API tools faq
paste
Advertisement
paladin316

Troldesh_e80879b6f74dd84b619573b800efd4dc_jpg_2019-08-16_22_30.txt

paladin316
Aug 16th, 2019
1,546
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 65.46 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Troldesh"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Troldesh_e80879b6f74dd84b619573b800efd4dc.jpg"
  7. * File Size: 1051824
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "6abb3f19ca91eb52ddcd9ce7387e64f4dc82a465f7a7f7c86ae1b059b51b62bf"
  10. * MD5: "e80879b6f74dd84b619573b800efd4dc"
  11. * SHA1: "c8294199894996550b62479a44c640fe210a4041"
  12. * SHA512: "0c428e5547d3e8115afd8cc3a99e0dcccb1927182d7b5da5cc3f1143d48c9217a2279296a5e87ea351c4caa14bbab3a1280e2aa2c96a62f406b30ef80dc2e7f1"
  13. * CRC32: "7D21D5E0"
  14. * SSDEEP: "24576:u/7TbYcDa6BSSEkmfSRmjNr0HmO0g9miDnP9GAHr8bOBHGH:u7TajSENNO79FDPzgbOBHG"
  15.  
  16. * Process Execution:
  17. "Troldesh_e80879b6f74dd84b619573b800efd4dc.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com",
  23. "cmd.exe",
  24. "chcp.com",
  25. "cmd.exe",
  26. "chcp.com",
  27. "cmd.exe",
  28. "chcp.com",
  29. "cmd.exe",
  30. "chcp.com"
  31.  
  32.  
  33. * Executed Commands:
  34. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  35. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  36. "C:\\Windows\\system32\\cmd.exe",
  37. "chcp"
  38.  
  39.  
  40. * Signatures Detected:
  41.  
  42. "Description": "Creates RWX memory",
  43. "Details":
  44.  
  45.  
  46. "Description": "A process attempted to delay the analysis task.",
  47. "Details":
  48.  
  49. "Process": "Troldesh_e80879b6f74dd84b619573b800efd4dc.jpg tried to sleep 951 seconds, actually delayed analysis time by 0 seconds"
  50.  
  51.  
  52.  
  53.  
  54. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  55. "Details":
  56.  
  57. "IP": "208.83.223.34:80"
  58.  
  59.  
  60. "IP": "92.34.132.198:9001"
  61.  
  62.  
  63. "IP": "76.73.17.194:9090"
  64.  
  65.  
  66. "IP": "131.188.40.189:443"
  67.  
  68.  
  69. "IP": "212.237.210.8:9001"
  70.  
  71.  
  72. "IP": "127.0.0.1:24986"
  73.  
  74.  
  75. "IP": "176.9.75.110:443"
  76.  
  77.  
  78. "IP": "86.59.21.38:443"
  79.  
  80.  
  81.  
  82.  
  83. "Description": "Starts servers listening on 127.0.0.1:0, 127.0.0.1:24986",
  84. "Details":
  85.  
  86.  
  87. "Description": "Reads data out of its own binary image",
  88. "Details":
  89.  
  90. "self_read": "process: Troldesh_e80879b6f74dd84b619573b800efd4dc.jpg, pid: 2272, offset: 0x00000000, length: 0x00100cb0"
  91.  
  92.  
  93.  
  94.  
  95. "Description": "The binary likely contains encrypted or compressed data.",
  96. "Details":
  97.  
  98. "section": "name: .rdata, entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000d8c00, virtual_size: 0x000d8b8e"
  99.  
  100.  
  101.  
  102.  
  103. "Description": "Attempts to delete volume shadow copies",
  104. "Details":
  105.  
  106.  
  107. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  108. "Details":
  109.  
  110. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  111.  
  112.  
  113.  
  114.  
  115. "Description": "Installs Tor on the infected machine",
  116. "Details":
  117.  
  118.  
  119. "Description": "Installs itself for autorun at Windows startup",
  120. "Details":
  121.  
  122. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  123.  
  124.  
  125. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  126.  
  127.  
  128.  
  129.  
  130. "Description": "Exhibits possible ransomware file modification behavior",
  131. "Details":
  132.  
  133. "file_modifications": "Performs 862 file moves indicative of a potential file encryption process"
  134.  
  135.  
  136. "drops_unknown_mimetypes": "Drops 498 unknown file mime types which may be indicative of encrypted files being written back to disk"
  137.  
  138.  
  139. "appends_new_extension": "Appends a new file extension to multiple modified files"
  140.  
  141.  
  142. "new_appended_file_extension": ".crypted000007"
  143.  
  144.  
  145.  
  146.  
  147. "Description": "Collects information about installed applications",
  148. "Details":
  149.  
  150. "Program": "Google Update Helper"
  151.  
  152.  
  153.  
  154.  
  155. "Program": "Microsoft Excel MUI 2013"
  156.  
  157.  
  158. "Program": "Microsoft Outlook MUI 2013"
  159.  
  160.  
  161.  
  162.  
  163. "Program": "Google Chrome"
  164.  
  165.  
  166. "Program": "Adobe Flash Player 29 NPAPI"
  167.  
  168.  
  169. "Program": "Adobe Flash Player 29 ActiveX"
  170.  
  171.  
  172. "Program": "Microsoft DCF MUI 2013"
  173.  
  174.  
  175. "Program": "Microsoft Access MUI 2013"
  176.  
  177.  
  178. "Program": "Microsoft Office Proofing Tools 2013 - English"
  179.  
  180.  
  181. "Program": "Adobe Acrobat Reader DC"
  182.  
  183.  
  184. "Program": "Microsoft Publisher MUI 2013"
  185.  
  186.  
  187. "Program": "Microsoft Office Shared MUI 2013"
  188.  
  189.  
