\\xdb&rw<\\x0e\\x05\\x98\\xc5r\\xcc\\xa6lz\\x02\\xa4&\\xe8v\\x9ew\\x1d\\x0c'3\\xec\\xa9"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\xb1\\x17\\x98\\xcc\\xac\\xc1+\\xc0\\xe9k\\xff\\xc9m\\x05\\x83\r\\x12\\xbd\\y\\xdf<\\xf65\\x07\\x06\\xe1\\xc6\\x92\\xa9p.\\xc2\\xe5'\\xa8|\\xab\\xac.u\\xda\\xc577\\xcd\\xd2\\x96\\xd5\\xad\\xe4\\xa1\\x83\\x15_o]8\\xcb\\xe9\\xc0=\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xaa\\xede\\xd6\\x02\\xd3\\xbf\\xd0\\x8d\\xcehbju\\x83\na\\xdcw\\x197\\x1c\\x15\\xcb:l\\xa2\\xc1w\\xb9*x\\xd3w>\\xbc6*v\\xa6\\xa9r\\xfd[t z"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6ij\\x7f\\xec\\x9e r\\x1a\\xe9\\xb9m\\xf8\\xadn\\xcc\\xd2o\\xbe1\\xaf5u\\xf5\\xf9t\\x15i\\xb4\\x04\\xe2o\\xa2=\\xe1&r\\xf7\\x1bm\\x0b\\x9f\\xd6\\xbe\\xdft\\x9d\\xdee\\xe4\\x823\\xc5\\xebo%qv\\xf1\ts\\xd3(_\\xee\\xd3\\x8b\\x0f]\\xb4\\xf1\\x11\\xc6\\x8d\\x05\\xfa\\xa8\\xf4r\\x95\\xfdr\\x02\\xe9\\x9f\\xefy\\x18\\xc3\\x0f\\xfc1.|4v\\xa6\\xab\\xfa\\x13\\xdc&\\xd6\\xf3\\xd2\\x8b%$ci7\\xa7\\x0b\\xf4\\xa1b]2\\x0b\\xfek.m\\x077\\xad\\x80\\xf2\\x0f*\\x03\\xdf\\x85d\\xd4\\xafd\\xe59\\xac\\xdd\\xb96\\x89s\\x8ca\\x8e\\xb9sl\\xde\\xb29l`q\\x03\\xd9j{e4\\xa5\\x9eu@n\t\\x04o\\xfc\\xc5\\xf6\\x0fw\\s\\xac\\x1b\\x9fsk\\xf6hi\\x03\\xcf\\xe6j\\xff\\xe3%\\xae\\xd0\\x11\\x17\\x7f|\\x1e\\x86at!\\xea\\x90`\\xa2\\xc2\\x95\\xec\\x0fx\\x9c\\x8c\\x91\\xa4x\\x1e\\xd2\\xc0m7c{\\x01-\\xdf/\\x00\\x84f\\xca)\\x8f\\x893|\\xa3\\xcd\\x98\\x9c\\x99\\xcct\\xce\\xc0\\x1e}\\x10v"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x87\"\\x02f\\xfb\\xe0\\xb6\\xfb[a\\xa7\\xbe\\x9e\\x87\\x8fz\\xfc\\xec\\xde\\x8c\\xb6\\xb4\\\\xf2\\xc3j\\x11\\xd9\\xbfr\\x9e:\\x07\\x98\\xb0#f,\\xc7\\xbb\\xe9\\xc3*\\xfc\\x13m\\xe9\\xd0d[`\\xb0\\xc0\\x1a\\x81\n\\xff\\xed\\xf1#\"o\\x93ye\\xd1d\\x95q\\x99\\xd6c\\x8c\\x13kze\\x1b\\xd2=\\xff\\xe8x.\\xa30\\xf3ml\\xf6\\xb2\\x1c[\\x0f\\x1b?\\xbb-\\xe8\\xab\\xf3\\xb3\\x93\\xfa\\x11\\xb5\t\\x0b\\x891\\xb8?\":x\\x8b_k:\\xcb\\xd8\\xc7\\xfb0d\\x9a\\x80|\\xa7\\xb8\\xa9w\\xc6%:\\x04;\\xb4x\\xc6\\xec\\xcd\\x17s\\xb9zebq)\\xd3_7\\xa8/|wiq\\xa1\\xcb?\\xf5\\xa8\n\\x07\\x87\\x96\\xd9\\x9d\\xdcs\\x7f\\xc49\\x85\\x89^\\xbd\\xba(\\x8c\\x8c\\xe4s^\\xae\\xa0\\x96i\\xe9u\\x1b=n\\xe5\\x82`~n\\xb3\\x1f!\\xbe\\xbc\\xd0\\xafz\\xdc\\x1c\\xd9\rk\\x86\\xbc\\x08\\x1a\\xb0\\xd1i\\x9d\\xf7\\xbc;1l|o\\xfc\\xfc1\\x82\tfi\\xf2v\\xaf\\xe1\\x00\\xfe\\xd4\\x8d\\xc0\\xec\\xa5y\\xce\\xe0\\xe9"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x84\\xd0cm\\x88gz6x\\x0b12a\\xbe\\x06~2\\xbeo\\xa4\\\\x9e\\x81\nu\\xd3\\x05)\\xfc\\xea\\xdf\\x99,\\x1fa\\x82\\xb2\\x9f[\\xa8\\xa2\\xe6\\x0b\\xb0\\x14%\\xc9\\xf9\\xdb\\x8f\\xf9\\x1d\\xc4b\\xe3@}\\xea\\xf8\\xe8\\xaa]\\xccp\\xfe\ru\\x91\\xe9\\x1be\\xde(v@\r\\x85\\xabo9x\\xb8z\\xafe|\\x81\\xada\\x10\\xe3\\xc7\\x11yy;v[i\\xe2\\x99\\xe0\\xe1\\x90\\xf0\\x91{\\xef\\xee}\\x8a\\xc4\\xce\\x7f\\x9cr\\xd5^b\\xcd\\xa1\\xd3\\xc4~pu\\x940^\\x93\\xe6p\\xa7\\xfa\\x04?\\xe9\\x9b?\\x8c\t\\xa6\\x99d%\\xb1\\x95{k\\x8ehq\\xb5%s\\x1a\\xce\\x16\\x14\\x99\\xd8}\\x92\\xf7\\xa3\\x01to\\xbau0\\x7f\\x9b`!\\xa1\\x9040c\\xc1\\x9c|\\xb9e\\x92\\x8b\\xbf\\x89ro\\xb6\\x0b~\r\\xb22iu\\xbc\\xd6\\xb2\\xa0\\xd64\\x1c\\x95\\xcem\\xc5\\x9by\\xe5p?4: x%x\\x93 \\xa0\\x9e\\xfa\n|\\xa4\\xcb@he\\xaf\\x8e\\xb3\\xa8\\x82\\x98\\xc7\\xac\\xe7\n\\xbap\\xabw\\x12m\\xe5"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\xfd\\xda\\xff\\xe8wxu\\x04\\x00\\xb0.\\xf5 x\\x82k\\xadt\\xf1\\xc7$\\x81!\\xb3\\x91\\x0b\\xb6\\xd6a\\xc3a\\x8c\\xf7\\x1f\\xfejc\\x95\\xa8\\x171\\xfc\\xf0\\xf9+\\x82!\\x05\\xa3t\\x18\\xd6weqm(z\\x7f\\xf8\n\\xc3\\x02\\x0e\\xe1\\xc6\\x8f\\xe8\\x11\\x86\\xe5\\x878\\xba\\xb7\\xc3\\xa1\\x86.m\\x1e\\xffs}w\\x10\\xf7\\xf4\\x12\\x83<x\\xa4\\xc7\\xd5l$\"]j\\xe6\\xfd+.~6\\xa2\\xfa\\xed\\x84lc\\x18\\xf6\\xac\t\\xe2\\xa6\n\\xf0*ax\\xd5\\xddz\\x8fml\\xa64\\x02ap\\xed\\xc5\\xd0\\xad\\x98\\x94\\xd6\nz\\x08\\x99\\xb8$:#z\\x93\\x8c\\xa8\\xcbsn'\\xea\\xec\\xf2qb\\xf3\\x1b\\x0e\\x96\\x02\\xd8`tpq\\x01i\\xe39i<\\xda\\xc8\\xc2\\x91i\\xc1\\xe3i'\\xd5m\\xc5=\\x14\\xae\\xf9\\xbc\\x1f\\xb7\\xa8\\x0fx\\x95m\\xd5\\x0c\\xf7\\xb8\\x92\r\n\\x1e\\xa0\\xd0\\x17\\x89k.\\x0c\\xec\\x8c\\x1fok\\xe2<v\\xa8\\xb5\\x1f\\xcf\\xa5\\x83\\xba\\x87]\\x8f\\x98i\\xfc\\x84wf\\x11'2\\xbb\\x17\\xe9\\xff\\xacu"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ue\\xb25\\xd6\\x02b\\x9a\\x19\\x91\\x89a\\x89e\\xb1\\x8a(9\\xa1,\\x1br\\xdb\\xf9\\xa6\\xd9ks\t\\x96\\xadi\\x98$\\x9faut\\xfb\\xf8\\x1f\\x14{\\x93:7?\\xbdck\\xf5\\x82\\xa61%l\\x18;1(\\xb4\\xbdesb\\x7f\\xce*\\x1cmf\\xdb\\x81j\\xd7\\x91v7&7\\xb0v\t\\xb8\\xbb\\xd8=\\xd9h\\x1e\\xcd\\x96\\x14\\xd2\nv\\xe4\\xf0a\\xdb\\x14r\\x90#\\x0b\\xf5\\x03*g\\x90b\\xbf\\x1d+\\xbd\\xa86\\x1ea\\xea\\x8c\\xe9\\x8f\\xe4\\xdb\\xffh.t!\\xfc2 \\xc3\\xf1onb\\x96d\\xb0z\\xcaq$\\x1a\\xa1\\x88\\xbd\\xa8qcfe\\xc72x\\x95\\x91\\x02g9z\\xc6\\xf2c\\xbd\\xfa\\xfa\\xc5r&+r\\x00--e\\xc3\\xe1\\xbd\\xedzp\\xb3~w\\xc52i):\\x89\\xa1\\xbc\\x15\\xd9x\\xa47\\xa7\\x89\\xdd\\x02s\\xc6\\xbc\\xe5v\\xf8\\x085\\xf8e\\x11\\xe2\\xf6\\xf6\\xd9\\xc3\\xee\\x97\\xa7\\xd8\\xfb\\xbf`u\\xa8\\x8en\\xe9\\xf4e\\xb3\\xf2\\xb92k\\xc1w$\\xf0n\\x96\r\\x87l\\x81\\x1b\\xd5"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<iv\\xd6\\x98n\\xaaw\\xd6\\x93q\\xc7?\\x9c:^\\xba\\x93q\\x10\\x07\\xe6\\x9b\\xe0}&\\xf6\\xdfcj\\xcb@\\x82l\\xad\\x9fo\\xda_\\xed\\x07`6\\xc7\\x9c\\xf1\\xd0t\\x07\\xdc\\xc2\\x0f!\\x1d8f\\xa2x7k\\x1dy\\x9fn,\\xc2k\\x8dpp\\xc98_nap\\xea\\x163\\xe2\\x1c,\\x17}\\x05jx\\xd4\\x85\\xc5\\xcf\\xb2!\\x84l~\\x14\\x0e\\xd9\\xc4@\r\\xd6f\\xf2\\x06)/\\x0c\\xaa\\x9d\\x9dv\\xa9@y\\xf3\\x18\\x05\\xf8\\x00l\\x84\\xa93\\xba'o\\x95\\x0e\\xf2\\x93\\x94\\x10b{?`\\xd1\\x11\\x81\\x8f\\xbf\\xd2h\\x1ao\\xb3\\xbc\\x1a\\x92\\xa3)\\xc9\\xa9\\x98\\xf8\\x17q=\\x18k\\xe1\\xeek\\x93\\xa5udnai\\xc6\\x9c|\\xb9\\xbd>\\xf7\\x95\\x9e\\xd1\\x1by\\xed\\xb5\\xa3\\x1f\\xf8\\xfc\\x97qwm\\xac/]\\x80x\\xf36\\x89-\\x1c\\x90\\xb3\n\\x12\\x00m^\\xc0\\x1e\\xa1p\\xda\\xdap7\\x05\\xe7$\\xa9\\xa1\\x99i%z\\x16\ny5\\x07\\xe7\tt7\\x04\\x12\\xf8\\xb8\\x80\\xd0e\\xe6\\xcc-\\xa8\\xb24\\x9b"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\x89\\xeea`*\\xa9\\xfa\\x0c;\\xa9\\t\\xfbl\\xed\\x06\\xcf\\xf9\\xa7<\\xd3\\x1a\\xaf\\x8a\\xf1\\x12\\x8ct\\xada\\xeekvl\\xc8\\xed\\xa8\\xf0\\xbd\\x8e\\xf8r[\\xe4\\x95\\xe6\\x04\\xb3\\x02\\x90\\xe7\\xbd\\x1fq\\x92\\x85\\x97\\x07w;$.b}b.\\xfe\\xe8\\xd4wl\\xa6-\\x17\\xa3\\x91\\x85\\xfez\\x01\\x14\\x00\\xf2\\xa1vkj\\xa9zt\\x17<\tf9\\xb6i\\xd6y\\xe7\\x97\\xdc\\x9c\\xdb\\xc8\\xdb\\x07ku\\x90\\xd3\\x1d\\x80\\xf5\\xb68)\\xc69\\x15\\x8b`\\xbe\\x11\\xbb\\x16\\xffi\\xd4\\xd2\\xdf\\xe7_\\xb4\\x02\\x9d\\xe6\\xc2\\x9f]t\\xa4 ]w\\xd0\\xfb![\\xc57\\xd1\\xb0\\xa3\\xbeq\\xa9\\xe8\\xdb\\xc2\\xeab\\xc9\\xb5\\xed@?\\xba\\xbe\\xb2\\xfft,0 m\\xfd+o\\xa4xw\\x89\\x13\\x88g\\xed\\xf7{n\\x06\\xab\\xd8\\x9a\\xbd\\xaa\\x86\\x05t;9\\xd8w-g.\\x99\\x9d8\\xa6\\xa4\\xe59\\x15=\\xdbj\\x9e8\\xf0'\\x08\\xe4v.\\xf9\\x0c!\\xea\\x82]\\x13\\xc7\\xcb\\x9b|\\xd9\\x95?\\xa2\\x7f\\xbf\"\\x11\\x7f\\x0c\\x91\\x14\\xec\\xa7"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\xac\\x7f\\xe6\\xe1\\x8f\\x84\\xd2^\\xf5\\x1dc=\\xa1up\\xa4b\\x9f\\x9ax\\xa3h\\x1e\\x93\\xb2#\\xd3k\\xdb\\x0fy\\x17\\xf7\\x1dqul&\\x91cv%\\xc1\\xbff\\x12\\xd1\\x98\\xa5\\xed\\xa2\\x10\\x94\\xa4\\xa1~\\x966i\\xb2\\xe8\\x9e\\xac\\xa6\\xb8a\\xcf\\x8e~\\xdc\\x90\\x94q\\xa8\\x8d.\\xdf\\xde\\x06s/gj\\xd0\\xe7nv&5(\\x176\\x06\\xb9\\xbf\\xf9\\xd0\\xfcp\\xc5\\xb6\\x9a\\xd4\\xd3x:\\xd8\\xb9\\x1c\\xd9\\x00\\xf9\\x10\\xd8\\x1f`=\\xd5\\xe5d\\x00d)\\\\xf5};\nhwd\\x8d\\xf4\\xdb\\x117\\x17\\xb1\\x92s`\\x00\\xfe\\x8a\\xce\\xaf4\\x96\\xd8p\\xa6\\xf5\\x08\\xc4\\xc5<\\xe8\\x92\\xb1\\xe6\\xcb\\x92\\x08\\x88\\x859f*836\\x8e\\xa0~\\xb3jc\\xce|\\x84\\x8d\\xc1\\xa0\\xb4\\x8f\\x10d<s\\xad\\xdc\\xd5\\x04\\x07.|0\\x9b\\xe1\\x90\\xeb\\x05,\\xc1<:<o\\xb2\\x12\\xce\\x03\\xc5+\\xa6a\\x1e\\xee\\xc1e\\xd7\\xe5z\\xf3\\xcf\\xfb,8yar\\xb3!\\xfa\\x80\\xe7\\xd8\\x9f;*\\x12\\x9c\\x87\\xc0\\xea\\xefg\\x1e#&"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"\\xb4\\x03\\xd4\\xe9\\xed\\x91\\xe3\\xee\\x96j\\x100\\x0f4g\\xe7\\xfc\\xde\\xf6\"\\xf6\\x9c\\xe5\\x1ad3\\xbd_`\\x12\\x94\\xdf\\xdb\\x03\\xb5\\xeeo8\\x19p\\x80\\x15\\x924\\x02\\xb5p\\xe5\\x8c\\xb0\\xb5\\xc8\\xd6\\xaf\\xc7wtm\r\\xff\"\\x01\\xb5\\xaf\\x0f\\xc4\\xf7\\x8b\\xfbc\\x92\\x89\\x8e\\xad\\x1a\\xc8\\x1e\\x7f\\xce'@\\xeb\\xb8d\\xa8\\xa7\\x1d\\xf6-w\\xa6\\xce2\\xdd`0\\xfa}cz;\\x92\\x06\\x00\\xce\\xe2\\x03\\xeeo\\xe2\\x80\\x89\\xa2\\x994s_\\x8e\\xc5\\xc6#\\xe5ewh\\xd5\\x88t9!\\xef\\xde\\x96!\\xd6\\x9d\\x10\\xa0\\x87lp\\xb6\\xd9(y\\xd4\\xd653\\xe9\\xe9\\xd8\\x9b'\\x18\\xb4\ng\t\\xa1\\xcf\\x07\\x87\\x9d\\x7f\\xfd\\xe3q\\x03\\x19c\\xb2\\xde\\xd7h=\\xbe'\\xe48}\\xd4\\x8d$\\x83\\x1e?u:>\\xb3\\xf5\\x17\\x83b>\\x83\\xa0&{\\xa3-\\xc44\\x11z=\t\\x12}4\\xea#\\x87x\\xe92\\x99\\x9b6u\\x84`\\xb1z\\xe4\\x92m\\xc3\\x14r\\xa8\\x1e\\x1f\\x1c\\xd5\\x88\\xde\\xf3\\x10o\\xf3\\xb7\\xd3.\\xb1\\x13\\x08\\x85w"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcdb\\x19\\xe5\\xc7\\x82\\xc8\\xeb\\xc4\\x80\\x9b \\x0bl\\xd5\\x03\\xf7\\xa1i\\x15]\\xf0\\x19}\\xddt\\xc4l\\x80\\xc4\\xce\\x06\\xd0\\xd0\\xb9\\x1fk\\xaa)\\x8c\\xd3\\xc6\\x06\\xc1\\x9a7\\xe1g\\xdabt\\xfdg*%\\x9c&r\\xa7\\x18\\xb7\\x11\\xa4\\xed\\x94\\xd0\\x00x\\x7f\\xab\\xdd:\\x8a\\x07\\xe4q\\x89y\\xda\\xa6\\xb1\\x8d\\xa67\\xcanpz\\x05b\\xaap\\x91[o\\xf9\\x0f\\x15\\xbf\\xa0\\x03\\x89\\xf0\\xc2p\\xa6\\xcfim\\xee\\xfd%\\x89\\xf0\\xca\\xa0\\xa4n%\\x9bl_\\x17\\xa4\\xba`\\xdf\\xbb\\xaa\\xae5}'\\xeb\\xc3*\\x95a\\xbc\\xe0\\x0c\\x12#1!\\xb7\\x8a\\xbd;9\\xfc\\xfd\\xb7\\xef\\xe13t\\x89\\x16\\xd0\\xbb\\x00n\\xd4\\xe7*\\x84\\xd1y\\xc3\\xbef\\xc32\\xac\\xfc\\xc3\\xea\\xa6\\xc8\"}\\xa0\\xaa\\x91\\x00\\xdeq{\\xd2{\\x96\\xec\\x99\\xa3!\\xe2e\\x9c`\\x08\\xfb\\xc0-_{n\\xb1\\xf9z\\xff\\xf8\\x11\\xb6\\x1c#\\x8e\\x91\\x14\\x0b\\x97z\\xe3\\xa7\\xaav\\xbdm\\xbc\\xa8]\\xd0g:\\x1e\\xb7\\xc8\\x1b\\x7f\\xfa\\xea\\xfd\\xb3q\\x19cj|\\x93k\\xc6"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15\\xf9b\\x99 \\xb2j\\xab-\\xd3\\xd7x\\xea\\xc5}\\xd0\\x1bl\\x98\\xa3\\xc5e}%\\x8f\\x7f\\x9c\\xef\\x80\\x89\\xf6\\xa8\\xd8\\xcc=\\x02\\x8d\\xff<\\x1b}nag\\xb7p\\x95\\x88x\\x0b\\x88\\xf1\\xe1\\xbeq\\xa0\\x0e\\xc35\\xe2\\xde\\xc4\\xcb\\x15\\xa6\\x0c\\x88\\xed7\\x8f 6\\xc2a\"\\xfdl\t\\xc1\\xdf\\x96c\\xf1\\xb2\\x07\\xddx8\\xe1y\\xde\\xde\\xce\\xf6\\xe1uc\\xadv\\xfa\\xd2\\x12g\\x88\\x96\\x02\\xaa)\\xb9%\\xb4\\x88\\x88\\xeb\\xb3\\xbdd\\x9ef\\xaf\\x95\\x9dw^xb\\x94\\xad\\xab\\xb7\\xd3i>ph!es<\\x92\\xbc\\xd5i\\xbb \\xa3z\\xb2q\\xb2|\\xf1\\xbc\\xda\\x86*#l~\\x00\\xa8{\\xae;\\xb8y-\\xb1\\x9f\\xbe\\xf3'\\x95fp:m:\\%*0h&\\x89z:v\\x0c\\xbf\\x11w\\x1e\\xf0\\xf5\\x15j\\x80o\\x89\\xb9\\xfd{\\xa4\\xd2\\xb3m\\x89^^\\xc6\\xac\\xb5\\x12\\x98\\x83\\xc7\\xea\\xab;r7\\xde{\\x9c\\xb4}\\x95#\\xb2m?5\\xe9\\x82\\xde\\xd2\\xc4\\x98\\xc4\\xc7\"\\xe5{\\xa7\\xf3>\\xe7\\x03'\\xd1"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x92\\xdaex(\\xc4\\xde\\xfc\\xbc\\xca\\x91\\xe7\\xda\\x16<\\xc1\\x1d\\x95\\xbf\\x88\\x07\\x1a\\x14\\x8b\\x1b?\\x17\\xc3\\xa5l\\xc0\\x96\\xceb\\xa5*b\\xb0\\x0bd3\\x0euv\\xc4/\\x02\\xe6\\xcc\\xc0}\\x146\\xbf\\x97a\\xa8\\xb9\\xc7y\\x98\\xfd\\xa0\\xc5\\xeena5\\xa5{\\xf8v\\x14\\xaes\\xf3r\\xaf\\x99\\xb5u\\x1f\\x8cnc\\xb5\\xf2\\x1f(\\xe4i@z\\xf0\\x06\\xdf\t\\x15\\xb5\\x08\\xd1q\\x11\\xf6r\\xc8$\\xac\\xd8\\x8c\\x97\\xd8<h\\xd9}\\xc7\\x7f\\xea\\xc5\\x88f\\xcch\\x91`\\x1d9\\x10*\\x12\\xd8\\xf0\\xfa\\xf6\\xabn\\xfa\\xca\r'\\xb1#e\\xe1}\\xfcb\\x9dbm_\\xaf8!\\x18\\xcfy\\xa8:\\x1cj\\xb3\\xb6\\x1crn\\xf4\\xf9\\xd3#k\\xbfc\\xaf\\x13\\xc7b\\xea\\x82\\x1f@\\x8fu]r\\xe4l\\x04t\\xaed\\xdb\\xed\\xfd\\xb0n\\x94\\x87\\xba\\x94\\xc2`\\x16\\xb3\\x91)\\x8a\\xa6\\xc3\\x94\\xf0r\\x80|\\xaf\\xc4\\xb7\\x12z\\x06i\\xe4\\x94]&p<\\xb4\\x8c\\x886_\\x8d\\x00\"9~\\x85\\x122\\xb6\\x85\\xb7~r]\\x13\\xd1\\x93"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc|\\xcc`\\xff\\xfc#\\xafz\\x1f\\xd1\\x88g\\x19\\xf6\\x9fkd\\xadj\\xbd{\\xe9\\x0f\\xaa\\xa9$9\\x918\\xf2\\xdd?\\x15{\\x02f\\x13~\\xb1-\\xa0 c\\xe9y!\\x02\\xa1\\xae\\x00\\x89p\\xdb\\x1e\\x1b!jnld$\\xf21\\x92pzot!