API tools faq
paste
paladin316

Exes_964a397b6cc4583fcf8719811a2c3f0d_jpg_2019-07-08_19_30.txt

paladin316
Jul 8th, 2019
2,235
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.92 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg"
  7. * File Size: 1112752
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "d8baad26a4b1cc0357f5a6da3da448186541b588315caf3e142293dca7775447"
  10. * MD5: "964a397b6cc4583fcf8719811a2c3f0d"
  11. * SHA1: "61a48644d7222a8c82c12f0912a2251fd96e4ab1"
  12. * SHA512: "9f1d7e8503a353b3b8a833a568c882f97b9f66b1da5d9849603b30a2cc7e99f24e9a2c58f8a20ab4d1027ba07df4b4583dcc2f4ca8128766c518ba77b6192dc0"
  13. * CRC32: "A9379483"
  14. * SSDEEP: "24576:pkxhI+WAlhFZIEETxUaQupob5wgtK5D0Xus2KowVunKI3IT:p3zAlJuUzupoCb50egpun93y"
  15.  
  16. * Process Execution:
  17. "Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com",
  23. "cmd.exe",
  24. "chcp.com",
  25. "cmd.exe",
  26. "chcp.com",
  27. "cmd.exe",
  28. "chcp.com",
  29. "cmd.exe",
  30. "chcp.com",
  31. "cmd.exe",
  32. "chcp.com",
  33. "cmd.exe",
  34. "chcp.com",
  35. "cmd.exe",
  36. "chcp.com",
  37. "cmd.exe",
  38. "chcp.com"
  39.  
  40.  
  41. * Executed Commands:
  42. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  43. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  44. "C:\\Windows\\system32\\cmd.exe",
  45. "chcp"
  46.  
  47.  
  48. * Signatures Detected:
  49.  
  50. "Description": "Creates RWX memory",
  51. "Details":
  52.  
  53.  
  54. "Description": "A process attempted to delay the analysis task.",
  55. "Details":
  56.  
  57. "Process": "Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg tried to sleep 1336 seconds, actually delayed analysis time by 0 seconds"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  63. "Details":
  64.  
  65. "IP": "128.31.0.39:9101"
  66.  
  67.  
  68. "IP": "127.0.0.1:42358"
  69.  
  70.  
  71. "IP": "91.194.84.89:9001"
  72.  
  73.  
  74. "IP": "50.30.192.79:9001"
  75.  
  76.  
  77. "IP": "76.73.17.194:9090"
  78.  
  79.  
  80. "IP": "192.42.115.102:9004"
  81.  
  82.  
  83. "IP": "171.25.193.9:80"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "Starts servers listening on 127.0.0.1:42358",
  89. "Details":
  90.  
  91.  
  92. "Description": "Reads data out of its own binary image",
  93. "Details":
  94.  
  95. "self_read": "process: Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg, pid: 1892, offset: 0x00000000, length: 0x0010fab0"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "The binary likely contains encrypted or compressed data.",
  101. "Details":
  102.  
  103. "section": "name: .rdata, entropy: 7.29, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00101000, virtual_size: 0x00100f2c"
  104.  
  105.  
  106.  
  107.  
  108. "Description": "Attempts to delete volume shadow copies",
  109. "Details":
  110.  
  111.  
  112. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  113. "Details":
  114.  
  115. "Spam": "Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg (1892) called API LdrLoadDll 114100 times"
  116.  
  117.  
  118.  
  119.  
  120. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  121. "Details":
  122.  
  123. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  124.  
  125.  
  126.  
  127.  
  128. "Description": "Installs Tor on the infected machine",
  129. "Details":
  130.  
  131.  
  132. "Description": "Installs itself for autorun at Windows startup",
  133. "Details":
  134.  
  135. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  136.  
  137.  
  138. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  139.  
  140.  
  141.  
  142.  
  143. "Description": "Exhibits possible ransomware file modification behavior",
  144. "Details":
  145.  
