API tools faq
paste
paladin316

Exes_e26d43eccb2671d56c9b8fe52ad4e088_jpg_2019-08-21_15_10.txt

paladin316
Aug 21st, 2019
2,133
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.36 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Troldesh"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_e26d43eccb2671d56c9b8fe52ad4e088.jpg"
  7. * File Size: 1051824
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "c8a73cd65e5a8f44e0947b266f7c81c4984ea9b94f4dbbf60bd6cb41e277712b"
  10. * MD5: "e26d43eccb2671d56c9b8fe52ad4e088"
  11. * SHA1: "8fbcfed254e8d6aba4e87f99ccf8eb45365829a9"
  12. * SHA512: "2168e7e02a74a3107256742a91cd59013e8aad6fe0ea7dec02b8e3e61ee7226154b57377d822b863faf1bebfc66947c07d9d88193bd82c827ab737578e63eec2"
  13. * CRC32: "D784A3AE"
  14. * SSDEEP: "24576:p/7TbYcDa6BSSEkmfSRmjNr0HmO0g9miDnP9GAHr8bOBHGl:97TajSENNO79FDPzgbOBHw"
  15.  
  16. * Process Execution:
  17. "Exes_e26d43eccb2671d56c9b8fe52ad4e088.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com",
  23. "cmd.exe",
  24. "chcp.com",
  25. "cmd.exe",
  26. "chcp.com",
  27. "cmd.exe",
  28. "chcp.com",
  29. "cmd.exe",
  30. "chcp.com",
  31. "cmd.exe",
  32. "chcp.com",
  33. "cmd.exe",
  34. "chcp.com",
  35. "cmd.exe",
  36. "chcp.com",
  37. "cmd.exe",
  38. "chcp.com"
  39.  
  40.  
  41. * Executed Commands:
  42. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  43. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  44. "C:\\Windows\\system32\\cmd.exe",
  45. "chcp"
  46.  
  47.  
  48. * Signatures Detected:
  49.  
  50. "Description": "Creates RWX memory",
  51. "Details":
  52.  
  53.  
  54. "Description": "A process attempted to delay the analysis task.",
  55. "Details":
  56.  
  57. "Process": "Exes_e26d43eccb2671d56c9b8fe52ad4e088.jpg tried to sleep 1221 seconds, actually delayed analysis time by 0 seconds"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  63. "Details":
  64.  
  65. "IP": "195.154.255.174:443"
  66.  
  67.  
  68. "IP": "38.91.101.180:9001"
  69.  
  70.  
  71. "IP": "108.39.229.147:443"
  72.  
  73.  
  74. "IP": "127.0.0.1:59206"
  75.  
  76.  
  77. "IP": "136.243.39.148:9001"
  78.  
  79.  
  80. "IP": "194.109.206.212:443"
  81.  
  82.  
  83. "IP": "86.59.21.38:443"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "Starts servers listening on 127.0.0.1:59206",
  89. "Details":
  90.  
  91.  
  92. "Description": "Reads data out of its own binary image",
  93. "Details":
  94.  
  95. "self_read": "process: Exes_e26d43eccb2671d56c9b8fe52ad4e088.jpg, pid: 2264, offset: 0x00000000, length: 0x00100cb0"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "The binary likely contains encrypted or compressed data.",
  101. "Details":
  102.  
  103. "section": "name: .rdata, entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000d8c00, virtual_size: 0x000d8b8e"
  104.  
  105.  
  106.  
  107.  
  108. "Description": "Attempts to delete volume shadow copies",
  109. "Details":
  110.  
  111.  
  112. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  113. "Details":
  114.  
  115. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  116.  
  117.  
  118.  
  119.  
  120. "Description": "Installs Tor on the infected machine",
  121. "Details":
  122.  
  123.  
  124. "Description": "Installs itself for autorun at Windows startup",
  125. "Details":
  126.  
  127. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  128.  
  129.  
  130. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  131.  
  132.  
  133.  
  134.  
  135. "Description": "Exhibits possible ransomware file modification behavior",
  136. "Details":
  137.  
  138. "file_modifications": "Performs 1060 file moves indicative of a potential file encryption process"
  139.  
  140.  
  141. "drops_unknown_mimetypes": "Drops 351 unknown file mime types which may be indicative of encrypted files being written back to disk"
  142.  
  143.  
  144. "appends_new_extension": "Appends a new file extension to multiple modified files"
  145.  
  146.  
  147. "new_appended_file_extension": ".crypted000007"
  148.  
  149.  
  150.  
  151.  
  152. "Description": "Collects information about installed applications",
  153. "Details":
  154.  
  155. "Program": "Google Update Helper"
  156.  
  157.  
  158.  
  159.  
  160. "Program": "Microsoft Excel MUI 2013"
  161.  
  162.  
  163. "Program": "Microsoft Outlook MUI 2013"
  164.  
  165.  
  166.  
  167.  
  168. "Program": "Google Chrome"
  169.  
  170.  
  171. "Program": "Adobe Flash Player 29 NPAPI"
  172.  
  173.  
  174. "Program": "Adobe Flash Player 29 ActiveX"
  175.  
  176.  
  177. "Program": "Microsoft DCF MUI 2013"
  178.  
  179.  
  180. "Program": "Microsoft Access MUI 2013"
  181.  
  182.  
  183. "Program": "Microsoft Office Proofing Tools 2013 - English"
  184.  
  185.  
  186. "Program": "Adobe Acrobat Reader DC"
  187.  
  188.  
  189. "Program": "Microsoft Publisher MUI 2013"
  190.  
  191.  
  192. "Program": "Microsoft Office Shared MUI 2013"
  193.  
  194.  
  195. "Program": "Microsoft Office OSM MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft InfoPath MUI 2013"
  199.  
  200.  
  201. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  202.  
  203.  
  204. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  205.  
  206.  
  207. "Program": "Microsoft Word MUI 2013"
  208.  
  209.  
  210. "Program": "Microsoft OneDrive"
  211.  
  212.  
  213. "Program": "Microsoft Groove MUI 2013"
  214.  
  215.  
  216. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  217.  
  218.  
  219.  
  220.  
  221. "Program": "Microsoft Access Setup Metadata MUI 2013"
  222.  
  223.  
  224. "Program": "Microsoft Office OSM UX MUI 2013"
  225.  
  226.  
  227. "Program": "Java Auto Updater"
  228.  
  229.  
  230. "Program": "Microsoft PowerPoint MUI 2013"
  231.  
  232.  
  233. "Program": "Microsoft Office Professional Plus 2013"
  234.  
  235.  
  236. "Program": "Adobe Refresh Manager"
  237.  
  238.  
  239. "Program": "Microsoft Office Proofing 2013"
  240.  
  241.  
  242. "Program": "Microsoft Lync MUI 2013"
  243.  
  244.  
  245.  
  246.  
  247. "Program": "Microsoft OneNote MUI 2013"
  248.  
  249.  
  250.  
  251.  
  252. "Description": "Creates a hidden or system file",
  253. "Details":
  254.  
  255. "file": "C:\\ProgramData\\Windows\\"
  256.  
  257.  
  258. "file": "C:\\ProgramData\\System32\\"
  259.  
  260.  
  261. "file": "C:\\ProgramData\\System32\\xfs"
  262.  
  263.  
  264.  
  265.  
  266. "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
  267. "Details":
  268.  
  269. "FireEye": "Generic.mg.e26d43eccb2671d5"
  270.  
  271.  
  272. "McAfee": "Trickbot-FRDP!E26D43ECCB26"
  273.  
  274.  
  275. "Invincea": "heuristic"
  276.  
  277.  
  278. "F-Prot": "W32/Agent.BAE.gen!Eldorado"
  279.  
  280.  
  281. "Symantec": "Packed.Generic.459"
  282.  
  283.  
  284. "APEX": "Malicious"
  285.  
  286.  
  287. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  288.  
  289.  
  290. "Paloalto": "generic.ml"
  291.  
  292.  
  293. "TrendMicro": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  294.  
  295.  
  296. "Trapmine": "malicious.moderate.ml.score"
  297.  
  298.  
  299. "Emsisoft": "Trojan-Ransom.Shade (A)"
  300.  
  301.  
  302. "Cyren": "W32/Agent.BAE.gen!Eldorado"
  303.  
  304.  
  305. "Microsoft": "Trojan:Win32/Fuerboos.E!cl"
  306.  
  307.  
  308. "Endgame": "malicious (high confidence)"
  309.  
  310.  
  311. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  312.  
  313.  
  314. "Acronis": "suspicious"
  315.  
  316.  
  317. "VBA32": "Malware-Cryptor.Kirgudu"
  318.  
  319.  
  320. "ESET-NOD32": "a variant of Win32/Kryptik.GJFG"
  321.  
  322.  
  323. "TrendMicro-HouseCall": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  324.  
  325.  
  326. "Rising": "[email protected] (RDML:li34aYNM0F3+Fymoe6Ps9A)"
  327.  
  328.  
  329. "Ikarus": "Trojan-Ransom.Crypted007"
  330.  
  331.  
  332. "eGambit": "PE.Heur.InvalidSig"
  333.  
  334.  
  335. "Fortinet": "W32/Kryptik.GLWT!tr"
  336.  
  337.  
  338. "CrowdStrike": "win/malicious_confidence_80% (D)"
  339.  
  340.  
  341. "Qihoo-360": "HEUR/QVM10.1.3F55.Malware.Gen"
  342.  
  343.  
  344.  
  345.  
  346. "Description": "Creates a copy of itself",
  347. "Details":
  348.  
  349. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  350.  
  351.  
  352.  
  353.  
  354. "Description": "Harvests information related to installed mail clients",
  355. "Details":
  356.  
  357. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  358.  
  359.  
  360.  
  361.  
  362. "Description": "Anomalous binary characteristics",
  363. "Details":
  364.  
  365. "anomaly": "Actual checksum does not match that reported in PE header"
  366.  
  367.  
  368.  
  369.  
  370. "Description": "Created network traffic indicative of malicious activity",
  371. "Details":
  372.  
  373. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 466"
  374.  
  375.  
  376. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 110"
  377.  
  378.  
  379. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 292"
  380.  
  381.  
  382. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 655"
  383.  
  384.  
  385. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 135"
  386.  
  387.  
  388.  
  389.  
  390.  
  391. * Started Service:
  392.  
  393. * Mutexes:
  394.  
