Exes_02fd84c6593960c03958cf58cf4d063d_jpg_2019-06-28_06_30.json

[*] MalFamily: "Shade"

[*] MalScore: 10.0

[*] File Name: "Exes_02fd84c6593960c03958cf58cf4d063d.jpg"
[*] File Size: 1443016
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c"
[*] MD5: "02fd84c6593960c03958cf58cf4d063d"
[*] SHA1: "bc9cc64e1538fcb4fc156a1403b83e08c2fac15d"
[*] SHA512: "337c17b32d4a266790c0f57c4468793edb36157dcfe396f8938473f1b6ef1eaac57437301e902cba3963947e320763c16e48b2795e5d9ef54cfec5508c099565"
[*] CRC32: "93C98D3B"
[*] SSDEEP: "24576:eSVujyq46MrDjZiRVvSdrZVN24SH5M7k7CydRzVRN:TujyoyjZ0atZVBSZW723"

[*] Process Execution: [
    "Exes_02fd84c6593960c03958cf58cf4d063d.jpg",
    "vssadmin.exe",
    "vssadmin.exe",
    "vssadmin.exe",
    "cmd.exe",
    "chcp.com"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "Exes_02fd84c6593960c03958cf58cf4d063d.jpg tried to sleep 574 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
        "Details": [
            {
                "IP": "104.16.154.36:80"
            },
            {
                "IP": "78.46.151.57:9001"
            },
            {
                "IP": "128.31.0.39:9101"
            },
            {
                "IP": "87.118.88.194:443"
            },
            {
                "IP": "104.18.34.131:80"
            },
            {
                "IP": "185.96.180.164:443"
            },
            {
                "IP": "194.109.206.212:443"
            },
            {
                "IP": "127.0.0.1:39133"
            }
        ]
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:39133",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_02fd84c6593960c03958cf58cf4d063d.jpg, pid: 1140, offset: 0x00000000, length: 0x001604c8"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://whatismyipaddress.com/"
            },
            {
                "url": "http://whatsmyip.net/"
            }
        ]
    },
    {
        "Description": "Looks up the external IP address",
        "Details": [
            {
                "domain": "whatismyipaddress.com"
            }
        ]
    },
    {
        "Description": "Attempts to delete volume shadow copies",
        "Details": []
    },
    {
        "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
        "Details": [
            {
                "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Exhibits possible ransomware file modification behavior",
        "Details": [
            {
                "file_modifications": "Performs 1211 file moves indicative of a potential file encryption process"
            },
            {
                "drops_unknown_mimetypes": "Drops 733 unknown file mime types which may be indicative of encrypted files being written back to disk"
            },
            {
                "appends_new_extension": "Appends a new file extension to multiple modified files"
            },
            {
                "new_appended_file_extension": ".crypted000007"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            }
        ]
    },
    {
        "Description": "File has been identified by 59 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.AgentWDCR.RAM"
            },
            {
                "CAT-QuickHeal": "TrojanRansom.Shade"
            },
            {
                "McAfee": "Generic.bvh"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Zillya": "Trojan.Filecoder.Win32.8919"
            },
            {
                "AegisLab": "Trojan.Win32.Shade.4!c"
            },
            {
                "K7AntiVirus": "Trojan ( 0054663e1 )"
            },
            {
                "Alibaba": "Trojan:Win32/Shade.6a7599e5"
            },
            {
                "K7GW": "Trojan ( 0054663e1 )"
            },
            {
                "Cybereason": "malicious.659396"
            },
            {
                "TrendMicro": "Ransom.Win32.SHADE.THBBHAI"
            },
            {
                "F-Prot": "W32/Cerber.ZX"
            },
            {
                "Symantec": "Downloader"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "Trojan-Ransom.Win32.Shade.prf"
            },
            {
                "BitDefender": "Trojan.AgentWDCR.RAM"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.GenKryptik.fniufq"
            },
            {
                "ViRobot": "Trojan.Win32.Ransom.1443016"
            },
            {
                "Rising": "Ransom.Shade!8.12CC (CLOUD)"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Sophos": "Mal/Cerber-AL"
            },
            {
                "Comodo": "Malware@#svpmswn9wt5s"
            },
            {
                "F-Secure": "Trojan.TR/Kryptik.ssops"
            },
            {
                "DrWeb": "Trojan.Encoder.27269"
            },
            {
                "VIPRE": "Win32.Malware!Drop"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "Generic.bvh"
            },
            {
                "Trapmine": "malicious.moderate.ml.score"
            },
            {
                "FireEye": "Generic.mg.02fd84c6593960c0"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Ikarus": "Trojan-Ransom.Shade"
            },
            {
                "Cyren": "W32/Trojan.GTFL-3055"
            },
            {
                "Webroot": "W32.Malware.Gen"
            },
            {
                "Avira": "TR/Kryptik.ssops"
            },
            {
                "eGambit": "PE.Heur.InvalidSig"
            },
            {
                "MAX": "malware (ai score=100)"
            },
            {
                "Microsoft": "Trojan:Win32/Occamy.C!bit"
            },
            {
                "Arcabit": "Trojan.AgentWDCR.RAM"
            },
            {
                "AhnLab-V3": "Trojan/Win32.Fsysna.R256594"
            },
            {
                "ZoneAlarm": "Trojan-Ransom.Win32.Shade.prf"
            },
            {
                "GData": "Win32.Trojan-Ransom.Shade.R9PGZ5"
            },
            {
                "ESET-NOD32": "Win32/Filecoder.Shade.A"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "ALYac": "Trojan.Ransom.Shade"
            },
            {
                "VBA32": "BScope.Malware-Cryptor.Winlock.2014"
            },
            {
                "Malwarebytes": "Ransom.Shade"
            },
            {
                "Zoner": "Trojan.Win32.76844"
            },
            {
                "TrendMicro-HouseCall": "Ransom.Win32.SHADE.SM2.hp"
            },
            {
                "Tencent": "Win32.Trojan.Shade.Glx"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "MaxSecure": "Trojan.Malware.74156879.susgen"
            },
            {
                "Fortinet": "W32/Shade.A!tr"
            },
            {
                "Ad-Aware": "Trojan.AgentWDCR.RAM"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Panda": "Trj/WLT.E"
            },
            {
                "CrowdStrike": "win/malicious_confidence_80% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.Ransom.449"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 246"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 642"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 276"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 577"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "C:\\Windows\\system32\\vssadmin.exe List Shadows",
    "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
    "C:\\Windows\\system32\\cmd.exe",
    "chcp"
]

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
    "C:\\README1.txt",
    "C:\\README2.txt",
    "C:\\README3.txt",
    "C:\\README4.txt",
    "C:\\README5.txt",
    "C:\\README6.txt",
    "C:\\README7.txt",
    "C:\\README8.txt",
    "C:\\README9.txt",
