API tools faq
paste
paladin316

Troldesh_34336be81874cf37fd35e2d9c5ab886d_jpg_2019-08-21_17_05.txt

paladin316
Aug 21st, 2019
2,202
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.03 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Troldesh"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Troldesh_34336be81874cf37fd35e2d9c5ab886d.jpg"
  7. * File Size: 1391792
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "b4475ffe3f465ea2e3811312b6950e8533115014fb99c6d96bea7a3e4e0ba0df"
  10. * MD5: "34336be81874cf37fd35e2d9c5ab886d"
  11. * SHA1: "a2487dc413e140a23fc97a03d9bc896e6a612963"
  12. * SHA512: "7621a8b6dec9ef997906b0ea6224f0948c52f5fef4910b95e5965c97c06fe3142d5ceba1c05742400425df2348ae1f1c2c22dd74e2a2e46f6d90a9ba51d19bea"
  13. * CRC32: "8DEC173B"
  14. * SSDEEP: "24576:0Zpi1ZGIRtOi3PdD+qMVyC+N+Ahfv5Ya4nKrQ0:PZGI7DdDaVP+NfuamKrQ0"
  15.  
  16. * Process Execution:
  17. "Troldesh_34336be81874cf37fd35e2d9c5ab886d.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details":
  40.  
  41. "IP": "66.171.248.178:80"
  42.  
  43.  
  44. "IP": "217.79.179.177:9001"
  45.  
  46.  
  47. "IP": "127.0.0.1:49650"
  48.  
  49.  
  50. "IP": "176.126.242.49:443"
  51.  
  52.  
  53. "IP": "212.89.225.242:443"
  54.  
  55.  
  56. "IP": "194.109.206.212:443"
  57.  
  58.  
  59. "IP": "76.73.17.194:9090"
  60.  
  61.  
  62. "IP": "171.25.193.9:80"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "Starts servers listening on 127.0.0.1:49650",
  68. "Details":
  69.  
  70.  
  71. "Description": "Reads data out of its own binary image",
  72. "Details":
  73.  
  74. "self_read": "process: Troldesh_34336be81874cf37fd35e2d9c5ab886d.jpg, pid: 628, offset: 0x00000000, length: 0x00153cb0"
  75.  
  76.  
  77.  
  78.  
  79. "Description": "Performs some HTTP requests",
  80. "Details":
  81.  
  82. "url": "http://ipv4bot.whatismyipaddress.com/"
  83.  
  84.  
  85.  
  86.  
  87. "Description": "Attempts to delete volume shadow copies",
  88. "Details":
  89.  
  90.  
  91. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  92. "Details":
  93.  
  94. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  95.  
  96.  
  97.  
  98.  
  99. "Description": "Installs Tor on the infected machine",
  100. "Details":
  101.  
  102.  
  103. "Description": "Installs itself for autorun at Windows startup",
  104. "Details":
  105.  
  106. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  107.  
  108.  
  109. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  110.  
  111.  
  112.  
  113.  
  114. "Description": "Exhibits possible ransomware file modification behavior",
  115. "Details":
  116.  
  117. "file_modifications": "Performs 198 file moves indicative of a potential file encryption process"
  118.  
  119.  
  120. "drops_unknown_mimetypes": "Drops 182 unknown file mime types which may be indicative of encrypted files being written back to disk"
  121.  
  122.  
  123. "appends_new_extension": "Appends a new file extension to multiple modified files"
  124.  
  125.  
  126. "new_appended_file_extension": ".crypted000007"
  127.  
  128.  
  129. "new_appended_file_extension": ".new"
  130.  
  131.  
  132.  
  133.  
  134. "Description": "Collects information about installed applications",
  135. "Details":
  136.  
  137. "Program": "Google Update Helper"
  138.  
  139.  
  140.  
  141.  
  142. "Program": "Microsoft Excel MUI 2013"
  143.  
  144.  
  145. "Program": "Microsoft Outlook MUI 2013"
  146.  
  147.  
  148.  
  149.  
  150. "Program": "Google Chrome"
  151.  
  152.  
  153. "Program": "Adobe Flash Player 29 NPAPI"
  154.  
  155.  
  156. "Program": "Adobe Flash Player 29 ActiveX"
  157.  
  158.  
  159. "Program": "Microsoft DCF MUI 2013"
  160.  
  161.  
  162. "Program": "Microsoft Access MUI 2013"
  163.  
  164.  
  165. "Program": "Microsoft Office Proofing Tools 2013 - English"
  166.  
  167.  
  168. "Program": "Adobe Acrobat Reader DC"
  169.  
  170.  
  171. "Program": "Microsoft Publisher MUI 2013"
  172.  
  173.  
  174. "Program": "Microsoft Office Shared MUI 2013"
  175.  
  176.  
  177. "Program": "Microsoft Office OSM MUI 2013"
  178.  
  179.  
  180. "Program": "Microsoft InfoPath MUI 2013"
  181.  
  182.  
  183. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  184.  
  185.  
  186. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  187.  
  188.  
  189. "Program": "Microsoft Word MUI 2013"
  190.  
  191.  
  192. "Program": "Microsoft OneDrive"
  193.  
  194.  
  195. "Program": "Microsoft Groove MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  199.  
  200.  
  201.  
  202.  
  203. "Program": "Microsoft Access Setup Metadata MUI 2013"
  204.  
  205.  
  206. "Program": "Microsoft Office OSM UX MUI 2013"
  207.  
  208.  
  209. "Program": "Java Auto Updater"
  210.  
  211.  
  212. "Program": "Microsoft PowerPoint MUI 2013"
  213.  
  214.  
  215. "Program": "Microsoft Office Professional Plus 2013"
  216.  
  217.  
  218. "Program": "Adobe Refresh Manager"
  219.  
  220.  