  190. "Program": "Microsoft Office OSM MUI 2013"
  191.  
  192.  
  193. "Program": "Microsoft InfoPath MUI 2013"
  194.  
  195.  
  196. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  197.  
  198.  
  199. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  200.  
  201.  
  202. "Program": "Microsoft Word MUI 2013"
  203.  
  204.  
  205. "Program": "Microsoft OneDrive"
  206.  
  207.  
  208. "Program": "Microsoft Groove MUI 2013"
  209.  
  210.  
  211. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  212.  
  213.  
  214.  
  215.  
  216. "Program": "Microsoft Access Setup Metadata MUI 2013"
  217.  
  218.  
  219. "Program": "Microsoft Office OSM UX MUI 2013"
  220.  
  221.  
  222. "Program": "Java Auto Updater"
  223.  
  224.  
  225. "Program": "Microsoft PowerPoint MUI 2013"
  226.  
  227.  
  228. "Program": "Microsoft Office Professional Plus 2013"
  229.  
  230.  
  231. "Program": "Adobe Refresh Manager"
  232.  
  233.  
  234. "Program": "Microsoft Office Proofing 2013"
  235.  
  236.  
  237. "Program": "Microsoft Lync MUI 2013"
  238.  
  239.  
  240.  
  241.  
  242. "Program": "Microsoft OneNote MUI 2013"
  243.  
  244.  
  245.  
  246.  
  247. "Description": "Creates a hidden or system file",
  248. "Details":
  249.  
  250. "file": "C:\\ProgramData\\Windows\\"
  251.  
  252.  
  253. "file": "C:\\ProgramData\\System32\\"
  254.  
  255.  
  256. "file": "C:\\ProgramData\\System32\\xfs"
  257.  
  258.  
  259.  
  260.  
  261. "Description": "File has been identified by 24 Antiviruses on VirusTotal as malicious",
  262. "Details":
  263.  
  264. "FireEye": "Generic.mg.e80879b6f74dd84b"
  265.  
  266.  
  267. "Invincea": "heuristic"
  268.  
  269.  
  270. "F-Prot": "W32/Agent.BAE.gen!Eldorado"
  271.  
  272.  
  273. "Symantec": "Packed.Generic.459"
  274.  
  275.  
  276. "APEX": "Malicious"
  277.  
  278.  
  279. "Avast": "Win32:RansomX-gen Ransom"
  280.  
  281.  
  282. "Emsisoft": "Trojan-Ransom.Shade (A)"
  283.  
  284.  
  285. "TrendMicro": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  286.  
  287.  
  288. "Trapmine": "malicious.moderate.ml.score"
  289.  
  290.  
  291. "Cyren": "W32/Agent.BAE.gen!Eldorado"
  292.  
  293.  
  294. "Microsoft": "Trojan:Win32/Fuery.C!cl"
  295.  
  296.  
  297. "Endgame": "malicious (high confidence)"
  298.  
  299.  
  300. "Acronis": "suspicious"
  301.  
  302.  
  303. "McAfee": "Trickbot-FRDP!E80879B6F74D"
  304.  
  305.  
  306. "VBA32": "Malware-Cryptor.Kirgudu"
  307.  
  308.  
  309. "ESET-NOD32": "a variant of Win32/Kryptik.GJFG"
  310.  
  311.  
  312. "TrendMicro-HouseCall": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  313.  
  314.  
  315. "Rising": "Trojan.Generic@ML.90 (RDML:li34aYNM0F3+Fymoe6Ps9A)"
  316.  
  317.  
  318. "Ikarus": "Trojan-Ransom.Crypted007"
  319.  
  320.  
  321. "eGambit": "PE.Heur.InvalidSig"
  322.  
  323.  
  324. "Fortinet": "W32/Kryptik.GLWT!tr"
  325.  
  326.  
  327. "AVG": "Win32:RansomX-gen Ransom"
  328.  
  329.  
  330. "CrowdStrike": "win/malicious_confidence_80% (D)"
  331.  
  332.  
  333. "Qihoo-360": "HEUR/QVM10.1.401D.Malware.Gen"
  334.  
  335.  
  336.  
  337.  
  338. "Description": "Creates a copy of itself",
  339. "Details":
  340.  
  341. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  342.  
  343.  
  344.  
  345.  
  346. "Description": "Harvests information related to installed mail clients",
  347. "Details":
  348.  
  349. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  350.  
  351.  
  352.  
  353.  
  354. "Description": "Anomalous binary characteristics",
  355. "Details":
  356.  
  357. "anomaly": "Actual checksum does not match that reported in PE header"
  358.  
  359.  
  360.  
  361.  
  362.  
  363. * Started Service:
  364.  
  365. * Mutexes:
  366.  