\\xc2\\xf0\\xeegh\\xd3 \\x8f\\x86\\x0f\\xc52]\\xb8@\\xf8\\xdb\\x82\\xf7\\x10\\xf3\\xf1%qe\\xd7<r+\\xcd\\xb0t\\xef\r\\xb5\\xa9\\xd6\\xc6\\x98./\\x04\\x9f\\xd2\trw\\xe2\\x90\\x11oi\\x19\\x82\\x17\\xdd\\xa8\\xbf\\xa7?yd\\xea1m\\x9f^\"\\x9a\\xe7o\\xa8\\xda\\xeb\\xae\\xb6\\x17\\xaf\\xec\\x04\\xd3\n\\xfbm1\\xebn\\x9a\\x96\\xe1\\x95\\xa2\\xf9\\xbav\\xb4ziw\\xd8\\xf1\\x1b\\xb3\\xc9\\x8b\\xa0\\xd8\\xfa\\xe4pb\"u=a\\xf6\\xfdpg\\x99|[\\x92\\x8f[7\\xdd\\x93\\xb8\\x00f=n7\\xb7\\x98\\x16\\x03tg\\xfa\\x04\\x86\\x91\\xd5\\xa3\\x9a\\xdepx<x'9| \\x90\\xfe\\x92\\x8c\\xce;3\\xabw\\x86\\x01\\xd1t\\xaf\\xe2g\\x07'\\x90!w\\xdb#u\\xab"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j8\\xae j\\xd8\\x08\\x8a\\xcf\\xfc\\xc0\\x13i\\xdb\\xc5:!x\\xd4\\xbc\\xb5\\x1a.\\xc6f\\xde^$\\xa2 \\x8a\\xb3\\xa4\\xc7]\\xbf\\xf8e\\xdd\\xe6\\xc7\\x85\\xb6.\\xb9\\xa7\\x81\\xe8zm\\xb6o\\xcd1y\\xb1^i)\\xb8_]\\xfc\\x16p\\xd5\\xf1xkj\\xf1g\\xc7\\x1c\\xa6\\xb0y\\x02\\x1c\\x163\\x19\\xe1\\xb6q\\x10m\\x10\\xde'\\xdf\\xcbl\\xe2e=\\xf2\\x05t9\\x1f$\\xdd\\xfd\\xc3\\x16\\x11\\x04\\xb6\\xdf\\xc3\\xe1\\x98\\x94\\xa9\\x18\\x00\\xa2\\x93\\x92\\x02c\\xadt\\xd2\\xda]%\\xd2ah\\xcbx\\xda\\x86\\x1c<\\xd5\\x87\\x8334\\xa4i\\x96\\x86\\x19\"v$-v0\\xae\\xd0\r\\xa2c\\xf5\\x8c\\x9c^p\\xb2i\\xf1\\x9d]p\\xec\\x85rb\\xf3\\xcdf\\x1f\\xdfc\t7qh\\x96\\xba\\xaa/\\x02\\xe6\\xa4\\x8d4>\\xc3j8\\x16\\xb9\\xef\\x00\\xc7\\x05\\xf3yn\\xf4/e\\xa7y\\xd5\\xed~\\xc7\\xado\\x10hx*\\xa2\\x13\\xb5\\xdd*a\\xf6\\xda\\xb7nb\\xcc\\xfd\\xf8p\\x1ap/\\xe2+\\x86\\xdf\\xe5\\x12\\xa3h\\x08\\x0fv\\x114"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xfdq\\xb0\\xb3\\x8c\\x1c\\xc59\\x17g\r\\xec$\\xce\\xe1\\xa3\\xd9\\xcd\\xc7\\xcb\\xa4\\xc2u<\r@]!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\nz\\xd1|\\x8b\\xc0\\xe78q\\x8b|j\\xaf\\xae%c\\xab\\x88\\xe0\\xd5\\xf1a!\\x8d\\[\\xd7d\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xdd\\x97\\xa3\\xc59\\x17k\\x99\\x0f-y\\x827\\xbb\\xee\\xe2\\xdf\\xbdtgdn\\xcbz\\x11 \\xe9\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\x99\\xdf\\xfb\\xb1\\x17\\xd3\\xe9b\\x9c0\\x85%\\xaf\\xa3\\xf8\tf\\x19a\\xef\\xc6\\x16\\x8djo\\x08\\xa0\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e_\\xac3\\xb4\\xb4\\x8c\\xbdo7\\xb6\\x1ay\\x12\\xd5\\x05\\x1b\\x84\\xca\\x08\\xe8l\\xdb\\xd8\\xae\\xdd\\xd5?\\xb05\\x0e\\xc1=gu\\xb2\\xbb\\x98\\xf8\\x0b\\x10\\xd2\\xd5\\xd4\"\\x12\\x9a5\\xb2zi\\x1a\\xac\\x8b[\\x08]\\x10,[@\\xb4%\\x95\\x03\\xa1\\x98\\xd8\\x82\\xf4d\\xeb\\x1b@\\x8cx\\x8d\\xb8drjhn\\xf8\\x18\\xc5e\\x9f\\\\x81pi\\xf8)\\xcd\\xc0\\xc8\\xb4\\x9e\\xfc\\x0c1\\xbd\\xbe\\xe1t\\x92\\xc5%\"=!cr\\x954^\\x0ek\r\\xd0i^\\xe2\\x06f;\\xdc\\x81f$\\x11\\x89n\\xc8\\xe9\\xb6\\xa4\\x1c z\n\\xb7m\\xa0\\x18\\x86\\x7f#\\x8d\\x98\\xed\\x1c1\\xa0\\x81\\xec5\ncza~\\xb3s\\xa7qm\\xf6dmjt\\xfb\\xfb\\xf4\\xde\\xb2t\\x01\\x06;f}\\x0b\\x93s\\x8e\\xb7\\xe1\\x92\\xc6\\xc9db\\x8b\\x8f\\xda\\x8d\\xca\\xd2)\\xc3\\xb4\\x11\\x9f\\x02_:\\x92\\x9b\\x88d\\xaf\\xd9`|jcmb\\x16\\xc9\\xb9\\xb8\\x80\\x9ee\\xef\\x05\\x84\\x00\\xfd\\xa0=d\\xd3\\x8c!\\x85q\\x07\\x92aj\\xeb\\xa6!hm\t"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\x9e\\x07sfu|\r\\x1e\\xa0\\xba\\xf3\\xba!t\\xdf\\xc4\\xc5\\x98\\xf3\\x1e2\\x86\\x8b\\x17\\xadg\\x0e\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xa6\\xecquq\\xcdf\\xbb\\xd1\\xa4\\x881\\xa9\\xe4?\\x1a6\\x81\\x96\\x07a\\xbb\\xad\\xe8\\xd3\\xc8b\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xab\\x10/?\\x9b\\xd7\\x1ao\\xda|1\\x9b\\xccm\\x80\\xb43\\xea\\xfb\\x13&\\x18\\x00\\xec(\\x89/y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\x16\\xfb.gil\\xf5\\x18l3jv\\xe4\\xef\\xbez\\xd2\\xb7<\\xc1\\xb3*\\xb7\\xb4=$h$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xe4\\x1bx5\\xc5\\xfd\\xaf\\xc2\\xe9\\x01\\xc1\\xa5\\x1f\\xca5\\xbc\\xbe\\x80d\\x934\\x81=\\x0e\\xde7\\x9c\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\x94+\\x11\\xe1\\xf7\\x02dp(\\xdd\\x80\\x05\\xc5\\x13\\xc9\n\\xbb\\xc3\\x86\\x9a$|\\xdb\\xe8e:\\xear\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xfa\\xff\\xe8\\xbf\\xdc\\x96\\x00&\\xdcpjx\\xbdsi]%\\xdduia\\xe1\\xd7\\x1e\\xe5\\xde\\xac\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\x04yn\\xb0\\xf1 \\xf1\\xee\\x93u\\xa9\\xde\\x9c\\xb2\\x0b\\x11@\\xb6\\x8c\\xfc]{\\xea*\\xc3\\xf1r\\xe2\\xb7\\xa8\\xd8\\x95\\x13\\xb5\\xe3z\\xe4\\x8fdmh\\x03\\xbdg\\xa9s\\xcd\\x15\\x0e6+q\\x89\\xb0{\\xa8\t\\xc9\\xca4\\xd2\\x81\\x8f7\\xe1'\\xb1\\xe97\\xbf\\xeb\\xe8\\xbd\\xc6\\xe8\\x16\r\"\\xe1\\x11\\xbcf\\xe5\\x8c\\x13\\xdd\\x95\\xf2\\x03\\x02\\x900ll(b\\xfb_\\xd0\\xc26\\x0fx6\\xec\\xed:)\\xace\\xde\\x7f\\x8dv\\x05x\\xf4|p\\x18\\xfa\\x15\\xb94\\xb6\\x90a,g\\x8c\\x98\\x87ea\\xa2\\x1fj\\xf5\\xa1o\\x07\\xdc\\x12.\\xe5\\x1et\\xae\\xd5i\\xf9l\\xeaa*\\xe3@]\\x8dnjex\\x05\\x02\\xc7\\xfc\\x97zo\\x87\\xb7\\x89^\\xafea#\\x0f6\\x1e\\x1f\\xa0\\xf4\\xbe2\\x9b\\x99e\\x94\\x1c\\xf1\\x8d\\xd7cic\\xcd\\x00\\x1c\\\\xc5\\x10\\xaf\\x8az'sa\\x0e\\x99u\\xc4\\x12\\xe68\\xb7<\\xb9\\x92f\\xaeb1*\\x05\\xa4\"\\xd5\\xc7\\x8f\\xc6\\xcba\\x82!\\x16\\x9fp\\x9e\\x91\\x9b\\x01\\x88\\xc9p\\x8c{\\xebp"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\ng\\x82\\xbb\\xe8\\x91\\xca\\xd0z:\\x1e\\xfe\\x0cf\\x14\\xd7\\xde\\xfd+\\xd7\\\\x8c\\xa3p\\x04\\xa6\\x15\\x8b\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 ^\\xab\\x9b\\x93vi\\xf3i\\xe9\\xff~\\x0f\\x85\\x1c\\x95\\xc2\\xe3z\\x04?\\xc4\\x1d_\\xc9\\xe8$s,\\xa1fz~\\x94g\\x1e\\x87\\xc6\\xb1\\xc1\\xab\\xb7\\xc5:3v\\xe6\\xdd\\x9e\\x8b\\x8f\\xdb!\\xaa\\xfd\\xb3t\\x1b,\\xaf\\xf0\\x98\\xcb:\\x9f\\x87\\xc6a\\x80\\xad(\\xd1\\x87\\x85|%\\xf8r\\x00bu\\x95\\x0f\\x1b\\x1a\\xaf\\x84q6\\x87p\\xb9\\xfc\\xbe\\xe4c@\\xcbc\\xa8\\x82\\x1c\\x8eet\\x9b\\xf2\\x08r\\xc2\\x95\\xfe\\xcc\\xa1\\x9f\\x0b\\x9cxa\\xbc\\xab\\xd4\\xd5tn\\x13\\x0e<\\x85\\xbbd\\xe5+d\\xac\\x9d\\xfb8\\x7f\t\\x9d)\\x84\\xd8\\xcde\\xdf\\x12\\xeakz\\xa1x\\xa8c)\\x9b[\\x82\\x1b${\\x84b\\xd24ii\\xfc\\xa0\\xc3\\xb7[d\\xbct\\xa0\\x80c\\xe6\\x96]\\x8d\\xdfy\\xe2\\x1bu!\\x1a`\\x04\\xd7\\xa8\\xc1\\xd3'i!\\x85\\xebov`>d\\xd5\\x02\\xfa\\xd1\\xfdo\\x98\\xfb\\xb0u\\xef\\x890i\\x04@\\xc5\\x19u\\xe42\\x8fi\\xaa\\x94\\x8b;\\x8d\\xf9\\xc8\\x9dc\\x1b\\\\xc4'\\x7f.!\\xe6\\x98)y\\x13\\x18"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe-h!.\\x03\\xc0 \\x8b\\xd9\\xce\\x8eb\\xfcv\\xc4\\xd7<\\x10r\t%\\x85\\xa7\\x95:\\xf4i&\\x85\\x01\\xe9\\x19\\x87\\xb2kp]kb4#dr\\x8c\\x1fm6$\\x02\\x91\\x03c\\x8e\\xa3\\xa5\\x9a\\x91\\x89p\\x8e\\x82\\x882\\x7f\\xdb\\xe9\\x8a\\xd6\t\\xd7\\xf3m\\x9e\\xbec@\\xaa\\xaa=\"\\xb3^\\xe0\\xe2\\x05/\\xfd\\xa8\\x8e\\xca\\xb5\\x04!\\x9fs \\x8c\\x07:\\x9a\\x8d\\x8e[\\xb1\\x1e\\xac\\x9d\\x18\\x10\\xb0\\x0bx\\x14\\x17\\x99r\\xde\\xc6\\xacb\\xf9\\xab\\x1d\\x14\\xd2\\xca=\\x05\\x08\\x06\\x9b\\xb4\\xd3)1q\\xec\\x16p\\x96\\x05\\xe8\\xfeuwu\\x9e@\\x0e\\xadws\\xd0\t\\xe3\\xf1\\xe6\\xaa\\xaba\\x99\\x86\\x1b\\x99\\x9d\\x8d\\xe9\\x9d\\x05\\xc1\\xf7\\x00|\\x93\\xc6\\xa9p\\x98\\xd5]\\x95\\x953\\xf4\\xee\\xa7\\x82\\xee\\x89\\xafmr\\xeai\\x7f\\xd03[\\x12\\x95g\\xb0\\xce`}\\x94<\\x82\\x0c\\xae\\xadg7\\xa7w\\xe0n\\xb2\\x17\\xda;\\xa3\\x89\\xd5\\x00t\\xd3q\\x8e\\x81sr\\x96\\x81\\x90\\xe5ww\\xa2\\x92\\xfbw.<y]+\\xfe\\x07\t"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc\\x9b\\xa1\\xce\\xc4@\\xf7t\\x08^1;u\\xa80\\x16\\x0f\\x8c\\xe6\\x0f\\xbfo\\xac\\x8d7vo\\xf4\\x08r\\xb3\\x1b'j$\\x00w\\xe2\\xd5\\x8fs\\x87\"\\xfa\\xbe\\x96\\xc1z\\x1bj\\xde{\\xc6\\xba\\xab4u\\x16qf\\x01\\xde\\x9fq\\x85\\x80\\xa7=\\xab\\xab5\\x8fl\\xcb\\xb5\n\\xe4\\xe8\\x1fji\\x0f&\\xaby+l\\xe2#\\xe3\"\\xbe\\x13\\xf9\\xdftt\\x84\\x08\\x90#\\xa1\\x01\\xc6j\\xffot\\x8d\\xe0\\xe6\\xb8\\xb2\\x9b\\xdb\\x82\r\\xe0iu \\xba3vuc)7cm{ct\\x0b\\xccl\\xc3\\xc6^-.\\xf6\\x81.\\x15\\xde~\\x98\\xa0\\xa6\\xda6}\\x08[\\xbb\r\\x8f\\xc2\\xe7\\x9b\\x80\\xe4ph\\xe8jg\\x04z\\x07*mx\\xe8?\\xe5\\xe6\\xe2n\\x9b\\xfb[\\xb6+5\\xd4\\xe5\\xd3\\x14&n\\xff\\xee\\xc2m\\xf10x\\xcb\\xb9\\xcb\n\\xf9=\\x04\\x97\\x8an\\x80\\xfdo\\x80\\x81f\\xa8\t\\xaa\\xae\\xf5\\x13\\xc1izp\\x8b&e\\xcd\r\\x17.z\\x18%\\xcc\\x1d\\xcd\\x9c\\xc4ds}\\xa2\\xa9\r\\xd8\\xaa\\x19\\xeb\\xff"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xff]\\xd3\\xff\\x9b#\\xd1\\xfb\\xe0\\x08q\\x07\\xef\\xa0s\\xa7n\\xca\\xe0\\x901?\\x8d\n\\xd7\\x9c\\x0f\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\nq\\xea\\xf7l\\x08\\xc7\\xd1\\xc9\\xb4\\xcd)ilw\\x07~\\x18\\x8d\\xb31\\x97\\x00\\x8d?\\xf1\\x1a\\xbei\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\n\\xdd\\xc5@l\\xcah\\xc2\\xd5b\\xe5\\x1c\\xfa\\x01\\xc3\\xf1\\xe7{5\\xed\tuog~\\x18\\xeb)\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010}j\\x889\\xf9`\\xe3\\xd6c\\xe5\\x1cn\\x8d\\xd3\\x91\\xbf\\x12\\xb7\\xb0k\\xe6 *\\xe6\\xda\\x0b\r\\x9c,\\xe5\\x87\\xb0g\\x87\\xa3\\xdf#\\xcb~\\xe8\\xec\\x15\\x17?\\x05\\xa7\\x8e\\xc1j\\xb5\\x1b\\xeaf\\x18\\xdb\\xce\\xe6\\x15i\\xfa:p\\x07\\xb7\\xe7\\xd0\\x87&\\x9c\\x82:v\\xa3\\xe6vn(v\\xd1\\xad\\xdb\\x87\\x9d3u^x\\xec\\xb4fu<c\\xd7tc\\xe7[\\x15\\xe7is\\x1d\\xa1:\\x88\\x13^\\x1b\\xd2\\x94\\xa6\\xa6\\x92\\x06\\x9d\\xbc\\x02\\xd69s~#_\\xc4q*\\xccj`!#&e\\x85\\xc6\\xe4n\\xd3\\xd3i\\xb5\\xdc\\xfc\\xd0\\xe7\\x8ct\\xc6\\xcf\\x8c\\x9f7;\\xfah\\x7fn!\\x9d\\x8b\\x17\\x1c\\xf2\\x0e[\\xa8\\xc2\\xdb\\x89*_\\x89\\xd4tp\n1y<}\\xa9\\xc2\\xda\\x1fwb\\x12\\x98gw5\\x7f\\x88\\x83\\xbf\\xdb\\x9de\\x02-\\xef\\xf602\\x1d\\x07v*\\xdcbl\\xe5)\\xbe\"\\x1a\\xf7\\x89\\x04\\xd7\\xbe\\xa9\\xec\\x91\\x8b\\xeck\\xa0\\xec\\x0f!\\xbad\\x8bh\\x13o\\xce\\{\\x9a\\x8fh4\\xbecs\\xa0ga"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9w\\xdd\\x8a\\x00\\x04h\\x90\\xf88\\xe9q,\\xc6\\xf4==]n\\xb1/s\\x03\\x1ay\\x8a\\xe08!*\\x19\\x12@p\\xff\\x02\\xa0\\xd8\\xb9\\xc6\\xe0_s\\x13\\xb8^\\x8d\\x8bi\\x96s\\xde\\x896cs3\\x94\\xf9\\x86kw)\\xa8\\x024\\xf0#\\xe6\\xcb\\xf2\\x01\\x15\\x9d\\x91\\x93)\\x15\\xb3f\\x1d\\x02\r\\x04k/\\xb4\\xa6+\\xbdon\\x04\\xd8\\xca_`jy\\x8au\\xae\\xe5vz4\\xd0\\x80>\\x80gt\\xee\\x8cw\\xe1\\xecy1\\x80]\\x04\\x1bb\\xad\\x88\\\\x06\\x99\\xe3\\x1e3<+\\x12\\xe9f\\x17#w\\xa9\\xddg\\x8eu;z\\xe3\\xcc\\x9d\\xcff\\xbd}\\xd38\\xf3\\xfdpr\\x85\\x0e\\xc5\\x08\\x0e\\xa7\\xf6\\xdd\\xd5\\xc9\\x15a\\x18\\xce\\x8b\\x8a\\x89'\\xf1\\x16\\x88\\xf7\\xdd\\x82\\xe48\\x8eq`\\xba\\x1f\\xe2\\xb31\\xd7\\xcc\\x99o \\x04\\xb5_\\xbb\\xea\\xad\\xc1m\\xe3\\x84\\x8d<q\\xef>\\x04\\xa6\\xa6\\xaf4mq\\xd5i\\xa5>\\x85w\\xf3m\\x89\\x9dyg-\\xd1\\x98\\x9d\\xac\\xb9\\xdf\\xb0\\xad\\xdbu\\x99`\\xfej\\x0c\rl"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vz*\\xaa\\xa5t\\x9fz9~\\x95|}\\xe6\\xe3\\xb372\\xc0\\xdcl\\xa9\\xf7t\\xddhw)\\x07r\\x9b\\xf0e\\xd1\\x10\\x07\\xef5(\\xd0\\x9c\\x8b\\xe6q\\xdc\\xed\\xb1sqwi;z~\\xed\\x88\\xea[\\xe89\\xa0\\xb7'>\\xc2\\x82f\\xddu\\x1a\\x00\\x8d\\x00\\xfan\\x13/5km%\\xbb\\xa5z\\xcf\\x92\\x1as\\xc2\\xbd\\x12w\\xcbq|/di\\xd7\\x9c\\xe8\"\\x18\n,\\xcd\\xcc\\xaa\\x1e\\xdf^h\\xcf\\x8c\\xbc\\xa5\\x8e\\x06\\x1b\\xe5\\xefn\\xab\\xc4q\\x9a\\x86\\xbd\\xeb\\xb1\\xa0`\\x15j\r=r\\xd2)\\x01\\xaa\\xb3\\x97\\xcb302\\x13k\\xec\\xcb#z\\xdax\\xdb\\xf7\\xea(\\x15fa\\xe4\\xa3\\xd3\\xcawx\\xe2\\xba\\x8b\\xa7\\xadaxm\\xb1\\xad\\xdb\\xf6\\x8c\\x01\\x0eg7\\x96\\xc8\\x0b\\xd1\\xcd09\\x01\\xda\\xbb@\\x1fc\\xddv\\x8f\\x9f\\xc7-o\\xb9\\xba\\xda\\xe8b\\xa7s\\xf4\\x90\\xa9\\xb9\\xef\\x1e/\\x00\\x00u\\xc0 l\\x10\\xf0(\\x99\\xbf\\x18z\\x8f4\\xad1\\xac\\xa0\n\\xe0w\\x1c|t(/\\x97+\\xf5\"x"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ha\\xbd\\x8e\\xf3bi\\xef\\xbb\\xef\\x03_\\xf2\\xfd\\xf84\\xc4\\x89\\xc3\\xc6\\x1a9z\\xf7o\\xff+@2t\\xed\\xd8\\x93\\x99p\\xbe6}\\xf8(\\x02\\xf0[@\\x9b)\\xa4\\xc1\\x80d\\xf4\\xa6\\x10\\xff\\x9d\\xd3\\x0e6\\xc2\\xa3m\\x82\\xb8?\\xd9\\x08\\xbav\\x87\\x03\\xd1\\x8f\\xd1\\xf2pux\\xfd\\xbb\\xd4\\x9a|\\x88\\x90\\xb6\\x0f\\xf1\\xeeu(\\x8d\\xc4\\x86t\\xe1\\x95\\x87\\x11?\\x8b}\\xb6\\xef\\xe2a\\xff{\\x900+\\xd2f\\xf3\\xe8\\xb3\\xee\\xe7\"\\xfdt*\\x00\\xb6\\x01\\x01\\xdc\\x1ct\\x15|\\xa3k8\\xdcg\\xce\\x14\\xb08\\x94\\xdb\\xc7p\\x151d\\xd5\\x1d\\xf7\\xb3\\xcd\\xf3\\x97\\xa7\\x8e\\xc30\\xd8i\\x9d\\xb9\\*\\xaa\\xab \\x90\\xea\\x17@\\xa0o\\xca\\xb4\\x0f\\x07\\x93\"sk\\x99\\x92l\\xa4\\x1d\\x14\\xdd,\\x024<\\x91\\xc9s&m\\x90\\xa2]3\\x99^\\xa5\\xf4\\x83>\\x16?x\\x7f\\xae\\xd4+\\xf2\"\\x00b\\x0e\\xa2\\xfb\\xee\\x14\\xf3\\xab\\x9d\\xdc9z\\x8ce}\\xaa\\xc8x\\xe4\\xd7\\xe0\\xee,.