  221. "Program": "Microsoft Office Proofing 2013"
  222.  
  223.  
  224. "Program": "Microsoft Lync MUI 2013"
  225.  
  226.  
  227.  
  228.  
  229. "Program": "Microsoft OneNote MUI 2013"
  230.  
  231.  
  232.  
  233.  
  234. "Description": "Creates a hidden or system file",
  235. "Details":
  236.  
  237. "file": "C:\\ProgramData\\Windows\\"
  238.  
  239.  
  240.  
  241.  
  242. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  243. "Details":
  244.  
  245. "FireEye": "Generic.mg.34336be81874cf37"
  246.  
  247.  
  248. "K7AntiVirus": "Trojan ( 0054985e1 )"
  249.  
  250.  
  251. "Alibaba": "Trojan:Win32/Kryptik.cbceadb1"
  252.  
  253.  
  254. "K7GW": "Trojan ( 0054985e1 )"
  255.  
  256.  
  257. "Invincea": "heuristic"
  258.  
  259.  
  260. "F-Prot": "W32/Agent.BAE.gen!Eldorado"
  261.  
  262.  
  263. "Symantec": "Packed.Generic.459"
  264.  
  265.  
  266. "ESET-NOD32": "a variant of Win32/Kryptik.GVNS"
  267.  
  268.  
  269. "APEX": "Malicious"
  270.  
  271.  
  272. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  273.  
  274.  
  275. "Paloalto": "generic.ml"
  276.  
  277.  
  278. "Endgame": "malicious (high confidence)"
  279.  
  280.  
  281. "TrendMicro": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  282.  
  283.  
  284. "Trapmine": "malicious.high.ml.score"
  285.  
  286.  
  287. "Emsisoft": "Trojan-Ransom.Shade (A)"
  288.  
  289.  
  290. "Cyren": "W32/Agent.BAE.gen!Eldorado"
  291.  
  292.  
  293. "eGambit": "PE.Heur.InvalidSig"
  294.  
  295.  
  296. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  297.  
  298.  
  299. "Acronis": "suspicious"
  300.  
  301.  
  302. "VBA32": "BScope.Malware-Cryptor.Filecoder"
  303.  
  304.  
  305. "Cylance": "Unsafe"
  306.  
  307.  
  308. "TrendMicro-HouseCall": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  309.  
  310.  
  311. "Rising": "[email protected] (RDML:VYFUKWPD4tNYoAlGLo51sA)"
  312.  
  313.  
  314. "Ikarus": "Trojan-Ransom.Crypted007"
  315.  
  316.  
  317. "Fortinet": "W32/Generic.AP.1D3C286!tr"
  318.  
  319.  
  320. "AVG": "FileRepMalware"
  321.  
  322.  
  323. "CrowdStrike": "win/malicious_confidence_60% (W)"
  324.  
  325.  
  326. "Qihoo-360": "HEUR/QVM10.1.5B4E.Malware.Gen"
  327.  
  328.  
  329.  
  330.  
  331. "Description": "Creates a copy of itself",
  332. "Details":
  333.  
  334. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Harvests information related to installed mail clients",
  340. "Details":
  341.  
  342. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  343.  
  344.  
  345.  
  346.  
  347. "Description": "Anomalous binary characteristics",
  348. "Details":
  349.  
  350. "anomaly": "Actual checksum does not match that reported in PE header"
  351.  
  352.  
  353.  
  354.  
  355. "Description": "Created network traffic indicative of malicious activity",
  356. "Details":
  357.  
  358. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 354"
  359.  
  360.  
  361. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 191"
  362.  
  363.  
  364. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 369"
  365.  
  366.  
  367. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 205"
  368.  
  369.  
  370.  
  371.  
  372.  
  373. * Started Service:
  374.  
  375. * Mutexes:
  376.  
  377. * Modified Files:
  378. "\\??\\PIPE\\wkssvc",
  379. "C:\\ProgramData\\Windows\\csrss.exe",
  380. "\\??\\PIPE\\srvsvc",
  381. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  382. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  383. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  384. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  385. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  386. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  387. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  391. "\\Device\\NamedPipe",
  392. "C:\\README1.txt",
  393. "C:\\README2.txt",
  394. "C:\\README3.txt",
  395. "C:\\README4.txt",
  396. "C:\\README5.txt",
  397. "C:\\README6.txt",
  398. "C:\\README7.txt",
  399. "C:\\README8.txt",
  400. "C:\\README9.txt",
  401. "C:\\README10.txt",
  402. "C:\\Users\\user\\Pictures\\Host.zip",
  403. "C:\\Users\\user\\Pictures\\G2hSait+cA7GnmLSCVanLFrm+gv1pjEUGXgMguCJrWY=.C30C4DA81AE308962B9A.crypted000007",
  404. "C:\\Users\\user\\Pictures\\Host.xls",
