Exes_76073dd5b9ef429bfc11a700ba828b21_jpg_2019-06-28_05_30.json

[*] MalFamily: "Shade"

[*] MalScore: 10.0

[*] File Name: "Exes_76073dd5b9ef429bfc11a700ba828b21.jpg"
[*] File Size: 1209096
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "b836f6973a97e0ad8bd02e32f63bab39f6cbed38db932dbd4a12937f7194fbb4"
[*] MD5: "76073dd5b9ef429bfc11a700ba828b21"
[*] SHA1: "5818b88fc15786d78b495a15562410ea7fead5e4"
[*] SHA512: "4f0e80c8be0baca60dece732ccc8045d260badaba1d42e59440b9828f09fa713147dc6d6d755cbca4a7e7b9c20f5f0870737dfe7a0d68bd2fb5058174fe9dcee"
[*] CRC32: "51E9CEFC"
[*] SSDEEP: "24576:rqzgQodEW+xRq2jH1NSuMBSfLZ8J1/KaFcK/cjtLpw5tLpwa:rC2aW+xRqyNSut/aFcK/CtLUtLF"

[*] Process Execution: [
    "Exes_76073dd5b9ef429bfc11a700ba828b21.jpg",
    "vssadmin.exe",
    "vssadmin.exe",
    "vssadmin.exe",
    "cmd.exe",
    "chcp.com"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
        "Details": [
            {
                "IP": "31.20.205.209:443"
            },
            {
                "IP": "127.0.0.1:32428"
            },
            {
                "IP": "78.47.224.202:443"
            },
            {
                "IP": "136.243.39.148:9001"
            },
            {
                "IP": "104.18.34.131:80"
            },
            {
                "IP": "128.31.0.39:9101"
            },
            {
                "IP": "104.16.155.36:80"
            },
            {
                "IP": "95.215.44.167:9001"
            }
        ]
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:32428",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_76073dd5b9ef429bfc11a700ba828b21.jpg, pid: 3052, offset: 0x00000000, length: 0x00127308"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://whatismyipaddress.com/"
            },
            {
                "url": "http://whatsmyip.net/"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .data, entropy: 7.34, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000fc600, virtual_size: 0x000fca40"
            },
            {
                "section": "name: .rsrc, entropy: 7.24, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00024c00, virtual_size: 0x00103a78"
            }
        ]
    },
    {
        "Description": "Looks up the external IP address",
        "Details": [
            {
                "domain": "whatismyipaddress.com"
            }
        ]
    },
    {
        "Description": "Attempts to delete volume shadow copies",
        "Details": []
    },
    {
        "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
        "Details": [
            {
                "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Exhibits possible ransomware file modification behavior",
        "Details": [
            {
                "file_modifications": "Performs 663 file moves indicative of a potential file encryption process"
            },
            {
                "drops_unknown_mimetypes": "Drops 633 unknown file mime types which may be indicative of encrypted files being written back to disk"
            },
            {
                "appends_new_extension": "Appends a new file extension to multiple modified files"
            },
            {
                "new_appended_file_extension": ".crypted000007"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            }
        ]
    },
    {
        "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.GenericKD.31609599"
            },
            {
                "CAT-QuickHeal": "Trojan.GenericPMF.S5293202"
            },
            {
                "ALYac": "Trojan.Ransom.Shade"
            },
            {
                "VIPRE": "Trojan.Win32.Generic!BT"
            },
            {
                "K7GW": "Trojan ( 00546c801 )"
            },
            {
                "K7AntiVirus": "Trojan ( 00546c801 )"
            },
            {
                "Arcabit": "Trojan.Generic.D1E252FF"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Encoder.fmpdcn"
            },
            {
                "TrendMicro-HouseCall": "Ransom_Shade.R002C0OB119"
            },
            {
                "Avast": "Win32:MalwareX-gen [Trj]"
            },
            {
                "GData": "Trojan.GenericKD.31609599"
            },
            {
                "Kaspersky": "Trojan-Ransom.Win32.Shade.pln"
            },
            {
                "BitDefender": "Trojan.GenericKD.31609599"
            },
            {
                "AegisLab": "Trojan.Win32.Shade.4!c"
            },
            {
                "Tencent": "Win32.Trojan.Shade.Aexr"
            },
            {
                "Ad-Aware": "Trojan.GenericKD.31609599"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Comodo": "TrojWare.Win32.Troldesh.GV@82hywu"
            },
            {
                "F-Secure": "Trojan.TR/AD.Troldesh.kcihg"
            },
            {
                "DrWeb": "Trojan.Encoder.858"
            },
            {
                "Zillya": "Trojan.Filecoder.Win32.8786"
            },
            {
                "TrendMicro": "Ransom_Shade.R002C0OB119"
            },
            {
                "McAfee-GW-Edition": "Trojan-FQSD!76073DD5B9EF"
            },
            {
                "Trapmine": "malicious.high.ml.score"
            },
            {