\\xc4\\x98|\"\\xea\\xfad\\~u\\x07"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12\\x1c\\x94\\x14\\xd5b\\x83\\x16\\xd3\\x8b*h\\x1a#\\xbb\\xa0\\xf7\\xb6\\xf2u!w\\xd6\\x0b\\xb2d\\xd0\\xdfo\\x99\\x98'7\\xf7\\xf3\\xf7~4 \\x87q\\xc1\\x96\\xe8[33\\x06z\\x15!s`\\xbb\\x15\\xb2\\x19\\xb4\\xd8\\xc9\\xb9\\xb02_\"\\xc6\\xf8\\x1b<\\x13\\xf3\\xa02\\xa2\\x81(d\\x0f\\xcal\\x86\\x8e\\x1ap\\xad]\\x88]\\x92\\x83o\\xd4\\xb32^i \\x19\\x0fm,\\xc5\\xc9\\xbb\\xd8\\xcbw'\\xb6\\x19\\x13\\xa8\\x91\\x1a\\x14\\x8a\\xac\\xde*\\xf2\\x80\\x1ep\\xa4\\xed\\x10s\\xf4g\\x96jqb\\x9f\\x8f\\xa4\\x826\\xc6y\\xf0\n\\xedr\\xd1\t\\xcb\\xb0\\xbc7\\x7f_\\xee\\xce\\x8f\\x95\\xc8\\xc1,\\xf6\\x84[2lq\\x17e!\\x12o\\xfc]\\xd7k \\xad\\x82\\x9b\\xad\\xca\\xc1\\xb9\\x88r\\x00\\xad\\x9d\\xe9\\x90\\xd5\\x8aov~\\xa1\\xc8\\x8a\\x12 b)\\x80\\xd8\\x90a!\\x8a\\xa0v.\\x91\\xf8@=u\\x8b\\x8e-\\x8e\\xaf\\x0b\\xb7\\xbbapxc;\\xaa\\xf8<\\xd8x\\xbb}tj\\xf8~o\\xec\\x03\\xd2\\x00\\x07\\x1e\t\\x9al`n"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=\\\\x8b\\xbf\\x99\\xc1\\xcb\\x0ck\\xa9\\xf1\\x9ap>\\x0b\\xb1\\xcf\\xdbv\\xf1\\xbc\\xc0:\\xfc6\\xdcc`\\x1e\\xd6\\xed\\x0c\\xf4p#\\x7f\\xb7\\x83|\\xa6\\xcc\\x97\\xe2\\xd2\\xd2\\xce\\xb8\\x9e\\xc3\\xca\\xd6\\x81\\xb4\\x07-\\x90\\xac\\xcc\\xc5\\x1b}\\xa6\\xcd(\\xf9\\xa7\\x18\\x1c\\x0c\\x1a\\xa85\\xf4\\xfc!\\x86\\x11\\x12\\x05\\xb6\\xf8\\x80i\\xce\\x0e\\xaeg\\x88\\xc7iw\\x1b\\xf9f\\xca\\xf1+\\xf6$\\xdch\\xd7~\\xbfs\\\\x03\\x06g\\xad\\x1a\\xbc\\x19\\xb5\\x1f\\x7f\\x9b\\xb79\\x83\\xe3\\xe1\\xd8\\xc7\\xd7\\x08l\\xee\\xcb\\x98)j\\xf6s\\xfe\\xd5\\xcb#\\xd7\\x1c\\xc9+pg[r\\xb4\\xf9\\xe0c\\xaf\\xc5\\x96\\x1cz\\xf3\\xec\\x95\\xdfhv\\xce\\x1a\\x83yp\\x04w\\xbe\\xba\\xf8\\xcb\\xd0\\x8e\\xc3\\xa4^\\x9e\\xa8d\\xe3f\\xc8d\\xca\\x9d\\x1f\\xbb\\xe0\\x87\\xbf\\x853\\x9b\\x9d\\x97\\xaa5\\xab\\xcc)d\\x91\\xd6\\x7f\\xf4\\xa1\\xbb<\\x8fgt\\xf3\\x140\\xfc3:\\x1f\\xf2\\xb5\\xba\\x87s\\xadd\\x0ea\\xd2\\xe5 osv\\xb1fwjv\\xa7r\\xb3\\x82\\x9d\r!\\xcf\\xd6<l\\xd7"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ib\\xed\\xdd\\xa2\\x13\\x83\\x8f:g\\xec\\x86,\\xe5\\x15\\xb6n)\\xdb\\xeb\\xb2\\xd1^_\\xa9\\x0c\\xaa\\xad\\x10\\x95\\x0c\\xb3}\\xdb\\xa9\\xf4$b\\x1c\\xdc\\x07\\xe1y\\xfb^^\\xfdu\\xd39\\xde\\x93$9\\x15\\xe7\\x84\\xb9\\x83\\x1f{\n\\xf3\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\x1a\\x01\\x9e\\x1c\\xdf\\xec\\xac\\xe5\\x14\\x9e\\xa1jc\\x07}z\\x0e\\x00\\xa3\\x17ul\\xabr&\\xa2-\\x84]n\\x995\\x9e\\x1f/*a\\x03\\xcf\\xc5\\x97\\xd0\\x1brp2\\x81"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\x14\\x16\\xeb\\xc2a\\x96\\x86l\\x8cj\\x80\\xf4\\xb6\\xaa\\xbe\\xa7m\\x81\\xbd%f\\x1b\\xa1.\\xa9\\xad63\\xd0\\xbd1\\xdf5\\xa8qxw\\x85qwvr\\xc7t\\xc1\\x9d\\xaf/\\x9b\\x82\\xea\\xe9\\xc2\\xf2\\xe7\\xc5$ep\\x07\\xf9p\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xa5(\\x86\\xaa\\xc3\r?c\\xce\\xeb\\x91s0\\xb2\\xa7\\x93\\x0c\\x15\\xef\\x81*\\xab=0\\xdf\\xe0:\\x7f\\xd4\\xc7\n\\xfd*\\x06\\x020\\xaf\\xe6\\xbd\\xe9q\\x01&\\xea0\\x96\\xb9"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1aw\\x14\\x01\\xbf-\\xd8\\x1b\\xd4[}\\x9e\\xe8\\xaf\\xaf\\xef0\\xa6\\xdb\\x16r\\xfaq\\xe4n\\x8e\\x8d\\xeb\\xa3-\\x17\\x0c\\xb7\\x11\\xc2\\xd8\\xfd\\xbd\\x03u\\x90\\xce3\\xd5\\xa3\\xb5\\x9e\\x1e\\xad|\\x10/{\\x86#|\\x8b\\x97ft\\xe0\\xa7\\xc1 \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000]\\xbd\\xe5\\x05k_\\xa9\\xc9q\\xa0\\xbf\\xbb\r\\xc3\\x92\\xc4\\xcbd\\xc4\\x03\\xec\\xa7\\x9a\\xc4\\x94\\xe1\\xdd\\xa3\\x80=\\xdf\\x005\\x8d\\x93?5\\xbecf\\xfa\\xb1\\xdb\\xb5v\\x0cw\\xca"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f~\\xd0y|\\x11\\xfb\\xb8f\\xf6\\xbc[~l\\xd1\\xb3u\\xd4oa\\xd9\\xce\\xab\\xfe\\xe3\\xdf\\x95/>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f\\x9f\\xca\\xad\\xa5\\xce&i\\xd3}h\\x02\\x1a\\xf5@\\x94;\\xa8\\xcen>\\x91\\x99\\xa2\\xc3\\\"\\x86\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\xff%5\\xb25\\x05\\xd6zu\\xba\\xf2\\x14\\x02i\\xb6\\xfd\\xc3\\x08\"\\x14\\x8d\\xdbe\\xab\\x87-\\x7f\\x9c\\x87\\x0b\\xa6\\xbf\\xb9\\xd0\\xe3\\xe9\\xd1x\\\\x19\\xe6b\\x11~\\xa2\\x039yl\\x8c$\\xcf\\xba\\xf4w\\xde\\x88`\\x8c\\x10\\xa5o\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\x1akbv|\\xb4\\xabq\\xd9\\x07\\xf0\\x19%\\x03\\xdf\\xeb\\x9fu\\xa3\\x13\\x87\\x86\"\\x8a1\\x93\\xba@\\xcat\\xc4\\x9f\\xc2\\xc7\\xca?:\\xf9\\xc2k:\\xcebs\\x95f\\xa6"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f\\x97r\\xba\\x9f\\x042-\\xbdb\\x02g\\xfc\\xd5\\xacy\\xe6p%!\\xfd\\x04\\xf1zwr\\xdadf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f\\x1e\\x92\\xd8\\x98\\xc5\\x86\\xe7\\x9f|\\x17-;\\x90%a\\xcci\\xbc`\\xc8_6\\xff\\x89\\xd7<\\xdb\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1fg@w\\x94t\\xc22\\x9aqzie\\xa7\\x9e\\x05\\x8cw\\x14\\xf6\\xf4a\\xc88\\x0b\\xd3\\xcck\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f\\x052|\\xe3\\xe3&kc\\xe7~\\x835\\xbas\\xbc7ad\\xa5h!p\\xbaw\\x04\\xa8.\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8\\xcd\\x9b@\\x8d\\x10\\xd7\\xac\\x118\\x03\\xa8\\xd0z\\xa1*[|mi\\xcc\\xdc\\xe1\\x08;\\x86.\\xb7\\x1bih'\\xfc\\x06\\x076\\xbf\\x00w\\xc4\\x8em\\xaa\\xe4\\x06\\x05\\xfd\\xb0\\x7fc\\x1b+\\x01\\x87\\xae(\\xee\\xb4\\xcf\\xe1\\x8cb\\x9br\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\x10_]\\x0e\\x9f\\x90\\x8b\\x84\\x82:\\xcf\\x9d\\x1bp\\xbb\\\\x96qc\\xf9\\xbb\\xe4\\x17\\x04\\xfb0[\\x8c\\xabjf\\xec\\x88\\xc5\\x95fe\\x05\\x0c\\x83vi\\xb6\na\\xfbg"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\\x14\\xdc\\xecj\\xe3\\x1e5\\x84\\x002\\xc1\\xe6[\\x06\\x95\\xac\\xe8\\x0bjo\\xdd\\x0c3i~\\x06\t\\x15@\\xf2\\xb3q\\xdafqw\\xfa-\\xb7\\x1a\\xc9kf\\x918\\xbfp\\x1c\\xe1\\x19\\xb2p\\xf0\\x15:r{\\x7f\\xd8w\\x85r\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\xdd\\xfa\\xb9\\x92j\\xd4i\\xe9\\xa2\\xa9\\xaem\\xf7\\xc4\\xa2\\x0b\\x9c<e\\xb2\\x18\\xccw9\n\\x16+\\xb8\\xaa\\xbcp\\xe7\"\\xf28\\xa4\\xf7\\2se^\\xef/\\xcex="
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07\\x9e'\\xf4\\xbb\\xcac\\xa4\\xd0\\xd2\\xd2\\x13\\x8c#\\xf4\\x1f\\xb7$?sm\\xc2=\\x8b\\x12\\x90>\\x7fi\\xca\\xf8\\x0e;b\\xd7\\x9dv\\x90\\xe5\\xdf \\xc7\\xa6\\xfer\\xa7\\xbb\\x17\\x8c\\x9a$\\xebe\\xfa\\x974\\xe1\\xdf;\\xf8\\xd1\\x9b\\x19'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\xa2o-\\xf1\\xcf\\x1a\\xbe\\xec\\xc1\\xd1\\xdb\\xdf\\xf0\\xb6\\x88n\\xbf\\xcb\\xf4\\x0b\\xef9o:\\xb0g\\x92\\x1b\\xc6p+!\\xbd\\xa0\\xa8q\\xee\\x18\\xbe\\x9b\\xff\\xca\\xb5\\xb0\\xb9\\xbaz"
  579. },
  580. {
  581. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xd5\\xb9/x\\xd9\\xffy\\xc4\\xf6\\x0b\\xbcx5\\x1a\\x8exc\\x8e\\x10n\\x8f\\xce\\x85\\x02\\xcf;{{\\xb9'\\xfcf\\x19\\xcc\\xbf/>\\xd6k\\xf3\\xd1\\x125\\xce$%x\\xcao*\\x99j0\\x16i\\x86\\x0b^b\\xea\\x11im\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\x19/c\\xdb\\xd3\\xe9k\na\\xc5?f%\\xee<t`\\x82\\xad\\xbf\\xd0&-\\xfb\\xf2\\xd3\\x03l\\x98l\\x07\\x16\\xc3*\\x000e|c(\\x81\\x1f\\x10\\x91]\\xeb\\xa5"
  582. },
  583. {
  584. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04hj%\\xb3\\x04\\x99\\xfel\\xc2\\x00\\x1c\\xff\\xaf\\xfeq\\xb5\\x94]\\x94\\xbf\\xf9\\xb6b\\x12\\xde\\xceoc\\x00\\xb2\\xa2\\xc4\\xad\\x1e\\x0ekg\\xba$\\xc0\\x1f\\x94h\\x02y\\xd5\\xb8\\xed\\x1a\\xf2r\\xdc\\x94.\\xaf\\x8d\\x12\\xa7\\xf9\\xe3\\xf4\\xbb(\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xee y\\x9c9`\\xd4\\xf7y\\x83\\x19v6l\\x10\\x08\\x90\\xfa\\xe1n\r\\xa5\\xe2e\\xa0w\\x1b\\x16\\xf1tgp\\xfdx\\x0fk\\x89\\xe4\\xdcu\\xe6\\\\xe1?\\x17\\x01\\xb6"
  585. },
  586. {
  587. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xae\\xb6\\xe3\\xd7\\x88\\xc3s\\x8d\\xb4\\xad\\xc6\\xb9\\x8c]1\\xa0\\x02\\xe8\\x93og\\xfa0\\xd7\\x01\\x8f\\xc5\\xea+j\\xc1\\xe3z\\xe9\\xc5\\x1f\\xa2\\x1dn[\\x84\\xef9\\x03s.\\xc5\\xc5\\xe0v\\x1d<n\\x87\r\\x16b\\x16\\xf3il\\xa4\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\x9dy\\xbf\\xbd\\x04m\\x88\\xfa\\x07\\xa6\\\\xcb-+\\x90q\\xf6\\x11\\xe9\\x96\\x18}\\xcby]\\xf5\\x86p\\x16\\xed\\x10\\xde)\\x1f\\x00\\xf1\\xf0\\xabb\\x14*mp7\\x14\r&"
  588. },
  589. {
  590. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\x07\\x91\\xf7\\x96\\xfe\\x0b\\xaas\\xff\\x9a\\xa8\\xd5b!\\xfau~\\x8f\\xad\\xc5\\xa3\\xaf\\x89\\xd4\\xbd\n\\x00 \\xff])\\x99\\x81z\\x81\\xa9\\xdb*\\x91o~v\\xd0\\xdf\\xbc#\\xec]\\xb3e\\xe4\\x98\\xe9\\xcd\\x9c\\xa0}\\x88\\xee\\x06~\\xe4\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000vm\\xd0\\xe6\\xf1\\xf65\\x11|\\x12\\xa7\\x97\\x87\\x17\\xaba\\xa9\\x0b\\x97\\x00\\xf7\\x82u%\\x96\\xb2\\x03't\\xb5\\xfb\\x97mdpx\\x97r\\xbe\\xb3{\\x9f}\\x9e\\x90\\x03$x"
  591. },
  592. {
  593. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xf9\\xdf\\xbd\\xc7b\\xb9\\x9c\\xd5\\x1a\\xf4\\xf6k\\xa3\\xaf__l\\x8d49\\x997\\x07\\xbb\\xa6\\xf0\\xc5\\xf3fp\"h\\xc1v\\xcc\\x1c`\\xbdgt\\xb7\\\\x87\\xc3\\x99\\x1a2\\x9f2h>\\xa6\\xce\\xed\\x15}\\xf9e\\xc2\\xbe\\xbf\\x95\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d8+\\xc3\\xa3i\\x9dcm:s\\xc163\\xd40k\\xed\\xfb\\xc9\\xf7\\xba\\xab\\xc1.\\xbd\\xac\\xa3\\x89\\x82\\xdao\\x9e\\x845\\xcdxi~\\x0e\\xf9o?\\x82\\x1d\\xa4\\xab2"
  594. },
  595. {
  596. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\"\\xc6%\\xe6\\xd6c\\xa8\\x87\rt\\x81i\\xb2\n}\\x8d\\xf0\\xe5\\xd2\\x1d\\x10qlc{\\x9ft\\xc6\\xf4l\\x1b\\xa6\\xe2\\x94\\x08sx+\\xa4a\\xd6iv\\x93\\xfar\"pn\\xce~\\x1d\\/\\xd4r\\xf5\\x91>\\xab\\x15/9\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\xc1\\xf7l\\xcf\\x18y\\xc49h\\x9bl`:@\\x19\\x84\\x94q\\x06\\xe4e\\x9a\\x97\\xbd)\\xddwg\\xa2w17\\xc4\\xe0\\xce\\x8b\\xb1\"i\\x83o1\\xdae\\xcc(\\xc3"
  597. },
  598. {
  599. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1f;\\xf2\\xce\\xeb~x}\\x04}\\x10\\xc0\\xa5\\x0cl\\xa1 \\x10yg}\\xc9\\x872\\x91\\xf9@s^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  600. },
  601. {
  602. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7e _\\xcb\\xeb]\\xa0\\xab&u\\xb5l.b\\x84\\x1e\\xcc\\x97a\\x01.\\x8d+k\\x92xce\\x16eo\\xb4\\xf0_^\\x1c\\xd3\\x9eh\\x88\\x19\\x80\\xb5s\\xb2fv\\xe0\\x8c9\rm\\xae@v*f#\\x96.\\xec\\xf0\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\xe6i\\x05ar\\xe0m\\xf7i\rb\\x83\\x9a\\x16y}~\\x8f\\xec\\x0b\\xc6\\x8e\\x08\\xdb\\x90\\\\x8c\\xa3\\x96\\xd1\\x14d\\xa4\\xecu\\xfffqc\\xc6\\xa47\\xfa#o\\xc1\\xc9"
  603. },
  604. {
  605. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'-n\\x1c\\x08\\x05x'\\x8b\\xf3\\x03\\xc8d.\\xea\\xc7\\\\xe0\\xc5\\xf6\\x9b\\x80u1\\x86\\xa8\\xa6ic\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  606. },
  607. {
  608. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88\\x1fkm\\x8b\\x86\\xe5\\xb6u\\xdd\\x02\\x87\\x89\\x0b\\xa4\\x18\\xa5\\x90\\xbfr\r\\x90\\x84\\x0f\\xc3\\xe7\\x99\\xf6j\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  609. },
  610. {
  611. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'\\x07\\xf4\\xd4\\x96\\x924o\\xdd\\x90\\xe3\\xca\\xce\\xab\\xbb\t\\xe6\\xd3n\\x9b\\xbd\\x1d\\xbc\\xe5\\xf60\\x92\\xdd\\xb2\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  612. },
  613. {
  614. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\x8cf3xz\\xcan\\xb2\\x08qt\\xba\\x82@\\x1f\\xa2\\xd9k9\\xa1w\\xdc\\xa7&\\xd4(\\xe0f\\xc1qe\\xd9\\xdaa\\xb9\\xfd\\xe2\\x9e\\x8d\\xb7\\xb0+w\\x89sye\\x02]\\xf8935\\xa1\\xb5\\xa3!\\xa7\\xeab\\x1a\\x98\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\xc9\\xdb\\xce\\xf8m\\x8c\\xf7*\\xac\\xb7d\\x97&!2\\xc25\\xe27\\x9a'\\xd1\\x7f\\xacw\\x9eq\\xa5\\xdcf\\xdc\\xddz\\xdbj\\xa7\\xc6\\x1b\\xf6%\\xdbc\\x9e\\xdc\\x8f:\\x1e"
  615. },
  616. {
  617. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\x98\\x86h\\x87\\x13\\xf0\\xf3v\\xf8\\xf1\\xdcf\\xcd\\xea\\xaa\\xce\\x13\\xdf\\xea\\xb2tug\\xa2\\xe0\\x8dos\\x19/}\\xb3\\x06\\x06%h\\xf5\\x1b\\xc1\\xad\\x8a\\x98c\\x1e\\x9bx\\xe3\\x9fkd\\xb3\\xcf \\x1c\\xbd\\xae\\x04\\xa7\\xe9\\xb8'\\xb6z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85\\xed\\xdf\\xd9\\x82h\\xdd\\xe9\\x10i\\x11\\x90r\\xa4v\\xc8\\xfd\\x0c\\x9d\\xbbh\\xbd~\\xde2al\\xa5\\xbbhl\\xeb\\xc5\\xa8\\xe7 n\\x91\\xe5\\x9by\\xfen\\x9ax\\x8fq|"
  618. },
  619. {