  405. "C:\\Users\\user\\Pictures\\kA2TDKcvs182e2h2x+bzDVtk2oS-Rd2QGDOdNE3Nrb0=.C30C4DA81AE308962B9A.crypted000007",
  406. "C:\\Users\\user\\Pictures\\Host.pptx",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.tmp",
  408. "C:\\Users\\user\\Pictures\\obk+CHR2tgZX3b3jR5R6fFvRz+jJ8D8uISKrZkTzdzs=.C30C4DA81AE308962B9A.crypted000007",
  409. "C:\\Users\\user\\Pictures\\Host.ppt",
  410. "C:\\Users\\user\\Pictures\\Ot-eSwXqj1T0TA-4w8aahSUyiaJPvy+CN4oeGFpx4go=.C30C4DA81AE308962B9A.crypted000007",
  411. "C:\\Users\\user\\Pictures\\Host.pdf",
  412. "C:\\Users\\user\\Pictures\\IGatS686bUIQ0tYPVAUq-yCewEs3Uf+wSDT9R5w-MN4=.C30C4DA81AE308962B9A.crypted000007",
  413. "C:\\Users\\user\\Pictures\\Host.jpg",
  414. "C:\\Users\\user\\Pictures\\3wkvRllF6NenHhvhRg5rekRCcfQ6BZpvmCfyFDkIllU=.C30C4DA81AE308962B9A.crypted000007",
  415. "C:\\Users\\user\\Pictures\\Host.html",
  416. "C:\\Users\\user\\Pictures\\pD79rI1bwtt8I1dNG9xnMaFJBWSK-Zidv++vtxDI0IE=.C30C4DA81AE308962B9A.crypted000007",
  417. "C:\\Users\\user\\Pictures\\Host.gif",
  418. "C:\\Users\\user\\Pictures\\A6D9-4cKavxod-wEDYUfciGUL5hsmkWt83aoAxtelRk=.C30C4DA81AE308962B9A.crypted000007",
  419. "C:\\Users\\user\\Pictures\\Host.doc",
  420. "C:\\Users\\user\\Pictures\\25Xi2GURxGW4We9i5-wjaadt2T-ANGdamRn8zU7lcg4=.C30C4DA81AE308962B9A.crypted000007",
  421. "C:\\Users\\user\\Pictures\\.xls",
  422. "C:\\Users\\user\\Pictures\\VKMEJFqW0pmKCSoPWTnypA==.C30C4DA81AE308962B9A.crypted000007",
  423. "C:\\Users\\user\\Pictures\\.jpg",
  424. "C:\\Users\\user\\Pictures\\B6u1mbyScTnsppDLb6I-Ew==.C30C4DA81AE308962B9A.crypted000007",
  425. "C:\\Users\\user\\Pictures\\.html",
  426. "C:\\Users\\user\\Pictures\\gtOxRYZTqKTw2QHdngf3rw==.C30C4DA81AE308962B9A.crypted000007",
  427. "C:\\Users\\user\\Pictures\\.doc",
  428. "C:\\Users\\user\\Pictures\\Lqaa4PgzOBWEVhGMQhVz1Q==.C30C4DA81AE308962B9A.crypted000007",
  429. "C:\\Users\\user\\Pictures\\.bmp",
  430. "C:\\Users\\user\\Pictures\\Rr7jCrkxP13sGnAOr8rSiA==.C30C4DA81AE308962B9A.crypted000007",
  431. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  432. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\tewxyvo6Id9FNYMO253zKz71si2o8gpjKbOwnXtHYt84xhhcHBjyBhj+AVLpdL+YIviNZU3fhdGEYotkKy2lbKKQknOcz0BQn73ggH8idOtuSPFrpcsyPPWSfdRoHOVT.C30C4DA81AE308962B9A.crypted000007",
  433. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  434. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ftSFNAHBH-jt7kZDQsSfE7Lj8sQHggKNlKqnL+wYJX4=.C30C4DA81AE308962B9A.crypted000007",
  435. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  436. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Lz3mQz2ACGNjcIe1iCtDgUNStYg8i1dw5O1u2dUyP-HGduxVL-K0p7l89InhiSUo.C30C4DA81AE308962B9A.crypted000007",
  437. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  438. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\DkCN+WtDNmtjOUPb3i6mn15Ow-wfMlNqoB4CTwrVcAY=.C30C4DA81AE308962B9A.crypted000007",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\R-kM7VdHeVwZ9o-sISmM1MMJdo5hFwZ8XsMyMJq+ECY=.C30C4DA81AE308962B9A.crypted000007",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  442. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\2RqtREzhnbFdfkBQ1SJuF9835aWRmXer+5XPfxBYMro=.C30C4DA81AE308962B9A.crypted000007",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choltj5M9sDjzq-gXyL+jqdJbv97b4e0JBclYRM8zJsmCN+LxFGNl-mkVqS2iUfj.C30C4DA81AE308962B9A.crypted000007",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\r45q2yEwQU88YnsIIDM7ODCYLV0PJw5QvzWvvjrDWiI=.C30C4DA81AE308962B9A.crypted000007",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\F-lRQ1+gS54TH7Nebvb0TvB5OZovOw0MinYXYdvtH-MyIthMuGovzap+YfNCqDOy.C30C4DA81AE308962B9A.crypted000007",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9SeWePTCsySJbFBliorAEEV5OtfT4DIs5Y-Ti-n5nMs=.C30C4DA81AE308962B9A.crypted000007",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Cz0mLqIUdSyp1H-ogrexIet8msyDA5WFcUdw9u95S48=.C30C4DA81AE308962B9A.crypted000007",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\JqjG4AgEMvtwbMbTbpKMHZo+vJk2AxRNZRV0LjpQ454=.C30C4DA81AE308962B9A.crypted000007",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uAU8kpk+1TfXvzCZ1TxiqWG37wfCZd2j12Ql9tKDTlI=.C30C4DA81AE308962B9A.crypted000007",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yom4qZtCt51XlNNb4YmKdqwzR7oV75+TWHnWK22BNFrZEkZJOdYct+q56cda9Sra.C30C4DA81AE308962B9A.crypted000007",