    "C:\\README10.txt",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\mxoy-fjc1vPyd4qh1QI1bTLUXgxIF8S639AConLtDKk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\YWtFs-W9bufAUAHRRLY9FyO95qOPQ+LyscYVi0pEK2w=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\05w5OiFs5qaPRt+ZVij4ab9Gin8DwpTalxWnPXnxgQY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\8Jv0jmnOYutXTGKYCa1uvBPATGivRQJNM2bCrX+X-zk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\+JdQI6kilfeXmwJK9Pn18A6l-r5BH6VoDBt3WdGMlO0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\6uV9N3jN-NXM6pvLt+xUQEpfpkwepaKbe-JeqKKfWQs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\xHhopsyfZ0pf0ICksVl3D2Ht-D0U-0ilsKYKOW4gQlI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\GJBlk39apcHRsxUHyX3-eksd4M1TGhifW8ZIFOPyQ2I=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\7UAcFA7Z92cTN-ZwEgDu+v0eT5tY8ei6D9MBwW+gL8I=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\X+SJa5Sx6QmghDxQSEhS5w==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\R8Nil2PFCtWzEH5gp531Iw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\jgK3M9JD7fmYtbAp5a-w0g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\7D4UsEaZ7Gv-vbML5w4WeA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\Pictures\\sQNJXPyf8eRYSfbgGDEUyA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\9NYKs8aDqZskz9Zi9o9CWVKkPVUr0qDIz2BEYWVWwcspFGhywpq32+8QC3+-htjwx5jpmxsz-W9zAj3-R2kr9litMrscCj9eIY9+l70tH7sO1KTL-RCU9IA5B1Zui3M-.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\QYy8DGeGt9mwc3GfxeOvUJiVKtLjor5A13o8-0jlZVM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9xtRYAItrOV5WcsyI2oJuP5wukBGMpAHlA0F4KWTSdvknqa6Rg8js1Y-fdCaCiLK.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\83yINjRARGpwLDdR43DbfMG7W0qQb2rum1LfcX2P85k=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\fEq+ctDfyE+l27CszPx6fmM62ov3vlOEBjN9O7K82c4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\pr2ZkKTX4Zd0edq97uV6603+ppzA35CutEds6ziErSk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\-gTAA9uvxjxjthQSsC-F9aTWtXlcVASrW24fRZkcv-erNyLTOLqdFRsayD98bbYY.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\dCXhkmIJM75LHKrp9CH3+60GenuI-cBMkUirms71G8o=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\oYfw6u1NeoeVSHK9n9MTn4VoGbXAE21MLrsIjHA5Lhn1BMGbNNvi3gePQ+5ddCc1.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bpiDfcvPE8RLeSoMFC6X3kJzxGkE11zj5uWgYVTsFDA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\0zf0fAxXEVuYeqqYHCi9FRRW4l2gyq5+K2pms6CuS80=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qyPfz8MRjWh60EaQAlaVPPvdFFjNZjIuPaXo7WCIrcs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6PO+AHK65PEIFHNFFoqSFLrvRp5MrwGpI5AjkVZwuy4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\QqEznR5kUDKzDRWePUGjjMPbk38LnMQ56xdKH-spsdJA+M23jsO+QKXv-McfhlDT.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HjOHadUM4JN6uPzABDD83oRtLlhgcah6qW8Giokb518=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ughZF-YtC8-r12YtVRssiNgSaU-JiRENVkt99-cWSZnxRoTXuwo5+n6ny8d16Ys5.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\v0VjfWLL5KdDOpEQm6I-8vJXtihCWXX8pXZbN4LlyPs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\4fj+ss19CY80IHUza0UZarF7wIcNr+w3UJTDoVDeu3M=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\zFYuVHwdbV5CtVmsNyc5POuA5IaO9WKt+NGH4FBS-Lk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\B0MUIZXufAAefi4xGcRvfvlHZMttxrYtsRKvLOEi07Y=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\DI03haNGHfxv9jKUoDq4FtzPZKaxbO8zf9uuY2sc+6s=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\mz4pg0dfU7sZj05Kk3zXLayhtvVzrV9-yGZQhCQ3M+Q=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\yuY+wsbPH7l7ko8YghGQiMMhn0pR3axUThh-gOpRqyI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\KikAst-qUPQ5JlplnnIn7scm28vE3HwGjvOJglk-sjc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\CqzAGHRpnfNrFonNrdHqOr54WrRJUi3nxAMJbc08RgE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\oGHVRf8o0AIqyQnCUNrvRE0EC4tSL3RVJt5vFlSl8BM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\qNVDSFSsfkzhT8rKOWhq4lMKmCO7rU44GlwsFNHocnk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\5AKcqW4rF6VD9c7sUlD2wHnPBuUp435soCIPCTG6VmU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\EBb1V8-niGQwGPTYeLQTFrW9e+sKm1GskVhEQyOuOuQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\RxUoCNh3FOzAZTg1EBhiVn7mIKMxZ+C0RSVgo0MuMGI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\mviHFotFN6e6FnfsEcgzw7ZTFFXQP+o2xrBslvfr871qd5CCZtemynbtNMA-dJJchHwEeY9OQ8y50pzbNvkj9A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\XUC6H4DUkve5+Fhx4PGc5wzfgq6SXw0CoYV2c3dyFCDRjd534yoJQ8Al7pcHi43RHhiHk4SgS3Cf3yoaRDZd3A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\sgplEPI9b00EYK6iLKwxqq9zddQBK1lt+Af9oiAloyNiroyN3JJJccNzZVfZ9fgPnBWtTM-J46zM4M5lRi06SDHhHMY9dzJ+L+7l8ymz64RYWoFOqzIlspiu5oT+ANN5OxrhF5JV7folDD8JIG65xpOj24+77S+JyemgkHYYvqFAbzxR-HSQarSxHAsjsxnM.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\ZFIYZplXfR46RK0B4uUYUr3hLQKAaW2BKgm5Nm4+LtScc7JOjNIw19Xutdy3d-X7BWGQKnwUWYrnEo5+qHn3lg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\OOA0nOEQdWsmQ6xbRG6rqlvIgSF6ryvOxtTjVDywCQB4BzX2hCEyGs+cA5Dl4wTMa8aYpZVg-7ptiX7a1Co+cw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\tKfAi7liRV5xLvKTfOAdXFfdZfXLN7IyhsfyKpe8PCrh+uwtdXfN4zxBSo-dEU442qBEDY76rX2dZ-bSb5DKzQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ldzxbk7nPuwUjCDLiskZpyaG20NqAF0lkXRiO7Y82ZV7MYD5M+7vLa63fFiypBMVHISSBP0fFklK-XZKd4AUBFPsQVpOC+ugkj1y0eWbV4rNnwLRpZJvPMFWRFCz+9N3b0JXNtXwz-GDvtI1XlLcSw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\7WPGDYQd4cMhr7duxVHBw5ik2J3DZMhJB4YTlQY9ZlU9e34BEwAYHc948fZi4E6sxaLniiy3MOoScC+Yr3toyWxtIRYHZK2NkKlr-3Mvz6c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\4PMNwGUu5cWW1cqVtIvbiYIr1s6cns5leLKd0MaOKmFRRgC63j6hj9e-URK2MLK2I1Ey5QcDRW0C29wOfdxEBA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\89Ioy5qLFPyZotXSatL3r6YYUdHe9EfLZGygIUWnkN3uOHilLopsjqiv2kA3QRC-zKhQz+qmb7c6U0Zuy1-nppe8oq4O9DGOMnMcW+vhLEeByw3sSPi-nZYItun4R+Eh.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\7urxVPLh-FNlX376NyPAeA9UL4PS6YEUaZe57AhRLi2O08vkv-d9rpGvdue2ICcHaK2HKiH7ctrBsUPPMFpOoYMB7LUyuqQLFi50pZbkOWKhn8yGFMdGXx5VHuyqsSD3hBu4QgHW47AMfCnioRQBsw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Z8jme2decX8brYBGsfRu6GDisxP7foYy+fXB-wbh7FJvbOiTjhdObNOUSycu126yoRHOsZrCxO37Wx+Wkbe0PA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\W3ANhHKXu3QgyIDdDpVe5lwTAfiun4wAJDVDzsJWefheP3crzQBKRQYzuYVy7vzw30WMqV5-YitkqX8KZrO9jw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\EisNJsWkzJSNmKtK4e8dfqdGpfXn03Kh9Mu4wxU+kSMSAfJct1Sj0Z88UhVMfjDD.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1lEGBHwvhGO4DuYwdb0+NO20PUba09G05dFYljJ-YcGwphY8OeaCylB0f0-OLPEYT7l9MWWVGUsour2KJ9samA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\aq5VQ1Cx0BO8XQ3qzs2FkFdI0bXXCHKzH1iMlB6KV-AopT1oQgd4j82TSvtseLKaMNVSjAbsUaL21TbOPQfwuKxqDSLGRfyWT8oyTbbSjOe0cekVnUpWcI5LvjrCNYkB.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\pcgxKUTdGtfojhRJwbm+hozqtZC9JMpWGicx8uB3PKrd6J0X4PCUZgsH1h95lrVsCf+bKDPkgpkrkZUFVcZiEA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xSxryQxVLR-uLCRUPGYsIUIb4RDLXXg4-gnlSp4J7N3bgu9pP0cCAVkpkR2TTwIr6KI2vl25ptXx3byUdvaaIw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rKfok9X43upOKHkK0gdD+1uVYIVve+6gnVn6Xq7yEI1ygTmN--ZXpaE-aSgT+-C5Sdv6P4m5jM0clMzq-dZuJQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\lFx3AviT3U-5u22AGO44odJjl9P1P+0hUGoPJ-kYXFx13NEYKFbtWacqr8nKnWivGBzWQ4TM1w3kMu6QvquovQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wAnG16Uw8a-sEBfWOs9ZidpwXei0hl5yNlGjCkNg4i37stJRAZgUUgZmZk86sKjlMhjcGBW8LQm0X3h7qlbtZg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\N2i1SoZLC1L-PJIvzUv0bCmdaIDctM8EoURUp68U53VUGAtNJsh0rwhZcIYo4w4BX2wM2yaLkKrVZt7yEmi5IA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\diABzOE0E-Cttzv3JschW7iEfr87FSRbp5whdO1W16JVKtMN1sCiGHxSAME3pCk5AdkrGGRBFFkcuCIoifNdX8ECjFf4-MKvK9XxvEyiQpo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\kShTH5WOTtyjoDKLCYhJJPPM0nMWyhsDvdvxNPgllM+HKDUZl5XJKBPzo3Pq7E7+Ur2HU1DlYFwh6DCq+y5dAQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Zf2peT8Enk-usQyQiQdFdAbFKYjGH8MQ47Ci9h7VU3-+sSRNXBWa8lJ-khnzgz-9EaP6W6XN7+iSnxPD0YRA1Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZsFIzOVpnHQP0KKlcFKn3chi4Jylpr6NTnVV1s0qWsLLLBKL90fBYGa8a89Cqgqq2IShv8ZuhdTpEpv1UCunrg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\T8c4xNGUoWraba6gvV51owqP5eLgCkvN-JL+VfFliY+lIVwHVCeRPkFa3P5-QKcCab9g4jU-BQkJLKT4ePvoDQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6OPlW4rOUYPQhB-8zoXl6H4FJNNbeSYemiTpJWuKPF6ufUof6VHfAOfB0pQp0hXgTCN+Qoi+4Dug77YtGqWegQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\19PHi9y5hkiuSn0ZBFMb+WnwqXAZ2vsBILsLL7RQPuFxnteVDPNGkFuQyoKj5+r9qwkwNLClJTw+xhJFm7FcBA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mTqzLMFHg1bQacazt65QSqqYVvDl8z2EIL8RapkmRQVi1iGMM9wbPjSzwgWrupqM5tHBStmVhSaOyOt4WYjOZQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\phNYHEWEKNuYzMBDVW9Y2xoY10r9GdcbREFljR4R-bGlLwhP8grl1ybudIKJVYuUUZm0yN2PsW6gRgmcG+Bn8g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\4AJhzQW71c8tjsAAM6gkxspVFo-wgS5cPkp5hIGK8NYSwzsGrGlb3IVQTPk2U2+hp8ctqKqX6iBNMxE9iihdNQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mfQkMWi7l2FL041BbZ7vfuFDRmquDe03MSfR0XB2MUlkiuceRY1ZJb0OEQwzykpL8LAJCwlLPjyOFRM7V-fu2g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\N9HUppxurvPbH+2SiLxERZdTL8rckqI63qDpb9CV-aHnkE5eX8MXm0XBg0Tvg29ratNiRrK1ZGKlthd7pmneJPcmOxYW6WZQeALvP4l1Tp0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\-zfYY2k9TxQnejvOfZyDwuRCX1w6fXpGImuE1HoBSN4jOZpP-zvyuAywqF0tsJHem6ND0caQjhLCbc9ci2KhyQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xcSCyEiiOSCvPmj0O+UMTpInuyaybG6R4sb+gl3GV0eYXj5--6s4DWdCE3aMUzNT5AWDp4fbvp-X096fG65mrQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\UUIPFdtf9zDoAV4uIywNc8am28l6NVQ3LEVZo5J-Qo3CvaPckSOd9iTw6oXA2XucfcPtMEttAVd09tJcyl3cPg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZD2K9jchquMUrMrgFOAd4hY8AZ+99cd1Wo1fSWSZYQ28Ctu37uWvjeB7kiQWdqPJi8lSQK0GCB1pyNU3Id3LJQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VmUWa9rtnl0YJxGcrkfGTD6hVzaRNriRhF8OMaw1hiv4tRbX6Vmpia147yTMG5e3nRnM5bBc+fQHzywaA8ADlQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\P-xu1pwt48jTv8ujCGJn1iUqZbLgU7jnuHl3IYgRBVtaTC05ILRqPyL3MzzdFdBtgVx8s4Gfwp27sLhP+XIlXA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\7gXQi+7Q+JV8I-+J6KGtR0uHxHTWt8SqonPWqE7luHESPECwYacap7NYCXNv0alz.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\iLo32FLbLqS7b26LqoihrUbKY9WARSfymQly0wlejIM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\lNikbehHjGjkjBEXxT6azISPPyBWQ07rYKzI4v50Emo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\di0e+Vidcm47PG-1tdio5qVloZdYKIDdWrfkGB3A4l4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\qByGy+QYvafYp+lJI1YU2iaZsSsGakXzC4sxHxZ3g-8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\iTP7AWDHldEmkuXfgT-om0dxNpijALwicSmtixb4l3o=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\XfD4clS23x5nV9mzAb4Vjt581E71udCjaELQ0zmsi87C+J-3bzl8ArKdp1rRrxeE2bgjhxnDG7-0rF5RHq+tUw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\El7EJRXWcolZlK0jxVxM12Ng+iL88Tjc7+As698zg9wVSb42m7Gzez4G1XeRmsZEWD5ZsVFRHNoWaF7bUk3wiw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\L16qJO+7clWiAoQiFl1SyWulVoX0JfYAV-t0u8E7MfI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\H821R0QqnIQVomsVEPIVlEl4nSNtvUpKQTqUGHoPqFI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SQfb887GzbpZ0mxlPoh0VgjMFu8gThE0lZxo4jDcHR2I+77mWXX7XYmRpPy7hDIeWsbPM3Y-qS+RcHHM6k-LAcAAsd1XoqICKxQVb-um79A=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\S+WFkL5TwcjW0FQGtNve0F8gPLUxZuRMWVgNW2GwgTCckRpAumX9QhLEH4UoW7GT.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\vnG-GXo7gcKNRjgb9teGI87vPPuF69sdjSI3DiCmW4M=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\-FrDjWtFJ0VZm8kU8vr0uAy1jvIWSnWwqoMszANrtyI8TYsla2PPExN7Dg9DqxdK.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\96bkNSSP1XdMVdm8yLX3TgqkoyYEW3OEksSPWUNlvyv-QF-Kkbr02+obcH98r1DfgVPA2P6XY0E6JQy4IrHwD5ImWUncez-Wn-6IljIChHc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\KeI2wFyLx5OuCVPE5Eu4s+ZsFQ5W2VWFEteijY9Cync=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\v6whJ1b-rDsbTqR6EcK-eikyj-YNlBvemnZ51AA2Vc8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\azcDJJByHr0QfvfTe0OmpQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Ynn5+glJj9iWVSVqQwvqOwVC3tSIqT4H-n-LKIc-POg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\61D4zq+ai8S4BRkDOQxh1qTWmRctG4S+MtQAF28qbaZTwnqqmBDbQ1JoUqg3jdaZkJyz9sg4lrYi7kVMiaHl2Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\gD8m3q3rmVqVkyLMYuA-yu11id2YNABTr9wBYzMx8RLfCATP2h99S0gOlAggu0icSkdGlOiBNXXMsXjTkEIF-VIYNt7b+6Y6mI83RPc+Z0i-L3hRTzfOyhKSN-LErWbXKA30PyBGZ59rc4vZaipsVQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\maQ0FZhataZ56AWaKDKgbDa2DQcNsAdkDRpgeWZ0LuYbUFYrtTeXkaArxvSnGEwx7a6SOlwCWC4U5Tg0DBNfOQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\kXwxcONTHKMpDu5CpCuCvyXCrESR0ir4J+XoRDuo3Wz-aTGtk5W-+ZCN6oFb50CaQSCAdSDRVmXW6xs4nq5nNyoaBIFFARVuWJQRjvgDzkM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\tuwis88+6itD2XvpdmOhYsMhrq7xAjI2-BFzKXdHn-c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\wZCAVtNKgLWzFrqNlPt+KRoVixPTvii9JW5atbkXIbE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\HXVvGAVHPy-yrPYnR8Djdnlb1dEebrhORsK5-IefkaE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\HZB7PXRLM3P2q35aZGhxRCH6yJHGQKr0iKmRcJSAaHIEDzVS2EO2DhUKU9SqDmMaUjXENNSqv9Dt9HjxDqBKVbWRnGIaAzvSooLkSrbhJUc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\EhGi76qs+T0QD1OrI4jVpKq4h6AJ3sfhY-c-W-2iS7w=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\KAhoGYqETkBup7lcHrIpvN3V9pcW95m6hgMXeubMJao=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\gjaqCW-zEmaiK9SL9pRvKXR97U0cJvLtwC7iT16E6lgS30nGtt-piFfwdvAYPqPO.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\E0fPP4HlvDcPtdQZp7+t2Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\Y5w27eRHMIVUxs3faAZLHqYFSq4UU6pPpdMnWRRBvxqNLnsDmSvrRINCwp-TZ7aJ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\WOMaJs5D0QlUILbigF32h+kVPoRjA9ejpUom9MPjhc8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\JLUDL5Exj3uAPJQbEoE2+5GClkicgwUdtoSZtI4JTnw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\cEd-1S22+e94XMLSenGLPpzJVxrropRCBGx0mbb0DhM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\rPktsrC1C8QhM32M1J1O7kSl4mlq9H2KR5QrMJ6VpvkvctY9cTHnvJrJvMY7nlaEu4Q2t+hPVeVYhKexqaglbw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\w7G9cMoPwqrYLCRfqa2KQfD0ZBwQ3iBqbwGXYvsUSDC1X0VsAeSZp2xoGqca6JGT9eJ3Fl9EiJNxAheKnsMPWg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\EkgSYKWBTPVhwJGQZW+RDyPTVjBX1yLd6FR1+uosDpBKbpp4+z0C5FjvI1QDYXvBDO4pSC3BCRJRsbP3Ut1zhw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\lpQMHR08Sr9l3gmjnoN2ycDYn+i6CRzPAmv3ivqaCnlzZ64JFg5EtPaysVvtuOGClCH3NPgNph3SDuKr+g8jeQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\rwjM1SajcWe1CTVjoPvGgaNE5e51K8hB+JQYsth-mk7ekQzdarsKG-Ke9ExlDgXuY9+OjT7jlK32bj4xuDL6sQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\GMrxUEqljWgX1cWJa5g0qXrtgud-p10sG2W5RwnO2o8fxla4mAkme-rqt3naVRyxlvt9aYK62rNB49OhULqvFg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\8jmvIFdfdw6FI2JhqF-2rs3POnxn4hAmZuEB6-TonDenrnZ1iz6Yf4ZBT9jqK4nvbjmS4statdXkTOuG+i2+5Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\70IbxtAS5EddLGRLdJO28g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\kDPnhdXUWgUGN8uM64tEvHZoSZamg3Ou9IE5qxLR4Ici0s894vlulBRfVW5K+2uvsbXxTuhGSsVpHE5x1dMnKK8m+xwpoylh2+TsDZp-d57Dg-MVz3p6pJgxUirYF8+45LzCdiMXt5uKu+s2rP04DEndYrAxZx9cvjPWQ6iqGqs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\OcG2+f1ddxaO49C4nTh36yICseGCVujfxpm8II1jfYvlMKshCUzgDOi7TZbYh0jfkqnZtOP-C6AxHcGsbz5bBeXCVeWTakJ-3yTvlAqpXDaIYZZxy6+jUxGMwwTDyLqHOUUTDE-lH47qUsMzGb0o8vXDYTrphZRHegoHswlRtQY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\bFXDQ08zROQGCEk4q1w0iDrcj1xteMabkXLHuuT7G6QjmosCipm18tcc4ojL-a4xiYSodXig9KMl4FuHBQyKzsbMh7Qx-i8EtIYF0+1jJwyyNTBngKFkZ1uekvgjS-2dto1ztyuRnC1RUXhgrr9Gczi8u6Nrn-IgpkdwevHRiKk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\gZ4P0sJgxIZcGoESDpgyNMnr6uJtmE6VgbsC+y5LWOiJpPcY0rvxFwPMOnTGkRGEnACNnjv6TlgjePOo3jTwxQFyZL-xY7TREfsyyAidiAJ4A1xu8j7RIgke4OkO-CYTzZaB+6yvi7tzdikBwKh4SD-gMVbvZmYOE0QGIHQ+IMU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\t1rnEOr0jFR9coukvgylAjby4rZfzpcOtX4gTKJfbNP7C1qMTeTKbAiYOUd2El6c3VAHOE6qDZ+BF+Xl2u7mvEuVTb0NyKOwSirO04lBQyhjpAKy2Kt3agbh95ZRIcMEN2rzwF0W+Ul8byXC6ci5PIxnSt7Y8TUbDoJJ8YvSMJw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\8MeH0eT2D7LLZxFLc62rxQhtBqV4CoHSj93WlJP5pZloaLBUTokrivSalPg-o936f-GdMkN-KWH+Mg7KGSliIg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9caf7p8qB6WeG9wW-vZukt9+ye0Q6huL8mrCaPbiTbe+cLins4QufsFjTF48k7aNupwwkIkc1P4erp2QXmjj0UCFK3jk1tzwKuN9YKudd6tjfgyzNFSyNA3HeK6nauWxDXiJNaB8bHDXXESWB56TULC47ucmYuiWqxukBlPnv4c=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jaWyez2+6ZoLrKJhwEIMe-F7N47w9U1zWsm96W7GqA-bgvWr71PwuZQDQx3bDCe6Ricb2Ubn8JDd7urL5EvFOQ0qOy-c+ZzlTrnB8+qsEFYliB6s+Qa5ABCF9m+OpnFKyrG6SkZcVnn7nbN-Ehgvsuj6D1Z+XauRQgYrCUPUzgQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\oBzjsZxx28IgEOV89alqB2M89fqgYfKxJ2aueZH6-N830Ozrtqz26YHUFPtRRG-cK1IIhFs1b3B1EdVEJxW9IggLSAavnNRmCrvJ1HnML+-jkeW4STjeYY9NFc8oSk2CltwkiM6M3H-Fc41LdQR6MioY+3BY2f+JUc1UTQtjvPg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\f1OuwY69PJKNzsQAOrxzALT2R-pmHV700eoVHjC9aqncRJ0oxNod6zEDCYIQA-vTv-jKWcMBSbi6cpNnPWH967trWDUxq9haetLn0vf6Yw5vSzOabibGnrQtGHlkQaXdd84cPR4NOPWYPbxNXv6A1iGLCzf98jmOvuggnyXpiH0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\aOjlfX99XXVZPdKnieBGUKoxJaIC5zDQW34q4Ks9MMYKuONtuJpevvr1V1IqQKW7et1hoMHfFscsKFxW6yD3xjAGWMfgivdB41cuAYQXmyc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\YUz7nGvq8AZ5FpCEo5Q3WXlCwypjoGu0MC+r9Xda6y1XS8gPBOcPDFuodc2KUC9t.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\POdRj9esbRDgmqObwJ0+qbGohZyECTBO-gXMhPfVYak=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\pcFD9lelVzWhOtIUVOAV9Otq-dgqZDoD-Lya5fwlI8yA6MO2NmFQK31GvOdgApU4vaDGfYzHN3openInc+qMdQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\QdZ9zuVahGT4cf83P2fcLYzmD8iHIkfPJBTQau8BDzk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