  367. * Modified Files:
  368. "\\??\\PIPE\\wkssvc",
  369. "C:\\ProgramData\\Windows\\csrss.exe",
  370. "\\??\\PIPE\\srvsvc",
  371. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  372. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  373. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  374. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  375. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  376. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  377. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  378. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  379. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  380. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  381. "C:\\README1.txt",
  382. "C:\\README2.txt",
  383. "C:\\README3.txt",
  384. "C:\\README4.txt",
  385. "C:\\README5.txt",
  386. "C:\\README6.txt",
  387. "C:\\README7.txt",
  388. "C:\\README8.txt",
  389. "C:\\README9.txt",
  390. "C:\\README10.txt",
  391. "C:\\Users\\user\\Pictures\\Host.zip",
  392. "C:\\Users\\user\\Pictures\\0WyZd+F34NWtWrjMRz6fS0thJkTWMaGR9UTYjfvGj+k=.C30C4DA81AE308962B9A.crypted000007",
  393. "C:\\Users\\user\\Pictures\\Host.xls",
  394. "C:\\Users\\user\\Pictures\\HfoLE3x2ahnM6InbC9MHEvKbhoxkwps5MsNaxMl6RFk=.C30C4DA81AE308962B9A.crypted000007",
  395. "C:\\Users\\user\\Pictures\\Host.pptx",
  396. "C:\\Users\\user\\Pictures\\66944K0Obiy68lKcna84IwG1mWsy4CKQyPaVXFUii8s=.C30C4DA81AE308962B9A.crypted000007",
  397. "C:\\Users\\user\\Pictures\\Host.ppt",
  398. "C:\\Users\\user\\Pictures\\SG9fNpc5AhiuW6Q+0FV619ouSJljRaGmqPs8h45s82c=.C30C4DA81AE308962B9A.crypted000007",
  399. "C:\\Users\\user\\Pictures\\Host.pdf",
  400. "C:\\Users\\user\\Pictures\\4O7xK+gm3zGiSUByeV90DQda6qzA5TRwXl+Z277j81E=.C30C4DA81AE308962B9A.crypted000007",
  401. "C:\\Users\\user\\Pictures\\Host.jpg",
  402. "C:\\Users\\user\\Pictures\\iduCDQyudi0ULMQ2diyRsCg4d6a0sJxpvJg3QtCp7Tk=.C30C4DA81AE308962B9A.crypted000007",
  403. "C:\\Users\\user\\Pictures\\Host.html",
  404. "C:\\Users\\user\\Pictures\\Px46RSx2R0P5FlFpTXCAN8DgSFNEcMNrH7TuiR2iWMw=.C30C4DA81AE308962B9A.crypted000007",
  405. "C:\\Users\\user\\Pictures\\Host.gif",
  406. "C:\\Users\\user\\Pictures\\ANhy2OM-HwfYR2zR1rJFyMKxhZNjqb7ppU0pWXJ6N8M=.C30C4DA81AE308962B9A.crypted000007",
  407. "C:\\Users\\user\\Pictures\\Host.doc",
  408. "C:\\Users\\user\\Pictures\\8QIapImk2gtB9waAYlTfsA0D+aefrm3FFNzm+p3ff8Q=.C30C4DA81AE308962B9A.crypted000007",
  409. "C:\\Users\\user\\Pictures\\.xls",
  410. "C:\\Users\\user\\Pictures\\DQOV5fERDtOpQVvp95Djnw==.C30C4DA81AE308962B9A.crypted000007",
  411. "C:\\Users\\user\\Pictures\\.jpg",
  412. "C:\\Users\\user\\Pictures\\IrSyxPHho2K67D4xiK9Rgg==.C30C4DA81AE308962B9A.crypted000007",
  413. "C:\\Users\\user\\Pictures\\.html",
  414. "C:\\Users\\user\\Pictures\\c-0oUNAVQDVuiteWAy6u4A==.C30C4DA81AE308962B9A.crypted000007",
  415. "C:\\Users\\user\\Pictures\\.doc",
  416. "C:\\Users\\user\\Pictures\\kDJIXrAqZOFdLBnqiHHnyg==.C30C4DA81AE308962B9A.crypted000007",
  417. "C:\\Users\\user\\Pictures\\.bmp",
  418. "C:\\Users\\user\\Pictures\\b3dGjX4xxPVd74mmp4IOEw==.C30C4DA81AE308962B9A.crypted000007",
  419. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  420. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\QXKugFMAq739g62j5-vLqStOmWcvS6J8bluxzEd12ZdmlxiXYfwielgA+GoAOFq+bz4c9kYKE5Id9WqORdQ4N+UC1MooN8ODQS2Zgv0f9dtViWDamUyj8eVpb2fc4oiP.C30C4DA81AE308962B9A.crypted000007",
  421. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  422. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\rUHJQJMep9dX6tuLgQqOgdGmwdbIq+zPXUTyLHM4OzI=.C30C4DA81AE308962B9A.crypted000007",
  423. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  424. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\O6OvoY4Evl3jnRrfGijbtUVV+mhHqdQT7OnycPWPRP0e2meCPCthwsiOxF9XZXpd.C30C4DA81AE308962B9A.crypted000007",
  425. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  426. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bVjKejHPXVZgbv9wQOLMqVgsybhAoB76lCINJQo87Qg=.C30C4DA81AE308962B9A.crypted000007",
  427. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  428. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\i+A3drHOLgbCKx4oQ1wxpD9RETDJMsO+8dIcQ+iGYBc=.C30C4DA81AE308962B9A.crypted000007",
  429. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  430. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\nc1GRTEOCMHaQX3HqVzupwRcqgCq4zmU06mclj8K3Sk=.C30C4DA81AE308962B9A.crypted000007",
  431. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  432. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1Sf9HMbZt68btdOaCgtHHNWeGZV0JeZVYN+g9kspbZY+b6uRfixrIjfEqDhA8WHm.C30C4DA81AE308962B9A.crypted000007",