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\l7NmNSmZcxYq4o76vqkYNsG56V9EdPVWc+TR1NxXZ+c=.C30C4DA81AE308962B9A.crypted000007",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yX-EXFziQiLi6i+JZeLSVRm-FQlPVBv6AP3xnOwgdyXTMUrqHnUAPAdDi7E7rbPl.C30C4DA81AE308962B9A.crypted000007",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\a7G0hF4RLwljZolg3xc1ktwtUksHuoPrqf4A5tO-Cm4=.C30C4DA81AE308962B9A.crypted000007",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6mz5q+ISbZy6gKGXp0KQ4rKxsJOaRA311w5kDcMUUHo=.C30C4DA81AE308962B9A.crypted000007",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ugWWpeAYwiL2SazXujw6swltjcqvUgW2JbSLyw71Rus=.C30C4DA81AE308962B9A.crypted000007",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TTZjVFu74RWvPDlaJzfBFmLCJeg0m7NyG7MUnPqv24c=.C30C4DA81AE308962B9A.crypted000007",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1nayvDltkp-+vF60dAi4jZnqqSQrWpY1Tve180ZCNtk=.C30C4DA81AE308962B9A.crypted000007",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\U9W224fjaJOBnX+uYSqa26K8b-OKtcilK1JpncqKKHM=.C30C4DA81AE308962B9A.crypted000007",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\ypERMfN3klSw3nvuL4f9zrCkKRmz2VcSJ8aVXrKXtBk=.C30C4DA81AE308962B9A.crypted000007",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Xr485DrEM-btSUP64lNO4-JW4OyTIbWRYDz+6a5Y5X4=.C30C4DA81AE308962B9A.crypted000007",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\ZczVElg+WUbPBmMCH2CBEqqhEPitwKSD-9D6PRNeDmk=.C30C4DA81AE308962B9A.crypted000007",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\vOuMNo2tGD+B96YidQ1dJelkG4lJrQPa5Lf-v9uMnv8=.C30C4DA81AE308962B9A.crypted000007",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\hFP08MPbCZieEry-qgY9z9lz4JlUlYROfDjWrlr+iCU=.C30C4DA81AE308962B9A.crypted000007",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\pAemeOo0xJ+7ftkZeKB6OaBoEqvoyFiPH7oyf0wkfHQ=.C30C4DA81AE308962B9A.crypted000007",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\k395yZgCMYHFGeb0c5ZbTHpJRZ3QPkJJdsXACkg3vag=.C30C4DA81AE308962B9A.crypted000007",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\eeNfQhogFN6+WCU47NsJANVY5z+Cf21OVYC7vQlLKsc=.C30C4DA81AE308962B9A.crypted000007",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  492. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\BJ-0bIIjXteJ12nIRvCWpPCF3GXBS5CUw0vWrs7dYDytfw8N8+ibgjlaTPETTqdqFWc5eQrjAlu+voWnpKotkg==.C30C4DA81AE308962B9A.crypted000007",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\qLhesnx-UsEYDHfDwKM-2kgA9C2sfgZhar7lElJG4yAA6Wxa514Xq6sT4oZhFNazolXxFodW8dwuPI2+nPFzpA==.C30C4DA81AE308962B9A.crypted000007",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\pZ1H9P0kjMrnR5ejmcrb+09THxL1IjR+Z+ZGVbsJ5RykivRNP7+3s64HxcJ1Ss--LqKhPqcnHOHGLBpth28yteqqOWgJ52kUwfvea8GCfka+OGv-nz3NWip6Ipcfacr8toGDrc-3wFFLD-JtHDjGg5KguKoYaEXkFmhE2O9vagrwzDWxcTqVwDcCrAvkPfQH.C30C4DA81AE308962B9A.crypted000007",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\YXgZhLYoK+dM5RrlK9izBTMAUJXiu70ChbPRdiRw7RkuXkh9dkgXQuRUOSxYusWYAkI4C-HRd1LwBZOnnhtT5A==.C30C4DA81AE308962B9A.crypted000007",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\3HBJ-lQWs9JLLUr6iaXKpJP+hu09kiI9CLs32mvEpQEjSTBUjRMvA051HXDvzP+gVbuWZmqmmzZTqExa5e0Wjg==.C30C4DA81AE308962B9A.crypted000007",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\D4jAwKtm-7ZKqDlUAT5qaSi-ky7v7iq3dFiosih0vcz+IHIKun4PtJKpjRG6Ygzx2RdKqBnOVh44omcKZ0NAWg==.C30C4DA81AE308962B9A.crypted000007",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\qc88sPtpp1llPevguxbdOuk59iP9doxEmd2-1lzBYUzSUSCY5ikEfpXmTM25JR14+NMLj9rAdz3QNSGKengdHLuWAY0gmzgxAsJsCCNSQP0PiaquQMP0Q5oJy4bmVFikyIGp+MYHiB+1idab-GT8HA==.C30C4DA81AE308962B9A.crypted000007",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vgghyIObuQoIaoOsY9U2+z2OSJsI6Ud9HJbUaXZBNsDO1LCj0hQGNBYF-iSDCIGxRDAlR6T8H7pGcMhtPr3To5tcnAFPoygQyRBh4nTVTX8=.C30C4DA81AE308962B9A.crypted000007",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\JgbqbVquBnWRNS-QbNrh9B9xTRyZRVLu3KGPI68VZHg2kPw8BpnRnVgO+U6ZPZAuhDV-5ubP8+sPCDk5k+YGdQ==.C30C4DA81AE308962B9A.crypted000007",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\mFPGKDu44e6eE30Okqxea5sZVgekq9jzB3kSC0IosZlEt4xMqoBRcdbHq+gxTUqlKDn9UJTbAvWmGiR2K1xsL1Qq5obg2OSYhB-4xvu5d1VWkyiGMMOwZUMJrlLS5ph6.C30C4DA81AE308962B9A.crypted000007",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Y-LqkQoj9vN89vjjpN2OCMAHqNXvLLJUlEYNZ8REZsXvQIbl0hNb1Xvuo0DH8ERdlXFi-FzWxVgIsRIm6ZKoZlo8iR+jKq6zLA5BpJMCQhLFDZZ5KaHAJU3QchhySr3DLtKaTj-C5EV9yw-edpeMVQ==.C30C4DA81AE308962B9A.crypted000007",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\C0dLSG6MUNJVd2UYvzO5nYbgzP2A-tIEEMtBAmSgoLVCH1Rxa0p4zEvd4uhXbM-baZf8iNuC6znZ+f6O8k0fEg==.C30C4DA81AE308962B9A.crypted000007",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\IIhZ27rO2nZtr8CXqt2AOmXZO3M22v3ywTN1qWymrD6rl7z2VY8oD7Iwhl-2Do1qHa6QcI8grFdlnUGLgWgECQ==.C30C4DA81AE308962B9A.crypted000007",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\lr9oE1a6NJXYnkdkeeOX0gL3qzcGnhfvYB1-u48f+jVACDMW-jiQUhAhIpbVmQHn.C30C4DA81AE308962B9A.crypted000007",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\NaBmbqEZ8Y7UJ72C5XqADjUV0hKRR-5mdJBaBFkPwGesiOEMDtCVCxpp5kfmmS2vetR9V3Y0-1R68O4l1WFXKQ==.C30C4DA81AE308962B9A.crypted000007",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\3Fvc7FqqoeFA-uHI68f6at8npzi6hAfSb8E-lec+ICmqjJjDjBKcED9mGZhra69FIfjxkoM6FmpmLpEZFv7ZK3Mmecin-sgDC2ZN+iDpfn-Fhwy9M1R-3N4RsPibEVq0.C30C4DA81AE308962B9A.crypted000007",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rWvwObumLsurVhRKzQUi6TZVW37QhwTFRhbY2lJICoKM87FBmpbP4Gahnqy9-3oDUKqGAW-szDHheeLiKo4Uag==.C30C4DA81AE308962B9A.crypted000007",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0dYfBinsFwquG0x4VKou-rsPZPDO0X4xLJTv4w4QroT3DT1L7hpLXqgIBgw4zZ6rF3jfYmlmv6QqPc454zaaWQ==.C30C4DA81AE308962B9A.crypted000007",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\etS0lB1Q+Znz-ly5r4iBoPktSwc8Tj1kxvTKYlTADeoc5gCLVyDaf2DlJjto4JuNOqRCnOlENVJmg4c+5AzQZw==.C30C4DA81AE308962B9A.crypted000007",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\L6oSE3--WkXl8YHBw4tAthk5dUyBvlyCrmOBoA8eQZNb6ZIkhoZUeJJfbz98dbyv+IjMCdyTJlsQ6fpTCRUOhQ==.C30C4DA81AE308962B9A.crypted000007",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Ld+x7KULaN4wjC1mJ1qt1WhMplJ+dyikO3us-dA9axijo6vb7cwHuCkpf4G8iwJb59SZmIr43ZLeVWBnq7GM3w==.C30C4DA81AE308962B9A.crypted000007",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\A3IAaFggCnXy97k2UJjnXZT+MIBXtXArZV1q2nPbBZyXgYOL3F4ROVyC7zgzuiADCSrwyxhcjQKtZ2T+Lcuumw==.C30C4DA81AE308962B9A.crypted000007",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\E2twyOuGDEclZa+7WcPG3Vb1HEoFxZ4q6OtqNfSvcAiTBQ3v4ORKnH+8SVZi-XDltakeJxhwHNW4CITtqDt4Q77qqdkpeJzMbe+wDgCxPCQ=.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\I8hytAYrcUJ1t5v13ehTAYDr9h3QWWi2Q00qfa86DL4Shy7gWoR0bNskHfP4yLv+fW2y9i6lTqbw4-5qlcdD-g==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\2KII6TsIz8I3SiKX3PXQ08vlFKQ+s+dQl6lnoyhsgc02qpt-DBPtdVVHpOwlnwSRD9DM9uT3arhT-9q4q57vZA==.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\BFIUuoi8qhLxxwEZo7KG0MVxt-7g22YnO51UeaIPWwysK7xhO39iGxJzv8FbQ5BR-n2DTLxYRgzFTpLNjfcdWQ==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\vQZdPACbadLBmbEhmskfM4ilb9sN0tJwZqclCNeOxq3Pluk+AbwT6YwBvb1HAa9KhUTHcOWK3Jt6n+hB5kx6lw==.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\IqvsQjwHAqGGlNwauNNllVza67OqEDrOA6tqjAi3GgIZ6i-ein6jnyqo9HDFe1j347wU6Bybowa22K7B9jKEqg==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\nqIvrNdkILq9RisHYACgRvW0VnWYRF-53ozZA4mUP0J6+81gGjUhh3HSASV+krZOb+ZSikegael9Qxk5Krw42w==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9QLpAdBk4lQ+SMwB75ynaeuMCfaSHADAgT+V7C2Y1iCSel6F0LKYnFvyFb0YwVEeTRWK8yi2LZUGSjNyIsvmOQ==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\JK0CvItmLGI43FzsOofFr6QNOvXc8TZFekZB6DQPRAX3k2l1Qq4TMFiXrCgFWswXRW1BVWRSGLCMFXIGEDpl+w==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs",
  555. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new.tmp",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+BrxJ1oBXbVVlYqpluOBIOrlgYqWcMLG+TxQriEQ-bZ5CkPZCpJjHScY8Ru5e3qsW-Vsm91WmO+keJpHAxBZSQ==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\KSt3aGULi6BZIfIAyIRW06cjF0X7R5DNTVx0JalntbCNuOLYwWYfSIPfsUKrJ1qO3mnfTXm7TEFRjhb70jKDog==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\c68kJuDKqnfbprCNUWj-RxEAP0cLdXnKPuFVOumL3b032yZnhtNfKb+cNQXiverU5QJOtrDkoi+bKBryYorKlRrOgTteGzpdQ4SlEOKiGzI=.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\zI1fnL4rk1XUGmZjmkexJ8ahvpLQ6yJP2CGNxGmoRT7rRz-gslHql2m7eP7Y3NIrBJBoV5ztC+CyCyo9cGLJyg==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\5dviMDCeM1ato6wDqdapuAzpCiKLkVeSe426cDyz1cNsofGOvEQSEtHXXUoZwiSSKbvey4gGXjLAR666t8ghoA==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\IiXRTUu9Mkg62s7+e27iucPLrOHFFq+gtp+jlsueRaljiJSyqQ32cHbQH5gtuWV6rqqajvTi+hNvhPTMXFTAQA==.