    "C:\\Users\\user\\AppData\\Local\\Temp\\grVY5Tv2Wjmx1-J2dNmMHXXzA-Rnob4-Dqb2+JVC-J0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AGbieKPqK5DwChrd+f1N2n2y1lhsvNHty0zLkqubusNXhIavfjUzeiraNucFQZ+-.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\OSdgboM2IqjjPtchvPCy1NqRn6PwV4-+RAMR8oRpwGQ6QMPinCCPWvZSoSULyDGUTSIEhFcNtIz3gUml4a0MCw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_02fd84c6593960c03958cf58cf4d063d.jpg",
    "C:\\Users\\user\\AppData\\Local\\Temp\\M-5Ms5980bKFSL2r4gwwKYXHep3HMphB7eX-j2spBFji2GqtstYzzNd+uFvVmOiOKbdNN73yIBl0t-vKkkr6qyUvg4QsmJpBxcW6INYRmkp0+mnzskDxYMhJnvRcYh8fCYtJTfq0xFAEdJ59cJAMeQ6YvVDi1d+JbC0+Tv-b3Qs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\lKbhAaQq2CGyTa4p-wHxzalAkg2LCdskXLZKdOhTwF6db13KTECbJF5n0UFrqNLr.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\KkO9dDbfVml85oP-WFN3zroffoEGsBGZFxA1R3u7pAzsyX0DPdunkOVy9Hfx73WcDdRxuL4a40XwxnHGoKH3dQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RyYxNelGXfT1oDTsfuk8MXx5WXOmuXZlbk9mwkQWlkY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\lMmMlnD4tkmhiK4AbbRFUKtl-odnitcopWT7rkZcuKY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\GtyJ9pDyb5Xj50HzNEa2ZYiNX8glSgMCuGtVndhdPNX2AalzX65Yd5bKoNZiiUb+sot6BGGugh3BKouII7-nHA==.C30C4DA81AE308962B9A.crypted000007",
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
    "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "whatismyipaddress.com",
        "answers": [
            {
                "data": "104.16.154.36",
                "type": "A"
            },
            {
                "data": "104.16.155.36",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "whatsmyip.net",
        "answers": [
            {
                "data": "104.18.35.131",
                "type": "A"
            },
            {
                "data": "104.18.34.131",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "104.18.34.131",
        "domain": "whatsmyip.net"
    },
    {
        "ip": "104.16.154.36",
        "domain": "whatismyipaddress.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 10,
        "body": "",
        "uri": "http://whatismyipaddress.com/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatismyipaddress.com",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://whatsmyip.net/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatsmyip.net",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x56030c"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x560310"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x560314"
                    },
                    {
                        "name": "VirtualAllocEx",
                        "address": "0x560318"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x56031c"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x560320"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x560324"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x560328"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x56032c"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x560330"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x560334"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x560338"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x56033c"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x560340"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x560344"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x560348"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x56034c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x560350"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x560354"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x560358"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x56035c"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x560360"
                    },
                    {
                        "name": "lstrcmpiW",
                        "address": "0x560364"
                    },
                    {
                        "name": "lstrcpynW",
                        "address": "0x560368"
                    },
                    {
                        "name": "DeviceIoControl",
                        "address": "0x56036c"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x560370"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x560374"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x560378"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x56037c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x560380"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x560384"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x560388"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x56038c"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x560390"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x560394"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x560398"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x56039c"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x5603a0"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5603a4"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5603a8"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5603ac"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x5603b0"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x5603b4"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x5603b8"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x5603bc"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x5603c0"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x5603c4"
                    },
                    {
                        "name": "CreateProcessW",
                        "address": "0x5603c8"
                    },
                    {
                        "name": "GetExitCodeProcess",
                        "address": "0x5603cc"
                    },
                    {
                        "name": "GetFileAttributesW",
                        "address": "0x5603d0"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5603d4"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x5603d8"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x5603dc"
                    },
                    {
                        "name": "SetFileAttributesW",
                        "address": "0x5603e0"
                    },
                    {
                        "name": "CopyFileW",
                        "address": "0x5603e4"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5603e8"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x5603ec"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x5603f0"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x5603f4"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5603f8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x5603fc"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x560400"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x560404"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x560408"
                    },
                    {
                        "name": "FreeResource",
                        "address": "0x56040c"
                    },
                    {
                        "name": "ResumeThread",