  395. * Modified Files:
  396. "\\??\\PIPE\\wkssvc",
  397. "\\??\\PIPE\\srvsvc",
  398. "C:\\ProgramData\\Windows\\csrss.exe",
  399. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  401. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  402. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  403. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  404. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  405. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  409. "C:\\README1.txt",
  410. "C:\\README2.txt",
  411. "C:\\README3.txt",
  412. "C:\\README4.txt",
  413. "C:\\README5.txt",
  414. "C:\\README6.txt",
  415. "C:\\README7.txt",
  416. "C:\\README8.txt",
  417. "C:\\README9.txt",
  418. "C:\\README10.txt",
  419. "C:\\Users\\user\\Pictures\\Host.zip",
  420. "C:\\Users\\user\\Pictures\\y0dMnnUd8p3GicplX+dvzlY8+ePKWN-VpbkCXXnRC4A=.C30C4DA81AE308962B9A.crypted000007",
  421. "C:\\Users\\user\\Pictures\\Host.xls",
  422. "C:\\Users\\user\\Pictures\\opQ3p664YZ8eWcnB1JEipo2JdCsC0jmXVQ75Sq22m-U=.C30C4DA81AE308962B9A.crypted000007",
  423. "C:\\Users\\user\\Pictures\\Host.pptx",
  424. "C:\\Users\\user\\Pictures\\pcSBr9K7G99IAiVOhLrUx7+6mTitAjoAtjuOlpsDGSQ=.C30C4DA81AE308962B9A.crypted000007",
  425. "C:\\Users\\user\\Pictures\\Host.ppt",
  426. "C:\\Users\\user\\Pictures\\vrK1SGPTzJov9JBBYf3FoJF5c7TojiHB5IsIY6+3KCw=.C30C4DA81AE308962B9A.crypted000007",
  427. "C:\\Users\\user\\Pictures\\Host.pdf",
  428. "C:\\Users\\user\\Pictures\\+pMf3lMWdXZejrIe1dQBvj5i78VQLjTI+pRuVW5jHmI=.C30C4DA81AE308962B9A.crypted000007",
  429. "\\Device\\NamedPipe",
  430. "C:\\Users\\user\\Pictures\\Host.jpg",
  431. "C:\\Users\\user\\Pictures\\oIl1HrxFL2uYALQaLM+b6Qe5epLg6boiZSDxGMHIGa4=.C30C4DA81AE308962B9A.crypted000007",
  432. "C:\\Users\\user\\Pictures\\Host.html",
  433. "C:\\Users\\user\\Pictures\\aimy5Q7MxjdOSusiqqkIdvXPnpPfj8Qu--8Q37fwcsQ=.C30C4DA81AE308962B9A.crypted000007",
  434. "C:\\Users\\user\\Pictures\\Host.gif",
  435. "C:\\Users\\user\\Pictures\\I39m53F71Zg3IOliaKLizzUimFD6D6P1HePlagq0FOQ=.C30C4DA81AE308962B9A.crypted000007",
  436. "C:\\Users\\user\\Pictures\\Host.doc",
  437. "C:\\Users\\user\\Pictures\\wBUXyrdtCKFdIsloSY3jwOj3IsOWUry79PA9QDkPn98=.C30C4DA81AE308962B9A.crypted000007",
  438. "C:\\Users\\user\\Pictures\\.xls",
  439. "C:\\Users\\user\\Pictures\\H57mJ8DVb45Vp-kDEKW0Dw==.C30C4DA81AE308962B9A.crypted000007",
  440. "C:\\Users\\user\\Pictures\\.jpg",
  441. "C:\\Users\\user\\Pictures\\3VbS3xSUYQKlTwBYoxUoHw==.C30C4DA81AE308962B9A.crypted000007",
  442. "C:\\Users\\user\\Pictures\\.html",
  443. "C:\\Users\\user\\Pictures\\bZWZy-bupIw9sdEmf0rPwg==.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\Pictures\\.doc",
  445. "C:\\Users\\user\\Pictures\\KlCjJwCot710RoLTZqh8jg==.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\Pictures\\.bmp",
  447. "C:\\Users\\user\\Pictures\\yeJqT+hd35xgs1G+VAArGQ==.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\DHoHngqzYUp1+u9s6evzwmk+YC9wxGzEnPGNAkSTLQayIaQbMhF4w5gwEJGFeiwo1umwaxWTEF3VCnQhLCHItyLH1X2jFpIeMTP+v+vkL3dNnvBd0iPYCSdxPO-ygWkd.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qAr9oR9NoasH71PsxxCbyosvn+V7GeYkauRTnFn2nmM=.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\86dU3h1dtyfboSLWPvqwcIcliy5JL8PvDIRb4bI3ZqdZa2sRwqaprNT2dGjolQAU.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\rYK0qI9sqyyo02zz6nggkUl5cTt7J20QRJq3WaC9k74=.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UXrNYO29aZtVvJhQ+aRb7-xvo8odFdc6w5qK7hh0TpM=.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\v5XVPYJDTo5Zr-YL6R-IGYG1MRoHL0cl8yFXSyUo4mo=.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1T+6qkXRWUe3IQzktUbBXaSeHAPqdTqqNj1132cED+YVWDPAzN9TVxUBsHRITsqe.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\4geURYaCE8FHblVEgdgjq3+0aLqvmw5qsaao0mZQ+YI=.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\torzt3TTSDHmc5kCzUrkTVhkaCgDP02J-nYXv2AS4o8qS5zxeX5J977618WnxfzD.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\aO-2jIgJv4VAvIhB8BCg3rGrjk6TwL9olUH1st69+rE=.