API tools faq
paste
paladin316

Exes_40b111fdffe33c4c776d87ce7ff02431_jpg_2019-07-31_04_30.txt

paladin316
Jul 31st, 2019
2,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.45 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_40b111fdffe33c4c776d87ce7ff02431.jpg"
  7. * File Size: 1107632
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "1caf5105988781e29d93e58abcbf3bf4c973eca1a207803629bd5cf901ef5be1"
  10. * MD5: "40b111fdffe33c4c776d87ce7ff02431"
  11. * SHA1: "dd6eee81a397d0b94c3532d62c613070501d0048"
  12. * SHA512: "07ef4139a40d8f08acb489c4c1ced0ffe787f536d59d185ef43aaa0f17e391ca000b8c1c10813feb573241314000b7a91d52fcfcaaa4311f73432cdaaa0f921b"
  13. * CRC32: "A32E4B0E"
  14. * SSDEEP: "24576:LzWuYg/8kz9ncHy/B5uwMp1p4pGj3m91dscI/P:LCuYA8kZnpB5uw+1p44S91gP"
  15.  
  16. * Process Execution:
  17. "Exes_40b111fdffe33c4c776d87ce7ff02431.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details":
  40.  
  41. "IP": "128.31.0.39:9101"
  42.  
  43.  
  44. "IP": "104.16.154.36:80"
  45.  
  46.  
  47. "IP": "104.237.156.214:3971"
  48.  
  49.  
  50. "IP": "205.185.119.222:443"
  51.  
  52.  
  53. "IP": "86.59.21.38:443"
  54.  
  55.  
  56. "IP": "127.0.0.1:53278"
  57.  
  58.  
  59. "IP": "144.76.107.124:9001"
  60.  
  61.  
  62. "IP": "104.18.35.131:80"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "Starts servers listening on 127.0.0.1:53278",
  68. "Details":
  69.  
  70.  
  71. "Description": "Reads data out of its own binary image",
  72. "Details":
  73.  
  74. "self_read": "process: Exes_40b111fdffe33c4c776d87ce7ff02431.jpg, pid: 696, offset: 0x00000000, length: 0x0010e6b0"
  75.  
  76.  
  77.  
  78.  
  79. "Description": "Performs some HTTP requests",
  80. "Details":
  81.  
  82. "url": "http://whatismyipaddress.com/"
  83.  
  84.  
  85. "url": "http://whatsmyip.net/"
  86.  
  87.  
  88.  
  89.  
  90. "Description": "The binary likely contains encrypted or compressed data.",
  91. "Details":
  92.  
  93. "section": "name: .rdata, entropy: 7.49, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000f8400, virtual_size: 0x000f82c4"
  94.  
  95.  
  96.  
  97.  
  98. "Description": "Looks up the external IP address",
  99. "Details":
  100.  
  101. "domain": "whatismyipaddress.com"
  102.  
  103.  
  104.  
  105.  
  106. "Description": "Attempts to delete volume shadow copies",
  107. "Details":
  108.  
  109.  
  110. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  111. "Details":
  112.  
  113. "Spam": "Exes_40b111fdffe33c4c776d87ce7ff02431.jpg (696) called API LdrLoadDll 114100 times"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  119. "Details":
  120.  
  121. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  122.  
  123.  
  124.  
  125.  
  126. "Description": "Installs Tor on the infected machine",
  127. "Details":
  128.  
  129.  
  130. "Description": "Installs itself for autorun at Windows startup",
  131. "Details":
  132.  
  133. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  134.  
  135.  
  136. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  137.  
  138.  
  139.  
  140.  
  141. "Description": "Exhibits possible ransomware file modification behavior",
  142. "Details":
  143.  
  144. "file_modifications": "Performs 175 file moves indicative of a potential file encryption process"
  145.  
  146.  
  147. "drops_unknown_mimetypes": "Drops 163 unknown file mime types which may be indicative of encrypted files being written back to disk"
  148.  
  149.  
  150. "appends_new_extension": "Appends a new file extension to multiple modified files"
  151.  
  152.  
  153. "new_appended_file_extension": ".crypted000007"
  154.  
  155.  
  156.  
  157.  
  158. "Description": "Collects information about installed applications",
  159. "Details":
  160.  
  161. "Program": "Google Update Helper"
  162.  
  163.  
  164.  
  165.  
  166. "Program": "Microsoft Excel MUI 2013"
  167.  
  168.  
  169. "Program": "Microsoft Outlook MUI 2013"
  170.  
  171.  
  172.  
  173.  
  174. "Program": "Google Chrome"
  175.  
  176.  
  177. "Program": "Adobe Flash Player 29 NPAPI"
  178.  
  179.  
  180. "Program": "Adobe Flash Player 29 ActiveX"
  181.  
  182.  
  183. "Program": "Microsoft DCF MUI 2013"
  184.  
  185.  
  186. "Program": "Microsoft Access MUI 2013"
  187.  
  188.  
  189. "Program": "Microsoft Office Proofing Tools 2013 - English"
  190.  
  191.  
  192. "Program": "Adobe Acrobat Reader DC"
  193.  
  194.  
  195. "Program": "Microsoft Publisher MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft Office Shared MUI 2013"
  199.  
  200.  
  201. "Program": "Microsoft Office OSM MUI 2013"
  202.  
  203.  
  204. "Program": "Microsoft InfoPath MUI 2013"
  205.  
  206.  
  207. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  208.  
  209.  
  210. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  211.  
  212.  
  213. "Program": "Microsoft Word MUI 2013"
  214.  
  215.  
  216. "Program": "Microsoft OneDrive"
  217.  
  218.  
  219. "Program": "Microsoft Groove MUI 2013"
  220.  
  221.  
  222. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  223.  
  224.  
  225.  
  226.  
  227. "Program": "Microsoft Access Setup Metadata MUI 2013"
  228.  
  229.  