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\7lSavAxmhPUMgEIGvq8yKpQVBb-2onPYZBgoZNE0t7SwMqgBYIYOFQyBw-+h560S3UXfglGd-6xDHwvdtUaE8g==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\bDf7DJsI6P-CxWygk+5tpwUt-FtPuDuFM2x7cFGkWtq9NNYjvtUXrs7mhSVEy5wHNbGVex1770D1FTVdcR2EFQ==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9eT04DU0WLmzgejBtuEUGi9we9TvnsImq2k+PxpF7jkP6BlwcZu1gVOqN3qy8GmQ5zEDrSXB7ziZg48p6t05Ug==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\fPgBpE18nQUPfHigzvdQlY6T4cSEkCzHwIUHtovrUiPSeMficBlfx9jbO3eGDM7W.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Uj2yPqoHujrk4Mhj8aimwoAbU7hqi3mMJlKWMJRlAyM=.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\o+ewwD3NhjU3OxNAsUcBYP+ON-3X82NwIc5T4xJ1JgY=.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\H7GMpz1HAEPXWY19hXbTG0mjdynFVrTa39WuZn0I-Jw=.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\l80aJxraHOdg5Xz8aYgP6oL9YDrj1SfhbXn7KbOiSmA=.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\QizshzPzDTaIcIFzRE6nVX00C2t-Qaw37H5fjo1wxfo=.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\a7ZLKYbK-o+CYWOQlTioplbuqro6WEB0EiBl6h-nsFKK2isZytQlCqlhycT5wtDtkva+UV2WL3kF3PLAwVbOZw==.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\QOSLCnK72aZ9qV+3pTHyuRuHK3GizE8j+Yrpk8N2iZWD5pADSsUVaV6uQDpkDi2+MUgeF-dQkhYxY-Qw6l74VA==.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\VNAq42VdbB+KCozlMuAHMgSUt6XnqT0Tg1fF9O8DRJ8=.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\YKgNf5Z5C-vdZIVR-qIv3NZjjMi2dyROxcYTl73KXTg=.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\OSxmeuorQ8PgvMN7ZTuetwKX0H7ZGex98-JHuraPFL4lFo+AoXnVuwEzP-45tB57wdlElHBv6ehmn2v5nTD0ZQ+TU2SvF3D843jpzXZ0k9o=.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\L9hP3ItluHpIeXpFolZI23bJPZYXjEEmszS+LUW7ETzXuLmaui+8n1lNajVHr6+t.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jKX+NTMY7PuQZVhO0GPecUkjcjmIJmVoL123-WlgnHM=.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\NTyhFumlfad6yxZ8YtqCWb27obQHv8h7fqfKGE6QJQfBu0g5nzRBDu-yz6eXrfeG.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\vRWHtLzjOGkkl2y399m008+buJhZe4UHmOLf3wkcpKb8uLbGXvrPsIKUOWvH3BhZxpsOzZQG6Nju3uj1bi8rDAWXk-B2Ti1-Epead7fYkuw=.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\gQQ8nfvVWOovvNlbP7PQwrC+S6tsxZcXGPn92rQITic=.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\rQpB4i4mzjG0TlrTmhWqaxMfSlnCwY1IeWmtnroxkg4=.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MYBBs7A3qizbr4IAPWrgxg==.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\8Ii4xbBz3yCjmnUpwMTaE0cykM9ok5EBfaPWKuK5B4w=.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\+FFxszaZEi5zmdnFx8tWh8PS2jex7lpEYWOD208dKDzG1Td0yFO1KSU0FyvOVm7lcXA0UxgayxwaBglr6x3WSA==.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\IaE4h7NONGsnTL-fJc2PoRueH7zHOwNAVML0mOSdQI5XP23uKSH2mAIhNAUOa2fR3UeD9Jk-QEamFKUyHXjpeaGyAsZ-QB-C90mAT0d6gomq993wuwNnaEZZaJybf0LIBj+p-ZgSj2NdvN4g+c7GRQ==.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\wtrqGc6mkqbQc+6iybGvlY0KFyb8WuUE0mq-qfkPc2INgnlBlf5RIG0B5dWhO2nal4XRTh9tDSLFEtOxyuKiPQ==.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\yOVIzinTwFd81G54HjAiln+wR9pj2D2MXLpFQnPsi6C-scKY3sp5-4EPXMrcyjLrXf5gpHMXApl2UI8UK32YBcHv9gMQJQwG3tWvxICrRdg=.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\qJbUmRMZ0GEyMFcw+wxuBmQwjYKy3bMvvXTBirYkybE=.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\VPJL9JnaU6ysRmEROHjpzf61dKv84lv4NsdDjPceIbg=.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\XypBbIUEy1C0QIYhZ1IqvG5yUq86PnPBB+olGJVs2yI=.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\3IZ+FVmk06nl5Yj34XIuoVFvvetLv3FDOZGp6ysStNyzuPpCpPTcvaxWse7dNEKDDp7Wd-qTcQQNHfkn3Q3AwtHVmV0E5CbWHe9I+-Uzj-I=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\CtsKoWdmIQY-dOhAy5FQsXVTIdvQecIdZ9OED3JCag0=.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\-8CpkPSz-tTAnYZ8ZvDWFrszEesiF9RARRqsmz4cfGI=.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\u4J8Uq1MDpUgqRood26iF2X9dLhEtIAKxS2M5GBjWpl-K1Af48aPpqhfysf00kqS.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\qS2AG1Y-DQuqp1cn0Lk9oQ==.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\i79wmodyMWN6qqq-8ceQ8GczsQQ3wCjfsPbpFzv+c2dXUv6XMKfRObZp59bW3nuS.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\+Gr6K0FKyKNG4ipZYzpo1XBxusisvtQyf4f94PdUj7c=.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\aYZSOPwW10o2vGOqQu15uetWAWGzD96f+luZ2MXr7lc=.