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\-ImSHx465PnNXNtoL+atFilWaPP6fgtle57JqTfbOa8=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\sg1mKwCvUn3gtdiNafZnA2ErAYtx2Lh2F7gycUOu8WI=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\e3Vt+0-sXsF2O1qEileKLTxru8QkY66KIjjCghvpPDM=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9krEjKKNPFWhNUOPvWT6V6QuHXB6lVjIUVPKnzKg2SSLOj19cn70eJ9DUsW0WQdp.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Kx94OWHZCa4XDHNRSbN8LrfjHTP8GDaaY-WeF4DPyGE=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\GusbW+fm8r-u6bjkjWcpSNXB4ejs6ynVfmeAqzhlntn1U3TS6F96TvE9WGOeW6FP.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\oHSlaezETwOTniiOV6EVPf6N6RelS2HsS5A68JB1smo=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\RFWbm8aVJ1rwVLcHKp7WOmCSxhcXteEH9uVkoVWc6U4=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uv3599cprYOkXPaAVgDYK8QRh46Uot4TlOGm+lZWxGA=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\FZcpo6EiLNcw7lwREm2g9McH2n++SimJy+9u7VY9wAE=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\XV8o+pQNs6ea0+Gi2FFY+IhkDBnW5H1kw3c1dyYLzTY=.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\hkOO0ZaSkqPFUun298IcRrZVu3dwXrdyQdklDtK0GlE=.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\P1IgNsGCfVjRgPzBTMnz4PepfNl-JZryv-8luEJKjlI=.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\dtfbikdRfCWBlV8ZMC1cowFtRio7HWMTGFD4Ll-DfIg=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  497. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\XMp94nN0q99iyPjIeAYOczVCwo+T7Buck3d7PPWaTN8=.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  499. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\MZvGqco0gCRJ5D4pdBTSDYVG87mSFVoFE0r0irs+rE0=.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  501. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\XsKSRMXnHZ7SIuj5DCKaYw81socpYKbwyt-9o7NMeWA=.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  503. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\NYUzbLZf2G0QoE5agmI2Nzlefrx5yaFT7AQcic2Tn80=.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  505. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\IxKzCxKuVVohQHZA019Mx34fQ-DJOJ+5ENcJACj+KU4=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\sBcRvYnHhhOb6hFX2VYH7goki4CC6I9FTkNS12bjLbo=.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\lsLIXyQQ5+1puIKP92-Cdawgre-Mvyo06+kDrdgUWCaaZb2bp6J9sUFpMtpJQ1j4Ea02BbTC3o9NlirVazO9Rg==.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\i6Ajvngz1p6XFOFF3+oo2x6t7Jo3zPCm3KgBq4VeN5+jMZuMTT5hs6SP8+H3XHv6wRWu49OJehE-0aMIH9Y8mA==.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\vzQ+pgKs5Xreg6HCs0dS8Y47WnNOz8FzcEdxCgSz2mP1oblEEcBtPcL9Y7-nT20VtSGQPbvFcFshuAgYozYSxxAnzL8RTUnmAoPdzBnVOYeB0YZJsjDLN3UDN2+XBaCt3eb+2N8MUKLVbeAcddnkf4opkX6H5+NWet+i6J3WUfAeDHMIVBoo-TVrDKjf2t2E.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\tN65dPAFCqBCRqp0V+NB3Fk9z6QC2NRuWOkBffEPqAG5FAMHj2zd0tpTd-y12k8DUForWNiNwx2kkVQHP-dLOA==.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ZzPveAw2HCIzNwC13TSROicNo+SnJrJaw1R5xTJtrUMOjeCpbLTl6aytxdcFFmwIzqP9gHniVXcYZ5fsio-zPw==.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\3VC1ciumTXTfe7h-bVFAEZGuoC5VkT7uGhP-F8plZ+DMUKp6XPof8kUfpSW-b75IJzaa0g2gBb8kut6x2ugNPg==.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\jJnGCjP04tyvBS7gLQEhAHU-aAMzUT+wTiztafOzq8BofPDUM23eVZyilJX1x55lQZkqRIpk3VBdW0cK34r18TG-CQIl6S-iPGGsx2yeZa85CiZlejOXv35Y7-9OKqh5cLLiV+-XGSt6dZwFrgOIzg==.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\RvuG4W74kxCSwXYdZnmcwieWJAFD68USFEEm4154FJZyUl9bmA8OU-Q5dz0RmkLcZ56JxFZw++OgMIuvMIT4+QjfVbqoKKV78g5GFSPSIKM=.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ETBnn-VPxxxjn7hBeEDtmYgE6SJj1sWnplcEOJ+VctBxnN5vPR8CW5zApL19rQuTyx4+aFGH-sQMqhBbVO9HpQ==.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\RNQpVbvXwn5+4YQAp8esBgweLUxiwEbbztwpWZ7YuSa-+nKaS9EEQMkxddqIHf-B5UC-nw6d4BJpwwKE1c76lGY5-QQSLBMFtGW5qISJx1wTXGJPAjDalxkrL7XN2Opy.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\7wMOw3Ub7Vc5Ep0rLXUT3IpQl-ASQQnbYyrLDQBnCbi5pH+uDTYTD8WIzcjF4CYhfHPajQ8b-OQwaYCZczvUbZzbfYBHwLVqz+ldgSp4gUCU+hIOhTIAQUtNYIMd6i0GwlfipZbnHKFMplxYc2GxlA==.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\sV0P0kYE9Kkdh57imFoYSlcOu6S7I87bOja9HPwi3n8ahXzuiWcJiqNrL5A1UCSdpg88y3IIvCsg2xj3vmsa4Q==.