                "Sophos": "Mal/Cerber-K"
            },
            {
                "Ikarus": "Trojan-Ransom.Shade"
            },
            {
                "Cyren": "W32/Agent.AXA.gen!Eldorado"
            },
            {
                "Jiangmin": "Trojan.Shade.qe"
            },
            {
                "Avira": "TR/AD.Troldesh.kcihg"
            },
            {
                "Antiy-AVL": "Trojan[Ransom]/Win32.Shade"
            },
            {
                "Microsoft": "Ransom:Win32/Troldesh.A"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ZoneAlarm": "Trojan-Ransom.Win32.Shade.pln"
            },
            {
                "AhnLab-V3": "Trojan/Win32.Hermesran.R254356"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "McAfee": "Trojan-FQSD!76073DD5B9EF"
            },
            {
                "VBA32": "BScope.TrojanPSW.Papras"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "ESET-NOD32": "Win32/Filecoder.Shade.A"
            },
            {
                "Rising": "Ransom.Shade!8.12CC (CLOUD)"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "SentinelOne": "static engine - malicious"
            },
            {
                "Fortinet": "W32/Kryptik.GOUT!tr.ransom"
            },
            {
                "AVG": "Win32:MalwareX-gen [Trj]"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.Ransom.b4c"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 709"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 127"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 437"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "C:\\Windows\\system32\\vssadmin.exe List Shadows",
    "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
    "C:\\Windows\\system32\\cmd.exe",
    "chcp"
]

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
    "\\Device\\NamedPipe",
    "C:\\README1.txt",
    "C:\\README2.txt",
    "C:\\README3.txt",
    "C:\\README4.txt",
    "C:\\README5.txt",
    "C:\\README6.txt",
    "C:\\README7.txt",
    "C:\\README8.txt",
    "C:\\README9.txt",
    "C:\\README10.txt",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\k4uEorUnHQn3uYXSS4PHDRTOBeixeP-kMzkakrwVblw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\RiQFTJMvWA9VhUljjMVyQ2sIavCENULFo5pX-aXXwPE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\thfOmNg422bGOh9H+k9siBf8UA0dqSPD7rWO2TiyyL0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\SBOjRgE66UXmvO-82fdNinyQrwm-rVSzgot6G4Ail3c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\E4zRuqv8RFYemtU9vouedcmPiLVXz-raODEYukhro7c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\FFh88beSjjBJkJi-0Ps-HdF7ZGRJTepTWsVr++DOoo8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\CZv1R2p0RTYH2HI7uZWdLcATn7nkoU2szlQz+JbbDlc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\VZ5Y8Elh1FIST-zHCEuROFZ7swWhnVe3kC7++WviSrU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\CtUJY088aBAbF7FW2NVs1K2-ThHiMiuRkWpttqRGuGI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\ZLxacz0Ix2vtdWKzBLCRUw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\rhq5yJstaJ-EdDCwSdG4Uw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\amp0THaeU9zejrpUI5idRA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\yOORYALV8PoidYZ2EifwlQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\Pictures\\lrB9a+9cwFwgVjL9Afwb7A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\ArGeieWH1cetswoWlS3ojFf38sHm26RpaZb5J8XCH4yIIYqQ1fRFZCUQLQTQg-AuUxTmTvKyhpgKZJyGoYzryNR8cvLLjqEI0ZYU1O+l2voQe4oG99eG8qQ0PNNL1kNr.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\D7d-VCkHJYrsCM3cqUgqZ-F50ZEEkpAzuK0K2DTv8sk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\zNJQnVwYY09OnXiBz0FToG3xekR5EnQcnaNcyJ0Z6JZMc3hPSapn6RyoaCReppba.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\D3SB+hwLSZDIqKjguNk70z2eKobW5iO4GNiI0CGJMj4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\EIx6syHwpo+nez00rzOVXXUBWQjHP1hf0MennB-NXlQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MgKhN9swIRAYkKFj3hUGqUjWrGD6mb95gRtIicupfWo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\7F9GvvCg7eFPFAhlYFjhunn9tLU3xYdjFwmfLibK4HxSXpGOCv7juwODLp9zBMBU.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\tHKG+hj+9LCJhhkP4Vvra9u0RRQvcYShhx2kA8f5bA4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\GvA4xgMenC7cEkgSM0ZhejCiYGVFc4a9JFVh38AVQ6fBjsHcPQCKs9SVAn2VJihL.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MfZYBOuQm7z2IyfaORzsn5vksubj7+4PMSg246knPeo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\IAkrpRjawpGaOe8ZV4dJbBhjf7KutLSmimuvxdIOyGk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\O+YyttrEm6wFhFwbUvoZByLGBCWpr-KXExVthm9ikK0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MU12IAMHx1BGY7LtOLnSHtjsiy2AD6DjsJpYFGsudmg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qXhtVfLLBKgpND6oxZRk9FVfK28AwSiuRXxK7tf-UfOsavG8kO0YgEH1-WXtdWqu.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\fGXnrM0LysHohotFJ1WcvK5WkA0pUWtVbZn2l5x0vsE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HE5irIGtf+Xkv6CEu9aBqvABBDUr81mFg-BNBGj0-qaYJkdO6SVheItIz3pSmHvN.