  230. "Program": "Microsoft Office OSM UX MUI 2013"
  231.  
  232.  
  233. "Program": "Java Auto Updater"
  234.  
  235.  
  236. "Program": "Microsoft PowerPoint MUI 2013"
  237.  
  238.  
  239. "Program": "Microsoft Office Professional Plus 2013"
  240.  
  241.  
  242. "Program": "Adobe Refresh Manager"
  243.  
  244.  
  245. "Program": "Microsoft Office Proofing 2013"
  246.  
  247.  
  248. "Program": "Microsoft Lync MUI 2013"
  249.  
  250.  
  251.  
  252.  
  253. "Program": "Microsoft OneNote MUI 2013"
  254.  
  255.  
  256.  
  257.  
  258. "Description": "Creates a hidden or system file",
  259. "Details":
  260.  
  261. "file": "C:\\ProgramData\\Windows\\"
  262.  
  263.  
  264.  
  265.  
  266. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  267. "Details":
  268.  
  269. "FireEye": "Generic.mg.40b111fdffe33c4c"
  270.  
  271.  
  272. "Invincea": "heuristic"
  273.  
  274.  
  275. "Cyren": "W32/Agent.BAE.gen!Eldorado"
  276.  
  277.  
  278. "Symantec": "Packed.Generic.459"
  279.  
  280.  
  281. "APEX": "Malicious"
  282.  
  283.  
  284. "Kaspersky": "not-a-virus:HEUR:NetTool.Win32.Generic"
  285.  
  286.  
  287. "F-Prot": "W32/Agent.BAE.gen!Eldorado"
  288.  
  289.  
  290. "Endgame": "malicious (high confidence)"
  291.  
  292.  
  293. "ZoneAlarm": "not-a-virus:HEUR:NetTool.Win32.Generic"
  294.  
  295.  
  296. "AhnLab-V3": "PUP/Win32.RL_Generic.R283889"
  297.  
  298.  
  299. "Acronis": "suspicious"
  300.  
  301.  
  302. "VBA32": "Malware-Cryptor.Kirgudu"
  303.  
  304.  
  305. "Cylance": "Unsafe"
  306.  
  307.  
  308. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  309.  
  310.  
  311. "Rising": "[email protected] (RDML:NagDsGpRI2ILWqSdRATdwQ)"
  312.  
  313.  
  314. "SentinelOne": "DFI - Malicious PE"
  315.  
  316.  
  317. "eGambit": "PE.Heur.InvalidSig"
  318.  
  319.  
  320. "Fortinet": "W32/Kryptik.GSVW!tr"
  321.  
  322.  
  323. "Cybereason": "malicious.1a397d"
  324.  
  325.  
  326. "CrowdStrike": "win/malicious_confidence_80% (D)"
  327.  
  328.  
  329.  
  330.  
  331. "Description": "Creates a copy of itself",
  332. "Details":
  333.  
  334. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Harvests information related to installed mail clients",
  340. "Details":
  341.  
  342. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  343.  
  344.  
  345.  
  346.  
  347. "Description": "Anomalous binary characteristics",
  348. "Details":
  349.  
  350. "anomaly": "Actual checksum does not match that reported in PE header"
  351.  
  352.  
  353.  
  354.  
  355. "Description": "Created network traffic indicative of malicious activity",
  356. "Details":
  357.  
  358. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 149"
  359.  
  360.  
  361. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 328"
  362.  
  363.  
  364. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 639"
  365.  
  366.  
  367. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 100"
  368.  
  369.  
  370.  
  371.  
  372.  
  373. * Started Service:
  374.  
  375. * Mutexes:
  376.  
  377. * Modified Files:
  378. "\\??\\PIPE\\wkssvc",
  379. "\\??\\PIPE\\srvsvc",
  380. "C:\\ProgramData\\Windows\\csrss.exe",
  381. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  382. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  383. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  384. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  385. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  386. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  387. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  391. "\\Device\\NamedPipe",
  392. "C:\\README1.txt",
  393. "C:\\README2.txt",
  394. "C:\\README3.txt",
  395. "C:\\README4.txt",
  396. "C:\\README5.txt",
  397. "C:\\README6.txt",
  398. "C:\\README7.txt",
  399. "C:\\README8.txt",
  400. "C:\\README9.txt",
  401. "C:\\README10.txt",
  402. "C:\\Users\\user\\Pictures\\Host.zip",
  403. "C:\\Users\\user\\Pictures\\DR+FjmcpnQKe3PAoZnNNhX3SjKFjCAmrGIj92fRpOwc=.C30C4DA81AE308962B9A.crypted000007",
  404. "C:\\Users\\user\\Pictures\\Host.xls",
  405. "C:\\Users\\user\\Pictures\\uPajIVyujdNIotfjDo4X3FpfV3iSqbL1qbC3zy2z01E=.C30C4DA81AE308962B9A.crypted000007",
  406. "C:\\Users\\user\\Pictures\\Host.pptx",
  407. "C:\\Users\\user\\Pictures\\71kgog-nAEFzMV845vY2DKRcqs8EV604LDHv6yQzRnE=.C30C4DA81AE308962B9A.crypted000007",
