suspicious office child http cache

sequence  with maxspan=30s
[registry where process.name : "winword.exe" and 
 registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\Office\\*\\Common\\Internet\\Server Cache\\https*"] by process.entity_id
[file where event.action == "creation" and 
 file.path : "?:\\Users\\*\\AppData\\*\\Content.MSO\\*" and process.name : "winword.exe" and 
 file.extension : "htm*" and file.size >= 4096] by process.entity_id
 [process where event.action == "start" and process.parent.name : "winword.exe" and 
 not process.name : ("splwow64.exe", "DWWIN.EXE", "WerFault.exe")] by process.parent.entity_id