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\+IlS0lPyaDRWWNXs8cSkcj62Xyh2ClbRALih-OGloQI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\KYlmBScCfTmi72AdRZxbP6y51tv59oGJVBF-9Hv+75Q=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mL2s8ddfIzR2sbW9iWrTmdYQyN9j9vDNMP7ot8hjsP4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\WLXlwH75Emf+Rz796a479BmNIYPo0NCCzEWhsE2v9DE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\hpsr85ylK+vf-wbFh9LX38lEELunwjdgIHchGHyQK-Y=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\sw6JP5vbvY-Lt+SmafaLAjSyZNcAr-O2a-9Qbg+7Cr8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\B-dnsfa2OJgmeX6z3C42yJekCGazvYrs9lpEwydXyOY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\9L6xHkYe7o0hHXOGtNUQK8urPFCKSy660ULBAg2oJyU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\U766i31zICO2TcLaNh+-dSPeUPwW9xCotRHS0k4S9GM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\dc7RHXJTUXlUu34srj8pynPCfsvV4Y+sVNhV0-NuWr4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\8BkAV4VLUUivk2tCoFQPCFyQv1txW8ukt06I39eIowQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\oay7T7i6DrQupurVbv0X+cLLVZxdMucHV50s293ZiNY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\yoC6k12D6JYhiENHZyNqWy9HGslfoC0BDJEPzkSYgYw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\H4HRChthw3ODQ99C+6z3c0-gR36Xh8biDRu-r9cLw8s=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\3PZW8o+Zn2N7OUP97hgN0ENj1yZ+jb2ANsEfqxYHMlzUQcdr6pt3ye7jF-VBKyRIdTl-b5QCvW1jxRMXX8aFDg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\3vzUjrFp7nU8JNebhjX65IzoIhE3uU6qksTJJTZEZqZM7sZNHuJClwzBa7QsG4c0aNovvQBU4WOh2ItfHKV-HA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\kaul28VSRF5x2YfYXm8lGfilR70Zjfi994eF12Yh8ooQeNz--WWMdLSF-h1YihwqcOWN9a0eOHPynF4nWqxqnkpM1RyasTkodyNenPMtu7aQw97M9PqOOeA8OhxvZ0JYcAynmIOMIv-L9mnGImxffpmpSsnLZkOQMn2kSIwV2HPFm+u4rOSrgksCssMH1hJp.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Nl68GYCl1sGB-Eyf7fHEsE8kszBq+Z09aoc3e0KV4t+KcCuvMAckPCY7-PKD1-12OgyHtZ8r50QohkW2jDT4lQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\shNJ6xqPudrW1Xe37cuSs24k8xn2+J9LcdAhAmwSdtlzEIipO8DJFl0bcTfKq56dQ2b9Tp4HZPx3ai2yiUIn2w==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\YkavAbl4o8C4PBA7H3q5zaKdNx0a6k4qvFfn4T-+f-b0rq39n4fYdMr1gXW8DV1Lvdkbzq6Z-PpgcBy4sazblg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\q6uBc-pkOMFWJdYY5vfqVL6iwkAeE6Bgvyk6VH1ORneCk3MXMrMkFQoe5-wWZRXPul7vh3H7iZEb23Byg8kQfvum0A0QX4XimeFD+N2tfelBd9j3xnhnpc-p5WlzzENZM2Go6tSzx+xCUDM5+a9FZg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\lp2vKSaQMtvBJ-JKVDSeG2STavMFI8Va+jfg-cxL8RT4S-QII16RP6KH1NBzsiUE+S0cFTaWr2tL5cBZr0e+U9ZuvbLBxJ-jluo3oGQ2pj8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\57ctFFH9FvEuFFEtcustFjD9uYq4uYs5JcBi2uaDYic5cOTUf5zfrmWdLpG3+pENFQ0CWVEH1o9T6YB5pXhXwQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\mVaChZiMdi-NOku3Q6KifxynH4oYUoXw++rMR2296b5GACkIPIwFik5rd1SyvZPzh0BUl3TaOgZl9X0a0GoheWLhrTkhpOMBvoztvb36m+kHqbvfx4jIZyczQL69JZ4I.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\f1D7A9ZAllJj9NZMZQU2UUVWL6D7jW3tAY43GYbvxINFdtcg77rfHjlT05Xn1yrpgeudXxgMmV62oPInD3EgT7aJIqrSKRmjlRrkHmpIeZ02POMuOGP4Pvls3POTaUNEc00fLohfk2oqBFbCLfkDHg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\dygX+cbbIHxnknS8-yewVHXGpJIuCAMv5Zk13W5SSgB6xx4XMyLcWLdkeYbDlRUkBCwbgcgcAEEa01lkL4XZDQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1TrDe3S32vRkWDVgvRxwWC8snXTqz9ycyryWZfv9-5OYM1qNjQuytgTxHSfNymUbF9F-ncxvMYDOHYObsGFHpg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Qb4D89SZWaXsMj1A5IE5D9Vk6JWeAfx-w9bs3kMmm1PThvh7E8YjojVprwx021kq.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\pLIL-DxasKy0u4z-IMoKJUX0NmzRYsYuIb5-3Mmrni35MqS3jOvVLHp7f4osB-9CfeL-JB3TjOxiSY8wflPdFw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\skVrqQN97gFdBRfnrafO+-4NngB5B8jCazKFSYYQz+l9ydlKGLBNrv3Kbj4YVCui5FlkFpqT0l7vrOXpQIB38MS-vq2oFMPDQVqaEsaH8uG3h184JDY3RkPvwZ54YvaV.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\AwnuC78NbncYYItE7eTFhWQLMvV9q7UUMZQtbaVMXSNI8xlFqcOjJ2IwsHAhrY3H76gtuTk40sqnwqRB1fBVlQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QC8XSzTUY-+hBzzQ2vZVNoKp4QidPplJAz0+zUlhovTn8LTyNE1S2cQjMU56H0QrauSdQzohBe9qD2lyf49sjw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\F6A54NzwsYYEuWmzj1PVzugTv0sKZY411SE9UUZPZnCycIF487Jdrei3W5s03K65ydPLz9rBv7y0Zq17nmeuUA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\AznAJH7enlJN3cBsK5wf8i9Kkxm9hjVhSLRhmGvlLM-HlCg3kYcfVcJEGfd+C38phkG+gs1AfUbSPgYBrYh5jA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ySHNGEyTaSEoRLoHQHFEOeC5LGelW-4xFYadced0lWGVZ7ieEeL8fG-kZh52-S2aXgAgBH16iG-leOBZBdp4Ww==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\BFHNb2kzoyfH6ntpHndxR2YYx-hNrd0IivQyNP4LGApDcl2iFgpxKa6e68OJiFb53pbi20wig0qWyTNy4-CE8w==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VDgdaEcsw7DS8vdmmrk-tn-6fXueMEOrqMXmMG7jzaWIXdYFrHyPbcPwM65fYeZDXMbqBDFTiD0bqwVc09tI3R5qHu7WltNjdEqj8ifJ1s4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yfi8zg5AtCd1MMFrameWCFE-euKor2XR2wyBwn4O08hnUwiyqirECq87PdITMmcUjB82K0-01Sohnwy2zZxFWQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xu3-jS3Io9ICJYPVpJc-anE-F4QeYYTVWlYB-mzUSDXv--vbGISFHPIuVWRAZM1HWmkEGdx60kw9mIl1HNvfQA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ymYr6ek-MyXHkUHdV636-PPgFqmBliMSGfwG7FKmqfQ5QPJyYqBj00iecYvsTrRJu8P1Xfa3q0obV9yvwCi0PA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\s6m0WLLVEm9uJasBoXz2WRobX3tCy-Sl9+Qvjbt3IweZ46zD7cBGYf1S2L5Ra63gP0a30O2v+JncUyzMnDm2MQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NGmKbmDc2cXUqJ2sk85iNLQ+LkJv2j0M7skphK