  433. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  434. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\5ACxqHokt9KGxzccobL2bgrc6cwG3KqinIzIAfXaVaM=.C30C4DA81AE308962B9A.crypted000007",
  435. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  436. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9jP+MklGQnATBjzLhmSQBE2kkHwXNy2Al4T+AIZnjlOaiI49xRiz-YpQZegV6uZT.C30C4DA81AE308962B9A.crypted000007",
  437. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  438. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HGhqJ-LaorFTBmt+k1LB0GkuJEcekAiRg0YA2OLD0BQ=.C30C4DA81AE308962B9A.crypted000007",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ak9LwTeGCz5OyADlgVsPUIb8cy5d8VyxiNkW3MXFq7w=.C30C4DA81AE308962B9A.crypted000007",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  442. "\\Device\\NamedPipe",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\YBakzGvdeBnoh5ezOHXx8ViWgynMxQNzr-h1pxXKmho=.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\LVK7FVjCwVBdWXutE92SojLwn7D+h-i8FDrfi6+5ihg=.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\K4GJNEsRTAlcgFfZ18nMFUKFoEiPPixV4W8yW+GraQP2CzfVtTFYpsqi+VYiDM3t.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\BBFAolKUVBJ0QQhMoySHbuyemGxqTTeCeJUR7elbk4I=.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\JolscpshoTFZ6KEP6zj9XLaJx6BPvnjb5yB7VtvVy46vf2AiyG91+1-sMqcLyjX7.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\EKKH8fnuhQo5FyyclwSZZn3gtYjRzbRRQCaggW2TCmA=.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uBSsTdOHE9ezISJeeaJyWv8Iry0lfgJrqAtwAVXmPWQ=.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\PfrooAsvcgdHkXeeNeL-ezc-UaGgFV8rlWzWROJBc7o=.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xNacQWZy7u530nXXxioPACogLxcnBODEQ7Tbu4mQQFk=.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\z-V7owgGWUiyj2ycRAi+7YvjQAGkWrUcufLFuyXr0eA=.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\HnxjvyL-WmS9z5sIOYeYr4nYB0y6mNOM+glwdchdcmM=.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\t0RDgBcuKzbJ9hOF2z8z5ZWxSSzR0r5U84qYHo0J7VY=.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\GRphzssIH74SmOSZKG3vctxFoaBqA5eOt1JSgyHqDYA=.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\pKdFZU1RGtxpQkgkvhg8U2ZwekQ5RYWiOO7ogyjbVOI=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\0EfNHdTQee3C-6WxHFWrRI9V09lhpu546rItr1IeXt8=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\AXHNKSYSVTYGptsTUv9OnOHkF3uXup5VvCxPI-gHxrU=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\FsxaH6N6EJktcsT5rR0z9bwscGCQVGvPe55sVlFX7oY=.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\+zOMh86e9U88IQ5O6ZzTxM9eJixYSZOhWf1mC+ySY7o=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  479. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\DKKC-o0kMl-7y1j-GYNasuWyNlcV3L7Se8HromH4Xyo=.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  481. "C:\\ProgramData\\System32\\xfs",
  482. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\YHFOees0SxckR9MOc6Ba9eJOD1MwxG1BMOBf2HaFPWOF9F0KA7+9QOSs5XXkLO-MA8+rlmn3f4HIXvEiE91WmA==.C30C4DA81AE308962B9A.crypted000007",
  483. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  484. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\+hxGumSws4jWMNrxxHtTWqqlS5rIv3QqxwQMaNqh9kNvIKF9Hp-DnyGMTo8cdMCMkH-WZGtXzsz0i1NjbGSeYQ==.C30C4DA81AE308962B9A.crypted000007",
  485. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  486. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\OI-lbXeicV9GcaTdb0Owc6Jp+n9J3S5iuE5PEUzss5DEQkViy-hjI+euh6P-dDqRV2BUwaVN3Sk7nJHlgjeYc5Twg35ikmeFcv2yqr4e9KlKPtLyd6SwBV5FcKafPv0QEGP90jee1iJV6g9W+qcI9libJ2xAN2Ztw+QVRg66ZwcQA5aYDRoyOPw62ypfp63N.C30C4DA81AE308962B9A.crypted000007",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  488. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\RdcV3fedNGIVCR+F-x0X5WmxnqlanRUt4Ih6ZSRtipUuqTBG32+4Sf2RGNBAduPyFJ6m7uOrJuhosQmItWnAlg==.C30C4DA81AE308962B9A.crypted000007",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\XReKuWf3fWR0TsC7kAgrBF1b5T69ShDkxFLt88w4A0pQo9IPZHr+iADJkYQQ933vEVhgejf8HCllSOktHcjyhA==.C30C4DA81AE308962B9A.crypted000007",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  492. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\RpGWbtzLyzz-wZF+EKFV7fnH9IS0SJf4waczPU+ujpiKDoxASDXaAXDU+Agba5Y1+-i9PiEh5wb6aPfTmiyFeg==.C30C4DA81AE308962B9A.crypted000007",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\D-fETVUKvqRVXnfqkdDJIxaYZA9a32S26iZOwGxU1ufffKl22AG2sD5lsWyrh5V4nfiL4UJmIcdmrXKEAp10xHSDXxX70ZjKbPGROLfudgnOSxoe22haxrM7PYw7YP1CwdvF9WjONe+CiyY32G0YRA==.C30C4DA81AE308962B9A.crypted000007",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ltaVjCB5BW5I8+eYXrajCO+Z-gGyZatcxcOio8W9f2BCvOwBBEPihLB04W+pbuEYXu0enJY4Rxlsk2j07WXawbSKXuHt4d17-nvkZFXy5DY=.C30C4DA81AE308962B9A.crypted000007",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\JumKuGVv5Ynn3Vw6Jj46RHdEBvsZHCHAhCc6h8c7zq61k5Qsefd0fOX9Aj69XCTNDZdWImw3-neF9TgW+cVe9A==.C30C4DA81AE308962B9A.crypted000007",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\uk-bDRWjSDuW3ulwph-+cBb1W1fparyj8GPjLQ8KWzcRcggkiwwPV2cnvMQoAExy6s1B3Nil5v9CWzxO3j4KuoqkgSCfWNvYNJUUQV3Hbj4qAKD8IQg+qlTaqDqiHHON.C30C4DA81AE308962B9A.crypted000007",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\K55sDFmqfHC9tDhflyti1iaNsHZEROwvECSHKZG-xLuVc5A7W-n-DJFWl7eVLC4Y9QMpx9bvlUayGXyD7TC0M4rAo8biLaFcXuFQa7PMpRAErwjIgzwi52cGXufwzFb0axpeXICYdo3HmARvLp7xoA==.C30C4DA81AE308962B9A.crypted000007",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\YjSyCPpE9B12wjiLn8N0L2126mPjjQ-nqkS4E1PVNA-Z6Or4m3UTaeo8oER6UTRNAfvpB+2-EY3BCuA4gpS-7Q==.C30C4DA81AE308962B9A.crypted000007",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\fH5OVqKkrYj085NscocuqsQXawGjV+oHthkaUVogoEyq-o6j1OGtFD0PmIIVmSRyNQxb1az4-u6zjQ5jAU-HAg==.C30C4DA81AE308962B9A.crypted000007",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Cpnef2RszF1R4N81+EO06eI2FeTyoHm8ELNCSMiF04CyxJ0tOS1OHkKYVZKceh31.C30C4DA81AE308962B9A.crypted000007",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\49+FzpyV6MBwmFNM0GnPxQQW116rY8hPEv2QN9feApOh8J78H9EFiti77KHoO+r8c3BP-18ZasANU6vD4ezkDw==.C30C4DA81AE308962B9A.crypted000007",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\eQS2zoVFC77IPqqCETLy0xJQfOks4VYpQ08tkWs0J2QI+5uhpmQDNs4j9MwgNZf8N1MbvV2Q26vT7uXqtcH0yEWUh1gl0HZiJPHJBQU2tHelEMNk+NXep2VmvHGX-SAk.C30C4DA81AE308962B9A.crypted000007",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\o8Z2-e0WZDf7HVVNqe58e0xSkwVRgaF9jvJ6xlGPo7k-e5E9ly-lVFDcOnjW+ue1KqWs4IPU7P6kv4FSiihX-g==.C30C4DA81AE308962B9A.crypted000007",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eBxQqjxtBoCwpK23wo777q7HUmCjNwmWpE9p2qj8YMakH4uXBubWanJDMPyVusjbbgFfJm1ScJqe+k09DHmbnA==.C30C4DA81AE308962B9A.crypted000007",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ckbrHR4R-gcxT9sCBTmzHdyDyBISlEAq-hM0Xt1i4bckG1u6u-Daubyf9qRljEudxwpfo2hGI3KkY33BpFITmg==.C30C4DA81AE308962B9A.crypted000007",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qsOAYU0dWK3Q5ZrK+ca9hI+HZlgsCy2hVYHjY2QJr4rJHWzQc8iBR35WH0CCbW2RJz4Ix34NstYG0mYlgqmiHw==.C30C4DA81AE308962B9A.crypted000007",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Xf9iCep7XCA8RY0LyUh6QJ6F8qcvWYVresw1qZZ5DI5QgXe4yr+Wc4qKxILs6tvjU0VR2YdeZ6jFtvH-Ajf7cg==.C30C4DA81AE308962B9A.crypted000007",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ayliNkiLMpDgeQW7Hf-ruxomXoXJ5hhjkBYDOKTC2XsepOHUnwvB2qHg6sIweFQLPgGJx5xCvjvTvxnLfkVRbA==.C30C4DA81AE308962B9A.crypted000007",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\DXMSQQYQ0KoX7cw-CKcWPNleUVHIn4QEHdnz3Q5YSKMXpSxPsU83-fXebAh0nsgPVOfqMgPhRpj0hxrMzvX8ZE9rkzBz2M5pgn2oxfysB-Q=.C30C4DA81AE308962B9A.crypted000007",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CqgQgD1qcsIHW5qSDFP0KUJaDFYqw84oPfxkwLcDV20KPTJPHsB9mkOObo0vzWmxsHt8RoVNNTgfH7OZZlmN9g==.C30C4DA81AE308962B9A.crypted000007",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3SRawdOY3EwZp95whBS86kGSPgr+A6IzhpA9bzQ9hfcFyyEcRvz3ca1lTqFTvchcPWzYXyx4-1Ouzit3PYlJwQ==.C30C4DA81AE308962B9A.crypted000007",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XLjyfwuf0UL49vueIAweY4ujb57Td10ZSMY2wOHDpD4QJoYSD+bUpTaujIddhFIwRm40ViPxgYtLTZ6oF2UQUg==.C30C4DA81AE308962B9A.crypted000007",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wemILAvoFV8TGMZRfbppHFX-DXjNWIkHzS5wa1t7oZYrIP-Oac7y9MEjfytEn5UrU3RAOv2uweBEr6iXOPdvrQ==.C30C4DA81AE308962B9A.crypted000007",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\C5uNPe1DHcKSygex47ougWHFkPbrOX4YpT0IgEYPu6j5ESu5SWFUlKWWqJUalz5MlEX9gn4OOsBppTAA-Zvk9A==.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\7Eyu-Wn7PTVjWxgRQY-qiI5T0nDg7QEKsacLKigT78We+03tpihS3ngsdFHjckRAQmSFGq4Ciy4nowzqWO0nCA==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TxIbE5KHqGepzfro7v0WUiGxNHfICER-6nTAYOW--L-DlmaWYTy+T0JZ2VlctXmTDV0JGb-28tW+Rvd9S4UswQ==.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\D1BqpqXugloUIkUc9O3Bvh0iGmK9QPA-lfdw08L2kh9xYkPV+6V-JVxMbt7DJMm1RqnnLwWr+lnY+vGRdEK4gg==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+uMrL16dv+UkG6vJkRGZmMCDwoE7aZU0ic3rCCs7l4nIo8OSq70rEB3cjIbQ5TCjMB8uIyWK9rd80cWfp7KjgQ==.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\nFw0bp+h2GA5dnX4HFm0ZJzc7nGpSRDgiviceVtkVbFB59xT3x0Ys7X5x2j0DR7u23d2Q3GnXJo4rtj-YYenDQ==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\puJdVTjnNDhwrqQYeLxj5VX6jXduUkjIfkTnTuAR+1Cs35Zhti0eA-FU4tLB4fq2cINebeZ8qzCtlUEnTfeLTSI8fHkV2obEm5jCiojoTMA=.