  620. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xe8\\xee\\x8a=\\xf7+$\\xe8d\\x0en\\x11t\\xae\\xda\\xb6\\x9cy\\x1d\\xec\\xbe\\xab\\x17\\x90\\xbd\\xe3\\xf6j\\x1f\\xa7\\xe1\\xc3u<_\\x83\\xceg\\xb3\\xad6\\x95}\\xa5\\xf9\\xe7\\x9e3{\\x08\\xae\\xcb\\xd5\\xfb{\\x03:\\x834\\x9d\\xabe\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\x1d]\\xa8\\xf0\\x00\\xd6\\xe3\\xc6\\xe0vf\\x1bv8\\xec\\xb5fm\\xb9\\x19\\xee\\x8fk\\xeb\\xa0\\xa2g\\x15\\x80\\xa9w\\x1f\\xc3yyh#\\xed\\xb3\\x17\\x84\\x8c\\xe0\\x90\\xbc[d"
  621. },
  622. {
  623. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!h\t\\x9ei\\x03\\xed\\x8f\\x00f?\\xb4\\xe4j\\xb3\\x05\\x88k\\xdbf\\xfd']+\\xc2\\x9d\\xd2h-6\\xdf\\xa4\\xdef\\xa9yo\\xb1\\x1b\\xf00\\xebh\\xf3js[\\x08im\\x95\\xb9ym\\x03l\n\\xb2~\\xda\\xb5z\\xc0\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\t\\xcb\\x9f\\x08\t\\x90\\xe2)\\xa4z\\xe7tc\\x86'f\\xee\\x9a\\xb8\\x10(\\xa8\\xcf\\xe2\\xb8\\x98\\xbd\\x90\\x89(\\xe2\\x8a\\x9a\\x06x\\xf3\\xe1\\xb5`5t\\xd2\\xf3\\xd4w%\\x94"
  624. },
  625. {
  626. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04%\\xb9mhw\\x93r\\xab\\xeey\\xc7\\xf1\\xd7\\x10_\\xce\\xdclkk\\xdfj[\\x16`\\xc6\\xc0f\\x8ay\\xef\\xe5\\x9b\\xc2\\xb4y\\xaa\t\\xd2}m\\xee\\xfe\\xbf\\x87o\r\\xf0\\x98`>\n\\xb0\\x96\\xa6\"1t\\xcf\\xadw\\x15\\xa6\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\x1b*+\\xe7x=k\\xa5z>2+gw\\xd77\\x000\\xfb3\\xc5\tf\\xd1'\\xca\\x19\\xb9(\\x9f\\x02\\xf0\\xdc}\\xf4l\\x8e\\xb8x\\x17\\xc9@29\\xfe\\xf5\\xd7"
  627. },
  628. {
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'\\xe3\\x1e]\\xa8gi\\xd5\\xda(\\xb1o\\xe6\\xc0*\\xe7\\xfe\\x17\\xe4m\\x86\\xe5\\xfd\\xdas\\xcf\\xa4wj\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  630. },
  631. {
  632. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\x88'\\xce(\\xddrt[+3%\\xa7\\x94\\x9d\\xceb\\xb5\\x9d\\xde\\|\\xf3~\\xb4.9j\\xde\\xd4\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  633. },
  634. {
  635. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'\\xbe\\xce0\\xbd\\x05\\xfd\\xe8d\\xd2\\xd6\\xb0\\xd1\\xcf\\x1c8\\x7f\\x98\trn\\xfd\\x9a\\xa5\\x8b4\\xf3o\\xe1\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  636. },
  637. {
  638. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'kq\\xb7\\xe4\\xe1q\\xb9\\xec\\x12v\\xb0\\xcb\\x1a\\xe3(\\x98\\xa1\\xb4y\\xa1\\x14\\xdbk7\\xa4\\x18\\xd4q\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  639. },
  640. {
  641. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1}\\x0f\\x95}\\x80q\\xd1\\x0e\\xad\\xe9\\xc2j\\x14\r-\\xa5n\\xddz\\xf7d\\x98\\x1a\\xa5\\xfb\\xbaa\\xe2e\\xc7\\xc9j\\xb2?\\x1a\\x17\\x8f\\xb1\\x19\\xdeb\\x06\\x98p|\\xccv<\\xae\\x14.\\xdc\\x80\\xea+\\xe8\\x94[*\\xa6\\xac#q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5t\\xb7\\xda\\x98\\x8d\\xda\\xe1r\t\\xb9\\xdf\\xef\\xb3\\xadu\\x10\\x05b\\xb4\\xd3|\\xffq0\\x96\\xf3/\\x06m\\x0bk\\xfa:t\\xf4x3\\xd0\"\\x1cd\\xe6 zx\nb"
  642. },
  643. {
  644. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\xa9\\x82\\xc7\\xc96[d\\xa8l\\xd6&=\\x90\\xe3\\xc8#\\xafwlo\\xc2\\xec\\x10{\\xba\\xcbo\\xd2\\x13\\xb0~\\xca\\xf5\\xc8\\xd3\\x80\r\\x07\\x92\\xff\\xbd\\x8f\\xd5\\x8bqei\\xe4\\xc4\\xb2\\x91\\xa9\\xdd$c\\x18\\xe8\\x07\\xb6\\xc7\\x85\\xda\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\x06b|'\\xfb\\x15\\xba\\x07*\\xef\\xfa;\\xa8\\xd5h\\x14\\x80|\\x00\\xd2q\\x1a\\xf4 {d\\xecpdb\\xe5%s\\xa0\\xde4ow\\xd6h2\\xfd\\xf6\\xbf\\xdf\\x037"
  645. },
  646. {
  647. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\x911\\xe9\\x97\\xd0\\x0c<\\xc9\\x10\\x84\\xc1\\xa9@\\x0ec\\xc9\\xc6\\x04g\\xffd g\\x8e/#\\x95\\x8do\\x90\\x1c#\\x08\\xdfb\\x88g\\xeev\\xfa]\n\\xb6\\x0c\\x1c\r|\\xb7z\\xed\\xdf)\\x82\\xc5&'\\xaf\\xce\\xc6\\xfc\\xd5\\xbcl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1cvt\\xdc\\xc6\\xda\\xf7\\xec\\xd2\\xacn\\x08t\n\\xce\\x1a\\x1e\\xbb-\\xd6\\x1ej\\xc0\\xd7\\x98\\xe7\\xb8\\xe1\\xd4-)\\xec\\xb3\\x9a\\xec\\xcez()\\x7f\\x01eb\\x15\\x161$i"
  648. },
  649. {
  650. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'\\x10#\\xdd\\xa2\\xc6\\x99fp\\xe4\\xd3\\x07\\x9b#2\\xcdig\\xe7\\xd9xf\\x0c\\xbc\\xd6\\xe6&\\\\xee\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  651. },
  652. {
  653. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88'>\\xef\\xfd\\x1d\\xb8\\x19z\\xbf@8\\x9a\\x02\\xc1d\\x01\\\\x19\\x80\\xe1\\x0c\\x8e\\x02\\xd0'rq\\xd9\\xed\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  654. },
  655. {
  656. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xe9!ms\\xeb\\xb0g*\\xb86\\x15\\xba\\xf82\\xe6}vy\\xfe\\xfbl\\x98e\\xb0\\xd4\\xf6x\\x12\\xb7~\\xa5\\xfa\\x98x\\x9c\\x18\\xb4\r\\xa1q\\x15\\xc3\\xeb\\x96\\x1b\\xfe\\x80\\xfb\\xea/\\x99\\x9e\\x0f\\xd8\\xc7\\x96\\xec\\x96\\x90b )\\xab\\x87q\\x9f\\x800a.\\x84f0\\x9c&\\x98\\x920x{\\xcf\\x18w<\\x02 \\x0bta\\xe8\\xb3\\x85\\xb3\\xcfw3\\x99\\xd7\\x960\\xf2oz\\xa9\\xb5|}\\x83\\x9f\\xb9)\\x84;\\x844\\xde\\x07u\\x00\\x01\\xf8@\\xeb\\xd6\\x07h2\\xa3c\\x8f\\xcbh\\xbaa\\x88\\x84\\xd2(a\\xe5-\\xf0\\x01\\x1b\\xa63ow|\\x06\\xcb\\xf8\\xaak\\x0e\\x85\\xb0z\\xfc\\x8a\\xae\\xbc?\\xe9\\xb3\\x089\\x19on\\xf3o\\xe7\\xf3\\xdb\\xc0\\xb3\\xfcv<\\x1cv\\xacx@1\\xbe\\x\\xeb=\\xdd\"\r\\xd1g\\x0e\\x0c\\x04o\\x96\\x01\\xd6h\\xb5\\xbb\r\\xed\\xa2\\x96\\x1c\\xf4y\\xb7\\xcd\\x0bz\\xbc=\\xe5\\xab9*x\\{\\x9bdb.;\\x10\\xac\\xae\\x0c&\\xd3\r5\\x1a\\xa1\\x14\\x9b\\xcf;0q\\x03\\xd00"
  657. },
  658. {
  659. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88h\\x08\\xce4\\xddi\\x19#\\x10-\\x8d\\xd4\\xe19\\x91\\xeb2\\x1b\\xc3(\\x99\\xef\\x02t|r'\\xe5\\xd8)\\xca\\x11\\xbe\\xb4d\\xa8\\xf2\\xe9\\x97w\\xd1\\xc1\\xa3}\\xae7r$\\xca\\xfc;\\xe87/q\\xb0=\\xf2\\xfd\\x81h\"9\\x89\\xaa\\xb9\\xae\\xa0\\xda\\xa3/\\xa6\\xfap\\xf8\\xaa\\xd3\\xdf}\\xf4\\x10\\xdb\\xca\\xabxp\\x08$\\xf0l\\xd7\\x13(\\x085\\xf6\\x91\n\\x99\\xedt\\x19:\\xf1\\xa9\\xc3\\xdbk\\xcdr\\xee\\xc8\\xdfh\\xbb24\\xc3\\x99\\xce\\x91\\x94\\xf1\\x9cx$1\\xf6\\x10\\xbf?e=\\x88\\xe8\\x87\\x98u\\xda\\xc3\\xd0\\xb6f\\x1dv\\xf8[`\\x86\\xe9]\\xb0e\\xae\\xef\\xa8\\xb7\\xf3g#\\xd0\\xcbq\\xc1\\xab\\xb0y;\\xea\\xcb\\x85\\x1b)\\xb0e%\\xc4\\xcc\\xd83\\x89\\xf4\\xbc\\x04l\\xf0\\x16\\xd1\\xaf\\xb0\\xa3\\xa4\\x00\\xb51\\x1e\\x8f\\xf6\\xa8\\x1d/\\xa1dz\\x10\\xa7\\xcfc\\xea\\xad\\xf9\\xe4\\xdb|\\xecno\\xcb\\x04\\x04\\x01)\\x04\\x00\\x1eo\\xa0n\\x8c\\x13\\x05j\\x1e\\xa5!\\xe2\\xf7\\xa8^'\\x8am\\xef`\\xd3\\xe8s\\xe6\\x058"
  660. },
  661. {
  662. "http_request": "winword.exe_WSASend_\\x16\\x03\\x00\\x005\\x01\\x00\\x001\\x03\\x00]\t\\x88+\\x10z\\x14\\x15\\x02\\xf0\\xbf\\x1b:\\x19\\xa2\\xa5\\xe3\\xe4\\x8c\\x1d\\xe8n\\xb7\\xa7\\x8e\\xf1u\\xcb\\x03\\x92d\\x99\\x00\\x00\n\\x00\\x05\\x00\n\\x00\\x13\\x00\\x04\\x00\\xff\\x01\\x00"
  663. },
  664. {
  665. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8\\xe3\\,\\xf3!f\\xdc\\xc5kg\\xe1^\\x8ba\\xa5d7n{i\\xfb\\xde\\xda\\xa0\\xa4d\\x8b\\xbe\\xfc\\xd79\\x8c\\xe2\\x02\\xc0\\x92\\xa2f\\xbe\\x95wm\\xd7\\xb9\\xf4r1\\xd3\\x88\\x06\\x89\\x1d\\x84\\xc2m\n1u~\\xe6b\\x00\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\ni%\\xe8a\\xd2~\\xe5yc-\\xe1\\x88\\xf6-\\xee\\xdd\\xd5\\xe8\\xc9\\xbd\\x83\\x820\\x93\\x13\\xb8\\x8b;i\\xd2\\\\x87\\xe5\\x06\\xfe\\xa7\\xd0\\xb0\\x8a.l{\\xbf\\xefv\\xd0m"
  666. },
  667. {
  668. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc\\xcd\\xb0\\xa2|\\xfe\\xffi\\xa3j\\x1d]\\x0b\\x00t6\\xe8l*y\\x8ef\\xd8u3\\xc6\\xa9\\x9f)\\xf5dg\\xd6y:-\\xb5n\\x04\\x92\\xebd\\xc2~\\x19-\\xd8`-\\x0e\\x9b\\x90\\xda\\xd9m\\xcaw\\xce}\\x01\"\\xecj\\xb8\\x0e\\x17\\x83u1`\\xb9\\x83~\\xe7\\x9e\\x7f\\x94>\\xb5\\x06@4\\x8d\\xecz\\x04\\x1cf\\x12u\\xe0\\xa6(;c:\t\\xb0;\\xf6\\xd1\\x82e\\xdc\\x08a\\xec\\xae\\xb7\\xc4\\x16r\\x02h\\x8a\\x90\\x84\\x90\\xfc*\\x9cr\\x1125\\x08\\xe7\\x87\\xfc\\x99]\\xd4\\x8a\\x85\\xae\\xb7\\x0b]~\\xa1\\x1f\\x9d\\xbe\\x98\\xb3\\xac-\\xa5\\xae\\xbfc=\\x8c\\x8f\\xb6\\xa2\\xb4\\xf7+a\\xd3\\xd4'6hi\\xde\\xe3\\x11\\xc3\\xe7\\xad\\xb7\\xa9\\\\xc9\\xa1\\x88]\\xce\\x0f\\x06\\xaf\\x92\\x8b \\xe6\\xa2<\\xbb\\xc7\\x9e\\xf1\\xeb\\x89\\x86q^\\x08\\xbc\\xc4\\x81/\\xcfp\\xe9\\xbfb\\x99\\x14\\x1er\\xa6e{\\xe0\\x89\\xdag\\xebi\\xeb\\x0e\\x08\\x1d\\xeb\\x0fx\\xcf\\x8e\\xc8\\xbb\\x1f\\xb8\\xbempw\\xe7\\xb9:)\\x039g.}\\xca\\xe5:\\x03"
  669. },
  670. {
  671. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xd8\\xdae\\xe9\\xc2\\x82s\\xee\\x1f\\xdc\\x96\\xa7x\\x0bg\\x00 \\x18|f\\x9d\\xc7<8\\xf4\\xf1\\xcd\\xda:\\x8b|\\xc7d\\xdd/n\\x9e\\xbc+\\x8d\\xcb\\xde\\xf4\\xb5\\xbd\\xca\\xce\\xf3\\xaa\r\\xa5!\\xa6<2\\xb7\\x7f\\x85\\x87\\xde\\x89\\xf9z]\\x90y\\x15\\x12\\xffj\\xeeh\\xc8?p\\xbff7\\xaak\\xf6\\xcd\\xc2\\xff\\xe7\\xcbr\\x80\\x15\\xb66\t!%\\xcf|\\xd7:l\\x13\\x9dg\\x10,p\\xb9'\\xb2\\x03]\\x90\\xfb%\\xaf_\\xae\\xef\\x95\\xd3g\\xb2\\xe8\\xe1k\\xc4\\xf6\\x7fuk\\xfe\\xf8dnr\\x19]\\xb6\\xba\\xad\\xf6\\x9f^\\x1d.\\x00\\x88\\xcb\\xc3\\xc0\\xcf\t#[\\x1d\\xd1\\x90\\x9d\\xeda\\xd7\\xcc\\xb5\\xbe\\x04\\xe5\\x80\\x14\\x96e\\x14\\x04k\\xbd\\xd3#j\\xdf\\xbe\\x0c\\xc4\\xfch\\xcf\\x9f\\x87m\\xb6\\xf5u\\xf5*\\xfe\\x030km\\x1de\\xc3\\x98\\xb9\\x8e\\xd1\\xc4\\xf3\\xbb\\x8f\\xe08\\xd0\\xd2\\x8e\\x12hd\\x14\\xfba\\x8b\\xff\\xfeo\\x0b\\xe2\\xba\\xa0$\\x16\\xe8\\x88\\xd3\\x0b\\xb8\\xdc\\xff\r\\xed\\x98\\z\\xfe\\xa9l\\xef\\xd3m)\\xc9\\x1a\\xb1"
  672. },
  673. {
  674. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\xe6b\\xd1[\\x98\\xb9\\xd3\\x1a\\xd7'\\xa57\\xca\\xdf9\\xbd\\x94\\xa2\\xe6\\xa9'1\\x8a\\x1b\\xcb\\x1a\\xc3\\xc3\\x12c\\xf9\\xf8\\x12u\\xb4\\x98b\\xf2%\\xb3\\x0c\\xba?,\\x8b0\\xe1\\xb2\\xb3\\x01z\\xcf\\x9d\\x86n\\xbb[w%jgz\\xf9\\xfe6\\xa8\\xdf\\xf1\\x9f\\xc3\\xf8x\\x0c\\x8e\\xc4f\\xf6u\\x94\\xf7\\x99\\x061\\xf8\\xd3\\xf3\\x1b\\xb1\\xfe\\xd4\\xb9\\xa2\\x05w>\\xbb\\x9c\\xed-\\xa8\\xa0\\x11_(k\\x93\\xf7\\xde\\xdfi\\xee\\xefw\\x86*\\x9a\\x8dm\\xc1 \\xcd\\x91]\\xefc\\xe6\\xa7\\xc0b\\xf2\\xdbe\\xa2\\x99i\\xa2+y\\xd6i\\x88\\x1a\\x18fu\\xcf\\x86\\xee\\xc7\\x0e\\xc2\\xe5\\xf5\\xac\\xf5s\\xb9qlk6*1\\x1e\\x14\\xb2 \\xad\\xda\\x1c\\xfa\\x9f\\xf0? \\xcf\\xea\\xc3\\xfa\\xcc&k\\x18\\x10\\xb2\\x93$`md6av\\xab5\\x8a\\x0507?u\\x1f\\xab\"\\x1co~ohn`\\xbf\\x11+1\\xf7\\x06\\x80\\x04\\xc1t\\xd5\\xfc\\xf6\\xb0m\\x9b\\xad\\x12=j\\xc6\\x13y#o\\xb53oe\\xa4l>\\x86\\x0b\\xfb\\x9f'\\xa46"
  675. },
  676. {
  677. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010rm\\xb1,$\\x94\\xaa\\x90<<\\xa5djj#\\xe4\\xed\\xb3h6\r\\x95\\xfbv\\xc8\\xdf\\x1fk\\x90\\x8c\\xc9\\x9a\\xd7a\\x1a\\xf81y\\xb0\\x03\\x1erm\\xbb'\n\\r\\x10\\xc4,\\xddo\\xbffs'\\xa29\\xe6\\x01b\\xce\n\\xe6\\xb3\\xfa\\xab\\x8cxn\\xe1u\\xbc1\\xa3}\\x17\\xf4\\xe3\\xd5\\x08\\xa63\\xb0\\x9b\\x8d\\x1e;\\xec\\x08\\x9d\\x0c\\xee\\x8e\\xce\\x07\\xfb\\x014\\xb5\\x84\\x1a\\x0c'\\xd9p\\x8a\\xa7\\xa9is\\xe1\\xe0\\x7fl\\x101\\x16\\x8dq\\xa8\\x01d\\xf9\\xcd\\x9f\\x06\\xc2a\\xc3\\x87\\xe4\\xfak\\xc3\n\\x8e\\x821\\xebj#[\\x0b\\x93\\xc18u\\x0e\\xea\\x8ar%0\\xa9\\xe8$\\x8e\\xc4\\xb2m\";[\\xafr\\xdfl\\xc1\\x16j\r\"\\xbf\\xf0\\x81\\xb5\\xa5\\x08\\x96'\\xc2.\\xda\\xbf\\xc6|[\\x18\\xd8\\xc1\\xb6hh\\xe0\\x03\\x913\\xf5\\xba\\xa7\\xfb\\x1d\\xeb\\x18\\xe7^`\\xbd\\xaaub\\x82cr\\xa8\\x83e\\xdc\\xe4\\xf3\\xb7\\xa9m\\x1a/\\xcd\\xa3\\x80\r\\xc5\\xb5\\xaa\\xae\\xe0[q\\x82@d\\x03\\xdc\\xa2\\x11\\xa1u\\x94\\xd6\\xea\\xcb"
  678. },
  679. {
  680. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbffxa\\xa1s\\xb6\\x82\\x9f\\x0fa\\xde\\x1e\\x1d\\xdfr\\xbe\\x1b\\xe4\\xda\\xf2\\xe0\\xbc\\xa0i\\xed\\xcf\\x8d\\xf4z1l\\xc92\\xff\\x1b\\xa4\\x1d\\x13v1\\x93_<\\x9c\\xf5\\xd2\\xff\\xa4in\\x06\\xda\\x99\\xbc\\x9a\\xf0\\x04\\xdb\\xacf\"6\\xa5=\\xe4\\xe1\\xb8\\x13\\x90\\x9c\\x02$\\xd1\\xd1ie\\xae\\x05\\xe8\\xeb\\xcc>\\xea(\ny\\x1f\\x1f\\xc25o\\xc5\\xed0x\\xc9\\xf3\\x04\\xf5dk\\x0ci\\x08v`l\\x86\\xf7]\\xf5\\xdf\\x02\\x02!i\\x1c\rs_p\\xb5h\\x9ca\\xd0\\xe5\\xca\\xa0\\x15\\x1a:\\x0c0\\x06\\xed\\x10{\\xd9j\\xaa\\xa6\\x8b\\xd2\\xb4\\x9adc\\xca\\x8a\\x94\\x92d\\xef\\x81\\xc7q\\xc6\\xa2\\xf3h\\xbezk\\xb6\\xffoz\\xef\\xd3h\\xef\\xc8a\\xd1\\xb7a\\x98\\xf9\\x15\\xa8\\x00\\x8c}/\\x9a'zj<\\x9a\\x92\\xf0@\\iyv%\\xf6k\\x9d)t\\xfb\\xe3\\x91\\x05b`)\\x04\\xadbv\\x87\\x7f\\x92\\xd5\\x0es\\xf7\\xbc\\x9bv\\xf9\\xbc3;1`\\x8b\\xac\\xc7\\xe6\\xf7z\\xe2\\xd0\\xa1\\x02\\xdaf\\x0f\\xda\\x8er;'o"