6cCacqT-8yhbKGt3To5eXwgS1JdvuAeyWPtMH64GQ1um4t+w==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XqAcP1X-aEMCKz1JYccXP4dn2Y4TAc13jkrQYEx7VURRJTZOXAWHqUoUWhq6m6XKxkIfi32SeKNcPLUxTxwUeg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\D2QhX4pvOa9SCqSHKveN9DYI3OqSxgYFb7TeAQjJ-bFx-4N5dHOg5l5hmtSmch3WYSzwaaH+xnE3uAVrFL6kdw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\1kW88OACEYEVc6+Xk7bZPxYFIHmafrGEDINinUYAChaOflSoe7VUMEEgKg5k2SI6LDqP-8avQqUe4+6cor54FQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\oEFUDV+MU0FaTwYVexg6BUHL5TFFHHxlfeq1y-NQq9zeQ+stY8oizGadX7BvgJGireg6hZBfI1DYN6hXt7eTog==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\J1MkPdIygRcVZ8mZTfgPBzWbq9jNUTH1gAnVye8pilWrxU3rADbKhf6VPKFht9VpKOL4mNIIdxvsjEupgCAPYw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\YjveuGM8fwNGb7udCfAr96MlxcJcSj9keFVmDhZ8R0rzazp8QAD4NIa-U25MtoEqJpYiZjzhzL0HxbGBz1dUBwrxCzPRKQ3d9i8Lt78c4Cg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\8QduN-HuQSYjX2puQ9YoAFUooyYCUd7v-2wLCt8fiMqLOKrZXpeap4VKH0ovOaOYQdA1UMJfwry0HL1+CBYl6A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HLFEUPdL3W8S5nzi2NOevMbkkDPuyLJr85wDzlVPiKEYML+Ig8ueXdMRrrq-5H3qz3d00fpxSRkSNpF8DoOJWg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\drOuaOQJsA1euW2e+sl4JWK8Q2BbZ4udMwUB0RpDwh+mqWesAOcWGmSTWuSUzPEe2NEJNKDGLkMH5rej9Rdhcg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aEColPDS8+r5vUUnhWd5E+PYUJHav6aBE6OCA0mhhWaC3TLl99Z2bHYlUyP1RwmQShu7YCbM9rUd80j2n-OBmQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TDxrL7gg-um3rGQZLb4ksBa7CrqaM7RhmEi0C9kHm6YQCdmUy4adEeYp6uUQjXpHbMc7Vu51mRfxCBRqS31BwQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\tl2nl2YfXSwBaUYa-sydCmeg9m5tC-0gVpmT5aL97phj+x1WS8+mNllJ8SHbWj3fhGHWKMlhL+Dow2gRfm0xfA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\MFeoK3TRfkkJa2VLpjUwtp+2liGM0gqXWqCdcVpahGks+t0krZ0uSRkn0RZydB5M.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\ipJ6FydU3bQTVJ2WCgpEu4-md7HP-OhQ+3NV4mHp6Pw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Y63k9znzEXF79jCpGv0Rc1JGNyNsjGPI2OYGlecj-Yk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\LAbmh5XHOF7ufR85U-pOZYLuCabJ7tG7mWHQAg3wjhc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\rMN75sNJ6HSCJncSslFZaekvb-mea1TYXTc6OkN+LDc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\T45lPqtSphkF8Oc4CojJIveOAdMBbxwebHjnP3I6ttk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Btp6GSiThg1h2XGVTt7A-0mKr-KThbgVeP8qgAeDF3KmyHipbiENha4H89-x36AiD3eM58L3EFMqW0Cnn3TjWA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\IJTa26eGSnqmB1VvVX0qlZdKRzuElXIb-4jUld0F6mBCC+J2iROlxRoa8a-Ds5FtqnHr0Xk2KLzrbxRrkAr0jA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\-GYT6mX4SW0X0bEpsjXQ5AboWlnWfUU6ZRVOalnGEQk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\JzmYlEWlbsVs8PDgMP5EvMMurPMXViQCfwptEH42C9k=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\AaplRxpeh51WAIoQWZXO9Y+ZmHXCdee9kYCMH0OCkSPKy2p5ET9LAzms3EfQ14loDIpkHasOhuMVL4RgtMDySJIfNppuU6xNpSJ83jlaiRo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\w8aTzRoiEWAIiHPHGUCwgSt-kE+SGCyMaPKG14pLU1dbfoid64npk7as8DVRVpOx.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\wIWgHC97WolTQEw1Jfh--sv66CKDG2QIZmrOncRLOdA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\gomk9glh9tvAzM+xKaqPMwxYm39wZYhJsyaT99sNoLhVU0YXz1tx9XGWD6We08MQ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\X5+fQwNKR+I1bU9eOv74w1CMG9m2aSB+XSVWhDeMOlQvJtGsQdWtlGDbu+Ta3YzFSrDVnav+8WOxTLd4whxdn2Asr5qH-KfbR37Mkouibdg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\4b-7BOhWQQdnL1sdogMMX4FJvtDfb5z4icy3ouxLXU8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\i44RfbgapCBkNG+53M5ZJyKjCRQqK-4KJ2ihTT3f4gI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MdHUFjUiyQyikqo4SjvDmA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\mcMJV8OceJ84I9oGjRtoq0qjXVD3ud3P2AubsU50kf4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6CcI99M1ngqwmFeJoVo8rjYCVCA-4U3FJcIWxy-L8rh8EecwFrawPVQNUKuk8QuluuIVVR00Y5R4aBHwBuajfg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\qQrEU3zpwQn+x7puKLrQdv-7Onsp1TGlIe7ryTjOPoSEQHUvufoc5kNhAqr9-QxftBl3kg0XiuV2anCCkK22q32C1REGUX0O8tivkLms83iAxLERpHfvk8rkcJ3UL-ZXX+6yTVZVK9QW1TA61aPoFA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\UKgsMVVdxDBgzyhioXD0rwlKTQdpHLhRfZSWqCsP19R4MvIBgXU30MVi7BDt4EAEWXPZ8Y0I1Dv1oVsqESJKYg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\60MI5Jzr2AeWOQMQ76K-DapEI4f+FiW5Zsj9ewH+yLqxNhgvAW089nu3q0LYmoNwQmo-tDGXuKORI6Xv-m9SmW7eKszz9EkMzVWjZ2j-qHs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\Lcv2HhPMemA-836YXzl1JXJtfwo5LRpWlHa8xy+bWvc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\MLtNjI5uMpzmqNU+31NV3wA3WI7UJ5Xte34rRzS6aUo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\Jhp60MapqWc1bEqAti3utHaQ0HAPXl8aBAvAUbBtpCg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\bFp-JzP0pPI+uVfJtvJnW56PDmToSXSZaSs1SF7K9iRFCDukjEZe5aDiYazw7L-ZGObIdFI0gMb4jheuoZtSlUJXaiDX2+ayyj6MSPfK69c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\VSuSuoxHH+nXBAQhgZSbmTPN3erMkr2YJfgZGpZ9vQY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\v2cwqApQOmIzbraOOnwJQltd2V1P9fBYFTFKxscp-zI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\e74BockJ4GfOz95GIr97ExON5VglGzRykfhSAVjLcpDaTaBGc61Ru7hB8IBDs6jQ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\PiKxRbZIdGLHKUHHR2ORKg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\jLdkzrd4vCQpya+A-TnoXwq1T7gHHKbA-F0tzxr+5KpIP6aGcpCJTR8jAx8BHs4K.