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\CalwlsOwQJRZVaAELGmQbG6qLMFH+Tk3GzwDDQfXcvccnHHkIuvmutqZf42d66IwxVwVCi1b2AuW05+qfMQMqQ==.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\zayZc23cle8UDMkoBsWRZY9QKjdKKBXvQw5xhwBYoGGp4+IJpumBGKsWQqNPFx96.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  537. "C:\\ProgramData\\System32\\xfs",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\op548XPmGcfO3mamc7tq2IYBokpCVJCO5m7Um7DrQTWtjo30s+emv3Rg-ka99WReKjgYAq8kt88qAEtf7joO9Q==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\c5I+TLIUckA7lLA-aC59LDDNcFCoYjRawOX0pl2t1cPiKLqd5HkoGYoZYmGoiTZgoHR7PWw-hQDFSa7l0fnC1TXxw9Z0SUKWkbAY+oVJyE3K0rfthWr0RF-+GhhxlfRV.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jhA-8dZ8VPalc85mhvHcpw2eUKERMV8b9VyqzDRfzvQx6C+ryRbI03JmTn4lWLtXKn-QeUcgsC94iDe-i3T7vw==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6RWIm4gQ6em5puxwm3sBIdnXCS7KW6x6OY8YKYmytUCalrON-W2aAX8j8LlnAdcZA305Y4Zm9jIA8nME63saGA==.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0fkbtppD5zH1SEuzaADvBquxMcUFPMce5-IMmoJdq8iQV+-ubzPXP1kJs0zJbLzE3lRlDHPYmnP0kaHGD+7wbA==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\j985cZ66vS6RpJKqH25Uz2fSqVMQo3HdNS0I85D9bILckiniDxy4Nww5cwIKaod7jhPujGrtv-Tiivq5yE2lYw==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\gj7nZn24mLVIXngoBw0E5yrwXaF21p30kpGFOkmIQxt69OEix52rp12WFq5bwJJtuxIYxAGNYAtLkXh9FcQyCw==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\dRql4w477JQv-3mgB1UvYDx64zI4CMWa4mSinbgqX7rJBF45Q6vdk-13w8YmFY4rU3SrWTSqsbbKF+Ua2PMrpw==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TZ6LRodW1B4krsGvh96EWvQUOeOxBYN80iO0BKNqG4oOuaxJ-MsUtV8Y-msvR8DI9bxcI+jMfZ+zLCBuZ9Q9tfEb35xZLlxVe1R8hinQ9UI=.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NyAjnxkkyTipBKMt7CECb1g4E3mr0EgsUAzCl7WO6O7ddsbM4316pWHF6IrZt6msBHJj9oRkLBlTSBV8daO38g==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\76pwastTlygBGsTxCfCMIqVQRGs1-6nFrNzm544TzSpAoXphcgDOI9RP3nmJPv--NgTr3BZ28tu1N22o6p17uQ==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0pOOdcTif7RrNvoPJctQVCS1szzrBaC2scFG0c3+Xke5Z7xatq5TOYlsz8RZAMfzbBn-IuAnNTCp7egk6FH6lg==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\fOmOmm6qNx9dxvkPapcjlJGMNQXNPvB4A28ANWn8c+dxWeRfCWAsJxgVwFM77c5PajyYscGqk5EZwq81oX+igw==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eZFeO9uGJdYHOSXeELpd8zDXIvNdnkaSq6GImsa3xz4S36IK8EHw-TQhY76Td0-luzrxxeA2g4NTXm76hEZCEQ==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eLDS7t8szcc3yQ0sibjoEN9PnUeeLsSXpqXRUjw2NtuqSNVykdxScl9BXHUGER7mklW7GsoHWsp0rbfra4ZsCA==.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TjgeSnxMoSGVLLFldUMrlDYiDx3U8Ih2QPKQmjFX5x2rXa3y9C6l9OpxQThjEXaVNdFG+VGT0HaOvu-0vIvfZw==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\r6I9kyr9GmLRmIjLXFGXXkEDmfmW5hHEDZZk3t9wViDPXf7cyohCf1nbKVIKTYtlGv5wjrrgGMFlHq8Mu0L7qg==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\fhVt+tNml0HmB9ypxI8huFs1YfnTnb3PxUgqup+DIOfdG8Qq1V7FVrOx8JZWaoZJ9dZKTEiMVwkj+JFxfVphCw==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3Dipeao+KGC4ag908ZWFIElU8AQfiXg1BhUDQa9otZz0iNIW4k-iv-ijq3tVr-aBJgjfUtujI6syEL8UVW9g6Q==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\A0mZv1lzEp61PP4-EHXeksw9Qhi32n2xpj83Tuc+SuXK0wYGCDsNkE63X6bL10o89oipMLCfDqlIQYahGr-kiICUImHYYQc2+ZkQEMXG5i4=.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HKTeTKGLNdc1B0CYPLjdxcNJi835BjwFUhIlwnE+zKqcOGjodBADjn5P0k7NRDPYYhiqx6hjhDU-4QpdlaDb+Q==.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aYkaf6orWTEv4YG+6ObYlUM82H4rZKrfCv6beXRH6Evjm2EogFHcOQynI-Fx0VgeC0nWPVVl1TrV0TPMlw-OzA==.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Lv5J9LNhXkoCtgtHP4xABUZDVkrcRfxxCyhnkaNrSRAhCJEU55fJluTgwWznkr6EZjCIh6AhbQnZ33US8qNpiA==.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GNFSSBTrp-j0fZ+YMeRUCzwyAkOoDujoYYbMLt9kON8NHWjIap5vmJANs5dwXGk67pJo3RfknuTR9f6KCx-lNg==.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\5hfK1Q3vIuoUjImAK2jdrT7EAd2UT0lU5IqHnuXZd8R9Xu0V4smgeO6Oq-TsxlS2dycAaO4bdyEX5rNKfpHjgA==.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\7Fz2Ag1ba9L6DyNs0JnaTyr7Hicfia-OZwIDAQkjON5eBZuUvGGP9qoxUDluQvNtiB4mjMalGV37iJM-t1lbNg==.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\HEN8VXi4132ZkC+ArFKOwEg5g2tkD5VbcIk4W235YWTBzaCV8HTzfPwmpMfoYSbp.