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\Pjo0BnzZ0SfdCnNwWcp01phTmX6IgxzltM121TNacKA=.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\Troldesh_34336be81874cf37fd35e2d9c5ab886d.jpg",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\cso3yjzLLGyya8gaeXgqXNySgP6Rxoq1qyC0haRJTKfQd4ZF4MG8ppm3-WZJEK1nLG54582feQNOMY-Aw-kPmQ==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\1PRuZ-xFe5Pxzc5c0x2C0OOQugzDtILtlcEMg-YGnkxaahtXH-EraNMXe2RX42CT5RIawuMUdQV1Fah2WC0Bqg==.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\xE5+S175zMj+Jp5r+XWJqDci48Byb5WJbsA239KGebCWYQNF3h7hJgokiC59RmSxzXiTv-LPQ2kQGPAGwaEFnA==.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\U5FueM7b-K0WdJ-OOQCeMc8XE4BduQlFxMJPmrfoRkrm7drY8XhH2Ny0yy1hsrWTA0uxCVIUM4absHso2riPXw==.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\E9g9Er2+JbZDT60qA0BsBQ==.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\DY5lNvNoKkX1D6dj3SFS9PK0pheIo1+gNj3dZscJXj4BjfspHaBUVboqdxK5wltSGIoBAa4KfB+e9eeAkJ0BLgXctrs95KNUEVtXT54X8HfifdXy0yCUE2jm2mOuuO1N8dziXmR97fXevF5K-GPnTyxo+QnLyaNYFwYxJ6J+22E=.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\qGi74GXn5r+CicM9dHdE7Ci5cDtULOAvu2keRwmKWniMDBXFaGuXtl+5dDakZm3Dt4+zZgj-2m6DLDXkdsdO8bp7ib5d1dW9xFE6p+tLRVwGTsXGzsxCBar4iTcMQ+hpMJ8e+Ofoj14yarIOdsXas0G006B9t4ZIJKZyKzk92pA=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\x1lwUwT2cdVQ-J9SccANTrLMv30SNAyeml0kqojr+1O6vCvIdIEHI-+gwyKxyyaB30Xi7bdnc6P-GAHZLJqp14kRvfseeF+q9TdAl7Dh77ZAXsEWyREzF8f+LEqtpyWytlqUxdttrFgJbD3TKxniZoA86ABVK8tyL8WD8-D5dc0=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\sHcDNRWTPrsNGbhfAxQDqc3g02lrf5i1LzEEvlmIlNHJGPGSJi2+MsrcXyb4x508ep1KoSvXamuJ6ik+se2tuo51PP2dAC3-vsWSvdqbU--505+AQffwInnoIQ6wmFX1IJSvwssBLJkKcbl0mFHs2amjcqo0pbj2C2GdBJFBCos=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\TQXUOiR8Mp2vwswxgjUlrqvKGV6c-d7-nXomcYBzAsQdqB-lerewu1tW9kDOZziSgjpEIEp2iUvDtN+L3gkOq6-F1VXtlL3yHpL50V9sdqlqB71jmOTVaD0CKR5A69DJDjC4eedhznbVvYCf1HUrDzaflwQlkgSPKE-pG46gDdI=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\A4D7eYYRS1dlzdUnFhfCO2NKgwdqeLOhfbTynVWYH6Xhp58FhwzOOMCTef7fIA0+nx78oY87bWwd03U72RbtDQ==.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\abRUv3-qZGpJqnerNzPsSJ3Te6Z2OPXoVVoNFMJzb9b6aFRmb0yURSCPPAwfqGvYuxQmWCj37642bJoITMnI+fcSjRbb5qT3+7uNdvZtCALGbnL+CwTmiWglvQgW3znE60HQcsyx8L9a6CttlyTxETeiRCR2AC7-fNT4ddsDb7A=.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\UuT3hEoGIUGhqLjmIL5FisB3YxCdim+Pn7mnSfCMoTW9y9lBwZPSEF5QQgbF6LW2szSL9VGbjf7uyhxwBXxGF7eBfu9j+V5DRrX2hJ1jYsMAYzYFSEJVOAByrdVwuOI7G+AHziXpQ6sDvBD5oMWqNRxQ6nmE7-V9KpCWUCD7ozs=.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\KmDwja+xlLaseSxndce6XKRgfCZ9OR1Kufx1V0W-9Jfkd5mM0A1pkh9-HIlWaqJF2HrfBDNLeker6NF7YmJgVpbvmnv2pdYv0y6U9anmOF5Bz4aJCZ3XGE4qx1oqlmlrBAlKTpYPXDnMnFVfZmN+Pw-zR2iEJSbjKxZwGVvYLco=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\URPj+mFzGpHDz5TiWYbxqoipt-oSmmO-+Pvcf4Nr6Rfu92NVp86uAqpshJ1H0gMvV4BgAtvIgG+UoCkMBVJwZtoPfoAqQfvJPV8jrYeKd+T8gvTQCFIWlsh+49XAg0SQM15bwF6UWfglAt1uXDwl9zpIBsDLNIS43JXiF0uunwg=.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\XZ2c24ya1td+mq4b4EUEs1Apz8LjPIU7bOas-nw+8ED21q3caZDkMJRQmLaV-EfgkSo-mqKcM9DzKFDIs2BdIJgqio39I8tp5Ni0RoQ18rA=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\yBtfcMY1kTZ64VlSIANc-cy9r+97tUI64bX1ZpWSmuTjJcSPM0DAKfEhV7v0G4m8.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\n8kS8wIsrHmqXPxIDb8IWDSQyQRqdryOECuIgjqtUml85yldb8K4sN-NhI4UzV5dstJ0RKUDqteAI4vEa9C57g==.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\dig14cUU3OJLeKrxwNUZFdRrBn-JQZHaPeONj9TVVFWnsDj5HWW0J0xxz7+r0j7TaX9xQGRO+Hhoc0dTe634lg==.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\uMtx4ozLv43trco-ai5aGFoYf2iXId7LHHYtcMvagiZFK3P2W99jfbSX-cYTxZMelPFRP7WRVYdWPrq1X5ITMA==.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\qrd0VL5XFkVC4NoAQgiLeSC9QRvjUnLZmAQWDhc39mA=.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\ol5YkgpUE+lme8+vJLP4oV0MJ3AfaqtFueGXId5bUUExPUibrY4vPOjFWaEjUB7MkWDYLqB47f0RAlZPD9KzEg==.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\LL6pbNS4VS4VH17W1-z-CJZMRFmCurSF07hIrdnslgU=.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\LoxWj9yuulUIh+NeX4BJvf+9vAiEYRRHgt6nCMpSw1g=.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\ukOqZr5FbaqI0YFQ6eRYH3RfRoqqYPoF6OhJVcQq43Cx29Xm7-5hsMflgGUezQEI.