                        "address": "0x560410"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x560414"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x560418"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x56041c"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x560420"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x560424"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x560428"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x56042c"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x560430"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x560434"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x560438"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x56043c"
                    },
                    {
                        "name": "FindFirstFileExW",
                        "address": "0x560440"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x560444"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x560448"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x56044c"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x560450"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x560454"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x560458"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x56045c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x560460"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x560464"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x560468"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x56046c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x560470"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x560474"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x560478"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x56047c"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x560480"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x560484"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x560488"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x56048c"
                    },
                    {
                        "name": "InitializeSListHead",
                        "address": "0x560490"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x560494"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x560498"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x56049c"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x5604a0"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x5604a4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x5604a8"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5604ac"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5604b0"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5604b4"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5604b8"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x5604bc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CharNextW",
                        "address": "0x5604c4"
                    },
                    {
                        "name": "PostThreadMessageW",
                        "address": "0x5604c8"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5604cc"
                    },
                    {
                        "name": "MsgWaitForMultipleObjects",
                        "address": "0x5604d0"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5604d4"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x5604d8"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x5604dc"
                    },
                    {
                        "name": "UnregisterClassA",
                        "address": "0x5604e0"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x5604e4"
                    },
                    {
                        "name": "SetMenuItemInfoA",
                        "address": "0x5604e8"
                    },
                    {
                        "name": "GetUserObjectSecurity",
                        "address": "0x5604ec"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5604f0"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x5604f4"
                    },
                    {
                        "name": "EndPaint",
                        "address": "0x5604f8"
                    },
                    {
                        "name": "GetKeyboardLayoutList",
                        "address": "0x5604fc"
                    },
                    {
                        "name": "DefFrameProcA",
                        "address": "0x560500"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x560504"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x560508"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x56050c"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x560510"
                    },
                    {
                        "name": "IsCharLowerA",
                        "address": "0x560514"
                    },
                    {
                        "name": "SetDoubleClickTime",
                        "address": "0x560518"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x56051c"
                    },
                    {
                        "name": "GetShellWindow",
                        "address": "0x560520"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x560524"
                    },
                    {
                        "name": "GetUserObjectInformationW",
                        "address": "0x560528"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x56052c"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x560530"
                    },
                    {
                        "name": "GetKeyboardType",
                        "address": "0x560534"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x560538"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x56053c"
                    },
                    {
                        "name": "SetThreadDesktop",
                        "address": "0x560540"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x560544"
                    },
                    {
                        "name": "OpenInputDesktop",
                        "address": "0x560548"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x56054c"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x560550"
                    },
                    {
                        "name": "GetWindowDC",
                        "address": "0x560554"
                    },
                    {
                        "name": "GetUserObjectInformationA",
                        "address": "0x560558"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x56055c"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x560560"
                    },
                    {
                        "name": "GetIconInfo",
                        "address": "0x560564"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x560568"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x56056c"
                    },
                    {
                        "name": "FillRect",
                        "address": "0x560570"
                    },
                    {
                        "name": "DrawIconEx",
                        "address": "0x560574"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x560578"
                    },
                    {
                        "name": "CreateIcon",
                        "address": "0x56057c"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x560580"
                    },
                    {
                        "name": "CharLowerBuffA",
                        "address": "0x560584"
                    },
                    {
                        "name": "CharToOemA",
                        "address": "0x560588"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "STROBJ_bEnumPositionsOnly",
                        "address": "0x560590"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x560594"
                    },
                    {
                        "name": "STROBJ_vEnumStart",
                        "address": "0x560598"
                    },
                    {
                        "name": "GetRelAbs",
                        "address": "0x56059c"
                    },
                    {
                        "name": "GetGlyphIndicesW",
                        "address": "0x5605a0"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x5605a4"
                    },
                    {
                        "name": "GdiResetDCEMF",