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\PTy8pMcIwmuZBs6mTBXfcaxnAAXaNI5q6AZPeZtmXCA=.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\mMFHahsPX8aD6xJwEm9LkYnM5QsouwI6PLyHfh4GdIY=.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\dGNZGabL8t3Tm2V1i7ReR2LpbiSKwYOFtWemq-z4vm4=.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\s-nJe2AJVl1lAVFJjRWhfaZ6qMKDltZcP0+1UCZJV3E=.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\oMtCAuPSTi1o2x5WRrHvPg3eFZFCDERQIkFSfWBvnas=.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\1PMKILB+Iqqp4hjn8bpY5vpL42wu8LRt81jahwWojaJJrLroTzbZjgpOh-qj0bQm0YbPm001f3rV5fyjG83naw==.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\VfzRD2zfQVyCRXVocBiBfozImc47yAbbE9-ieg-2siDzmECjKlkm5E3r2X9MVd6BdURDQqlanpIhjR5otKE37Q==.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\wo8z3jtwpDPU2PsWZD+tCU1EnIbuk7urEmuLlrP0O6s=.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\0G0Y1XYA-Vsy0i8NPs6Bs3+lK-bCJMQa6vUvj8tp0UM=.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\I6hHebPmRn1Tm3L5rTOYfdzIgQ2BJ6lWIVFcAWD4PxvlWf6cGyPgTFMftaju4mOWNJPNZcHyeCYOggZizUXoSuJf-pfxtmqdCqke7McYOJM=.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Ze4cmOSPqdxArqIbYAWc5GXjffL3EJBJIdE2nleXXjFK09DjsHWYyiO0Gd7u4-oa.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\X8rUN7CmdscVEjeFklYGcHsIGLJUDJh6TCle+YS4E3s=.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6SZMi+MiIIOcb7GYTApp7Q2IwvkBdl+IWPP8cCrX4O5dJBszZ5htZ00alPGqUSdz.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\BULJzhOrqfITaaGyf3DP9w5-G+ed4J1wXzFeFBJyIDfHxxjnwh98MoF7zTK7UW87ChapVJO+PnyuFbcmHBc2uWLfchgvzj0b0gfUmKgEmTQ=.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\9Q0t1ICjxaYDGBH2UnIpuyEW9hkHxGeNjOWyBQFZ2eQ=.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\4NPiCZxCCC6ba-9huE4HN9DXXm5qsBnx0qqeMAHF68g=.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\PUtBCU3XnMpM+U1I--EMtA==.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SXYhEDu6A9ugN8JVVQYFliUbLe5mbM42LwZRGlVc+Js=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\G7fBD2Dq-PwoDGJd8irW0ia1hRBBKZymNCrwP0iD+rmbzic2LtJwooHgaQRF0ypCiQb2maQwqz5xo6DRFPfxGw==.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\T4v9fo+EUCoyFr3rvgUTM18DAed-6hiNsqGkdKwHfQc=.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\OaM1QZCpkakjoqWXkDeiZMZTT-BDyF2OWJAx16gDuaTb+6Z-DAPrqPKzFFtglxS789MD7OX5HJrUcD0Y9xiLiw==.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\sz8HbQYe1gPBMOp8HWqwnCKT3R27e6c9hs+u+Yct+J6Fc4skFt-JrLb+0grBwBohT80W46KGeV2juUgrNXenIIobFHLhEQ186AFDXRaVmXw=.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\PXw7TXEIgJBZKu9RWpFr9+udIBUj72LODzWIEppdxv0=.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\T6beBPQOuHe2SUz95rIlHNUqK10ijv9DHNi6vzwSa44=.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\R0PobwKcoKNLZBgrd-RuAgCkf+EmUzUWdnf-ICSzdSw=.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\KuMImRfeuPhUrSjy5vCIZUs-cTYtwvRmSBAVzqcgBgVBskb3yHfTdZCtkFkpll36btp7nBwnRMys90GJC3eHs-XiC3e3Ow7FjBIffCgDdOo=.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\Z4StBS9k43bv572lTUQ69YADI+t1TPjPzrOlg8mMK+g=.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\pER8uvtad6vw3Dla4zmI-7EYZCFvOL8NfXghSU2fTYou0OKUSimPQL3nrbmpdcgz+-lvpSR5U45jAWpmGoFIMihbIi56TutpKL9Z6MtPHDLZ3lvH7SVb49XTuHmbBjIHfFESAuZWfQg0CeRZLxsZ-g==.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\roCvJLyZKQG51D6DSeWGaUmDdjvN4eLHEoWKT9WsVHonfrt5b4t67KqFJI66gILm.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\p7LoQCM0BQ6xkxZssV1jRQ==.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\7R7bQEr8mJvfVmGlx9wbYvbrM0aMaSS-f23KGygVCKpDgVA8WwpyIEwrgoAcn-hb.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\S1QHEpVrTLzvWjD0GDEm+In4iEWAAzZzjLaNuWekN6k=.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\bkaQVi-S8jpePaq4D8U3fSM1qsVIztPn+WlDz-T-gtE=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\5FRKlsczlSSxByV5RpDq4MIZBm2DHjNnKpPUVNNY+BE=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\1mosbiwI-p0vmlmOdcv8Aq1HOX3rMY81fiEqQB2DaM3nmCRJBCCOf-3dHYdVOcNlemFWKN4xliREeVEF+9RkbQ==.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\jm5m607RXwLX9kjnN7mb+vZ9cKNyq1DbvD1VtK2L46pCaN2k+Iv4szQnKYgluQCIQ7c-9Wqfs1ahvWD2Iq3LJQ==.