  146. "file_modifications": "Performs 1225 file moves indicative of a potential file encryption process"
  147.  
  148.  
  149. "drops_unknown_mimetypes": "Drops 275 unknown file mime types which may be indicative of encrypted files being written back to disk"
  150.  
  151.  
  152. "appends_new_extension": "Appends a new file extension to multiple modified files"
  153.  
  154.  
  155. "new_appended_file_extension": ".crypted000007"
  156.  
  157.  
  158.  
  159.  
  160. "Description": "Collects information about installed applications",
  161. "Details":
  162.  
  163. "Program": "Google Update Helper"
  164.  
  165.  
  166.  
  167.  
  168. "Program": "Microsoft Excel MUI 2013"
  169.  
  170.  
  171. "Program": "Microsoft Outlook MUI 2013"
  172.  
  173.  
  174.  
  175.  
  176. "Program": "Google Chrome"
  177.  
  178.  
  179. "Program": "Adobe Flash Player 29 NPAPI"
  180.  
  181.  
  182. "Program": "Adobe Flash Player 29 ActiveX"
  183.  
  184.  
  185. "Program": "Microsoft DCF MUI 2013"
  186.  
  187.  
  188. "Program": "Microsoft Access MUI 2013"
  189.  
  190.  
  191. "Program": "Microsoft Office Proofing Tools 2013 - English"
  192.  
  193.  
  194. "Program": "Adobe Acrobat Reader DC"
  195.  
  196.  
  197. "Program": "Microsoft Publisher MUI 2013"
  198.  
  199.  
  200. "Program": "Microsoft Office Shared MUI 2013"
  201.  
  202.  
  203. "Program": "Microsoft Office OSM MUI 2013"
  204.  
  205.  
  206. "Program": "Microsoft InfoPath MUI 2013"
  207.  
  208.  
  209. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  210.  
  211.  
  212. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  213.  
  214.  
  215. "Program": "Microsoft Word MUI 2013"
  216.  
  217.  
  218. "Program": "Microsoft OneDrive"
  219.  
  220.  
  221. "Program": "Microsoft Groove MUI 2013"
  222.  
  223.  
  224. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  225.  
  226.  
  227.  
  228.  
  229. "Program": "Microsoft Access Setup Metadata MUI 2013"
  230.  
  231.  
  232. "Program": "Microsoft Office OSM UX MUI 2013"
  233.  
  234.  
  235. "Program": "Java Auto Updater"
  236.  
  237.  
  238. "Program": "Microsoft PowerPoint MUI 2013"
  239.  
  240.  
  241. "Program": "Microsoft Office Professional Plus 2013"
  242.  
  243.  
  244. "Program": "Adobe Refresh Manager"
  245.  
  246.  
  247. "Program": "Microsoft Office Proofing 2013"
  248.  
  249.  
  250. "Program": "Microsoft Lync MUI 2013"
  251.  
  252.  
  253.  
  254.  
  255. "Program": "Microsoft OneNote MUI 2013"
  256.  
  257.  
  258.  
  259.  
  260. "Description": "Creates a hidden or system file",
  261. "Details":
  262.  
  263. "file": "C:\\ProgramData\\Windows\\"
  264.  
  265.  
  266. "file": "C:\\ProgramData\\System32\\"
  267.  
  268.  
  269. "file": "C:\\ProgramData\\System32\\xfs"
  270.  
  271.  
  272.  
  273.  
  274. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  275. "Details":
  276.  
  277. "FireEye": "Generic.mg.964a397b6cc4583f"
  278.  
  279.  
  280. "McAfee": "Artemis!964A397B6CC4"
  281.  
  282.  
  283. "Cylance": "Unsafe"
  284.  
  285.  
  286. "K7AntiVirus": "Trojan ( 0054985e1 )"
  287.  
  288.  
  289. "K7GW": "Trojan ( 0054985e1 )"
  290.  
  291.  
  292. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  293.  
  294.  
  295. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  296.  
  297.  
  298. "APEX": "Malicious"
  299.  