                        "address": "0x5605a8"
                    },
                    {
                        "name": "EngCreateClip",
                        "address": "0x5605ac"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x5605b0"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x5605b4"
                    },
                    {
                        "name": "GetCharacterPlacementA",
                        "address": "0x5605b8"
                    },
                    {
                        "name": "PlgBlt",
                        "address": "0x5605bc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x5605c4"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x5605c8"
                    },
                    {
                        "name": "RegDeleteValueW",
                        "address": "0x5605cc"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x5605d0"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x5605d4"
                    },
                    {
                        "name": "RegQueryInfoKeyW",
                        "address": "0x5605d8"
                    },
                    {
                        "name": "RegEnumKeyExW",
                        "address": "0x5605dc"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x5605e0"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x5605e4"
                    },
                    {
                        "name": "LookupPrivilegeValueW",
                        "address": "0x5605e8"
                    },
                    {
                        "name": "AdjustTokenPrivileges",
                        "address": "0x5605ec"
                    },
                    {
                        "name": "RevertToSelf",
                        "address": "0x5605f0"
                    },
                    {
                        "name": "RegOpenCurrentUser",
                        "address": "0x5605f4"
                    },
                    {
                        "name": "SaferCloseLevel",
                        "address": "0x5605f8"
                    },
                    {
                        "name": "ImpersonateLoggedOnUser",
                        "address": "0x5605fc"
                    },
                    {
                        "name": "SaferCreateLevel",
                        "address": "0x560600"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x560604"
                    },
                    {
                        "name": "DuplicateToken",
                        "address": "0x560608"
                    },
                    {
                        "name": "DuplicateTokenEx",
                        "address": "0x56060c"
                    },
                    {
                        "name": "SaferComputeTokenFromLevel",
                        "address": "0x560610"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SHEmptyRecycleBinW",
                        "address": "0x560618"
                    },
                    {
                        "name": "SHGetSpecialFolderPathW",
                        "address": "0x56061c"
                    },
                    {
                        "name": "ShellExecuteExW",
                        "address": "0x560620"
                    },
                    {
                        "name": "CommandLineToArgvW",
                        "address": "0x560624"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoUninitialize",
                        "address": "0x56062c"
                    },
                    {
                        "name": "CoInitializeEx",
                        "address": "0x560630"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x560634"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x560638"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x56063c"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x560640"
                    },
                    {
                        "name": "StringFromIID",
                        "address": "0x560644"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00161f5b",
        "overlay": {
            "size": "0x00000ac8",
            "offset": "0x0015fa00"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00165f46",
        "icon_hash": null,
        "entrypoint": "0x00401dc0",
        "timestamp": "2019-02-22 07:49:40",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00142a00",
                "entropy": "6.29",
                "raw_address": "0x00000200",
                "virtual_size": "0x0014293b",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00144000",
                "size_of_data": "0x00000800",
                "entropy": "4.41",
                "raw_address": "0x00142c00",
                "virtual_size": "0x00000708",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00145000",
                "size_of_data": "0x0001c600",
                "entropy": "5.15",
                "raw_address": "0x00143400",
                "virtual_size": "0x000c257c",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0015ff40",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000008c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0015fa00",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000ac8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0016030c",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000340"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "dd3cbc2b4cff73f0bf02bbc24a598ae0",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 6,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "advapi32.dll.RegOpenKeyExA",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "comctl32.dll.#386",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "iphlpapi.dll.GetAdaptersAddresses",
    "wkscli.dll.NetWkstaGetInfo",
    "cscapi.dll.CscNetApiGetInterface",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.SetConsoleInputExeNameW",
    "ntdll.dll.NtQueryInformationProcess"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x56030c"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x560310"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x560314"
                    },
                    {
                        "name": "VirtualAllocEx",
                        "address": "0x560318"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x56031c"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x560320"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x560324"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x560328"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x56032c"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x560330"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x560334"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x560338"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x56033c"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x560340"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x560344"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x560348"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x56034c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x560350"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x560354"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x560358"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x56035c"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x560360"
                    },
                    {
                        "name": "lstrcmpiW",
                        "address": "0x560364"
                    },
                    {
                        "name": "lstrcpynW",
                        "address": "0x560368"
                    },
                    {
                        "name": "DeviceIoControl",