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\-xr0yWJAWOL9LWnbfrWVoHTkTD+u4syhtMyNY5q2ZGQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\BwbwjTIpyGgHwuA7JHcQ1AK9gz3jD5GKsYhRjK7OPWA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\MME0Iy4vBkiRlms4Q9GaTyk23hfYZrc7x3wf-yrBRLQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\nmL2FsRch5TZRs1kUk6973vQtPdoofVPZYZbTDJzwHMTIq+dLrwHen-vd5NGulwnxtsptRyAoLGJNfRbCZFuSw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\tOvwuE2YJ84Drv6VeG-2JWnO45c49MrsdUSHAJ3FDAU0iO6VrlnZciK+mg51GonPpsZUoUSOce6o9Fr1SIKj0Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\IEBSZ3gQZoLlVkStcFWP+kggnrrZ365J3pD8i8HcS34+t1d52Vg+jHDEF31Boxb38QAK2crvaE7svxWFNqVtYA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\YnWSOdlYcfOH8+qs-sCiEYbWl7V7RuuFzloqgMwq0qN9mvPGwbnaYfoKqz-JnNhCLqBs-BxuXS8StfQIiMl4mA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\D2j2i+MeYCbQiphdEvbpT3l2ICFk14msRLmSq0aZRjWKM23A-IjWyFvMw1B2riU4UkaEUzzIuVmcZpGMMTvJDA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\PK7X9KfS9rhVvBFhAP97a8-Bvsyr9adX6xDTgjJrDUXPAJPA4oxfMDOd-0zLoJJJvaj0f8tyP2QsjruxZkoAQw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\j3RTkyOu+UgHNNUv1zjdKxVRDd4ED2bsgcIeS0dNjWEy6gjxg+jk+lPjnWVH2X94eGzMzTdPHzl43MQpKJdBTw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\j5YoCGYc6PZy7T1cSO05sw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\pGPDnHh3t3B5rBIqjEkwGecO4-6iulB2lg-h61Oe8IMcbpi5FkP2WhNOl4ub6YsGInJ-Ww1D1r6-5R2kGD2w0WIc+2FgK1bxxZkvxHqtt2AHSBPzQKE7JzT7LIL7itdHcszhyaDLa8glC-Rg8874-dvhlHi2HjQ+2DJY+1TsXoM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jFcUH7+TPpzS+ks9SzG4YDSn66EiPHwaXEjqLwt+QJmCCLGs68jz8Ed5iCWWeaNPkooRzgeYT2r52ZmTVDtxNKRJlPU-IJvD+4vP99lfKuHVrznI+qc07w8biw90IUrH0iMIhsT3im7BMolHqxHlLFV2hP1U2zw8NOD8971wjSQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\-nBxf+d-2g4dZkIrrfua931nvnmu04qTw+3vzUhefWyH5IM5x3FdgQEpV5Sn59k1umMIKpMuekiKFnLaEL7055LZqyFrQsPYRRNQgwTQOBFEpgxqsJUrON4hVMEIXdGqJ+Vi2c5c6qzxRdVILKdgbBJ6JlPQMEXF0JjSoy8Bhfs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AXC0Em-yoh1N9e6nI4V4vUSHdIQEzq97YTB1MAqUluxppnrRG2AbtBidZJC0x9OekmsyqEmidDc8O0lKlgI4-Mky0lXTFEwpJFXJOdqduwq-rUdsvynVQpWWGgEw9ZOBNalVCmmohWnuGEYKh4dHWVhCuP3sRj4HVcSuCRLOnFg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\uW3TriQvGeH69zkt29SAtG3CR6yXY+Qf19OhRLy46osgYDgz-kGmdxiWQ4OLzvBFhc8LB981g5-gTAjsLpfZGx3h+7qEVTOmaYAUZF4hYpG6lxZ8dam98zgzyxkS45xqMdk9O-FPEaZHo1PeeV+QlooAtDkVKd3nvokLKwMUK+Q=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MASP3B453Kz0JUfBTVvmMcYcNAq1eOYu1dyQd+UcS3wFHvPVSgMXL8Z5Lhk3D8SXTTiz8C64ngKloyqHj0Tmkg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\pOqpXNIzTA2pKdvYNuroDjN0ad868hK34FRQdIIl3sUGH7A3Bir6fLpsuitx-qlPHYLpIB7T3kBMTcuMdltGYjv6UPXiKkHm5YcbJjINjz+zIU7Jx0cjPQfkCr3EDo8Ubvlw92dOmmDrgdVgDEa71ot28YehxvNxDOgqPtnd2fs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9aZW8iiGeH9c56SPYc8vr2KhqJX6XnX2ihj7uFddQl7aRz4D91-Lb7ucNlZs1bmNrM9FZib4f2FWc27ewfRm0GURRiPzhQ+q2J0h2JLZtRmSdqSU6SylvwNiSaoxcAp0th+U2s5CazRECb-lLYcivG5l37s7R4S5bRbmJl38sFw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\XROOwY391zPFHQH+HgfJ1QFXqRM6x0A3Y16TyhdfDLxGRkZUcRwV7UiIeR-npetdGcIbXTNnULPfCiPy3aQ+USLdt1YNJsN5h+uoGEfeDLIVDTYzQrBDciEij2B0y8GfCsmNfQuHgtriNiOSs19-S1pSom4TjY-wxLxmqDPf7bA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\P5UDS2h2ZVHwI0BI-DwOjhTkvjzzDRdRhWgbPdFwO4p+GOCwxnCzhSDq4GJkIjPLmR8dK8yxcf0L6ZIHyX5DVqaJ57771mLk1NROl33fKThb5iDI3vsZE8qv2lGupfTPChvJ37C+gb71+xO9clWjUvLF7qH+LI0tqCiYAKe-OcA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\aFqt6aHAqNN6W88iN7UEuM+gvSut09v+nat4wwgYrHzFzMfSC4wg1H669xjpbU6xYVhHP19c5lfIF4UyiwRlEmFVyw-HVlFdd8q0TnXTUc4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\lRp+MQ0tV5VvmIdVB73bE2Yi1NrgwDL6smH12ZdBpk1wFuu4+ZayhLIZLoAwVdNk.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\thtCAwINn9z6SCt7RihD6VIdq4BhmPY03qrh61FzlDg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\1CAh2A+LvyTBw-pLVi1GDFzKsPhKXXQi2v4Z4hzpIaW7sI5pz1pwnDT23q-fwvI+9pQqkbDCgUEowmYZAFY1Mw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\z4vEXnFM51ibR3qanRI0pl2zy6q6P3X50p89FCWSkJ0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
    "C:\\Users\\user\\AppData\\Local\\Temp\\5mhZHhNoYHczUmF5aCUUddvOrVyPOf5iBU8d7qkrgGo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2-pqJ48CJrgAMfj37C8h+ZqpS6Qx3-oxhj9ebcW1JFSN3Nr4DcNydhte+6aouWxp.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Wi0dr0UIzBT2-Px2M2+M+0UDwsnkzydsygmJq3TtP1BUP7xOCfZ0+9oItb1xtRp4KhrCzg8D3-t4rds+DzLFmg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_76073dd5b9ef429bfc11a700ba828b21.jpg",
    "C:\\Users\\user\\AppData\\Local\\Temp\\gIuoHRIPh8-go5buRepXirhFmGcjgLEvkE13VXd8QmSXo0s0r2eTC5i-tb929PDnMubWEIy74qBq3MffT+vg9VC6yYScbtuK+W7mRxCDYyPRFOM7fg2m41WENVu7zrCCklrCEZLziYVCX2+nJ4pORCKafqQqT0d52e9NpbySBYI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\pTeX9OjadIJduvTP0P4pdChXQLba1igC+JsCvvLb8v40pwN4EpyNLkhrYyQYGRZw.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Rpv3ugsFGApUyOuK1Kf7+RrejZuIFCaw5TDoXgPCFc4bsm-AcMYQhUCY-guX+EY8V1Z0TU6EW4VOMf0QjY7tbw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\psrs5fjPiSJADdi9qtHi47yXVgrI3lEIABm8cN9b1U8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SfaKY52JHt-8d0msUaFqP7hkvoZHvzWW3sgYoHtK3Hw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\ON460OYowcmGTZLR0R4o+6Ou7MJHvhaXpsDEgFv-QgxZN5zFiDfVHPGHJrB7R03J93lRWXYvnTsigL-0Jdrtlg==.C30C4DA81AE308962B9A.crypted000007",