  300.  
  301. "Paloalto": "generic.ml"
  302.  
  303.  
  304. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  305.  
  306.  
  307. "Avast": "FileRepMalware"
  308.  
  309.  
  310. "Comodo": "TrojWare.Win32.Ransom.Shade.V@8a2fgu"
  311.  
  312.  
  313. "Invincea": "heuristic"
  314.  
  315.  
  316. "McAfee-GW-Edition": "Artemis"
  317.  
  318.  
  319. "Trapmine": "malicious.moderate.ml.score"
  320.  
  321.  
  322. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  323.  
  324.  
  325. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  326.  
  327.  
  328. "Endgame": "malicious (high confidence)"
  329.  
  330.  
  331. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  332.  
  333.  
  334. "Acronis": "suspicious"
  335.  
  336.  
  337. "VBA32": "Malware-Cryptor.Kirgudu"
  338.  
  339.  
  340. "Rising": "Trojan.Kryptik!8.8/N3#88% (RDM+:cmRtazr3CFfyOCRpenUMzlSB/5Mr)"
  341.  
  342.  
  343. "SentinelOne": "DFI - Suspicious PE"
  344.  
  345.  
  346. "eGambit": "PE.Heur.InvalidSig"
  347.  
  348.  
  349. "Fortinet": "W32/Shade.B!tr"
  350.  
  351.  
  352. "AVG": "FileRepMalware"
  353.  
  354.  
  355. "CrowdStrike": "win/malicious_confidence_90% (D)"
  356.  
  357.  
  358.  
  359.  
  360. "Description": "Creates a copy of itself",
  361. "Details":
  362.  
  363. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  364.  
  365.  
  366.  
  367.  
  368. "Description": "Harvests information related to installed mail clients",
  369. "Details":
  370.  
  371. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  372.  
  373.  
  374.  
  375.  
  376. "Description": "Generates some ICMP traffic",
  377. "Details":
  378.  
  379.  
  380. "Description": "Anomalous binary characteristics",
  381. "Details":
  382.  
  383. "anomaly": "Actual checksum does not match that reported in PE header"
  384.  
  385.  
  386.  
  387.  
  388. "Description": "Created network traffic indicative of malicious activity",
  389. "Details":
  390.  
  391. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 185"
  392.  
  393.  
  394. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 491"
  395.  
  396.  
  397. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 271"
  398.  
  399.  
  400. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 679"
  401.  
  402.  
  403.  
  404.  
  405.  
  406. * Started Service:
  407.  
  408. * Mutexes:
  409.  
  410. * Modified Files:
  411. "\\??\\PIPE\\wkssvc",
  412. "C:\\ProgramData\\Windows\\csrss.exe",
  413. "\\??\\PIPE\\srvsvc",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  423. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  424. "C:\\README1.txt",
  425. "C:\\README2.txt",
  426. "C:\\README3.txt",
  427. "C:\\README4.txt",
  428. "C:\\README5.txt",
  429. "C:\\README6.txt",
  430. "C:\\README7.txt",
  431. "C:\\README8.txt",
  432. "C:\\README9.txt",
  433. "C:\\README10.txt",
  434. "C:\\Users\\user\\Pictures\\Host.zip",