  408. "C:\\Users\\user\\Pictures\\Host.ppt",
  409. "C:\\Users\\user\\Pictures\\w25MdRYpmkjrDPfQV3gb0Uy729jDxvKV17-VIZVLoh0=.C30C4DA81AE308962B9A.crypted000007",
  410. "C:\\Users\\user\\Pictures\\Host.pdf",
  411. "C:\\Users\\user\\Pictures\\oyLpBThyJpBz5hd2LUTaxr9VcRiH7nIlWd8jF2DaFrA=.C30C4DA81AE308962B9A.crypted000007",
  412. "C:\\Users\\user\\Pictures\\Host.jpg",
  413. "C:\\Users\\user\\Pictures\\HNB3qODARfW8RdH5p4EyYt89Y52pg1pt6a8qAv+Bspc=.C30C4DA81AE308962B9A.crypted000007",
  414. "C:\\Users\\user\\Pictures\\Host.html",
  415. "C:\\Users\\user\\Pictures\\rUMpxWhiyxj-16ih-YnOsurDoO8GMYqjdCth7bOIpNI=.C30C4DA81AE308962B9A.crypted000007",
  416. "C:\\Users\\user\\Pictures\\Host.gif",
  417. "C:\\Users\\user\\Pictures\\cQD6GsUk4wErDtR0Fbh5QkMOWmACFhcdoCJ1ACNh94o=.C30C4DA81AE308962B9A.crypted000007",
  418. "C:\\Users\\user\\Pictures\\Host.doc",
  419. "C:\\Users\\user\\Pictures\\Eq3+iDeEdNi4FlJOA7TXMdRH7t-fXC+0yk-PnkmgSl4=.C30C4DA81AE308962B9A.crypted000007",
  420. "C:\\Users\\user\\Pictures\\.xls",
  421. "C:\\Users\\user\\Pictures\\Wn6Sl46u2DI+sv61nG7TPQ==.C30C4DA81AE308962B9A.crypted000007",
  422. "C:\\Users\\user\\Pictures\\.jpg",
  423. "C:\\Users\\user\\Pictures\\H6Kg+Dmxr1oIfLeLNVLh+A==.C30C4DA81AE308962B9A.crypted000007",
  424. "C:\\Users\\user\\Pictures\\.html",
  425. "C:\\Users\\user\\Pictures\\T1aohqGk9kLnTg2roLlvgg==.C30C4DA81AE308962B9A.crypted000007",
  426. "C:\\Users\\user\\Pictures\\.doc",
  427. "C:\\Users\\user\\Pictures\\BV3QksIDBvQOzQlPEr-siQ==.C30C4DA81AE308962B9A.crypted000007",
  428. "C:\\Users\\user\\Pictures\\.bmp",
  429. "C:\\Users\\user\\Pictures\\wOcKFla7YbCZJGd+Hp61iA==.C30C4DA81AE308962B9A.crypted000007",
  430. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  431. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\ehpt6Rqj+fyoSFLgf1fdiIxYH8IfKkzwR7eipMJN8lAt4qxkzqay47nJBMZfeyKrwjTCiTmmVfZ2DWbOyOJoAgvpGsbDkFCHdHtFOtdFjTFdbR+FS+z--DaJiAkdy6yB.C30C4DA81AE308962B9A.crypted000007",
  432. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  433. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\kbkCLM3Ul6SKl1M23rA1HKO6QyhGAYOMH-quWs3pQJs=.C30C4DA81AE308962B9A.crypted000007",
  434. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  435. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\4GE7fCjBr67rs1YexyObRAq-dXC1G0TJJXiCTWQf2p02TfV2mTiXQPP6KQli07Yz.C30C4DA81AE308962B9A.crypted000007",
  436. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  437. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\AfWDRLx8UmqRk6rVZYSSbV3LXIdPuHlpTWSQP65Q1cI=.C30C4DA81AE308962B9A.crypted000007",
  438. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\U+QCaSPcCgXebTL3pkyIgkrollK+ERVyIc3nB1o8NGM=.C30C4DA81AE308962B9A.crypted000007",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\A787jQ6Z-YVyN4-R5oRKkN4B3eGkicDV3--XNY7v+0U=.C30C4DA81AE308962B9A.crypted000007",
  442. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9++GEQw6BS-WdNncio+IKFxOQOXQLP8V3JfOSVCSMUCkBpfAcLFIwovA6wo1KwR9.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6cYNrpy9V6bUHIqPoIG-elH0QmyuCN4ASLvii8XcpOQ=.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\dAi4cn9-3O1HLAYpXz30HZf8L6mrGjzZ1feho7BcjDMpTKLy7HrsCUjsJa7gDaWl.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\raR48pl-CGLmbCMLps5wn5B8xeLGg9XQFcLDWqfUl7c=.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\2DVeqBaE2NZ5eTK-ehhkkSseDfBKuLELfNr0H3HGqqY=.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\b7cWht3TxCNJcYw-33AOnGD6M922yp2bDBJn6JIYrvo=.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Z-swOAaRgYJFNh4-UdCd3j1GcLfKKHGkr+l8p6r2fUs=.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qlQJPBbyWvRuBAB1PepkIYYkbA2YNihZyvWkaZ4wvopUFMn33YFYrfVclsfaizpa.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\BGuGiZLEguI0oJN3XKJgOjoDcbqpOzChDylC2Slljaw=.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uNIUa2YaEj5HNqj+E0l5Y4ho1xjbURjME4bJDe62Pe-UkSb8n6rW4rlutK9dtvYQ.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vVqIsrrwMcqEU2XLnaP1FSzZHHbA-u2qGdvgB3a7sic=.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ehc-Oaz5E5YiogD0Or7oVyIuioPDmeYdcS1XQducHCI=.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yxmIdcjAJK8dSgRph4tp4XTr3uvoK6qMwwUSY+hrDsY=.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\z+YSqUj5uOtppA1zowo182WLE54j9tJKDzRogih2nXI=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\be7c4pJNjg4XSgOzo51UOSQnvWMMLBWtj5FcbNU4Eyg=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\OkHadYM1iWpGwZ8KWdvSh6Hnjo-LEyq020kZB33WuT4=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\CFQgFKjolUb4wbGkh242Y1sWe4jQeiDn4aMsD9bJrz4=.