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\V+Cm3nhkb5Bsl7S6mzYYKU7ohZa2Uw+8TZ6QJ8RGDyz9QsxN-knd2Zrxqt-zQ6uSK24zRNR7iskW1sOktneLwQ==.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\B8bJ1U2luGWFpfg+tfLp2EdoGNkLPHrN4NRJnYtGQujJona7oU3F-2yyv+IutuexmG8D7BZYhxxKJkrUayzoXg==.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\q6D5Fq7MCPggRLObcIne3w==.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\p8YoClJVHlba-1L5yXsTkvFpXjbuwCvuCVIWuhxd4qpzH4IN+IAL9zrH1FiVo0zK9bM4j1ZMAseDDy5mBC-hBxImAbwlOD0YBz+OyB4LOxtByfCI8tudth1cQnKQ1oaB79YHXHdGtwYEHspqEFAl7Z9ubCutNS7UJk6FP3SLF2c=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\L7Vsdp1+dnMoG+ckunzM5zFQz4UG+BpLCwunDwI0oArhhTxAUPYCccKgXCtubDXClR4uKSFMYZCXjAcg05RW5Wj1H+AQg2ISpWx5lFvW576CUBfPRebIbZOd9448lx1eY6MSOAJ8OC2wpk+NhPX9b-oN7bWWa7xYJbVmGnLIJzg=.C30C4DA81AE308962B9A.crypted000007",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\YF5QIxVtXWzqB+7I9Buxe9iS90jhefEsL0Mldz+s5Nm5B+Qm28KrfAVG7jV4Up+azTl8Pu2cOSzSMNx-9cKo9WLDTzao+O3XF2jfQ6wCF6fRbydHV+Ap-6zIrYVgOF2Tg2T-XnzKnQZTTWV5SniWo7XIBZ4Vbak4IFwBSQnyIHA=.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\ih12uAi+1+8jKwM217EdG63wbUZwTZSq-oNYVSDSm6LZ6laXUusq5CWp8lU7pOuaVoBqrfUGzwtQdhnPuqpePWZ7E-rXdXvhJa5rdiWyX9xoCbCex-Kt4KOxHt9mB9ETsCQ5Zsp403LnW-q0w94sbUBt0kfsSS8xrFyMoFYmtVI=.C30C4DA81AE308962B9A.crypted000007",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\5QGCFrYZB6UIn20rUUD60a54VCiULv02GU03309wFxegKm2wb+ORJZVKsOu94xlThVv95r8MH9ui6ErQzPBv8dZN334sWpZWY33U0nEAQvVkPauBMAQlSJi-ByrL58+iXD6tRAHnRnu7WzaFR6EfQlzDHpmwQzb5JU5GViu+Loc=.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\7TO3OFLJH+unIMoQqZCv7kaCUx1-pSK94w9prt11xnhPkBTaN1vUdU7xb1txHeVAoJK9dvXh1WB1SwHGMBl7FzJXyoPGrBED1nguZDU5f25G6cvZh20VPYgoKsrz7EYvmPmqNtJLNiNQWAGR72HSHAtmSAOElOjEIqGES-f-7DA=.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\f8tobVzdpOfg8lmR1RVsNZkvC40tGkUC97t-CBUGfbwOFErSPnDu7bbNfV5Tw1XVTz+uuZS0DCP-hB78lGWLnUAdYQTkBcvXGWDxRHILYghvvCyimiAQL3uzKr8puJyVm1rrx1Ek9Qzu4iJH6elj6D2ctFAbigHICsMMa8IsVuc=.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\yX5BCC60n0ywYIKGwqB2J2HEjailNYaPh7rPdkIQ9T-jAZ6ly+LDIJQdmdDs+pcEov3zYMyY9eNWWlnXnNBmnunQlqup2foSU9nTmeKQdqeI2fo+WfnXKTsa8LOCVjdfIe26G+zrRDKcBn7qg1I5mx1IPhxPlSre5UA0qHDlnSI=.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\Mcw89y8n4siMbQq5ooDyJKZ1Tx26mOZM8v1idb3Zt3mNxTFk9WdQdpVMumkzfCaCh2zoKLMGVVFVNX7o8q-7vNxGQHLEzHH2mvm3X+oHg5IrVUNyAcJMBqKwSIVdGdQUS5689DT93Vn0XSL68WyopX25HaibaNY1mTb6i2RxpHU=.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\QhnQ38ju-6IjdkMJkyN9yE5QjDdjs25ZULFRdtbwZhEGHMpp3uHCotE9fx0GsdqpY0FHomP9mDwDYx2lEc2Plj9ENzkDWxLpRC89pQRHV1pgJJyEHUh74UVye1MbvCF3NorqAqfQj42EDvpHHRTWbkftaRQVsQmq-HQCdpE8no4=.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\TSOb3OpFcrE7HVuB-MrYTnaYUCftfy12R0a3RLrlzhI2-S8ID2ur0CFllaJCc3Lr+-ffBuYDP8cMCGG9A0Mu9HGqut95tph+lj4jbCfA4Uc=.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\RMM92X0SSGj6yDHoMk3YYpEVefRAcezH3IeHOW7QtV45ITEcpzrTOBdfeOT4MEesMq9F-XI9ql2GK7vEEqLiAw==.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\TitduHnpMJd1h3aWtSbBWdToxdehCDhHYfusCg9OxtGIZuprikKJhuv3-3T07UfW.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\I12i4q-XqlXFjqqOBpcgBxA-biAYS3R4jkE-wH0rEZ24nfyurdyl1J3BBbTfrEAzhYe-JJfK2TEMGoVhpICnoA==.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\osD37AbrSCA3Ay4IgrME5Rl7g2+yVN286rIZUpn-qGxfq-KERKGu1sX1ho6pSmXajGeogrbtCVd44YBLYQfsmw==.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\VGEicz2BImGtWtCgqlJse1kqfRVL0c23erSGgWy9Bks=.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\7hHYUHqKbLe8AX-7WX9TwvwCMVLxnByRIC6yT-ZNQMIXgsX3qT5FbEec9aMSreGu0DPP6sCmJbq3aOx+nVSsVg==.C30C4DA81AE308962B9A.crypted000007",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\yBSn16MGSh3tsdPhtu-bvBPQiTyeUrs6zO8h76Adn-c=.C30C4DA81AE308962B9A.crypted000007",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\gnL-nYlIted4Qd+yH-InQFThYwk1nnyYGif3VjrQc7I=.C30C4DA81AE308962B9A.crypted000007",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\RnJNr0w0bmpssmFUJKpPmp7de9rExymDzbk28UwvyAUQxmJu-V7ATVsp0otKDL4n.C30C4DA81AE308962B9A.crypted000007",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\rtVBE1gHMqGNc7SgES3KHc0YxvciJnJ+Xf4Trb3cm8NwmftEerfvp8U5ZIhJjZcAyg57DEc8Injp4cDFR7J75g==.C30C4DA81AE308962B9A.crypted000007",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_e26d43eccb2671d56c9b8fe52ad4e088.jpg",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\nJFKC6oFIOuqN8myGhPuBq0wt2qR-9Am6Qx3MjACVGHyw2MgHXrdmVyw42GJ1MG-PdI468cBZ3aWPbZI4feZTQ==.C30C4DA81AE308962B9A.crypted000007",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\rtRGtoUzU1q3Dxj4fjK-Nak-yUuXgqTA2jjGmaccKDNYdygtlrtfRVoVW5QVvU8s.C30C4DA81AE308962B9A.crypted000007",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\JZGWBLICX7d0qY1sqQIunXiUpwSSj1khN+99HBiPP0psu9kLlg-Tdzf9Pty6DdOiL3mwqE7WMn+gT4QF1VPz3Q==.C30C4DA81AE308962B9A.crypted000007",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\UsaXTTJNKq7CDjuvZhqnKyJ3coW+pGSzHsJvZG+Y-Vo=.C30C4DA81AE308962B9A.crypted000007",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\rGAhxbbVlXrI3Gk1XGdpwV7cKG7RJKE3cKtPioBY79g=.C30C4DA81AE308962B9A.crypted000007",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\Iyl+pUeWCmANeTmx7+yMrVOH6K3SXM1J-HIKtEcSF5iURSdJyvnFSqNUyOFGsRFuJBmqkT5qYNGA9RY4vXuoJw==.C30C4DA81AE308962B9A.crypted000007",
  713.  
  714.  
  715. * Deleted Files:
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  723. "C:\\Users\\user\\Pictures\\Host.zip",
  724. "C:\\Users\\user\\Pictures\\Host.xls",
  725. "C:\\Users\\user\\Pictures\\Host.pptx",
  726. "C:\\Users\\user\\Pictures\\Host.ppt",
  727. "C:\\Users\\user\\Pictures\\Host.pdf",
  728. "C:\\Users\\user\\Pictures\\Host.jpg",
  729. "C:\\Users\\user\\Pictures\\Host.html",
  730. "C:\\Users\\user\\Pictures\\Host.gif",
  731. "C:\\Users\\user\\Pictures\\Host.doc",
  732. "C:\\Users\\user\\Pictures\\.xls",
  733. "C:\\Users\\user\\Pictures\\.jpg",
  734. "C:\\Users\\user\\Pictures\\.html",
  735. "C:\\Users\\user\\Pictures\\.doc",
  736. "C:\\Users\\user\\Pictures\\.bmp",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  746. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  747. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  748. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  749. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  750. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  751. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  752. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  753. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  754. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  755. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  756. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  757. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  758. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  759. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  760. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  761. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  762. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  763. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  764. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  765. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  863.  
  864.  
  865. * Modified Registry Keys:
  866. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  867. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  869. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  870. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  871. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  872. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  873. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  874. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  875. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  876. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  877. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
  878.  
  879.  
  880. * Deleted Registry Keys:
  881.  
  882. * DNS Communications:
  883.  
  884. * Domains:
  885.  
  886. * Network Communication - ICMP:
  887.  
  888. * Network Communication - HTTP:
  889.  
  890. * Network Communication - SMTP:
  891.  
  892. * Network Communication - Hosts:
  893.  
  894. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!