  681. },
  682. {
  683. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x8a\\x8euf\\xcf\\x8e!\\xee\\x7f\\xdf\\x04\\x15n\\xf7sg\\x049\\xbb\\xa5\\xa6\\xa8_\\xe3\\xe4\\xa3\\xdf\\xc3`\\x98~<\\x8f\\x109\r\\x12\\xb8\\xbf\\x84\\xddq\\xc601]<\\xc9&m\\xd1{\\xb1\\xb4\\xee\n\\xc4[\\x94\\x9c\\x8c \\xc7\\x00\\xac\\x11\\xc8\\x1e\\xc2c\\xe1;\\xa9\\x18+\\x1f\\xb7\\x17\\xc2\\x9d\\xf1]#\\xfabc\\xa8\\x113hwu\"\\xban\\xbb\\xbc\\xd9k\\x9ayu\\x8e\\x82q\\xe2y\\xaa\\xea7\\x00\\\\xd86\\xf6[!\\x033\\xaa\\xd2x\\x8b\\x87\\xd4_32\\xa8\\xef\\xc5n\\xbel\\xfev_d\\x905':\\x16gq\\x02\\xfb\\x85*\\xf4\\xf4\\xce\\xa0&)\\xa4\\xe1\\x9czj\\x9d\\xf7c\\xdcwz\\xb3xp\\xdf\\xce\"\\xef[\\xf3\\xe9y\\xbbh\\x90\\xc1\\xf8l \\x95\\xca\\xa4\\x0e\\xb0\\x90\\xf6\\xa45\\x0e;\\x7f\\x9e\\x1bzv\\xa4hp\\xc48\\xa7\\x95x[)#%b\\xa9\\x7f\\xfa\\x83o\\xdb\\x8de\\xbdj\\xb6\\x84\\xed\\x90is@l<m-o\\x94\\xc0\\xce\\x11seb_\\xff\\xa3\"\\\\xaf\\x0b\\x1e"
  684. },
  685. {
  686. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_%idr?c\\xba\\x1e\\xeaj_\\xe9\\xe8\\x0b\\x8e\\xe3\\x9e\\xf8\\x9e\\x89\\xb3w=`e@\\x84\\x99\\x9f\\xb9a\\xa2\\xaa\\xc8\\x03\\x9el\\x01\\x96\\xfd$\"\\xfb\\xe9;ky\\xe6]\\x11\\xe6\\xde^\\x8ca=hf\\xe5^\\xf0\\xd8\\xbd\\xc56i\\xf4\\x13\\xb6\\xb8\\xfe\\x0c\\xab\\x84{\\x11.\\x88\\xfb>\\xd8\\xa3,\\xca5|\\x87\\xb1\\x07\\xe1n/\\xf9\\xca\\xb7\\x15g!\\xfc\\xf0\\xe1o\\xad\\x01y\\xc4\\xbd?\\xa8\\x8f)\\x9e\\xf6a\\x14\\x81\\x9d\\xb5-\\xea\\xe0\\x11\\x99o\\xf3\\xe6?\\x9be\\xbe\\xb2\\xa2yi?\\x92\\xcbk\\xffy\\x0ec\\xf0\\xe8\\xc1\\x9e\\xc6\\xb9k\\xe4\\xde\\xfe*\\xc3\\x8a\\xad-\\xa2\\x04<\\xcal\\x1b4\\x88&\\xd5@;f/\\xc2\\xbbg^\\xf3\\x9f\\x11f\\x90c\\xa3\\x07\\xa4\\xee\\xab\\x8e\\x07\\xb5r\\xfau\\xc3\\x8bn\\x15\\x0c\\xa1l\njgc}k\\xfa\\xd6\\xc7@\\xf8\\xa6jm@\\x0e\\x1d\\xc8\\xac`\\xf7\\xc0\\xf0\\x99\\x07\\xe2s\\x8b\\xad\\x04\\x92\\xd0\\xc5\\xb9\\xce_x\\x9b\\xdf\\x99}\\xb9\\xda\\x97\\xe1\\x02\\xb6\\xaf<\\xec\\xc2"
  687. },
  688. {
  689. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8\\x04n\\xed\\x03\\xbc\\xbc\\xe4\\xe0a\\x99p\\x87\\x98\\xb7v\\x85\\xa8\\xf6\\xd6\\xb3\\xede\\x88*\\xba\\x96\\x13db\\x03y\\x1a\\xb1\\x88/\\xf3\\xfd{v7\\x84\\x0b\\xadq\\x1dz\\x9bt\\x7f\\x8b\\xb9\\xd3 `d2xhg\\xb0a\\xd0\\x15}\\x81\\x1bwb\\xb11u-\\xcf\\x00\\xf2\\x96\\x07\\x08[\\xe9\\x1b\\xb8\tf\\xed-\\x9f\\xecg\\x0f\\xa5\\xd7\\xf1\\x82\\xe4\\xf4\\xcb\\x9d3\\xad)*;\\xfb\\xa4\\x11k\\xa8\\xeb\\xf1\\xe5r\\xf1\\xdcv\\xc2\\x9e\\xeb\\x01\\xbdjw?;?g\\xf9\\xb9\\x95\\x82\\xe0\\xbd\\xd6y\\x84\\xe2\\xbd\\x85\\xd9'|\\xf9\\xa5>(\\x91:y\\xb3@uu\\xcbk\\x02v\\xcc\\x8b\\xffp_\\x8f\\xe8\\xeb\\xf3\\xb8\\xe8a\\xaa\\xfe\\xde1 \\xc9\\x01{\\x95\\x1f\n\\xf4\\xa4\\x85*>\\xa0\\x9d\\xa7\\xe9\n\\xafr+g&\\xdc\\xcb\\xf8\\xb4\\x02w\\xaa\\xa9`n1\\xba\\x9d\\x1d\\x9a\\xf2\\xday/\\xce-d\\xe6\\xa7ch\\x9b<n{\\x96\\xe5\\xc9f\\x00}o\\xc6\\xb5[\\xa8\\x03\\xd5\\xc5\\xdd\\x80\\xbd\\x92\\xb9\\xe2\\x08a\\xcfp.l"
  690. },
  691. {
  692. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff\\xd4\t\\x13\\x84@\\x97z:rz\\x14l\\xbd\\xcd\\xe2\\xcc\\xf2\\x1e*\\xa4\\x03l\\xdc\\x04\\x07\\xf5\\x9dsn; \\x8c\\xa6\\xcae\\xe6cj\\xd7\\xechrd\\xc5\\x84,x1b\\x86\\xd9\\x0e\\x06>\\xb7hh]an\\x94}7\\xb2+zj\\x91\\x99\\xf0\\x9f*\\xc8\\x7f\\x1b\\xf7\\xd9\\xcb+ga\\xe9\\xe4\\x07\\x11\\x06\\x0b\\x94_uq\\xd9\\xba~%\\xe5\\x0e\\x88=\\xe2\\x1e\\x1f\\xb7\\xd3\\xba[a\\xe1\\x9f\\x88\\xd9\\xe6d\\x91\\xeba\\x18\\xfab@\\xe3\\xe7\\xa5\\xdb\\xae\\xc5[\\xb5\\xa9r\\xddw\\xc8\\xb4\\x92\\x0e\\xec\\xae\\x97j\\xd7\\xf9\\x00\\xeb\\x84\\xf3d\\x8df\\xdfgx!\\x9ao\\xf99\\xb7\\xd5\\x87\\xc4g\\x88j\\x05\\x86\\xe2c\\x89\\x1f\\x10\\xb8\\x8dm\\x88\\xf2@\\x9d\\xa3\\xd0y\\xf0[\\x04\\x8f\\xe5x\\xd6\\x03e-\\xcc\\x05\\x164\\xbf\\xf9fp\\xbe)\\x82\\xef\\x1b\\xa1\\x871\\xad\\xc0zd\\x85q\\xa8\\xb8eg<^\\xc4\t\\xc0$\\x11\\x83 \\x81\\x9d\\x86\\xf3 =\\x8e\\x18\\xe5\\xbc\\xf5\\x94\\x94\\xbf\\xde&\\xe2\\xc51\\xfazq\\xe6\\xe3"
  693. },
  694. {
  695. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\xc6\\xae\\xb8\\xe8\\xef\\xfb\\xc3s/j\\xdf\\xfb\\xc4u\\x940\\x07}\\x1ddi\\x0c\\x04z\\xc6\\xa4\\xf9\\xbf\\xb06(f\\xaa||-\\xa4=\\xee}*d!u'\\xf2n}}j\\x86\\x11_\\xc0\\xb5\\x16\\xa7b\\xb6\\xe1w\\xfeg\\xed\\x88\\x93\\x80og\\xef\\xb7\\x1di&\\xcf\\xcck\\xf3c\\x0f\\xd7\\x94\\xb1\\x10\\xd3\\xdd\\x1e\\x06\\xe1\\xa8\\xd2g\\xcb\\x7fn\\x9b\\x0c^\\xec\\xda\\xf6\\x8f\n\\xe4\\xd8\\x97\\xaf\\x1e\\xc5\\xa30\\xdbo\\xaf(\\x13\\xbe\\x98\\xfe\\xe3\\x9a\\x01q\\x93\\xa6\\xb1s\\x19\\x00\\x9a\\xd0\\x0f\\xec\\xf47$s\\xa7\\xd8\\xfd\\xder\\xea(\\xf9\\xec\\x93[\\xbee{\\xf9\\xc3\\xf3\\xa1\\xb0]\\x11k\\xaa4\\xcb\\xa9\\xcc-n\\xa3\\x0c\\xce\\x0b\\x17\\xb4\\x15\\xb62!h.\\\\xdc\\xde\\x82\\xd2k\\xa3\\x1b\\x11\\x021\\xdd\\x0b\\xc8m\\x0f\\xd5\\xb4\\xbam!p\\xfe\\x84\\xf0\tq\\x07\\xce\\x0b\\xe0h\\x04\\x8e\\xb5\\xd6\\x04k\\xfb\\xbc\\x13\\yb\\xba\\x00*d\\xac\\xce\\x08a\\xc8\\xedc\\xa9\\xa1\\xca\\x15\\x1b\\xf1\\x15\\xa2\\xa9\t\"\t \\x04\\x07\\xbdp"
  696. },
  697. {
  698. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  699. }
  700. ]
  701. },
  702. {
  703. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  704. "Details": [
  705. {
  706. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  707. },
  708. {
  709. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  710. },
  711. {
  712. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  713. },
  714. {
  715. "McAfee": "Exploit-CVE2017-11882.ah"
  716. },
  717. {
  718. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  719. },
  720. {
  721. "Cyren": "CVE-2017-11882!Camelot"
  722. },
  723. {
  724. "Symantec": "Bloodhound.RTF.12"
  725. },
  726. {
  727. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  728. },
  729. {
  730. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  731. },
  732. {
  733. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  734. },
  735. {
  736. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  737. },
  738. {
  739. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  740. },
  741. {
  742. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  743. },
  744. {
  745. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  746. },
  747. {
  748. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  749. },
  750. {
  751. "TrendMicro": "Possible_SMBCVE20170199"
  752. },
  753. {
  754. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  755. },
  756. {
  757. "Sophos": "Exp/201711882-P"
  758. },
  759. {
  760. "Avira": "HEUR/Rtf.Malformed"
  761. },
  762. {
  763. "MAX": "malware (ai score=80)"
  764. },
  765. {
  766. "Antiy-AVL": "Trojan[Exploit]/OLE.CVE-2017-11882"
  767. },
  768. {
  769. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  770. },
  771. {
  772. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  773. },
  774. {
  775. "GData": "Exploit.RTF-ObfsStrm.Gen"
  776. },
  777. {
  778. "AhnLab-V3": "RTF/Malform-C.Gen"
  779. },
  780. {
  781. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  782. },
  783. {
  784. "Zoner": "Probably RTFObfuscation"
  785. },
  786. {
  787. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  788. },
  789. {
  790. "Ikarus": "Exploit.CVE-2017-11882"
  791. },
  792. {
  793. "Qihoo-360": "susp.rtf.objupdate.gen"
  794. }
  795. ]
  796. }
  797. ]
  798.  
  799. [*] Started Service: [
  800. "osppsvc"
  801. ]
  802.  
  803. [*] Executed Commands: []
  804.  
  805. [*] Mutexes: [
  806. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  807. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  808. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  809. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  810. "CicLoadWinStaWinSta0",
  811. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  812. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  813. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  814. ]
  815.  
  816. [*] Modified Files: [
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_9d944cd642bd8d94bec6e25aff9831a1.doc",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_9d944cd642bd8d94bec6e25aff9831a1.doc",
  819. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{3777B19F-FDD8-45C0-9F62-2B1ACA5CA57A}.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{80E6E38E-0D0F-44EE-B5FA-275F27243721}.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{FCFF602E-8463-4116-84B0-F13D57859A8E}.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  823. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  824. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  825. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  826. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  827. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\070C03D13B170C50ED5CDDF6BA1053A6",
  828. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F52EFD459704E23E98B5C774A45162",
  829. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\070C03D13B170C50ED5CDDF6BA1053A6",
  830. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C1F52EFD459704E23E98B5C774A45162",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1615.tmp",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1616.tmp",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66B8.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA29.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD64E.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD661.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD65E.tmp",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE680.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF27B.tmp",
  841. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{8E914365-DED0-48D6-83B4-A7C5C3DC6415}.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE693.tmp",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA28.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD65F.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD660.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE692.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE691.tmp",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF28B.tmp",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF28C.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD662.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCCE.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F1.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9.tmp",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA8.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B78.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDC.tmp",
  859. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5075.tmp",
  861. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  862. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEEE8.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEEE9.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF98A.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEEEA.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF98B.tmp",