  435. "C:\\Users\\user\\Pictures\\+4mxQ451lC0OKiw7Qj9y1x9wjMcIisbtruws+fj4No8=.C30C4DA81AE308962B9A.crypted000007",
  436. "C:\\Users\\user\\Pictures\\Host.xls",
  437. "C:\\Users\\user\\Pictures\\yfv2RChtURYiNeA5nkUQT4gDUoGUPUQdl9xEB5tcP7Y=.C30C4DA81AE308962B9A.crypted000007",
  438. "C:\\Users\\user\\Pictures\\Host.pptx",
  439. "C:\\Users\\user\\Pictures\\PAZoomfP2HxDYdQIsg5gL+lVPKjYGwgzLORp2yVAqU4=.C30C4DA81AE308962B9A.crypted000007",
  440. "C:\\Users\\user\\Pictures\\Host.ppt",
  441. "C:\\Users\\user\\Pictures\\WHoyc+fOmJ5-Jj7ctEd3iiCoyRl0MyTS9MTPsljaqrI=.C30C4DA81AE308962B9A.crypted000007",
  442. "C:\\Users\\user\\Pictures\\Host.pdf",
  443. "C:\\Users\\user\\Pictures\\4wlpJWsDDqCWPKRuNSOnDgsfICknAR-h9IBkAFv4MSU=.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\Pictures\\Host.jpg",
  445. "C:\\Users\\user\\Pictures\\JRzDT0-C9i9O+cuN9yVsxvvf8Q9OFhMnHNxOQpSaNys=.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\Pictures\\Host.html",
  447. "C:\\Users\\user\\Pictures\\q47GDVJmJoDrOkJtwbamZwtiF5zQRl5WUCL4sPLU4Mo=.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\Pictures\\Host.gif",
  449. "C:\\Users\\user\\Pictures\\Ig+xZgbeJjB-eF+mV9u-4MZjDS7ulv25vjL9X2biQtA=.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\Pictures\\Host.doc",
  451. "C:\\Users\\user\\Pictures\\GB1mp-UONEOrZO5tnFJz-+LeVBBGYDQ8UAcwPcBF8s0=.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\Pictures\\.xls",
  453. "C:\\Users\\user\\Pictures\\DiTQ91snZFuO1p30mdquyQ==.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\Pictures\\.jpg",
  455. "C:\\Users\\user\\Pictures\\NakzIuKRVCq-LW1+R8z1eQ==.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\Pictures\\.html",
  457. "C:\\Users\\user\\Pictures\\ttqVmoUc0NaLJRJggddsYQ==.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\Pictures\\.doc",
  459. "C:\\Users\\user\\Pictures\\a+ZI+DNg7eSIjrlgnZ+mBQ==.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\Pictures\\.bmp",
  461. "C:\\Users\\user\\Pictures\\rEMbeXtuZzsUPz+uJ6Q84g==.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\yTyjOqolSiPmDHIwqM9XjLTvn8j0+OOR8b5aLTbSCjno3hxmUuEZdanHkXj0q9Z16gw0Mg+YmqtV7vezcyMhVQe7I65QOHEjdxVDWxzdRoJrELsCA9DGICIll9odrJVa.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6OW2RLLzr1sQo2LqV2Ide0x7G0UR3daOPHkxG1+STb8=.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\I7dplIKi058L3WxZDQwxKblr2IFAt8vwmCo81gpctcZ8Vb2pIQ7hTrDqE2ywnADf.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\CRapdcGPtYkUT6O9uyoWwV6o3L+hQYL+JjUZY2obv+Y=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\BSYrraBdEzYAo4zkpFrt8j4UyJwF1PjUbe9ypdDqQxo=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\KCtq2Mb2k4vMn1+IK3eCn6gcFPZaU6FLN0wG7wjFlys=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bVQ0Ho63Ur5BxXbwGLm7RhyqXxVvMgDfTB+gz+hCRoLuDTu9+ZL5SV2N6U5TY15S.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xUUMDEU7tQjG-dVnlfhViWwQEwYqqQlXRtPskYTKP9g=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\kyz0N6mEW+mrJKBNRT6Z4r9eivsSDVBGYdbOr4CTAoGi+58V51BZu3BxE7msbK7D.