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\-F8jEw2Wn+X3rJ1EAjN5VuQnJncZLWqAiLl6JFJNkro=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\+eYuM0EvizRVQcHAT02XgL6wNOgKXmCUSv+dbY60yU4=.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Rz56XIEBMrDh1Z0zhQ5K3LnBOr7kYx-2BLNhPSAsuis=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\FFblWegj0TcOz65RUpykJREfejgRuYuNXgDKvXWoPDU=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\CA6heT6Pd4Bu75OU3Bg0TYNkrGKNZC67sxT36dkNkJ8=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Nj7lWNRrWgUhhFrLoZhvqOqooh3CCW183nzl6AIdZvg=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\FO1uuMFUNQTcZ2kdtIDsiPrGn-UV1XR1INuAHaD2khE=.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\V5bLT5OU5dt09L+LkedVCc4s+yGgGl2e6Sf64ui-ysMKXc6Wfxn06RnusW-rUnGxlQOfq7cq8G4WF9YB+mv26w==.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\BjvQg58fUMbp4nUf7u1UCYXl6QGPbmR+ikKCBnKoTcMHur7HmtUS5pZHK-8hO1Q7vyREjL6HHPysy9bDIZFN0w==.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\-bVj5is7dj6tyCQnW5eBKfcBYeXdytbjOC3y56osMuN6ZGcmLPK-JfNuetIkHqGcSdOdxoLZOnvGDazCfBZ+zAxy8ACGwu2LRC22UF8+d1MiK8A818-+NdAHAwQiJBGHmVIqwiDRlF+H2Gd-fIC9OjcydRNQBU2RbMCVCysU3uG-60E3c6rjkJlQoIQlx-6r.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\rgS++0UYhSERAqc6Ptf-u0rXSWujz7IUu1JXftNQLFOnPwhlTeVMhdTe0eG+4GRjvNkUkiF+OJRlJKq0c+OyXA==.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ipld8eJ3-T7BpF15ID-t53a1Lb8Ne-70GlioAPf2xlbpN444Pg6vjbt07hUIDzlfytukI8vYJZyee9uHbsbZ7g==.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ZZUCrX3njq+Z7nDmgaj7C3x73pEWjJirbzTtULRhjgdezmvK0lswBIobU0RKXOsGEHMETeIwWUT1LC-ID99kpg==.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\JSNh44GwT-8FV9ZY6GlaNLEAEmawr+2HJHCGxn1D0CG7zFnIONwtqdqRBZ6I3PzQZI4INzVGAtu5DR+pv+GkFUP-stgh8us9QujJJIBnFff4FB0ooecrxZTPjSykOGcYKFljKEIv7IlmalP6f0iSOg==.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\lzL0guDxZ6L-QCOsAEFgClF2QWGEoAa2uPhaIMnSN+bxboZ8qezWOFrGhjNtAC0UT4JBqKn4gOUoe0nlyDrKYHCGlVCnYItuMu-WtXN2syE=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\4AhGo49OjJ5MogQvLZWLjWmmAN5TL9NrZpE0Yw9TBXlVAGuxFfnT6k0noVEpzas5ZploAnc+QD4ojRoZHpGd3g==.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\h0wbL8V6HTNu3JpDmpTCW+n0w9WhDe1DAQxrpGXZ+MPmEe1BSqsNVnHyhZ69H3b19d887NVCZpI2QGKYc-MLTapLb8tD4y70wO44Gh1hyP2s-M1tzyuYOO-x5Z6R-PPB.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\r0wEygzvsFLGxD0hTf2Jf28inrHKpc9C-cM5wrtYkRKm4VhBRf1eFE5hs7OtyLa9+W-wm72Oi7U0YGqid2o1Cajnz0Z+1Vp8zaz0QffHwUE7IWKhj-e46e9TMs7dptcytxT2Tv-FWKCM7syTHzTtGA==.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\l627YfG5WF4EU2TxUW9X5OFVUxfpG4grvN6X-X4L8-1EAL9TJQ49sAXj-D1X8A4QjbdiBYwr-KxqGR+y8JisCQ==.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\JVE2NWmeF-X-2195vS+cGzYIrVD89T+iilEoCb1NPQ1+584r+DQweV4t5AqcV3nTC5lAmkPiY7g6Km21ma2CMQ==.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\JG4IqhoqMgdmvOUCRk5b+-8Y2OQp0YDDnD5R+mUuNo9tdFM5HU2Skqr-aBc0aOm2.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\5kYJjnBpjOIdl67r0vUIUD3co3Mo17zvpHgR116hZl-9fi1JWhL+XWqdQTVa2taPrN5nPZUx9dTk750g6zl4dw==.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ngtjlmxHyIe8d7ByU0a3vsp6mrmw+omba4GYr81omEmgmAHjehthiH8BA9RbVIVbO4IzdJe9RzFHDot4DmA3XboxxPR8Obvxkz9+ktQMhqOs9nOtp0KYmH2ndiTmPLqK.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qa4vPDD08d0Qs0qlKy-joGI9o+lLbh+KoIHTbIS56h+OM0bCEA4yQpj-3L8xxdp21ZR046sb8Yup5zZRZ+LfBg==.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rTTnsvSUlIsf4MpCqOjB8C5VxxdwclHrjhfqmzYLdEt5s0fNLXUOss0xyqRYYTrT4GrdGZaVxvsWYf5-iRB0eA==.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\etxsVG8Hu9qY6julHLEyIHQU+oJtWEqUoGoJpxdfgVHSLYj3v1L4BRqJPfJZx2cB+GaY6uzR3W8RCdSQyMqMdA==.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NFiQCsN+RwpuYnJPQgADNMbgjC+3sjPS2LWjvFj1vP8uMdCSNNCOUm81HpDdwWxtvyQGr5hO8DHFH7y7+hhP9g==.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\1P8WrgQePJVa8e+Qj0toD8Lmk45frd+2Iox6QyAtx+KJacfayuMSBxsChcfOjdPWUvsBu0OJTW73LL0IFr9gww==.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eah1O7BPKArwArx5j2CyMeqDwpJ0q7cZm7k0UKnGH0SEQD7wE-gC83XJg0mfeDsmFTUeDF-ASVTFhA33wHrGGQ==.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\K27IbZN4fihdmzplIt7lm-ZMhGkCCnPmAKPshdK7EsEgBjhBQxJozYxAiNAPwdi3P1jEESMYq0-DrVlxEONnKVzYfzn3SEi38M3pwB1WAPY=.