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jsCwBem2TRwsK8SzFO07QT76cG98wZGP98f+IbPcne2tP+2xNp+4sov+Z0Nnb5KyaPQ1AnSBpXr5Q51iVbN-Sw==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Kl9uhSaAbLd+3-cu+cAWjjClEZ3uGAuafvw3SIldtr8S0ToY4Me9UK8KEEBVWN9UjOn033cFYpi5N6ZfKtUOCg==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6+SBwqWZ4nHyQpZDlDL4k3axMHEwvh84VEu8P6Qpi+LFCso5B0FRYZBXUnrYPZiedMAFuD3Tukyzq+ojcLKBpw==.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yW0TTNXAY6umkmADNxc+u-Mwg7P5harBQbgdKp3-C-KQ9qqhhsPoKX9Y1yv9e1sOYzCQD4YErzvk15ky-J5Kxg==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3NT7uEStgzkwNGRmTMzMPYbCqC6wXCs2nhDNV5foKcRpE2Bsb9BEyudJXFXuDa21yLWqG-p6DvVdJUI7cuvQvg==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\cmsnMTRWoUsZ2ev6h0kbvHMnGOHrdLeTkkuqITggtC9984NXmxKYiOVAv+u4DcKOKXorfN6JyzGbJfkD6LEbGg==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\taSKefldVhbIvjZJv1N0MK6LO+caOUFnYXyVxm+JRZs5KMEwk9Ad8DDIxd4c4Ib8.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Qy5n64yIGFqBkRHYPE0ZzAZTq3yiUY7rBmluK4sN4wc=.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\0cu2XckdibtZ4ticJEQxFzHn2ahHczAzNKBJuYLz3SQ=.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\iUKQwEJEJkUrdRrlPGrZqz5a0QJ4kUHziOf5w3tXq6o=.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\pBO1LG2dhUAKAhPN4WZ8jLc3b7nklTEcF0B9Ub6dZbk=.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\oKkfLShLzU4Y0ldobaT-EbCfePkpyjC03vedaldFKCA=.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\K6LLA41AlTTlU6lEjONOg0takKok50mlyKmIMWDwater1FCNDh3rc7VqQramHzoLqpq07k01I9Gp2UslVesIug==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\3SU3sYiaR-FcmeCAEvnBWDsZc3VJizyqLFmJjjpEK0+7CGBTE0gLQS5Sx2sXfh1oqSdBDjWcrlWgzz5uyqBwLQ==.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\yagLNLycvraC1L1LW-gzU2ocq7ICq+qA66qgIltbMAw=.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\LIsYmFVh21MzOejKVpXiRmMbDThoLNJzEsUN9kAd+28=.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\5dOUdsUH8HN-5W5er8hqJCH2QhLbZbxin6vvH-FRxw5liJNxXquFuMfdgvG4LztfN3al-bAV9g2k1ZriiaKFUC02t8IennCvT1tERUjO0mY=.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jnMkoqRhX1ZdcbTGISDDvYUeLs4-IXFcJaEyVcENt9D7P1u3A2jVLxar6slvdzmb.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\2bwuVj1EN6dg787h1y+PrYbvPdgcGSYFputwRY0reeA=.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\VxZ1RHdewKmhBTGuCiFTomNYLY1LSq1cZ3SUaXcu0S67QvMI5cL1clfXsR-uwCeX.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\XUpwTU0+C-pBTeyvCqs-Xr2XpPq9KgrVN9WEPP-iFkOVl9M+KG2VE6JX01gsIWPPwQdo3WVusxO+gknyjbfc6xD5RxZ8rLbyaiR1A-1pvDc=.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\rcAAHc6q47kfydlX-xamy0OBOR24p3Fbppyde9TZdDI=.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\omRXZMP8wf4E-IHso9jvMDV0KDPMjryDd6lpKqbk3WE=.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\25GtwF6P41BxBt87RUXvSw==.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\gr-GmCiJXoEmurd26bS8zuCr2acNAv3szyQtXW-AH+c=.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\teD973iu4Pm0dPo9Wr5+TOH-qk0a++AAfOvnXdkL3DL-51wfUDeM2cgxTrKjfRSZfMgmwpB1hp5DNxz3op0Mcg==.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\cUAzkluTwK8mCoonpm8Ev0VsqyPW1HA5eOPgKIxePEU-9M+5bCN3wke-mt4q-u6p2trHqPN8eS2aJJSoB0Oaag==.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\OI17leXP83UITMoKUwgRmAMP5ZPObKMD-M3Laf0ZFcWphVPtsSTo16xUBC3Mb6nIpxG7V+2fqxHV7F4waIxCYFlvtkHcGMIQQcjWZExbs9s=.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\PPwKN4qUWKqdPcUw3L-v4qGx4w+evjWXAezJ3N--ei8=.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\5p7Gpt0lhuXiFBfhhXZNOpEsgH0fsdJ0E0nDYs-Kd1k=.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\vquqtTrkODr+V0rsAfs8-dlLAG65lDxIdaMkTGJATuo=.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\fYf+wHB9sLp8URKHX+u0BN4Ijpw33RMu4XIssVmyMCKF7Kl8j9xBxXi6LjoJTl9Xf45-hpkcRbjvBLo6YgfIsbyLrYAxkFyMn6noKiMdQ9A=.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\w176nZaqapCv5v6wqrgveTtc3qR5+FurOczfvo2EykE=.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\ca3k3Y8fTltNRw2E7TojczuO4ng-GbiX6MQZ3G4Acs5it6lyR1idxHmYugT5CD71OBx5-wEQoKrsI6vsOAqS0KnNlwMVCkQMx2YLyqOMN3hBqa5M3c3w3+AmAe2nn9sw6Z12Jf087aAs52JSKRVfzw==.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\MFUgb3+xn3YOfam1hY0D-bqKUQvxaD8E0907XM5drCM=.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\Xd58dYWAZ5hjk9cCjUrskxV0i+SRac7xT8c5kuVV1U27ne8GYY9JDKSk+JXMapCV.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\ss6HoJCpdxNuzhtBnQb1dA==.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\nmt3Y3We60OxvozN8XmsCGTtH2A8rEkvXlaxHNcEdf1gv6mu7wbdmSODaRT9ttdi.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\rSoZF+LjyzLGJQ9GsZ2LxfCOmQFGvO2kXYWVfNknGCc=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\DkqWQ4QEbEW3S1GKJ1T600jaGvYrqD8EIo3f7yZFYxc=.