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\U-93eVyLZO6HUuwezGmtgA-sD3cZfvwXXgnLhPXsN-pG62fhHntFBHK-2iw3fBM8J+EfWKvNjx+ULSzh2MwU+tU0lNib3Kj6I0XZ0ARMLtsZLYLTGd3j5ETyl5FIMJhi54kH3Rk8y88xR3hrc8CHct7rZv+2qLBKK81zI3eVtZ4=.C30C4DA81AE308962B9A.crypted000007",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\39ZHG1a3+1Odn1fSrr--ebSfaKdBkFHcQS92X0uERa1Nau10vjt9CHEu0h5QMKCZh0iZKm7rQeJn1-oHYynJaQ==.C30C4DA81AE308962B9A.crypted000007",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\iNCk5caQxzbr2KzJ7cSSijmVYgJchKIcV5SbBg8VanNaNiqxjTTLgRzKbCrW3qoQ.C30C4DA81AE308962B9A.crypted000007",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\zfzyAsNQmSbCxE59zS-AyzpCZ-jSDxxi8SvAkkoyQUGaxHIhd9+56xA0N3ed-+GyVrCKluHUlOlIV8MGnqojMw==.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\gJj-L+8ypb3XzJoRkos9jmI9lwmj8ZDYFA3tLLCVTlk=.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\cYm7Sz16N7MDm6zlNUiMcpHDgkbTlK-4HPzXTp4FIkk=.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\CxWJsUR2r1Ht2rvT4eSb8iTNCSQ7Z4VP3GEwPCXbGVyrdNg6NzWDN3n2jIlBKBPKWJZ7l7GrxrW+Lg6ctF8AoQ==.C30C4DA81AE308962B9A.crypted000007",
  697.  
  698.  
  699. * Deleted Files:
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  705. "C:\\Users\\user\\Pictures\\Host.zip",
  706. "C:\\Users\\user\\Pictures\\Host.xls",
  707. "C:\\Users\\user\\Pictures\\Host.pptx",
  708. "C:\\Users\\user\\Pictures\\Host.ppt",
  709. "C:\\Users\\user\\Pictures\\Host.pdf",
  710. "C:\\Users\\user\\Pictures\\Host.jpg",
  711. "C:\\Users\\user\\Pictures\\Host.html",
  712. "C:\\Users\\user\\Pictures\\Host.gif",
  713. "C:\\Users\\user\\Pictures\\Host.doc",
  714. "C:\\Users\\user\\Pictures\\.xls",
  715. "C:\\Users\\user\\Pictures\\.jpg",
  716. "C:\\Users\\user\\Pictures\\.html",
  717. "C:\\Users\\user\\Pictures\\.doc",
  718. "C:\\Users\\user\\Pictures\\.bmp",
  719. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  720. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  721. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  722. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  723. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  724. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  746. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  747. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  748. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  749. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  750. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  751. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  752. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  753. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.tmp",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new.tmp",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  849.  
  850.  
  851. * Modified Registry Keys:
  852. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  853. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  857. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  858. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  859. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  860. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  861. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  862. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  863. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  864. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  865.  
  866.  
  867. * Deleted Registry Keys:
  868.  
  869. * DNS Communications:
  870.  
  871. "type": "A",
  872. "request": "ipv4bot.whatismyipaddress.com",
  873. "answers":
  874.  
  875. "data": "66.171.248.178",
  876. "type": "A"
  877.  
  878.  
  879.  
  880.  
  881.  
  882. * Domains:
  883.  
  884. "ip": "66.171.248.178",
  885. "domain": "ipv4bot.whatismyipaddress.com"
  886.  
  887.  
  888.  
  889. * Network Communication - ICMP:
  890.  
  891. * Network Communication - HTTP:
  892.  
  893. "count": 1,
  894. "body": "",
  895. "uri": "http://ipv4bot.whatismyipaddress.com/",
  896. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  897. "method": "GET",
  898. "host": "ipv4bot.whatismyipaddress.com",
  899. "version": "1.1",
  900. "path": "/",
  901. "data": "GET / HTTP/1.1\r\nHost: ipv4bot.whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  902. "port": 80
  903.  
  904.  
  905.  
  906. * Network Communication - SMTP:
  907.  
  908. * Network Communication - Hosts:
  909.  
  910. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!