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\piJBz2FaaXb3vce5U0kqd626HcILK+Y8l7Nm6r2cQPSFtsXizp3XcyoOKZ--0JFIzp5lIwEMAfgNbOT8UtvpWQ==.C30C4DA81AE308962B9A.crypted000007",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+D6-DpHi7PLragUZXxZKjspjYANxyDPAJVsML7uQqrsbEiUgZFGFzs-8aeL-A3N3ch3dDDaPqpzz1RIMbjat+w==.C30C4DA81AE308962B9A.crypted000007",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yijbgG7ZQu8ymgKOGitMyjm-Ikb9Qc8qcetDy54n0aj4g18A6H3Xa3V2GpqBU+HnvvuHFxF6mjVSCSb3bATAWw==.C30C4DA81AE308962B9A.crypted000007",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\WiQajMQCn1vYZk6QV84NWowM+w9-D7Lv6PoaCjYki4DJQHVpLQ3SdEDBYUSp78mmTphbviuyFSgdqjD7YWKnvQ==.C30C4DA81AE308962B9A.crypted000007",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\k1QmLA3k9ozvPANzA18xg0uVZuxjwewRIUWHqb8oEmej7x-B4gsjXOg9FXIEWoHfwva+4wMpfs0xtEtlO183-A==.C30C4DA81AE308962B9A.crypted000007",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\OsY9reNkeIqo6UPWPKYU+CisEiFX-nxVRRUXTwYNkGAEJMF6INYdtazcbqCS6nSnLq3L-dwXnoNg5xMCnjgPCA==.C30C4DA81AE308962B9A.crypted000007",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\kcfbEARgPooCgGx8VFgGaBBvyxMZr+u3-rbgYTsJugIdANELtykt52-BQOb8A1fjmYJm197rejrlnuG7LZWlBw==.C30C4DA81AE308962B9A.crypted000007",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TOQpkrvB+9o9Mvisn+cI0i81i08rsXYYMyxgOcMk3ovu2wFiE6kmthV2rPmQMZAYYo9GHdCNuk9vtUOp6OO9eg==.C30C4DA81AE308962B9A.crypted000007",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+EFM+e5BHIMDS3MuYFzle+fP5xRjexW-8pis45RkyweSfSW6bHd30mdsAx6I-qcKBiH3r1pap+8iF4BVlnlcuw==.C30C4DA81AE308962B9A.crypted000007",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\fjLpRoDWkdekgdO6CBaSV49y2qeKqiH1Opa1jffJWDXmYIltRuABe-8s113PGZXNL1JgAFY5yguZ14WyrVQ6EQ==.C30C4DA81AE308962B9A.crypted000007",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\w-pR2ZyXNmrGZ8lzL6hKJYPM6OGgrJKgwmHGcqV-N82W-KHCRG2PUWawW9dxaKGCMEJfI3niL25shzIiOKNa91GyTkUFknl3d8hNraHvJKI=.C30C4DA81AE308962B9A.crypted000007",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XbwmMa7ebxKiDeJ17OTuITL0RtCTH3KS9Yc8hlzITU7N14f38FeebrtvDQnc6eGgeQWcNHxWH+unzB3qt5Q+Yg==.C30C4DA81AE308962B9A.crypted000007",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\X8ZApNOaRtV7-0tdBLrfzK2uejoNOxfPByOO611jsfevrDIQPM8nxihQ2CI35uOUXzjo0Svdcby2kRJwwq+2Cg==.C30C4DA81AE308962B9A.crypted000007",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\q23sjo127pxHJLbpGmzKrCsj1SGNV70-J2CowKixponrklyxd1f3PF7FkA4+2QJKbtVDeiv8p0+DbHqVriSRHg==.C30C4DA81AE308962B9A.crypted000007",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\oi2OKU61tdwDU4GzEAn7KqehK8-CGEvCTYe9F-OX6cb4TF2qFqoum+qWayrB5yurjL-5eLRwqCrcI33mBzZDrw==.C30C4DA81AE308962B9A.crypted000007",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\4w+SbkdVxzk8ekzyJNMSlcsPsYZ9tMz6kJUtpdC0+fb8sqBkYWDjPChi9qixUNlEuUb2xpE8gF7XADp59Ei0bw==.C30C4DA81AE308962B9A.crypted000007",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\UXYgdn56I7PSnHl9tw4A0db5OuuI1KmzE9tiLLjZK032apcx6u1WY7f-KEnIVP9BuTuBrMYDPi1c9BGuDDyMSA==.C30C4DA81AE308962B9A.crypted000007",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\WHY7YHBUjiTNZR81iiy1bUAiNe0sZQne8nff0+Lfx7KKFZ6-OO8chBNhb53eR4-m.C30C4DA81AE308962B9A.crypted000007",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\wfscXCe3BxOKgsTrKKSjSs9x+6G6jC9mZrVM1-LRtag=.C30C4DA81AE308962B9A.crypted000007",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Md9+IeNfeYu1KpBvMxexwtyVN7nlZ1gW10vOVjbe6VA=.C30C4DA81AE308962B9A.crypted000007",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\-tI6wM08Io2anf8-AHyAQ4Wrdg39SNKg0Fa5VTVMwIQ=.C30C4DA81AE308962B9A.crypted000007",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\OFNZb6+BMqSKbKkuAA+ZvvHR4-joLOt0d0OWvjijJBM=.C30C4DA81AE308962B9A.crypted000007",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\XsYmgl3tm25qxcwwI2nmkZrvqwkvyXk+YKEhC8P0K64=.C30C4DA81AE308962B9A.crypted000007",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\KRXiJJWmKi6g-hgED4OghOSvlKQIcx9vgHO8mj0WxKh4WGnMMdMQ39wKkXuBsDFoiydhJrzwgmnFmS5IAzj7Gw==.C30C4DA81AE308962B9A.crypted000007",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\-mFWx8aGfU47cYrwTBYyn4FCD0LTPrFytyLZCX6faqb2IaHvLofDrcRnpZ3pHVsAef5VQXK5ymR4f6jbeclBag==.C30C4DA81AE308962B9A.crypted000007",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\eYEfKUH6wv5UA0SA9MuiE-DhzbJDOXdRzLIHpThnn8w=.C30C4DA81AE308962B9A.crypted000007",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\2