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\u0PT0qMdTFv0p7ac59flz83VcIlsMaAhagHvX2FRRjc=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TtGDxWVEyoulkS2W22CizNkjtn6ZGpC+4ZDmYiFXC0E=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ZLKlTpZQd2xZ7Tq4ZePXLKKZW3SIZm1zdEni2B6KTU8=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TuPOHvoQ42gsYppokXl++yYF2ojxzHZ0ahlBWyrpxU4=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\V5NGcxHjq4slpps6XFFCATv7nJvH-PaXVeE2hTWnOPjQT9CF007P0lgeUyV8hK68.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Y5JGA06IAib2SlxA2eOYEbBVnpYbsm57A34MJyK-yhc=.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\+nKL+ajNSokRsOBVaOce17wlb6M5aLi42chhWyIGqBFj0GCRUIMYuwTy3ijw1v7M.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Sua6RAWAUJTKSvU0qXElcTql7lpYUNOM1vb3ATii6e4=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  497. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\pmw9Irz1a9qC1yEj0gdHL4NKAIXRhTbzg4IpTkH-Zjo=.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  499. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\2c7JvNOpoG5LA4jsHGLYyZOt+IBM36eAffP7v4iF-hg=.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  501. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ryjgsd36B7SPJOQcEW2qsuKt59FTOyapF56w90WFQ1w=.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  503. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Z7ejK45NNZkOGArfpGtAjUcqs6FoxaG-Jx0uttmvPAg=.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  505. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\rdfQDHHQRbd5AZtgycIoWJbuBhwQEsnAWbTb3mOHUnQ=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  507. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\0MxKDjQUugQGdGxEXWtSN7YdSKGGmsGfZxtXJxHNyyM=.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  509. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\nVRcPSy08WB7Nk-QIOKBISHy6hW9H+ujFCtvaPo0JOA=.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  511. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\ZXcSitvdCEwQd-YYEOkov44lR4kR6MydeYeZpY1GgwY=.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  513. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\OrKmefn99TZBOxfeGkdnY0btLlHx+FxDgADWeuE66u8=.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  515. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\nRHPG-3VfdHtHZPtqYwpGpnwqxTXPCTdU-y9vqGkm+U=.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  517. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\JH9lwXy1sppxv9AMJPIoJ3nTQylPY1gLhmhDfiI6yfU=.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  519. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\cN5R8vcM-IOeWnyfkeQqhep7DItCjafyjSlWcdIT2DI=.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\vawOSm8wDb+NzFyptJY7+9bQkVG3toVTeUjeNeVDYIc=.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\n+Ldy6jwPhGMsLi0GD3ZFRMeQbJG12rRB1gs-z4qP3z101Xn5mkkKuvki6yfNcLlUioh06hsfTIT+hx3EVyrxQ==.