  868. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  869. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2187.tmp\\iso690.xsl",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F34.tmp\\ConvergingText.glox",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E5.tmp\\Banded.thmx",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F34.tmp\\Content.inf",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E3.tmp\\APASixthEditionOfficeOnline.xsl",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E4.tmp\\TabList.glox",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E4.tmp\\Content.inf",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F93.tmp\\InterconnectedBlockProcess.glox",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E2.tmp\\ThemePictureGrid.glox",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D6F.tmp\\harvardanglia2008officeonline.xsl",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F83.tmp\\gosttitle.xsl",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55A0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6303.tmp\\gb.xsl",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6302.tmp\\BracketList.glox",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F93.tmp\\Content.inf",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55C1.tmp\\mlaseventheditionofficeonline.xsl",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6302.tmp\\Content.inf",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E2.tmp\\Content.inf",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F83.tmp\\Content.inf",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E2.tmp\\TabbedArc.glox",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E1.tmp\\content.inf",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55A0.tmp\\Content.inf",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559F.tmp\\chevronaccent.glox",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D09.tmp\\gostname.xsl",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E2.tmp\\Content.inf",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78CF.tmp\\PictureFrame.glox",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8076.tmp\\RadialPictureList.glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D6F.tmp\\Content.inf",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78CF.tmp\\Content.inf",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BDE.tmp\\chicago.xsl",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D1A.tmp\\pictureorgchart.glox",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77D4.tmp\\iso690nmerical.xsl",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E1.tmp\\Wood_Type.thmx",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D1A.tmp\\Content.inf",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\turabian.xsl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E3.tmp\\Content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80F4.tmp\\sist02.xsl",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2187.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E5.tmp\\content.inf",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559F.tmp\\Content.inf",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55C1.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D09.tmp\\Content.inf",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6303.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8076.tmp\\Content.inf",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77D4.tmp\\Content.inf",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFE.tmp\\Equations.dotx",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BDE.tmp\\Content.inf",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFE.tmp\\Content.inf",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80F4.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A8B.tmp\\content.inf",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  935. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx"
  947. ]
  948.  
  949. [*] Deleted Files: [
  950. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1615.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1616.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_9d944cd642bd8d94bec6e25aff9831a1.doc",
  954. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
  956. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{8E914365-DED0-48D6-83B4-A7C5C3DC6415}.tmp",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475[[fn=Frame]].eftx",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475[[fn=Frame]].xml",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
  960. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475[[fn=Frame]].xml",
  962. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
  963. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{80E6E38E-0D0F-44EE-B5FA-275F27243721}.tmp",
  964. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  966. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx",
  970. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
  971. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{FCFF602E-8463-4116-84B0-F13D57859A8E}.tmp",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  973. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  974. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444[[fn=Basis]].xml",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444[[fn=Basis]].xml",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF98A.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF98B.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEEE9.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEEEA.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F34.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2187.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D6F.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E2.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E3.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E5.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E4.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F83.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F93.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6303.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55A0.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559F.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E2.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6302.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55C1.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E1.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77D4.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78CF.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BDE.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D09.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D1A.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8076.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFE.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80F4.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E2.tmp\\TabbedArc.glox",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F34.tmp\\ConvergingText.glox",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2D6F.tmp\\harvardanglia2008officeonline.xsl",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6302.tmp\\BracketList.glox",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF28B.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD661.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE692.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E4.tmp\\TabList.glox",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F83.tmp\\gosttitle.xsl",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD64E.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA8.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A8B.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F93.tmp\\InterconnectedBlockProcess.glox",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE680.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E5.tmp\\Banded.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E2.tmp\\ThemePictureGrid.glox",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD559F.tmp\\chevronaccent.glox",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD662.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D09.tmp\\gostname.xsl",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDC.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D1A.tmp\\pictureorgchart.glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8076.tmp\\RadialPictureList.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD65E.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE693.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCCE.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA29.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2187.tmp\\iso690.xsl",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD78CF.tmp\\PictureFrame.glox",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F1.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77D4.tmp\\iso690nmerical.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF28C.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE691.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55A0.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66B8.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55C1.tmp\\mlaseventheditionofficeonline.xsl",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF27B.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6303.tmp\\gb.xsl",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34E3.tmp\\APASixthEditionOfficeOnline.xsl",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD65F.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BDE.tmp\\chicago.xsl",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\turabian.xsl",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFE.tmp\\Equations.dotx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA28.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBA.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD660.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80F4.tmp\\sist02.xsl",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B78.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55E1.tmp\\Wood_Type.thmx",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5075.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8A8B.tmp\\Main_Event.thmx",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEEE8.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR2011.tmp.cvr"
  1059. ]
  1060.  
  1061. [*] Modified Registry Keys: [
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\s\"{",
  1063. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1734FAE",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1734FAE\\1734FAE",
  1083. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1393. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1397. ]
  1398.  
  1399. [*] Deleted Registry Keys: [
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\s\"{",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ fy",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1734FAE\\1734FAE",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1418. ]
  1419.  
  1420. [*] DNS Communications: [
  1421. {
  1422. "type": "A",
  1423. "request": "paroquiadamarinhagrande.pt",
  1424. "answers": [
  1425. {
  1426. "data": "188.93.230.15",
  1427. "type": "A"
  1428. }
  1429. ]
  1430. },
  1431. {
  1432. "type": "A",
  1433. "request": "ipapi.co",
  1434. "answers": [
  1435. {
  1436. "data": "104.25.210.99",
  1437. "type": "A"
  1438. },
  1439. {
  1440. "data": "104.25.209.99",
  1441. "type": "A"
  1442. }
  1443. ]
  1444. },
  1445. {
  1446. "type": "A",
  1447. "request": "unknownsoft.duckdns.org",
  1448. "answers": [
  1449. {
  1450. "data": "185.247.228.14",
  1451. "type": "A"
  1452. }
  1453. ]
  1454. },
  1455. {
  1456. "type": "A",
  1457. "request": "vemvemserver.duckdns.org",
  1458. "answers": [
  1459. {
  1460. "data": "103.136.43.131",
  1461. "type": "A"
  1462. }
  1463. ]
  1464. },
  1465. {
  1466. "type": "A",
  1467. "request": "ocsp.comodoca4.com",
  1468. "answers": [
  1469. {
  1470. "data": "t3j2g9x7.stackpathcdn.com",
  1471. "type": "CNAME"
  1472. },
  1473. {
  1474. "data": "151.139.128.14",
  1475. "type": "A"
  1476. }
  1477. ]
  1478. }
  1479. ]
  1480.  
  1481. [*] Domains: [
  1482. {
  1483. "ip": "103.136.43.131",
  1484. "domain": "vemvemserver.duckdns.org"
  1485. },
  1486. {
  1487. "ip": "104.25.209.99",
  1488. "domain": "ipapi.co"
  1489. },
  1490. {
  1491. "ip": "151.139.128.14",
  1492. "domain": "ocsp.comodoca4.com"
  1493. },
  1494. {
  1495. "ip": "188.93.230.15",
  1496. "domain": "paroquiadamarinhagrande.pt"
  1497. },
  1498. {
  1499. "ip": "185.247.228.14",
  1500. "domain": "unknownsoft.duckdns.org"
  1501. }
  1502. ]
  1503.  