ZnWk-5-xdqzdAdLA1YQGgGZ4KBM2MSPPjwBKFpx3FA=.C30C4DA81AE308962B9A.crypted000007",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\LcnZj9TN7hyceFHdvkZRbs4X4ge+XtDCMkE3SrlmsEa+pD-AZ+Nc83yGLYWls0JsTXYY0aHBwo0Ct6J6rRPfAFPmL9lnifD5Bw2VYl4eP3M=.C30C4DA81AE308962B9A.crypted000007",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\PCucyyXyTdxo+eyoGrxlRVgO2QYrs2q3UGpLqkCPXHJMs-qisirMiUrLr1EaFKqr.C30C4DA81AE308962B9A.crypted000007",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\7T4SQVDyqCnMuOVuvxfMBfZYsM9gd79JlrGps9q4dbo=.C30C4DA81AE308962B9A.crypted000007",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\8RB2YA-j-JajyTWFg-cx9XKGL3bfKtGnEix8Bgdy-mV8VG25RrcHLzyLaRRTMRGT.C30C4DA81AE308962B9A.crypted000007",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\0sFX-4Njgb7OgyGolUUabMeAmvLvXhzJZ0OLdhYWJGfZsZZlSGG3IkSHLOavFSmTNktBzxKYiDlUNyYPbHSHhGIaekDCtG--pzVo4DStcoM=.C30C4DA81AE308962B9A.crypted000007",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6Hg8AHe8UrCgK2gAqLlWJGeKiEqTF7qMCjHv2Oe5P4s=.C30C4DA81AE308962B9A.crypted000007",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\YXg8QgCUjgCGGeUQIjd6Q-eGuwTdtb8fxv7Kd4QhMV0=.C30C4DA81AE308962B9A.crypted000007",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\QT-XkXDMGehlJ-hOSPB+6Q==.C30C4DA81AE308962B9A.crypted000007",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\BY4VCEtHbRXeXUWB7fPWhI4kDN3CPJAKRhkdrPPv2sc=.C30C4DA81AE308962B9A.crypted000007",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ByS-Q0tDidS0yB4i5sX-Cr0Kw1EHENz5-iecFHD6QzKsdsk4k7G3xTj6jNFzW99Nj+B2W+0pPRAMvOtE7CWBUQ==.C30C4DA81AE308962B9A.crypted000007",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\ZMTKEDxnV7pMtysE0ntJliTaAKvPC85+0fgVkmfCdIBOIqc6WwVWrW2ceSrfCQf5ZbzYAi+ip1pM0QR9xcVJr1T9hfGHbw+NtU8GcPStt4y2zcW5SoElSAX3+aicMRvvEVz46dND7xEIA1P83ElBgw==.C30C4DA81AE308962B9A.crypted000007",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\utNieFIzPWq2qVOxkfi8uS1tdXfGCTy+aD5P-I33SkbOme-cAzMAIN1JMTUBVNU94v-ahPbmQAbCT3JjEzpb2w==.C30C4DA81AE308962B9A.crypted000007",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\bau17sMkiD58LfnXH4ExZr71-imwcItr-SnlV-H7V9yws-Hr+l6qHcWNp0nDrezh-5c+UOYsqcVumtTDe5Bxnrkb3G5yAMlJoyupWBt7QPk=.C30C4DA81AE308962B9A.crypted000007",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\X4ghGSRl8YftMKlWpRKp1MdW4udJ+v835f6+PMvHZNY=.C30C4DA81AE308962B9A.crypted000007",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\riFo-XBAgGojnQRmcOr-xcTgKAOiaXrSg4RcX9nPKTc=.C30C4DA81AE308962B9A.crypted000007",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\l3gPp8FvpLdpu7zWNoDmzoUQq0tV748bjMrEFPusx7M=.C30C4DA81AE308962B9A.crypted000007",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\p4SjOFUkYGjqWldudyw1bmr-MkxrpuXiVCfjW7K48C+3CGKfhoJotX38vTyTEMGITLbVtv+mmcLNIghPg+f7KylDwfMm0kfgHmjwN2WaDs8=.C30C4DA81AE308962B9A.crypted000007",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\PmHpO3wQOprfu8s8PHZRjfDiG3kl4f-wvjF-0-2OOtA=.C30C4DA81AE308962B9A.crypted000007",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\EelDggz7ttUKKjoifbQa1SKkglVzkCQH0qKy+Ksb6M4=.C30C4DA81AE308962B9A.crypted000007",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\WSOz-9NsYmCN5AehNdG+uPi+5hRyrJ2g-yVyltXbI7Ns9S2wvbR9OOCUdE+SPFkR.C30C4DA81AE308962B9A.crypted000007",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\yjrEosg8IxwQHxJb9DM7DQ==.C30C4DA81AE308962B9A.crypted000007",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\73PkUlUGQk7K1hD29zNyQLDkNCxSEULKaSDrLE3al0ii8t1p3QidPfa-sccVymTV.C30C4DA81AE308962B9A.crypted000007",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\dVnnNdSPuxn3-l2c0PWeiXQBx5hCVWgzCFFCU8C0--A=.C30C4DA81AE308962B9A.crypted000007",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\ylHERkImBz9+bkWgUT0v5lS1DNzzXk0xlZZNJwOSeFI=.C30C4DA81AE308962B9A.crypted000007",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\qtUpEK+5J8rrc1cFU2J2mhEqvLa4y6sUSqPciLIYfrU=.C30C4DA81AE308962B9A.crypted000007",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\mOlDbG3D4t0SNbYVC7aYmdnQQlwujAMStV7mfXTub1y8rc1lJyIAR43OD5pQDby1gtn2LDneT-cXGA9OzWySVg==.C30C4DA81AE308962B9A.crypted000007",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\uk3xacWT9eufm7PxQJGOoZ-sqZpNV1AFYryL+SSd3-YWCNFgB+0EXIciY-x58bos0wNIicv4Hn9Ryiq85fUqRA==.C30C4DA81AE308962B9A.crypted000007",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\uQPz6KBO+yndI1hx87dnbBS7UR3ohOAHt-pd6ihDeehtMcdrENI3qY73vfPnq0MyVHWCyMZ4Wdciw9AZAO1+ig==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\RfmvsBYjrjhBWgYMHxYV4cBhwJccQlwkZ5cqTBvbTb3eKSkv+h3Kqgv3xrw99Uh+z-8meGE4ibqLmLCN0l0nvQ==.