                        "address": "0x56036c"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x560370"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x560374"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x560378"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x56037c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x560380"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x560384"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x560388"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x56038c"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x560390"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x560394"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x560398"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x56039c"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x5603a0"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5603a4"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5603a8"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5603ac"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x5603b0"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x5603b4"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x5603b8"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x5603bc"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x5603c0"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x5603c4"
                    },
                    {
                        "name": "CreateProcessW",
                        "address": "0x5603c8"
                    },
                    {
                        "name": "GetExitCodeProcess",
                        "address": "0x5603cc"
                    },
                    {
                        "name": "GetFileAttributesW",
                        "address": "0x5603d0"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5603d4"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x5603d8"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x5603dc"
                    },
                    {
                        "name": "SetFileAttributesW",
                        "address": "0x5603e0"
                    },
                    {
                        "name": "CopyFileW",
                        "address": "0x5603e4"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5603e8"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x5603ec"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x5603f0"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x5603f4"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5603f8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x5603fc"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x560400"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x560404"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x560408"
                    },
                    {
                        "name": "FreeResource",
                        "address": "0x56040c"
                    },
                    {
                        "name": "ResumeThread",
                        "address": "0x560410"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x560414"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x560418"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x56041c"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x560420"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x560424"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x560428"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x56042c"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x560430"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x560434"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x560438"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x56043c"
                    },
                    {
                        "name": "FindFirstFileExW",
                        "address": "0x560440"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x560444"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x560448"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x56044c"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x560450"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x560454"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x560458"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x56045c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x560460"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x560464"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x560468"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x56046c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x560470"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x560474"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x560478"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x56047c"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x560480"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x560484"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x560488"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x56048c"
                    },
                    {
                        "name": "InitializeSListHead",
                        "address": "0x560490"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x560494"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x560498"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x56049c"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x5604a0"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x5604a4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x5604a8"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5604ac"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5604b0"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5604b4"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5604b8"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x5604bc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CharNextW",
                        "address": "0x5604c4"
                    },
                    {
                        "name": "PostThreadMessageW",
                        "address": "0x5604c8"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5604cc"
                    },
                    {
                        "name": "MsgWaitForMultipleObjects",
                        "address": "0x5604d0"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5604d4"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x5604d8"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x5604dc"
                    },
                    {
                        "name": "UnregisterClassA",
                        "address": "0x5604e0"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x5604e4"
                    },
                    {
                        "name": "SetMenuItemInfoA",
                        "address": "0x5604e8"
                    },
                    {
                        "name": "GetUserObjectSecurity",
                        "address": "0x5604ec"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5604f0"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x5604f4"
                    },
                    {
                        "name": "EndPaint",
                        "address": "0x5604f8"
                    },
                    {
                        "name": "GetKeyboardLayoutList",
                        "address": "0x5604fc"
                    },
                    {
                        "name": "DefFrameProcA",
                        "address": "0x560500"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x560504"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x560508"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x56050c"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x560510"
                    },
                    {
                        "name": "IsCharLowerA",
                        "address": "0x560514"
                    },
                    {
                        "name": "SetDoubleClickTime",
                        "address": "0x560518"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x56051c"
                    },
                    {
                        "name": "GetShellWindow",
                        "address": "0x560520"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x560524"
                    },
                    {
                        "name": "GetUserObjectInformationW",
                        "address": "0x560528"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x56052c"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x560530"
                    },
                    {
                        "name": "GetKeyboardType",
                        "address": "0x560534"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x560538"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x56053c"