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
    "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "whatismyipaddress.com",
        "answers": [
            {
                "data": "104.16.154.36",
                "type": "A"
            },
            {
                "data": "104.16.155.36",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "whatsmyip.net",
        "answers": [
            {
                "data": "104.18.35.131",
                "type": "A"
            },
            {
                "data": "104.18.34.131",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "104.16.154.36",
        "domain": "whatismyipaddress.com"
    },
    {
        "ip": "104.18.34.131",
        "domain": "whatsmyip.net"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 10,
        "body": "",
        "uri": "http://whatismyipaddress.com/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatismyipaddress.com",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://whatsmyip.net/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatsmyip.net",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x405034"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x405038"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x40503c"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x405040"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x405044"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x405048"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x40504c"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x405050"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x405054"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x405058"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x40505c"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x405060"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x405064"
                    },
                    {
                        "name": "SetPriorityClass",
                        "address": "0x405068"
                    },
                    {
                        "name": "SetThreadPriority",
                        "address": "0x40506c"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x405070"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x405074"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x405078"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x40507c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x405080"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x405084"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x405088"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x40508c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x405090"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x405094"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x405098"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x40509c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x4050a0"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4050a4"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4050a8"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x4050ac"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4050b0"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x4050b4"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x4050b8"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4050bc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "LoadCursorA",
                        "address": "0x4050c4"
                    },
                    {
                        "name": "EndMenu",
                        "address": "0x4050c8"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x4050cc"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x4050d0"
                    },
                    {
                        "name": "CreatePopupMenu",
                        "address": "0x4050d4"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x4050d8"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x4050dc"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x4050e0"
                    },
                    {
                        "name": "DrawMenuBar",
                        "address": "0x4050e4"
                    },
                    {
                        "name": "GetListBoxInfo",
                        "address": "0x4050e8"
                    },
                    {
                        "name": "IsCharUpperA",
                        "address": "0x4050ec"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x4050f0"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x4050f4"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x4050f8"
                    },
                    {
                        "name": "GetClipboardSequenceNumber",
                        "address": "0x4050fc"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetColorSpace",
                        "address": "0x40500c"
                    },
                    {
                        "name": "GetDCBrushColor",