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\rgV3CcjVMpncvA1RrNmHYE8e8oaPhghDo-Fe9DsTkPZfoXdI2MnKH6acBMYpGtmp3SpD6zrKb7Y0Yvbqc2Zb4w==.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\rKtB8EHKHU0cuSJj-uGisMSUhM+ZY5t-7CdkurTDhPTlDs4BdyxB5kQgQ5A8v23Eqty-wALUTq+uUtGFb0nB-E8MAMRl9jRKZiTzwWgQmVRYEfl22sclpBYObbZX23Hc3MM8sjSA60R5Xj14iAOrT-DK3NmzLhP6OEaiItkI8r2FPNtEfO2zJEhuj8DeL4Ku.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\-EtKv-4zug0ogSnDBbF+GaQ7ANrDX3foVFyw3cJQD6kTIsjpIeoB3ec6-Z19fxbLmf7ccRlJPaydn7sugMrOvQ==.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1RyS7ZNXivuJkDixVTVdBcpFxOJGkpAoEN3jLKkTZ4JNFHWv+46RYHvJy2QOWII+Gqnxh84ZyMuK++DJyzwlyw==.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TNb-VHK2jJuToQ3Kt1YKmTn+h2sj02Vh+EsrWYetYM6bTs1R2UnlgOI1RsKSbqpUu+3zzEzj6a+WGOxEGfK4-g==.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\IMeX9oh-uwzAF8pMS56ssfxpIoyHg6xQ3mZk8ArBPSSL2Sw1RJZ1KyeE8-J2Z9L8jyvw7hMjQySWZJi03PnZF23c1lDRKTwCYEDqt9hVn4HcOJZs6jd6KnQrSCoIGaA5KY7-0TCXtct6lpYaZWtFAQ==.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\sF5Pn1QBiC5NdUjIOh6ZwtpUTJ9RtqBZu+1CwdhPsO0FXcNm4sIA7NOhEYM6GjRrONoRMSTvYd1KUPX0P9uYmP0TPsadZh-WO434z+qmd8o=.C30C4DA81AE308962B9A.crypted000007",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\86VS2Owg0GADMTwC4oJa3tR1kc8qysOalI26VQCMQrqyPqxeN-a4YSzBSaVo3AAuU1hUHvhLghRjXMrstpp9fQ==.C30C4DA81AE308962B9A.crypted000007",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\0Ey2rFgnPbhynXjZbQqXnkWN2MxCacvFbyFWPFbN71K8g5+9srngzUK8HW5uVBrLnFgXzMSxdOU-2N+89X2vN5dTGldvVhBkHYAq7-Nkc7XWnF2CDZ-TxMIROq8C4Orm.C30C4DA81AE308962B9A.crypted000007",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\wsyaFEgbGwhB-dJH-mqt8JqGTD2YLLC1nyJqOcMohAY2d5NiyIjQCeA1fXLH-7qP+7ObC+UO2inD9S8nMfoPBaYaXb1zm1MUR2NtM63rPmsr0dp0fCTVVApoGmRhpF4qHCEvhPNfv6Rw4+qK7J1lkg==.C30C4DA81AE308962B9A.crypted000007",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\IP6PNBKIWgVsELPNF-yAbQ-6n0KY0bp5qEUy7fHjmxf5fq8u5MgEdJyy1e6at9hr1A4ZtqFnRpbAJxr+9Wm1yg==.C30C4DA81AE308962B9A.crypted000007",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\xnOTqwQhUqEhViFS4tbam8lV1WopeJEXB2AKSt8LNHBnbp-8s3+qz58975rW8loh1Eufp3ewUjGzKkXm6yNQdg==.C30C4DA81AE308962B9A.crypted000007",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\7C1nipAg+oFCKBuAdwcIIgYu6YUgHwgkD+jn3qU44whbfw1G+Rv0VHm2BhipcW6q.C30C4DA81AE308962B9A.crypted000007",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vWs6fiN3nc-1V3GGcPZ-cZTQLeKrSmwPdbLEGvI6FNsLXabJ1Q6VUKO12KwDzS+BOXiN0wF4akw1Z4Gb7CVv7Q==.C30C4DA81AE308962B9A.crypted000007",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\CiLD9f8ek1LCiOSyL1K0k2vczBgGTw9N9YxBZ-MOiRQlcS9gJ5O8tPeXIHopXOl2PzdaNl4SRBUSvdKoLFgramqvvVkV8+JrUDL5QrEQY2bp8tQ2UJx+b3PARuOv0+Yj.C30C4DA81AE308962B9A.crypted000007",