                    },
                    {
                        "name": "SetThreadDesktop",
                        "address": "0x560540"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x560544"
                    },
                    {
                        "name": "OpenInputDesktop",
                        "address": "0x560548"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x56054c"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x560550"
                    },
                    {
                        "name": "GetWindowDC",
                        "address": "0x560554"
                    },
                    {
                        "name": "GetUserObjectInformationA",
                        "address": "0x560558"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x56055c"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x560560"
                    },
                    {
                        "name": "GetIconInfo",
                        "address": "0x560564"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x560568"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x56056c"
                    },
                    {
                        "name": "FillRect",
                        "address": "0x560570"
                    },
                    {
                        "name": "DrawIconEx",
                        "address": "0x560574"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x560578"
                    },
                    {
                        "name": "CreateIcon",
                        "address": "0x56057c"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x560580"
                    },
                    {
                        "name": "CharLowerBuffA",
                        "address": "0x560584"
                    },
                    {
                        "name": "CharToOemA",
                        "address": "0x560588"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "STROBJ_bEnumPositionsOnly",
                        "address": "0x560590"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x560594"
                    },
                    {
                        "name": "STROBJ_vEnumStart",
                        "address": "0x560598"
                    },
                    {
                        "name": "GetRelAbs",
                        "address": "0x56059c"
                    },
                    {
                        "name": "GetGlyphIndicesW",
                        "address": "0x5605a0"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x5605a4"
                    },
                    {
                        "name": "GdiResetDCEMF",
                        "address": "0x5605a8"
                    },
                    {
                        "name": "EngCreateClip",
                        "address": "0x5605ac"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x5605b0"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x5605b4"
                    },
                    {
                        "name": "GetCharacterPlacementA",
                        "address": "0x5605b8"
                    },
                    {
                        "name": "PlgBlt",
                        "address": "0x5605bc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x5605c4"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x5605c8"
                    },
                    {
                        "name": "RegDeleteValueW",
                        "address": "0x5605cc"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x5605d0"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x5605d4"
                    },
                    {
                        "name": "RegQueryInfoKeyW",
                        "address": "0x5605d8"
                    },
                    {
                        "name": "RegEnumKeyExW",
                        "address": "0x5605dc"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x5605e0"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x5605e4"
                    },
                    {
                        "name": "LookupPrivilegeValueW",
                        "address": "0x5605e8"
                    },
                    {
                        "name": "AdjustTokenPrivileges",
                        "address": "0x5605ec"
                    },
                    {
                        "name": "RevertToSelf",
                        "address": "0x5605f0"
                    },
                    {
                        "name": "RegOpenCurrentUser",
                        "address": "0x5605f4"
                    },
                    {
                        "name": "SaferCloseLevel",
                        "address": "0x5605f8"
                    },
                    {
                        "name": "ImpersonateLoggedOnUser",
                        "address": "0x5605fc"
                    },
                    {
                        "name": "SaferCreateLevel",
                        "address": "0x560600"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x560604"
                    },
                    {
                        "name": "DuplicateToken",
                        "address": "0x560608"
                    },
                    {
                        "name": "DuplicateTokenEx",
                        "address": "0x56060c"
                    },
                    {
                        "name": "SaferComputeTokenFromLevel",
                        "address": "0x560610"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SHEmptyRecycleBinW",
                        "address": "0x560618"
                    },
                    {
                        "name": "SHGetSpecialFolderPathW",
                        "address": "0x56061c"
                    },
                    {
                        "name": "ShellExecuteExW",
                        "address": "0x560620"
                    },
                    {
                        "name": "CommandLineToArgvW",
                        "address": "0x560624"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoUninitialize",
                        "address": "0x56062c"
                    },
                    {
                        "name": "CoInitializeEx",
                        "address": "0x560630"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x560634"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x560638"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x56063c"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x560640"
                    },
                    {
                        "name": "StringFromIID",
                        "address": "0x560644"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00161f5b",
        "overlay": {
            "size": "0x00000ac8",
            "offset": "0x0015fa00"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00165f46",
        "icon_hash": null,
        "entrypoint": "0x00401dc0",
        "timestamp": "2019-02-22 07:49:40",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00142a00",
                "entropy": "6.29",
                "raw_address": "0x00000200",
                "virtual_size": "0x0014293b",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00144000",
                "size_of_data": "0x00000800",
                "entropy": "4.41",
                "raw_address": "0x00142c00",
                "virtual_size": "0x00000708",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00145000",
                "size_of_data": "0x0001c600",
                "entropy": "5.15",
                "raw_address": "0x00143400",
                "virtual_size": "0x000c257c",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0015ff40",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000008c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0015fa00",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000ac8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0016030c",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000340"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "dd3cbc2b4cff73f0bf02bbc24a598ae0",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 6,
        "versioninfo": []
    }
}