                        "address": "0x405010"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x405014"
                    },
                    {
                        "name": "CreateMetaFileW",
                        "address": "0x405018"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x40501c"
                    },
                    {
                        "name": "GetMapMode",
                        "address": "0x405020"
                    },
                    {
                        "name": "GetPixelFormat",
                        "address": "0x405024"
                    },
                    {
                        "name": "CancelDC",
                        "address": "0x405028"
                    },
                    {
                        "name": "GetEnhMetaFileA",
                        "address": "0x40502c"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x405000"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x405004"
                    }
                ],
                "dll": "ADVAPI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0012ed0a",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00126600"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00130cee",
        "icon_hash": null,
        "entrypoint": "0x004039b0",
        "timestamp": "2019-01-31 09:27:47",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00003e00",
                "entropy": "5.32",
                "raw_address": "0x00000400",
                "virtual_size": "0x00003d4a",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00005000",
                "size_of_data": "0x00001000",
                "entropy": "5.14",
                "raw_address": "0x00004200",
                "virtual_size": "0x00000f14",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00006000",
                "size_of_data": "0x000fc600",
                "entropy": "7.34",
                "raw_address": "0x00005200",
                "virtual_size": "0x000fca40",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".CRT",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00103000",
                "size_of_data": "0x00000200",
                "entropy": "0.06",
                "raw_address": "0x00101800",
                "virtual_size": "0x00000004",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00104000",
                "size_of_data": "0x00024c00",
                "entropy": "7.24",
                "raw_address": "0x00101a00",
                "virtual_size": "0x00103a78",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0000591c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000064"
            },
            {
                "virtual_address": "0x00104000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00024a78"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00126600",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00005000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000104"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "89f501e762eab8291c98dd51db7976cc",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 4,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "comctl32.dll.#332",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "comctl32.dll.#386",
    "shell32.dll.#102",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "iphlpapi.dll.GetAdaptersAddresses",
    "wkscli.dll.NetWkstaGetInfo",
    "cscapi.dll.CscNetApiGetInterface",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.SetConsoleInputExeNameW",
    "ntdll.dll.NtQueryInformationProcess"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x405034"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x405038"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x40503c"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x405040"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x405044"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x405048"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x40504c"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x405050"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x405054"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x405058"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x40505c"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x405060"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x405064"
                    },
                    {
                        "name": "SetPriorityClass",
                        "address": "0x405068"
                    },
                    {
                        "name": "SetThreadPriority",
                        "address": "0x40506c"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x405070"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x405074"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x405078"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x40507c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x405080"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x405084"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x405088"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x40508c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x405090"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x405094"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x405098"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x40509c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x4050a0"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4050a4"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4050a8"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x4050ac"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4050b0"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x4050b4"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x4050b8"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4050bc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "LoadCursorA",