  1504. [*] Network Communication - ICMP: []
  1505.  
  1506. [*] Network Communication - HTTP: [
  1507. {
  1508. "count": 1,
  1509. "body": "",
  1510. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1511. "user-agent": "Microsoft-CryptoAPI/6.1",
  1512. "method": "GET",
  1513. "host": "ocsp.digicert.com",
  1514. "version": "1.1",
  1515. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1516. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1517. "port": 80
  1518. },
  1519. {
  1520. "count": 1,
  1521. "body": "",
  1522. "uri": "http://paroquiadamarinhagrande.pt/app/tyeupy.msi",
  1523. "user-agent": "Windows Installer",
  1524. "method": "GET",
  1525. "host": "paroquiadamarinhagrande.pt",
  1526. "version": "1.1",
  1527. "path": "/app/tyeupy.msi",
  1528. "data": "GET /app/tyeupy.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: paroquiadamarinhagrande.pt\r\n\r\n",
  1529. "port": 80
  1530. },
  1531. {
  1532. "count": 1,
  1533. "body": "",
  1534. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1535. "user-agent": "Microsoft-CryptoAPI/6.1",
  1536. "method": "GET",
  1537. "host": "ocsp.usertrust.com",
  1538. "version": "1.1",
  1539. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1540. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1541. "port": 80
  1542. },
  1543. {
  1544. "count": 1,
  1545. "body": "",
  1546. "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1547. "user-agent": "Microsoft-CryptoAPI/6.1",
  1548. "method": "GET",
  1549. "host": "ocsp.comodoca4.com",
  1550. "version": "1.1",
  1551. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1552. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  1553. "port": 80
  1554. },
  1555. {
  1556. "count": 1,
  1557. "body": "",
  1558. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1559. "user-agent": "Microsoft-CryptoAPI/6.1",
  1560. "method": "GET",
  1561. "host": "ocsp.msocsp.com",
  1562. "version": "1.1",
  1563. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1564. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1565. "port": 80
  1566. },
  1567. {
  1568. "count": 1,
  1569. "body": "",
  1570. "uri": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1571. "user-agent": "Microsoft-CryptoAPI/6.1",
  1572. "method": "GET",
  1573. "host": "mscrl.microsoft.com",
  1574. "version": "1.1",
  1575. "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1576. "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: mscrl.microsoft.com\r\n\r\n",
  1577. "port": 80
  1578. },
  1579. {
  1580. "count": 1,
  1581. "body": "",
  1582. "uri": "http://crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1583. "user-agent": "Microsoft-CryptoAPI/6.1",
  1584. "method": "GET",
  1585. "host": "crl.microsoft.com",
  1586. "version": "1.1",
  1587. "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1588. "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1589. "port": 80
  1590. },
  1591. {
  1592. "count": 1,
  1593. "body": "",
  1594. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1595. "user-agent": "Microsoft-CryptoAPI/6.1",
  1596. "method": "GET",
  1597. "host": "crl.microsoft.com",
  1598. "version": "1.1",
  1599. "path": "/pki/crl/products/microsoftrootcert.crl",
  1600. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1601. "port": 80
  1602. },
  1603. {
  1604. "count": 17,
  1605. "body": "",
  1606. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1607. "user-agent": "Microsoft-CryptoAPI/6.1",
  1608. "method": "GET",
  1609. "host": "crl.microsoft.com",
  1610. "version": "1.1",
  1611. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1612. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1613. "port": 80
  1614. },
  1615. {
  1616. "count": 7,
  1617. "body": "",
  1618. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1619. "user-agent": "Microsoft-CryptoAPI/6.1",
  1620. "method": "GET",
  1621. "host": "crl.microsoft.com",
  1622. "version": "1.1",
  1623. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1624. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1625. "port": 80
  1626. },
  1627. {
  1628. "count": 5,
  1629. "body": "",
  1630. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1631. "user-agent": "Microsoft-CryptoAPI/6.1",
  1632. "method": "GET",
  1633. "host": "crl.microsoft.com",
  1634. "version": "1.1",
  1635. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1636. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1637. "port": 80
  1638. },
  1639. {
  1640. "count": 3,
  1641. "body": "",
  1642. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1643. "user-agent": "Microsoft-CryptoAPI/6.1",
  1644. "method": "GET",
  1645. "host": "crl.microsoft.com",
  1646. "version": "1.1",
  1647. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1648. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1649. "port": 80
  1650. },
  1651. {
  1652. "count": 1,
  1653. "body": "",
  1654. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  1655. "user-agent": "Microsoft-CryptoAPI/6.1",
  1656. "method": "GET",
  1657. "host": "ocsp.digicert.com",
  1658. "version": "1.1",
  1659. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  1660. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1661. "port": 80
  1662. },
  1663. {
  1664. "count": 1,
  1665. "body": "",
  1666. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  1667. "user-agent": "Microsoft-CryptoAPI/6.1",
  1668. "method": "GET",
  1669. "host": "ocsp.thawte.com",
  1670. "version": "1.1",
  1671. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  1672. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  1673. "port": 80
  1674. }
  1675. ]
  1676.  
  1677. [*] Network Communication - SMTP: []
  1678.  
  1679. [*] Network Communication - Hosts: []
  1680.  
  1681. [*] Network Communication - IRC: []
  1682.  
  1683. [*] Static Analysis: {}
  1684.  
  1685. [*] Resolved APIs: [
  1686. "mso.dll.#1443",
  1687. "mso.dll.#9214",
  1688. "mso.dll.#199",
  1689. "mso.dll.#1073",
  1690. "mso.dll.#4255",
  1691. "mso.dll.#3459",
  1692. "mso.dll.#1262",
  1693. "mso.dll.#5709",
  1694. "mso.dll.#7353",
  1695. "mso.dll.#5228",
  1696. "mso.dll.#2155",
  1697. "mso.dll.#1283",
  1698. "mso.dll.#2024",
  1699. "mso.dll.#5274",
  1700. "mso.dll.#3195",
  1701. "mso.dll.#6221",
  1702. "mso.dll.#2314",
  1703. "mso.dll.#408",
  1704. "mso.dll.#2714",
  1705. "mso.dll.#8622",
  1706. "mso.dll.#3380",
  1707. "mso.dll.#2052",
  1708. "mso.dll.#677",
  1709. "mso.dll.#469",
  1710. "mso.dll.#7974",
  1711. "mso.dll.#2609",
  1712. "mso.dll.#8499",
  1713. "oleaut32.dll.#7",
  1714. "secur32.dll.FreeContextBuffer",
  1715. "ncrypt.dll.SslOpenProvider",
  1716. "ncrypt.dll.GetSChannelInterface",
  1717. "bcryptprimitives.dll.GetHashInterface",
  1718. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1719. "ncrypt.dll.SslImportKey",
  1720. "bcryptprimitives.dll.GetCipherInterface",
  1721. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1722. "user32.dll.LoadStringW",
  1723. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1724. "ncrypt.dll.BCryptGetProperty",
  1725. "ncrypt.dll.BCryptCreateHash",
  1726. "ncrypt.dll.BCryptHashData",
  1727. "ncrypt.dll.BCryptFinishHash",
  1728. "ncrypt.dll.BCryptDestroyHash",
  1729. "crypt32.dll.CertGetCertificateChain",
  1730. "userenv.dll.GetUserProfileDirectoryW",
  1731. "sechost.dll.ConvertSidToStringSidW",
  1732. "sechost.dll.ConvertStringSidToSidW",
  1733. "userenv.dll.RegisterGPNotification",
  1734. "gpapi.dll.RegisterGPNotificationInternal",
  1735. "sechost.dll.OpenSCManagerW",
  1736. "sechost.dll.OpenServiceW",
  1737. "sechost.dll.CloseServiceHandle",
  1738. "sechost.dll.QueryServiceConfigW",
  1739. "cryptsp.dll.CryptAcquireContextA",
  1740. "cryptsp.dll.CryptCreateHash",
  1741. "cryptsp.dll.CryptHashData",
  1742. "cryptsp.dll.CryptVerifySignatureA",
  1743. "cryptsp.dll.CryptDestroyKey",
  1744. "cryptsp.dll.CryptDestroyHash",
  1745. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1746. "ncrypt.dll.BCryptImportKeyPair",
  1747. "ncrypt.dll.BCryptVerifySignature",
  1748. "ncrypt.dll.BCryptDestroyKey",
  1749. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1750. "crypt32.dll.CertFreeCertificateChain",
  1751. "crypt32.dll.CertDuplicateCertificateContext",
  1752. "ncrypt.dll.SslEncryptPacket",
  1753. "ncrypt.dll.SslDecryptPacket",
  1754. "winhttp.dll.WinHttpReceiveResponse",
  1755. "winhttp.dll.WinHttpQueryHeaders",
  1756. "winhttp.dll.WinHttpQueryDataAvailable",
  1757. "winhttp.dll.WinHttpReadData",
  1758. "webservices.dll.WsCreateError",
  1759. "ntdll.dll.EtwEventWrite",
  1760. "ntdll.dll.EtwEventRegister",
  1761. "ntdll.dll.EtwEventUnregister",
  1762. "webservices.dll.WsCreateHeap",
  1763. "webservices.dll.WsCreateReader",
  1764. "webservices.dll.WsSetInput",
  1765. "webservices.dll.WsFillReader",
  1766. "webservices.dll.WsReadToStartElement",
  1767. "webservices.dll.WsReadStartElement",
  1768. "webservices.dll.WsReadType",
  1769. "winhttp.dll.WinHttpCloseHandle",
  1770. "crypt32.dll.CertFreeCertificateContext",
  1771. "rpcrt4.dll.RpcBindingFree",
  1772. "webservices.dll.WsFreeReader",
  1773. "webservices.dll.WsFreeError",
  1774. "webservices.dll.WsFreeHeap",
  1775. "webservices.dll.WsCreateServiceProxyFromTemplate",
  1776. "winhttp.dll.WinHttpOpenRequest",
  1777. "winhttp.dll.WinHttpAddRequestHeaders",
  1778. "winhttp.dll.WinHttpSendRequest",
  1779. "winhttp.dll.WinHttpConnect",
  1780. "winhttp.dll.WinHttpCrackUrl",
  1781. "winhttp.dll.WinHttpSetStatusCallback",
  1782. "winhttp.dll.WinHttpOpen",
  1783. "winhttp.dll.WinHttpSetOption",
  1784. "winhttp.dll.WinHttpWriteData",
  1785. "winhttp.dll.WinHttpSetCredentials",
  1786. "winhttp.dll.WinHttpQueryAuthSchemes",
  1787. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1788. "winhttp.dll.WinHttpGetProxyForUrl",
  1789. "winhttp.dll.WinHttpQueryOption",
  1790. "webservices.dll.WsOpenServiceProxy",
  1791. "webservices.dll.WsCall",
  1792. "webservices.dll.WsAddCustomHeader",
  1793. "shlwapi.dll.StrStrA",
  1794. "shlwapi.dll.UrlUnescapeA",
  1795. "mso.dll.#1725",
  1796. "user32.dll.RegisterWindowMessageW",
  1797. "mso.dll.#4314",
  1798. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1799. "mso.dll.#6484",
  1800. "mso.dll.#9871",
  1801. "mso.dll.#4743",
  1802. "mso.dll.#5452",
  1803. "mso.dll.#2088",
  1804. "mso.dll.#5315",
  1805. "mso.dll.#8140",
  1806. "user32.dll.IsWindowEnabled",
  1807. "ole32.dll.CoGetCallState",
  1808. "ole32.dll.CoGetActivationState",
  1809. "advapi32.dll.RegisterWaitChainCOMCallback",
  1810. "cryptnet.dll.CertDllVerifyRevocation",
  1811. "profapi.dll.#104",
  1812. "sensapi.dll.IsNetworkAlive",
  1813. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1814. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1815. "rpcrt4.dll.NdrClientCall2",
  1816. "winhttp.dll.WinHttpSetTimeouts",
  1817. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1818. "winhttp.dll.WinHttpTimeFromSystemTime",
  1819. "shlwapi.dll.StrStrIW",
  1820. "user32.dll.IsHungAppWindow",
  1821. "user32.dll.RegisterPowerSettingNotification",
  1822. "powrprof.dll.PowerSettingRegisterNotification",
  1823. "user32.dll.GetWindowThreadProcessId",
  1824. "user32.dll.GetWindowTextW",
  1825. "mso.dll.#9175",
  1826. "user32.dll.SetRect",
  1827. "mso.dll.#25",
  1828. "mso.dll.#1056",
  1829. "mso.dll.#8136",
  1830. "mso.dll.#8931",
  1831. "shell32.dll.SHGetFileInfoW",
  1832. "mso.dll.#5362",
  1833. "mso.dll.#6044",
  1834. "mso.dll.#6516",
  1835. "mso.dll.#5780",
  1836. "mso.dll.#4870",
  1837. "mso.dll.#6046",
  1838. "mso.dll.#1241",
  1839. "mso.dll.#2821",
  1840. "mso.dll.#2340",
  1841. "mso.dll.#7287",
  1842. "mso.dll.#5290",
  1843. "mso.dll.#1508",
  1844. "user32.dll.IsZoomed",
  1845. "user32.dll.GetWindowPlacement",
  1846. "user32.dll.GetWindowRect",
  1847. "mso.dll.#821",
  1848. "user32.dll.GetSystemMetrics",
  1849. "user32.dll.MonitorFromWindow",
  1850. "user32.dll.MonitorFromRect",
  1851. "user32.dll.MonitorFromPoint",
  1852. "user32.dll.EnumDisplayMonitors",
  1853. "user32.dll.GetMonitorInfoA",
  1854. "user32.dll.EnumDisplayDevicesA",
  1855. "mso.dll.#2378",
  1856. "user32.dll.SetWindowPos",
  1857. "user32.dll.AdjustWindowRect",
  1858. "mso.dll.#5912",
  1859. "mso.dll.#9719",
  1860. "mso.dll.#8824",
  1861. "mso.dll.#6117",
  1862. "mso.dll.#3307",
  1863. "user32.dll.SendMessageW",
  1864. "user32.dll.DestroyIcon",
  1865. "mso.dll.#3813",
  1866. "mso.dll.#1815",
  1867. "user32.dll.PtInRect",
  1868. "mso.dll.#1613",
  1869. "user32.dll.SetWindowTextW",
  1870. "user32.dll.GetClassLongW",
  1871. "mso.dll.#8572",
  1872. "gdi32.dll.CreateDIBSection",
  1873. "gdi32.dll.CreateCompatibleDC",
  1874. "gdi32.dll.GetViewportOrgEx",
  1875. "gdi32.dll.SetViewportOrgEx",
  1876. "gdi32.dll.SetBkColor",
  1877. "gdi32.dll.ExtTextOutA",
  1878. "mso.dll.#1573",
  1879. "mso.dll.#8612",
  1880. "user32.dll.SetScrollRange",
  1881. "mso.dll.#2509",
  1882. "user32.dll.BeginDeferWindowPos",
  1883. "user32.dll.DeferWindowPos",
  1884. "user32.dll.EndDeferWindowPos",
  1885. "user32.dll.OffsetRect",
  1886. "user32.dll.EnumChildWindows",
  1887. "user32.dll.GetScrollInfo",
  1888. "gdi32.dll.DeleteDC",
  1889. "user32.dll.MapWindowPoints",
  1890. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  1891. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  1892. "mso.dll.#6126",
  1893. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  1894. "gdi32.dll.GetFontRealizationInfo",
  1895. "gdi32.dll.GetFontFileInfo",
  1896. "gdi32.dll.GetFontFileData",
  1897. "mso.dll.#7261",
  1898. "mso.dll.#9540",
  1899. "usp10.dll.ScriptGetFontScriptTags",
  1900. "usp10.dll.ScriptGetFontLanguageTags",
  1901. "usp10.dll.ScriptGetFontFeatureTags",
  1902. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  1903. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  1904. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  1905. "gdiplus.dll.GdipCreatePath",
  1906. "gdiplus.dll.GdipStartPathFigure",
  1907. "gdiplus.dll.GdipAddPathLine2",
  1908. "gdiplus.dll.GdipClosePathFigure",
  1909. "gdiplus.dll.GdipCreateMatrix2",
  1910. "gdiplus.dll.GdipTransformPath",
  1911. "gdiplus.dll.GdipDeleteMatrix",
  1912. "gdiplus.dll.GdipGetPathWorldBounds",
  1913. "gdiplus.dll.GdipCreatePathIter",
  1914. "gdiplus.dll.GdipPathIterRewind",
  1915. "gdiplus.dll.GdipPathIterNextSubpath",
  1916. "gdiplus.dll.GdipPathIterCopyData",
  1917. "gdiplus.dll.GdipDeletePathIter",
  1918. "gdiplus.dll.GdipAddPathLine",
  1919. "gdiplus.dll.GdipDeletePath",
  1920. "gdiplus.dll.GdipClonePath",
  1921. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  1922. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  1923. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  1924. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  1925. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  1926. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  1927. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  1928. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  1929. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  1930. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  1931. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  1932. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  1933. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  1934. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  1935. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  1936. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  1937. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  1938. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  1939. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  1940. "mso.dll.#2566",