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\Zwtk5+dgABD45w74DvTVCX5NpXGGYSaf2d2Yak5MuXg=.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\Troldesh_e80879b6f74dd84b619573b800efd4dc.jpg",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\jdIzBkpgObTrfb4euX-wfzKCBbnUFsryTo2JqoPEXDltFZkOFUKgzgw6kxN2Yg44bAAyoMHjeTrxjkZN6PBVMg==.C30C4DA81AE308962B9A.crypted000007",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\k1NAlWnkdum4p8fkob3Z8j-HHXIiVXBlShG7PWA0obRlHixRaK6DkHMjqgnZ67qmhswAdiUGsxuqjeZ-z09f9w==.C30C4DA81AE308962B9A.crypted000007",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\X-uXLjY5zH+H4+tVv531OAlByMNuksFIsYpCsbV5f+sZkJWvEtISHP8dALzjDqjVjlNDBqLrpRZudWy7LhDOEQ==.C30C4DA81AE308962B9A.crypted000007",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\QeXZWZW29gf5GXBjOtV8lBNftKvDfj2YMy3zxi0h7zxYwQSKApFFDZSeC1rWQomRgERy+nrpslfImuJDEKIBgg==.C30C4DA81AE308962B9A.crypted000007",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\bzyO5FcmRVVgEqlcOjRCdlQ1hC+4rDn53+2RBe7fjkRfcT+fhh4IaG1jvHLWsqr8jOlBVssNpFM9qIwUQvCCCQ==.C30C4DA81AE308962B9A.crypted000007",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\qG0ri1uuDTLgpUcZSM3hVCcCFOJCpsgBy-2zMOf6wx9un6lRzjYFH+AsyOsbzfQ7ySa7M5FMZLK6N7U-h6wrqg==.C30C4DA81AE308962B9A.crypted000007",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\twkxCphTWp8XtHGHDZb0-lG5jlma7SZ0B-w79ei6HElVdI6NGnmEetnW+yeb7lG4rtp5Vd+H-laiIVtTQ8EObg==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\tqDUD9uBrVtMM0T+NHn1Mw==.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\jvVLEpGX-699yVqXuzSYrVr2AdHGeq0FwmgkDcGe1LynUuVV6Pq9TwVR5didKbl0Yaan5KTm38iSAnOYmmdTIsHkZGn+j1z391APPJYyqUuIZ2WrsLZfPCsfGWKiwco1JTfkZettJmQqbW7oFiR8iTsE0Pk8zRxxwVLbUnEzhv4=.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\lBR9xnAbpwVBOJs9lubAsZn3+22kerPlUfD5ye9rm9X90KLVtVLYQWlnGL8hhqK7ejfhbwwBxfc6gtcfYE960wUo9if7lval4V78GUx1cqGctXt28iOTa8o0jGU7vfELKaRw+YjW6jiU6XK4P68SfJjUkoZ0eTXXVZxAAAEiuVE=.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\iE9xOy+NGgqpkQ4VOfTzBIDzTPqLNQO+HCavq07JKcK0hdiPqs6tXvTj3zKCZ2Dh9LVCLbNBbpBlXETJTXYvGzFrEP4avVUQdu69keZipzMRHCh-m7ifWKvC57-K5riWg0VvzqH2X-J1cQMt3NSs-0k2dDBersmW2CHSUdao0lM=.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\6jhv4h7bKG+PtUeNOrgyaWACWodlS9qUzMxKFR+Ufavpob-qfShAITBA8aQySjWH2WlMKcjkNCCyO6bFIaYh3DHATaw0lZX5aHQh6SqTJPumEabL3DoPlf+r4vhuyIj0sAepm+wnSyc9T8cRP9U4PmP8ZuL7V-HmtOPEoYYAdRw=.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\tJsMWnmRAp7sZfKvF+zsI77wD+iMQ9cJ-2Pa+4YvCtETL2wXb-4yEDIgFf7ZcsDM66JCJ3d4mM2qB9N1eBozaw==.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\RVehs3CFbDYFe9Ngr+uJr2MpPCuiD6O7LaOoYofL6YFnxgk43OgSGurlYy0zI4WkEC+2XG2c9CSxHkdqt0TbUkeVhh8M3dVlo-qOn6xtogp6Ji7ylqW5BebQGCNllGGFEhexvDS4ABHRFtydhoq4xZfKAo7mfyKsFDKwzJybHF8=.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\G8C1BoKjBP+0XijqM1GP5ck3g5bX3JFm7gW+Ao13jnQG36Q02gRMenKeLSP3GtlYRFuScUdKcVo9q0mkovgiuztl9-lEXclQCjgcPhQ5ejCHQ4IUuWGpW16tQ3mVP1hNLPNJJqHVdc-ogAwmxw4-Q2+Mji-YdKT5dF9Lmf8uAhQ=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\OmOJj8K9wQhQ39XPMzN9+LDQnXayxouTvaJlqOJGQqI0gdi0WE4MB7q2v8nDHx6aRXLbwTQXHNQFHxJ-KSpOFuG8a1YfDmTwbmKdmVTV5sQlppU1OzQzpBN8qNwq2835q4SizORthHWuq46kaFvWbK8eJ5I1EFHKrsviMbzYNuI=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\Fle4uYjXnqnXB1geHeTjxAEtqEB8Z28WwJKsRxM9onUTysQfiYzENtU+vyaMwS7wb5Tl88igjJ5F-XMOiotUndnmCKo2gNh7x7uRrghToh7vYvXi2Psd6k+1D535HJsdUEMwUvpUSYTjzJCxlqxTnoVB3p6acITmyv+xVry6844=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\SysFFbWfCkX-nK2huvjc6j5y5xo2PWCmVqXuMy78HiJnIg9+DqyJqgBPj500ICdu-m3ZV4h56reYLpoB1xfGTsKJ3iZhq95SBreF4MbgF3+R4zvLQWGBlk4nSIZdUYiZmudRDd9dI7hFfv-WMJ9yoomwHE9wWdw2Y71rzM6ztDs=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\1dAZyBKO9oR69x7iC3d9fx8FY85L2e1vaOoklXEebSjIciIp88TiKqGQcIWhToaFRq665IcpWcR519VLAiLKXIkrW5pWwziPjN+5Km10AlY=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\vjNbdG9uK0URYG2E0i6zdZYfiTcHjkUAE8ImmoK+OkB++aSUzGoNzKP5pJ82YlCb.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\6kEDvM3mJ0FTD8B5uU41nVrn10EbksC31mKzOLRotmE=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\mtqBnwElIxeV90M7kD24Ma78rOG45EHiERdIRopcu10M4ERif8lMp60zGzW5bJzji1avzW61vaUSmZuKUyD62Q==.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\VTNwBlftJZWQUJ-dRgogTWpaGDq24XuvLV1yhct7c-c=.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\RLX333IAtoIdPilHvlAyknbhu8mNU2sr-5sEY9oN4RQ=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\Oqc4Mx096bQlCEaCdfupMUdnM0YghnJUoqBPlEhzvAph9KMau5geWVGkrJ0-bi2Z.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\ZTT4V0Jo5dhE7hMAHmItv4aklqNZqIAOlieA1-ONbNXrQFliTKfYNI0LYX+nv5cyWAq83dIocdzQhPNVyDZeng==.