                        "address": "0x4050c4"
                    },
                    {
                        "name": "EndMenu",
                        "address": "0x4050c8"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x4050cc"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x4050d0"
                    },
                    {
                        "name": "CreatePopupMenu",
                        "address": "0x4050d4"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x4050d8"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x4050dc"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x4050e0"
                    },
                    {
                        "name": "DrawMenuBar",
                        "address": "0x4050e4"
                    },
                    {
                        "name": "GetListBoxInfo",
                        "address": "0x4050e8"
                    },
                    {
                        "name": "IsCharUpperA",
                        "address": "0x4050ec"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x4050f0"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x4050f4"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x4050f8"
                    },
                    {
                        "name": "GetClipboardSequenceNumber",
                        "address": "0x4050fc"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetColorSpace",
                        "address": "0x40500c"
                    },
                    {
                        "name": "GetDCBrushColor",
                        "address": "0x405010"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x405014"
                    },
                    {
                        "name": "CreateMetaFileW",
                        "address": "0x405018"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x40501c"
                    },
                    {
                        "name": "GetMapMode",
                        "address": "0x405020"
                    },
                    {
                        "name": "GetPixelFormat",
                        "address": "0x405024"
                    },
                    {
                        "name": "CancelDC",
                        "address": "0x405028"
                    },
                    {
                        "name": "GetEnhMetaFileA",
                        "address": "0x40502c"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x405000"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x405004"
                    }
                ],
                "dll": "ADVAPI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0012ed0a",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00126600"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00130cee",
        "icon_hash": null,
        "entrypoint": "0x004039b0",
        "timestamp": "2019-01-31 09:27:47",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00003e00",
                "entropy": "5.32",
                "raw_address": "0x00000400",
                "virtual_size": "0x00003d4a",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00005000",
                "size_of_data": "0x00001000",
                "entropy": "5.14",
                "raw_address": "0x00004200",
                "virtual_size": "0x00000f14",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00006000",
                "size_of_data": "0x000fc600",
                "entropy": "7.34",
                "raw_address": "0x00005200",
                "virtual_size": "0x000fca40",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".CRT",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00103000",
                "size_of_data": "0x00000200",
                "entropy": "0.06",
                "raw_address": "0x00101800",
                "virtual_size": "0x00000004",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00104000",
                "size_of_data": "0x00024c00",
                "entropy": "7.24",
                "raw_address": "0x00101a00",
                "virtual_size": "0x00103a78",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0000591c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000064"
            },
            {
                "virtual_address": "0x00104000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00024a78"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00126600",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00005000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000104"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "89f501e762eab8291c98dd51db7976cc",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 4,
        "versioninfo": []
    }
}