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\twbYIFqHuO18wC4HlQI2XlsJQJRc7KlAisaXy-4iBGxv00hOQPTUc3CCrr6myfJJBO+r4Rnd6JPnTZx6tZdIQA==.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\jFifVTw4I6hLdfeLqXvzm7pVPsnNSd-Xj0FILeWHBD+hAp+9BKUdla+wox1OJgyZcZ4DhBvjuttrjvUQwsGs-g==.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\TOwadtVzVywjB8t4O2UAzA==.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\yceZv6xX09MFbEtcGF9qesn9QNYxkk+uqS1CXgCtfAfI2J98ZJTcSKjMWo9pNsBfhvRTSvHcFhsa6e8f45priBOSnqBuZ1lSQ6k0TTZpuTG4Q-jaPb87AmSks6h1hoyWsfiAFs9Xgn+QfILj4rVqpsxYcopC8duPZsKZ0lcihaA=.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\SJpPdxi76a5Ma6rQeHTu98Z+HMQmJADCcA0cbK6RDpNaWPEjTOIERkncdU+bblGOCvuG4VQD9wQTc04MuA-HMRv7VJPjbURyTSQHjEO2DarlkhZKvUCd6FgSoYBE5Rct-tPagakU7vIyL6kmFBHC3ME1tFmI8l9lF1kpvLPv0Wg=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\FlLn4LZicOO-SvAQZIa7bHox8b4-xhc8Pex3Ume011l1UaSQPFAKBql5ooMLxwCDH95stAqJmQ-+69RjMPLgk+Fn2EvqZAmgsFD4AacBqQTPRGK0ICVRX6yY66ZOwCvi1XDQJKHKS-RPnvNc477QztcSs6JBMQitbc6NrR6g1Sw=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\fUy-TkbRoMNzOAogqXnoNX4okqV9q368C2vNJpyOP8jri1GtGfaTSO-pmM-pwS4P7psoBd2p5hp1Q8vTA-jx+VnVzwcSNtv-TGiDHfzWxwbbrM+VlxjPFULjvFunr2ZBIxVrpzljFW9gOK1I0Aqz36lRPctAgbmAH5+6MhPnmcs=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\zGaunljEbjp-Itg93UkQD6mQnaismIRv+r-2xhykA0eEEjyh3Lz0dgc5U5X9iy9ucIRZbzms0t8tiPb6U6P9nKZZPnHUv7jRBdLl0E+DCUpVtmcEZWT-u69PHdKfF72XtC1mfsrisUJ5Zb4bpxMjzFiYRWcNt5hWEq6r0YACRoo=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\CXUi-h1roUsJCYNHmxlo+bOC1PiOciIoNoBaLtVgJDek-zp1L4gVXw+5bvPtnz9eREnIr8VD4MEk9Ck6FP-hgg7H7X-aQB44htLEMg9pFE5EFCysiQOqeUq4hf3JHBTbmXn19Gfk7DO2eayqVdLczYP9WuIdUXMiqESM33qFRww=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\N0yRcfAc1gQwoYsbanvx7-WItKBC2AChmNV8fDwWaVUoDtKlJX146n55IF+OOul-IH--hgtEwrSfX-QTU5cD+A==.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\TOfADx8ykiwctFKM7tkLDnuGIBekPuMl9RPhRIDT3oetD1L4VGbh57rpFAu2oC93hx4qK9CmCa6wkv+D80RrfbRzZkrWXtdnm9+egFb4UOAm1g85syACOBPDk78R74bnxP+bcthp7V3RmdKNl+MyAmMMml0q9JygDeu6nZW4Azo=.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\RgJ927eat-Rm7E4F1dgZUHhXx4xyDg7Q5eHuq31Ax0Ixmeps2K6wfeYkm0I6Y94Thx2B0EF35E76m3J60rvKcz067wzV5IUZQZ5bNuHmcCVCxbXx1nGjoNwLPO82K3wEUnqWN4m+bqiSDryUDWw2rXuSAbsAsoBCJNUrdHbpEyA=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\4muBRAKN8vbYlIkbeW2rF5wDQHorT+e1B0aD0MUYotlF1fOlQPa26OCauMtH7cvoqrPCddFARmgKEY7ZzEk0vbs2zK7AHF+bscJBD9fNkBk84TSa3HaVuybCTEawgm1STZl+XVfOrtW783MznoL0YYEh7bqttUFDm0F-U2ItGj8=.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\wpxyfu87v1YsYJuACWu1SYgNJ4fV8pJuSryf8SY40kp4fP7xUvOIvpwtMTx8y9oK6OweDjpXNDvvbzWS4qKvXO3MhPnulZuv25Y9o3ipiPA=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\a3633e26lEvUpA2BSO7VwhZeWHwXUpUORjvYWf9-SxI38Y6nkvRL-1L7bInecRC1.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\3iT6YKlrGE6mw7066saD63xzsZq9Ml2z2Kq70N9KbgspbtIxKbQCGblqzPoUoT12P7hLCIFFGlvk+uXamRUEeQ==.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\ql1jBkj7pikX025e55XiDNx51FLfZxb9gJ-j14mymZo=.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\egPYdmlhWyqRn6WXcKEEV2Pu4VIetZT3pDwOatc90DjfaJR4MQlfqh8ab8yUgMsUWcYxS7Sr8ZjA32XNECKRxg==.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\6o+Z+mU4-rMUT1xWIXO6OaTflwZBuZbEAzIKb6aKNXE=.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\UYKKWOuiTtbiZgPKL+AaQ4SSRrSRda4lfXKoAFRp6+w=.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\NxP0LACVjuRORSnOajDj5HyzbLyDnQjJTZe-p+4HI3THO1aTN6Ke4JBxdS24uuCZ.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\4p+VLRek44xzNXb4zH+H+D5Xv4IGXl9jP+Cb482cwG7tKCjSKNbIbtM9VBfLd2YaHJguoP7SkzyTXeKyiRrg5A==.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_40b111fdffe33c4c776d87ce7ff02431.jpg",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\QhwjGcn320ST0D1k9nImxVXFvksqsbFng-uC1ProwWyp+m7r5XC7xfJg01WcvOspXSsD8oGaJeaQdxv8Np8CL0+5Zguye+U2tp1Hw8eiGO0T0sIlIuWENRo2QDCkbWkZjiBPoBut4OTLlzokwJ5SkiEXQV2orlnVSkYMFNnSoGY=.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\RtCoDLNz-u1IcqSNBtupbIiL4EEI4pgmQ+jre8qOg4WZCV+5j-MreDHNvTJkOPiM.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\tJCpMEaPBWeFIoEVmmvCWF4DHjfKdTHrT8vdN6qCJahhflt8pRs32AT5J7m8JEgXK8B9kVcCn7IrU-s2OridTw==.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\VH0F6UlxsvkGT0R-9ME9lZvKGuFJHJTnT0MwxgwwFJA=.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\hLSZ6-O5K5SLbRkeNUq6GexqGT0eTdgKjoTi77Bi5i0=.C30C4DA81AE308962B9A.crypted000007",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\+4nd64+wl0-rdmKeolMuvI0iic0ctn8M0f0UiM3L2x1BK2dq3nZPyftUdItZ7Plesi2G0QWeCZ9jYadpFQA5gQ==.C30C4DA81AE308962B9A.crypted000007",