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\C5OxI6GicZHWjZkbna48WfXD08+TowiUdW2YGuGR5RMUADR5JhCA4p-BbEAMFl+h58GzOLnyzwxVSGijvhVJrqLaZPIKJ3SOUsJv5bvnWx1Ygs6VCywjBzUKXvvkKLSchn9KVCcjm8yxjK2r0f+XsnzVwMPuTLh7mPatRnWcjKE=.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\b52gQeXLBXxzWoO1dBzfIY4v9cfwqMbjH33F+HaAC0GWa6V2LBXVjvbskFeme+g6.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\uR5Jd2mNAkhPsgMVr0NPmUtR-b1H3CPLMGYmWZJCFT1hVC40u1NUhZvD8d3bNMVSSYqU1kAuBbDt6-G2xFG7AA==.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\tBFaLXFHgg2CZUrRNxejTdB0RR8RcD9ly+w0mYs47L4=.C30C4DA81AE308962B9A.crypted000007",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\jR999CrAHGuhdHXWLm8Q+D7EUs1dzU3aXzzcErAWMmQ=.C30C4DA81AE308962B9A.crypted000007",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\-2bGtLJvexT-sNEKQ01kknNnb08-O88faCVifv1VCmMeRnTshzmA5131XMjIqZTsJKK6DHvQwRV6LvUfFvonAg==.C30C4DA81AE308962B9A.crypted000007",
  685.  
  686.  
  687. * Deleted Files:
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  694. "C:\\Users\\user\\Pictures\\Host.zip",
  695. "C:\\Users\\user\\Pictures\\Host.xls",
  696. "C:\\Users\\user\\Pictures\\Host.pptx",
  697. "C:\\Users\\user\\Pictures\\Host.ppt",
  698. "C:\\Users\\user\\Pictures\\Host.pdf",
  699. "C:\\Users\\user\\Pictures\\Host.jpg",
  700. "C:\\Users\\user\\Pictures\\Host.html",
  701. "C:\\Users\\user\\Pictures\\Host.gif",
  702. "C:\\Users\\user\\Pictures\\Host.doc",
  703. "C:\\Users\\user\\Pictures\\.xls",
  704. "C:\\Users\\user\\Pictures\\.jpg",
  705. "C:\\Users\\user\\Pictures\\.html",
  706. "C:\\Users\\user\\Pictures\\.doc",
  707. "C:\\Users\\user\\Pictures\\.bmp",
  708. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  709. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  710. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  711. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  712. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  713. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  714. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  715. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  716. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  717. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  718. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  719. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  720. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  721. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  722. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  723. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  724. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  738. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  739. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  740. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  741. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  742. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  743. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  744. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  745. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  746. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  747. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  748. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  749. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  750. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  751. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  752. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  753. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  834.  
  835.  
  836. * Modified Registry Keys:
  837. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  838. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  840. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  841. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  842. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  843. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  844. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  845. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  846. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  847. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  848. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
  849.  
  850.  
  851. * Deleted Registry Keys:
  852.  
  853. * DNS Communications:
  854.  
  855. * Domains:
  856.  
  857. * Network Communication - ICMP:
  858.  
  859. * Network Communication - HTTP:
  860.  
  861. * Network Communication - SMTP:
  862.  
  863. * Network Communication - Hosts:
  864.  
  865. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!