  1941. "mso.dll.#1429",
  1942. "mso.dll.#6502",
  1943. "uiautomationcore.dll.UiaClientsAreListening",
  1944. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  1945. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  1946. "user32.dll.SetRectEmpty",
  1947. "user32.dll.IntersectRect",
  1948. "user32.dll.InflateRect",
  1949. "mso.dll.#1100",
  1950. "mso.dll.#7047",
  1951. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  1952. "user32.dll.GetCursor",
  1953. "user32.dll.GetClientRect",
  1954. "user32.dll.SetScrollInfo",
  1955. "user32.dll.SetScrollPos",
  1956. "mso.dll.#3747",
  1957. "mso.dll.#8218",
  1958. "mso.dll.#5394",
  1959. "mso.dll.#331",
  1960. "mso.dll.#6829",
  1961. "mso.dll.#539",
  1962. "mso.dll.#4959",
  1963. "mso.dll.#6463",
  1964. "mso.dll.#4987",
  1965. "user32.dll.GetWindow",
  1966. "mso.dll.#7195",
  1967. "mso.dll.#7573",
  1968. "mso.dll.#445",
  1969. "user32.dll.GetCaretBlinkTime",
  1970. "user32.dll.CreateCaret",
  1971. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  1972. "user32.dll.DestroyCaret",
  1973. "user32.dll.GetCaretPos",
  1974. "user32.dll.SetCaretPos",
  1975. "mso.dll.#5932",
  1976. "mso.dll.#2071",
  1977. "mso.dll.#1024",
  1978. "mso.dll.#6245",
  1979. "mso.dll.#9041",
  1980. "mso.dll.#1767",
  1981. "mso.dll.#9369",
  1982. "mso.dll.#4617",
  1983. "user32.dll.FillRect",
  1984. "mso.dll.#343",
  1985. "mso.dll.#9636",
  1986. "mso.dll.#2022",
  1987. "mso.dll.#4750",
  1988. "mso.dll.#4577",
  1989. "mso.dll.#850",
  1990. "mso.dll.#1776",
  1991. "mso.dll.#9026",
  1992. "mso.dll.#4497",
  1993. "mso.dll.#4647",
  1994. "mso.dll.#8926",
  1995. "mso.dll.#7212",
  1996. "mso.dll.#5407",
  1997. "mso.dll.#5152",
  1998. "mso.dll.#3327",
  1999. "shell32.dll.SHAddToRecentDocs",
  2000. "mso.dll.#6333",
  2001. "mso.dll.#420",
  2002. "ole32.dll.PropVariantClear",
  2003. "oleaut32.dll.#9",
  2004. "mso.dll.#1335",
  2005. "mso.dll.#2041",
  2006. "mso.dll.#7834",
  2007. "mso.dll.#239",
  2008. "mso.dll.#6357",
  2009. "mso.dll.#7026",
  2010. "mso.dll.#1671",
  2011. "mso.dll.#8263",
  2012. "mso.dll.#9307",
  2013. "mso.dll.#1441",
  2014. "mso.dll.#9223",
  2015. "mso.dll.#6453",
  2016. "mso.dll.#8044",
  2017. "mso.dll.#3698",
  2018. "mso.dll.#8565",
  2019. "mso.dll.#8373",
  2020. "mso.dll.#9741",
  2021. "mso.dll.#478",
  2022. "mso.dll.#479",
  2023. "mso.dll.#340",
  2024. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2025. "bcrypt.dll.BCryptGetProperty",
  2026. "bcrypt.dll.BCryptCreateHash",
  2027. "bcrypt.dll.BCryptHashData",
  2028. "bcrypt.dll.BCryptFinishHash",
  2029. "bcrypt.dll.BCryptDestroyHash",
  2030. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2031. "mso.dll.#8633",
  2032. "mso.dll.#5213",
  2033. "mso.dll.#6163",
  2034. "mso.dll.#552",
  2035. "mso.dll.#5630",
  2036. "mso.dll.#2513",
  2037. "mso.dll.#1607",
  2038. "mso.dll.#791",
  2039. "mso.dll.#1848",
  2040. "mso.dll.#8735",
  2041. "mso.dll.#9374",
  2042. "mso.dll.#5286",
  2043. "mso.dll.#6368",
  2044. "mso.dll.#4262",
  2045. "mso.dll.#1010",
  2046. "mso.dll.#7979",
  2047. "mso.dll.#8549",
  2048. "mso.dll.#8970",
  2049. "mso.dll.#9198",
  2050. "mso.dll.#4795",
  2051. "mso.dll.#1865",
  2052. "mso.dll.#9688",
  2053. "mso.dll.#320",
  2054. "advapi32.dll.RegDeleteKeyA",
  2055. "user32.dll.DestroyCursor",
  2056. "mso.dll.#7173",
  2057. "mso.dll.#8511",
  2058. "mso.dll.#3299",
  2059. "mso.dll.#7001",
  2060. "mso.dll.#3913",
  2061. "user32.dll.PeekMessageA",
  2062. "mso.dll.#1380",
  2063. "mso.dll.#9500",
  2064. "user32.dll.TranslateMessage",
  2065. "user32.dll.IsWindowUnicode",
  2066. "user32.dll.DispatchMessageA",
  2067. "user32.dll.DispatchMessageW",
  2068. "user32.dll.GetForegroundWindow",
  2069. "user32.dll.UpdateWindow",
  2070. "mso.dll.#999",
  2071. "mso.dll.#287",
  2072. "dwmapi.dll.DwmIsCompositionEnabled",
  2073. "mso.dll.#1575",
  2074. "mso.dll.#5034",
  2075. "mso.dll.#1517",
  2076. "mso.dll.#718",
  2077. "mso.dll.#4708",
  2078. "mso.dll.#8046",
  2079. "mso.dll.#4175",
  2080. "mso.dll.#8672",
  2081. "mso.dll.#1990",
  2082. "mso.dll.#3051",
  2083. "mso.dll.#1819",
  2084. "mso.dll.#1419",
  2085. "oleaut32.dll.#147",
  2086. "kernel32.dll.WerRegisterMemoryBlock",
  2087. "dwrite.dll.DWriteCreateFactory",
  2088. "advapi32.dll.RegQueryValueW",
  2089. "apphelp.dll.ApphelpCheckShellObject",
  2090. "gdi32.dll.GetCurrentObject",
  2091. "gdi32.dll.BitBlt",
  2092. "gdi32.dll.GetClipBox",
  2093. "gdi32.dll.StretchDIBits",
  2094. "ole32.dll.CoRevokeInitializeSpy",
  2095. "comctl32.dll.#388",
  2096. "riched20.dll.REExtendedRegisterClass",
  2097. "user32.dll.GetWindowLongW",
  2098. "user32.dll.GetSysColor",
  2099. "user32.dll.SetWindowLongW",
  2100. "user32.dll.RegisterWindowMessageA",
  2101. "user32.dll.RegisterClipboardFormatW",
  2102. "user32.dll.GetDoubleClickTime",
  2103. "user32.dll.SetCaretBlinkTime",
  2104. "user32.dll.SystemParametersInfoW",
  2105. "user32.dll.GetKeyboardLayoutList",
  2106. "mso.dll._MsoGetFidUspDll@0",
  2107. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2108. "usp10.dll.ScriptGetProperties",
  2109. "usp10.dll.ScriptItemize",
  2110. "user32.dll.LoadCursorW",
  2111. "user32.dll.IsWindowVisible",
  2112. "user32.dll.GetKeyboardLayout",
  2113. "user32.dll.PostMessageW",
  2114. "user32.dll.DefWindowProcW",
  2115. "uxtheme.dll.IsThemeActive",
  2116. "uxtheme.dll.IsAppThemed",
  2117. "uxtheme.dll.OpenThemeData",
  2118. "user32.dll.GetDC",
  2119. "user32.dll.ReleaseDC",
  2120. "user32.dll.IsIconic",
  2121. "user32.dll.GetParent",
  2122. "usp10.dll.ScriptGetCMap",
  2123. "user32.dll.InvalidateRect",
  2124. "user32.dll.HideCaret",
  2125. "user32.dll.ShowCaret",
  2126. "user32.dll.NotifyWinEvent",
  2127. "user32.dll.GetWindowTextLengthW",
  2128. "user32.dll.EnableWindow",
  2129. "msctf.dll.SetInputScope",
  2130. "user32.dll.GetWindowRgn",
  2131. "gdi32.dll.CreateCompatibleBitmap",
  2132. "gdi32.dll.SaveDC",
  2133. "gdi32.dll.SetPixel",
  2134. "gdi32.dll.GetPixel",
  2135. "gdi32.dll.RestoreDC",
  2136. "imm32.dll.ImmAssociateContext",
  2137. "mso.dll.#806",
  2138. "mso.dll.#4908",
  2139. "mso.dll.#8439",
  2140. "mso.dll.#2736",
  2141. "gdi32.dll.GetTextAlign",
  2142. "gdi32.dll.ExtTextOutW",
  2143. "mso.dll.#8122",
  2144. "mso.dll.#2114",
  2145. "mso.dll.#6558",
  2146. "gdi32.dll.GetFontData",
  2147. "usp10.dll.ScriptItemizeOpenType",
  2148. "usp10.dll.ScriptLayout",
  2149. "usp10.dll.ScriptShapeOpenType",
  2150. "usp10.dll.ScriptPlaceOpenType",
  2151. "mso.dll.#1318",
  2152. "gdi32.dll.GetTextExtentExPointWPri",
  2153. "ws2_32.dll.#116",
  2154. "mso.dll.#8395",
  2155. "mso.dll.#379",
  2156. "mso.dll.#6338",
  2157. "mso.dll.#7964",
  2158. "mso.dll.#1437",
  2159. "mso.dll.#1427",
  2160. "mso.dll.#6137",
  2161. "winmm.dll.timeGetTime",
  2162. "mso.dll.#7578",
  2163. "mso.dll.#8483",
  2164. "mso.dll.#3055",
  2165. "user32.dll.GetFocus",
  2166. "user32.dll.GetClassNameA",
  2167. "user32.dll.IsWindowRedirectedForPrint",
  2168. "gdi32.dll.CreateRectRgnIndirect",
  2169. "user32.dll.GetUpdateRgn",
  2170. "gdi32.dll.GetRgnBox",
  2171. "user32.dll.ValidateRect",
  2172. "user32.dll.GetUpdateRect",
  2173. "user32.dll.BeginPaint",
  2174. "user32.dll.EndPaint",
  2175. "mso.dll.#3624",
  2176. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2177. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2178. "gdi32.dll.TranslateCharsetInfo",
  2179. "mso.dll.#3300",
  2180. "mso.dll.#7465",
  2181. "mso.dll.#6247",
  2182. "mso.dll.#5070",
  2183. "gdiplus.dll.GdipCreateSolidFill",
  2184. "gdiplus.dll.GdipCreatePen1",
  2185. "gdiplus.dll.GdipSetPenLineCap197819",
  2186. "gdiplus.dll.GdipSetPenLineJoin",
  2187. "gdiplus.dll.GdipSetPenMiterLimit",
  2188. "gdiplus.dll.GdipCreateFromHDC",
  2189. "gdiplus.dll.GdipSetPixelOffsetMode",
  2190. "gdiplus.dll.GdipSetSmoothingMode",
  2191. "gdiplus.dll.GdipSetCompositingQuality",
  2192. "gdiplus.dll.GdipSetPageUnit",
  2193. "gdiplus.dll.GdipSetInterpolationMode",
  2194. "gdiplus.dll.GdipGetSmoothingMode",
  2195. "gdiplus.dll.GdipFillPath",
  2196. "gdiplus.dll.GdipDeleteGraphics",
  2197. "gdiplus.dll.GdipDrawPath",
  2198. "mso.dll.#6899",
  2199. "gdi32.dll.GetClipRgn",
  2200. "gdi32.dll.SelectClipRgn",
  2201. "advapi32.dll.RegDeleteTreeW",
  2202. "gdi32.dll.SetWindowOrgEx",
  2203. "mso.dll.#732",
  2204. "mso.dll.#5804",
  2205. "mso.dll.#9465",
  2206. "ole32.dll.CoCreateInstance",
  2207. "xmllite.dll.CreateXmlReader",
  2208. "mso.dll.#434",
  2209. "user32.dll.GetMessageExtraInfo",
  2210. "user32.dll.TrackMouseEvent",
  2211. "user32.dll.GetInputState",
  2212. "mso.dll.#8461",
  2213. "user32.dll.GetClipboardOwner",
  2214. "mso.dll.#1422",
  2215. "user32.dll.MsgWaitForMultipleObjectsEx",
  2216. "user32.dll.SendNotifyMessageW",
  2217. "advapi32.dll.NotifyServiceStatusChangeW",
  2218. "ws2_32.dll.#3",
  2219. "ws2_32.dll.WSAGetOverlappedResult",
  2220. "cryptnet.dll.I_CryptNetGetConnectivity",
  2221. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2222. "ncrypt.dll.SslFreeObject",
  2223. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2224. "advapi32.dll.CryptAcquireContextA",
  2225. "advapi32.dll.CryptGenKey",
  2226. "cryptsp.dll.CryptGenKey",
  2227. "advapi32.dll.CryptImportKey",
  2228. "cryptsp.dll.CryptImportKey",
  2229. "advapi32.dll.CryptExportKey",
  2230. "cryptsp.dll.CryptExportKey",
  2231. "advapi32.dll.CryptDestroyKey",
  2232. "setupapi.dll.SetupIterateCabinetW",
  2233. "kernel32.dll.RegOpenKeyExW",
  2234. "kernel32.dll.RegCloseKey",
  2235. "cabinet.dll.#20",
  2236. "cabinet.dll.#22",
  2237. "devrtl.dll.DevRtlGetThreadLogToken",
  2238. "cryptsp.dll.CryptSetHashParam",
  2239. "sechost.dll.QueryServiceConfigA",
  2240. "sechost.dll.QueryServiceStatus",
  2241. "rpcrt4.dll.RpcStringBindingComposeA",
  2242. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2243. "rpcrt4.dll.RpcEpResolveBinding",
  2244. "sechost.dll.LookupAccountSidLocalW",
  2245. "rpcrt4.dll.RpcStringFreeA",
  2246. "webservices.dll.WsResetHeap",
  2247. "webservices.dll.WsCloseServiceProxy",
  2248. "webservices.dll.WsFreeServiceProxy",
  2249. "advapi32.dll.CryptCreateHash",
  2250. "advapi32.dll.CryptSetHashParam",
  2251. "advapi32.dll.CryptHashData",
  2252. "advapi32.dll.CryptGetHashParam",
  2253. "cryptsp.dll.CryptGetHashParam",
  2254. "advapi32.dll.CryptDestroyHash",
  2255. "msi.dll.#90",
  2256. "msi.dll.#111",
  2257. "kernel32.dll.FlsAlloc",
  2258. "kernel32.dll.FlsGetValue",
  2259. "kernel32.dll.FlsSetValue",
  2260. "kernel32.dll.FlsFree",
  2261. "ieawsdc.dll.HrExtractTemplateToPath",
  2262. "user32.dll.GetWindowDC",
  2263. "gdi32.dll.SetLayout",
  2264. "gdi32.dll.RectVisible",
  2265. "gdi32.dll.ExcludeClipRect",
  2266. "mso.dll.#1414",
  2267. "mso.dll.#8202",
  2268. "mso.dll.#7189",
  2269. "mso.dll.#2738",
  2270. "mso.dll.#8691",
  2271. "mso.dll.#6079",
  2272. "mso.dll.#7167",
  2273. "mso.dll.#7163",
  2274. "user32.dll.GetDesktopWindow",
  2275. "mso.dll.#333",
  2276. "mso.dll.#1785",
  2277. "mso.dll.#5919",
  2278. "user32.dll.DestroyWindow",
  2279. "user32.dll.RemovePropW",
  2280. "mso.dll.#5973",
  2281. "mso.dll.#2014",
  2282. "gdiplus.dll.GdipDeleteBrush",
  2283. "gdiplus.dll.GdipDeletePen",
  2284. "mso.dll.#9668",
  2285. "mso.dll.#8472",
  2286. "mso.dll.#2294",
  2287. "mso.dll.#2968",
  2288. "mso.dll.#1966",
  2289. "mso.dll.#2281",
  2290. "mso.dll.#2628",
  2291. "mso.dll.#1401",
  2292. "mso.dll.#3425",
  2293. "mso.dll.#5291",
  2294. "mso.dll.#1718",
  2295. "mso.dll.#4777",
  2296. "mso.dll.#1914",
  2297. "advapi32.dll.RegDeleteKeyW",
  2298. "mso.dll.#235",
  2299. "mso.dll.#4416",
  2300. "mso.dll.#9398",
  2301. "mso.dll.#1442",
  2302. "mso.dll.#4388",
  2303. "mso.dll.#8022",
  2304. "mso.dll.#8757",
  2305. "mso.dll.#237",
  2306. "mso.dll.#4214",
  2307. "mso.dll.#884",
  2308. "mso.dll.#121",
  2309. "mso.dll.#1712",
  2310. "crypt32.dll.CryptQueryObject",
  2311. "mso.dll.#4203",
  2312. "mso.dll.#3974",
  2313. "mso.dll.#4882",
  2314. "mso.dll.#2449",
  2315. "mso.dll.#2767",
  2316. "mso.dll.#9199",
  2317. "mso.dll.#7948",
  2318. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2319. "mso.dll.#3209",
  2320. "mso.dll.#4083",
  2321. "mso.dll.#292",
  2322. "mso.dll.#795",
  2323. "mso.dll.#8349",
  2324. "mso.dll.#8796",
  2325. "mso.dll.#3930",
  2326. "mso.dll.#9105",
  2327. "mso.dll.#2427",
  2328. "mso.dll.#8116",
  2329. "mso.dll.#6156",
  2330. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2331. "cryptsp.dll.CryptGetDefaultProviderW",
  2332. "cryptsp.dll.CryptAcquireContextW",
  2333. "crypt32.dll.CertEnumCertificatesInStore",
  2334. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2335. "cryptsp.dll.CryptReleaseContext",
  2336. "wintrust.dll.WinVerifyTrust",
  2337. "user32.dll.KillTimer",
  2338. "uxtheme.dll.CloseThemeData",
  2339. "user32.dll.UnregisterClassW",
  2340. "wintrust.dll.WintrustCertificateTrust",
  2341. "wintrust.dll.SoftpubAuthenticode",
  2342. "wintrust.dll.SoftpubInitialize",
  2343. "wintrust.dll.SoftpubLoadMessage",
  2344. "wintrust.dll.SoftpubLoadSignature",
  2345. "wintrust.dll.SoftpubCheckCert",
  2346. "wintrust.dll.SoftpubCleanup",
  2347. "usp10.dll.ScriptFreeCache",
  2348. "user32.dll.UnhookWindowsHookEx",
  2349. "mso.dll.#7002",
  2350. "mso.dll.#186",
  2351. "user32.dll.PostQuitMessage",
  2352. "mso.dll.#591",
  2353. "advapi32.dll.RegDeleteValueW",
  2354. "mso.dll.#2272",
  2355. "mso.dll.#4284",
  2356. "wintrust.dll.CryptSIPVerifyIndirectData",
  2357. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  2358. "mso.dll.#4426",
  2359. "mso.dll.#8473",
  2360. "mso.dll.#8106",
  2361. "mso.dll.#8876",
  2362. "mso.dll.#4210",
  2363. "mso.dll.#8586",
  2364. "mso.dll.#8004",
  2365. "mso.dll.#6078",
  2366. "mso.dll.#815",
  2367. "mso.dll.#187",
  2368. "mso.dll.#5625",
  2369. "mso.dll.#8316",
  2370. "mso.dll.#7598",
  2371. "advapi32.dll.SaferiSearchMatchingHashRules",
  2372. "wintrust.dll.WTHelperProvDataFromStateData",
  2373. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2374. "crypt32.dll.CertCloseStore",
  2375. "cabinet.dll.#23",
  2376. "advapi32.dll.ConvertSidToStringSidW",
  2377. "msi.dll.DllGetVersion",
  2378. "user32.dll.RemoveClipboardFormatListener",
  2379. "user32.dll.UnregisterPowerSettingNotification",
  2380. "powrprof.dll.PowerSettingUnregisterNotification",
  2381. "advapi32.dll.CryptReleaseContext",
  2382. "shell32.dll.#155",
  2383. "advapi32.dll.EventUnregister",
  2384. "user32.dll.UnregisterClassA",
  2385. "gdiplus.dll.GdiplusShutdown",
  2386. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  2387. "winsta.dll.WinStationUnRegisterConsoleNotification",
  2388. "mso.dll.#2482",
  2389. "mso.dll.#5458",
  2390. "advapi32.dll.UnregisterTraceGuids",
  2391. "comctl32.dll.#321"
  2392. ]
  2393.  
  2394. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!