  694.  
  695.  
  696. * Deleted Files:
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  702. "C:\\Users\\user\\Pictures\\Host.zip",
  703. "C:\\Users\\user\\Pictures\\Host.xls",
  704. "C:\\Users\\user\\Pictures\\Host.pptx",
  705. "C:\\Users\\user\\Pictures\\Host.ppt",
  706. "C:\\Users\\user\\Pictures\\Host.pdf",
  707. "C:\\Users\\user\\Pictures\\Host.jpg",
  708. "C:\\Users\\user\\Pictures\\Host.html",
  709. "C:\\Users\\user\\Pictures\\Host.gif",
  710. "C:\\Users\\user\\Pictures\\Host.doc",
  711. "C:\\Users\\user\\Pictures\\.xls",
  712. "C:\\Users\\user\\Pictures\\.jpg",
  713. "C:\\Users\\user\\Pictures\\.html",
  714. "C:\\Users\\user\\Pictures\\.doc",
  715. "C:\\Users\\user\\Pictures\\.bmp",
  716. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  717. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  718. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  719. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  720. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  721. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  722. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  723. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  724. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  746. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  747. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  748. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  749. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  750. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  751. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  752. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  753. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  842.  
  843.  
  844. * Modified Registry Keys:
  845. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  846. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  848. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  849. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  850. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  851. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  852. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  853. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  854. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  857. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  858.  
  859.  
  860. * Deleted Registry Keys:
  861.  
  862. * DNS Communications:
  863.  
  864. "type": "A",
  865. "request": "whatismyipaddress.com",
  866. "answers":
  867.  
  868. "data": "104.16.154.36",
  869. "type": "A"
  870.  
  871.  
  872. "data": "104.16.155.36",
  873. "type": "A"
  874.  
  875.  
  876.  
  877.  
  878. "type": "A",
  879. "request": "whatsmyip.net",
  880. "answers":
  881.  
  882. "data": "104.18.35.131",
  883. "type": "A"
  884.  
  885.  
  886. "data": "104.18.34.131",
  887. "type": "A"
  888.  
  889.  
  890.  
  891.  
  892.  
  893. * Domains:
  894.  
  895. "ip": "104.16.155.36",
  896. "domain": "whatismyipaddress.com"
  897.  
  898.  
  899. "ip": "104.18.35.131",
  900. "domain": "whatsmyip.net"
  901.  
  902.  
  903.  
  904. * Network Communication - ICMP:
  905.  
  906. * Network Communication - HTTP:
  907.  
  908. "count": 10,
  909. "body": "",
  910. "uri": "http://whatismyipaddress.com/",
  911. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  912. "method": "GET",
  913. "host": "whatismyipaddress.com",
  914. "version": "1.1",
  915. "path": "/",
  916. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  917. "port": 80
  918.  
  919.  
  920. "count": 1,
  921. "body": "",
  922. "uri": "http://whatsmyip.net/",
  923. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  924. "method": "GET",
  925. "host": "whatsmyip.net",
  926. "version": "1.1",
  927. "path": "/",
  928. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  929. "port": 80
  930.  
  931.  
  932.  
  933. * Network Communication - SMTP:
  934.  
  935. * Network Communication - Hosts:
  936.  
  937. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!