  554. "\\Device\\NamedPipe",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rEHf1EHVmJH1n0XLZosN+u4+SxrPzAAQmnTsUQFLPvGAwwOPEsypEQmWAUGKDt3cbcf+taHrfPq7KiDkXVW37w==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\gDcowcQ0amOz+GRCfLitNkVd0iD1R7vusF0ZNJPnZJY0IxztsSUcFKeeT1ej3lbv+n4iwc7ba0dm45Jfss68ng==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\G3PSWjaR2bD9b3TZecWlS7b3O+aQ9kbxwFtbbOiryk8EPHPaJ7HhtSKI-atMroPDrbPkJ+ABJ3eM+94+VuaaIA==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3SLlu8byd-J-uEN6Jol3MpyfW4ip4pl9hWLftl9RaPAouvgI7yfQBAa2LmTtUITyrtLVSUCkqNWSfgsQDEE-Tw==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\oJokIPdUVXtUdncpWrCoZSOxu+J+SAVcLwOfitRmgl3-7YftLphZWul5wz7ogze066m6xWxlMkpGu5TQ3fVdgA==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XYmL2StSynaBQJvgk4W9hKgJtDx8oPbVeMDA8ZLKqpeB3SHRdT+pWKZWnnKW6KXkIR9QdsmWJTSCDTVz2BX-jQ==.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\MI5WW3ZXIc9Ku9723YTb8Mjr5moVBM5Rb57b9Xhpnj5yn5TZEH5NnHNw6OIcVtzTOSJYQxcqDi9TWVFwF6Bg2qdPTsSxnEJ5ccExyY1+tkU=.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VtxW30hLa-rZESwhQ+o2OZzOcAwAV7U0p7MUpFwGs+sR8PJ694Erw9wRyf3rsW-RTsGnx3v1DsG4BbsZ+sB2PQ==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZHila3sBSD221CXo1fOd5p1VCjmM9XVPqIDzEhKaJg3SchuTtXQfM+8eRuVN8DuZ3ar1ilWccI5ic6Q79MWNZw==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\-KZH6cQcjcC1De44BKRb7Qh0eFi7CpJGiRqzO-DySdputkF--XJL-mXfg2J2TviWqBT6VOM5lOcT7KhSXxSUKQ==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  576. "C:\\ProgramData\\System32\\xfs",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Y0m613Tr9GV87igSp25S1nY6Y7tFlP04AGezP31CnAOPD39CMVrxeTyBD+UwTTlhALNj5DzpWLHvPG3isMHVxA==.C30C4DA81AE308962B9A.crypted000007",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mYo2AyjS6NTIM8sZZHCnJU6FrLnKxu4g21eHBjmp4nLE2r89j5D8fsDyqTJSm9MbQw8OmKiEa5alzcZJ4hmwfA==.C30C4DA81AE308962B9A.crypted000007",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eKzpZ-SY+QJkzFx6hDs-TtL8GeNyC1DOOWO0yCvJJmf9MksUUj2COAEz29VW875yLBmUM1-RFqZkCO8j2fYK2Q==.C30C4DA81AE308962B9A.crypted000007",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Q2NJYru-ImiDSEue+Uz-HW3Tx3qBhNblFgUxGeNDNgvppv59v5--Ig73Dl+iHlXlfGJJ5KBoULOlI-U1BeAtRw==.C30C4DA81AE308962B9A.crypted000007",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EJIXuCVIOSBjVubXbd+cchvv3YagRbXG2eMwIG7F9C8XQarMUQ9f8WqMKoPsQ-15EClUu6oKdzEYza-EWz32sA==.C30C4DA81AE308962B9A.crypted000007",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\-+Q2Wty8gtqre2F4y5OEVOzLKwDOHcuE9w3fkIDqKBHjc-qqdMp1oCefPr0su4Jwk2+WBrF-X14FQlRZBfuC-g==.C30C4DA81AE308962B9A.crypted000007",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\zhOm-8anL056Ii1YPPKoV7UtizzOKoBwgwsqkHZIZ2XrlioZq88QK2y6M5uAfz34aDBiOdBKr1xdbs6kC9rgBQ==.C30C4DA81AE308962B9A.crypted000007",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GX8Pjm4Y-xCrIjBNfdTcEE31rPh37ck3gr8GTSZBlCs9o4SB5Ph7+Jl4R-s2zziwVf5d8CwNcdyuCcYo+b8eVMGiXvuRkv7NXo+RxTEjylI=.C30C4DA81AE308962B9A.crypted000007",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VdZtHsLyook-CLv0RtgNHf+e1Q2FV+nZFuqkINliCwA9af8rWhduQGSNQkKIllQHhYYPHNZqpyV9IhZKwKMkFw==.C30C4DA81AE308962B9A.crypted000007",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\RVqwpWYutlpSXqPrKLtKdCWIdabTke3khTNegzP-2tAABz6SsIGrzFHXKZA9mi+ie14kCyNEerafGvUi2GzWMg==.C30C4DA81AE308962B9A.crypted000007",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HjE6qCenynYY9MEExsCBi1pSsFVtphxZVImtZsrlgL4mLlEDaf+JHgRGBtk8cOhN-ywXngjDiwN+3yiwxfg6Aw==.C30C4DA81AE308962B9A.crypted000007",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Zm7nV0UUl9kz6X3nsmmP7Oscc6rzhTlEA9jVJUQutJ+nmW7pDIlVOcKxv2vGIRPEHsJjCnJSTC5SEyw-ByccSg==.C30C4DA81AE308962B9A.crypted000007",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9PGwWRrVpRRVEzFT8ezAfSh6Cmt-ywcqMs0gkZfpHBeL1R9FPw+lYnfuyUvYtXkcIgdTIic1F1m8V4UjOWr06g==.C30C4DA81AE308962B9A.crypted000007",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\vwSnODz2tGl8PJDZ+6pYTlzs5pom6QLySIOHb8HtBXDaOiLLp0lGxWEsTbw-uv1lCDyjx43NPWWooMvS5VF6nA==.C30C4DA81AE308962B9A.crypted000007",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\r1btRQPDdBNNzxgidPpacf32UKhSUKq4gDJHkfoDsG843cugJYnxlwB2TmxMnmEH.C30C4DA81AE308962B9A.crypted000007",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\HlDCtGzuH9LniOYZcy2wBXRbyIMgbH6ihrDxWJOG5jM=.C30C4DA81AE308962B9A.crypted000007",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\jnP54lUVVHX3GCzdRjY3F5X-QelHceH1jYrdofu3-LI=.C30C4DA81AE308962B9A.crypted000007",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\JoQa-ZxIjWMU1B97ghAQ8AH1Mmlsz7aQtcjhQZYcAQU=.C30C4DA81AE308962B9A.crypted000007",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\iEiSRxMhZEQgA7IZzieg0iOlmMfRGYxIKl7W9qDk1LA=.C30C4DA81AE308962B9A.crypted000007",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GC5VMMKnf0QyYO+MSsQieaJhKrd5sv52w5The85hu30=.C30C4DA81AE308962B9A.crypted000007",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Ps6JqXPCf942fqi3oJsApWETepflfxYS7X-sJfIfMgV9J+EbRnjjapa+JB0313ZbVPbjhmNM7BOsoZvwOH+0Qg==.C30C4DA81AE308962B9A.crypted000007",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\G6GW+ksRgLjdRBrOWHzgpk4+2iYSYbk6T8Epf3Ag1nxHu9AETefHo+x2YYU-JCvmR18xUV5Htldd8gylZZ7ZDw==.C30C4DA81AE308962B9A.crypted000007",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\z5wCM6mpZ+EHX+BrzIWP24rQBRPH0XqpZMDn10VmI6o=.C30C4DA81AE308962B9A.crypted000007",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\4JHbmtjEwQiu9Uafw+MXO5vibUDmRcm4VjHWnWqYFoE=.C30C4DA81AE308962B9A.crypted000007",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\0VICvmE48Z6GvAdcMg-MVmf75gohbZQ+7+0FvBIkRcBj-+DJDG+I4A3fmWIcAKv-6rl0G7R0Ebd24ifZF99OCSfPyEsHUM+sH6caK6VVxnc=.C30C4DA81AE308962B9A.crypted000007",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ae6hUAizVRbcFGc8Vu8MEJIhYxYlIpgKTVbG-VQm2yN590sIC7-xZu-1mBDL44CV.C30C4DA81AE308962B9A.crypted000007",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  629. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6xUgMXJEtrVicvgGoKwIDpkM3YQoG6WOYTCkcraB+r0=.C30C4DA81AE308962B9A.crypted000007",
  630. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\tuonSZnARPWRrxNdg52xhKN4lCc1N6QBcZbeX2-dbELkL6CO0fjaUNhGMMmdxwtO.C30C4DA81AE308962B9A.crypted000007",
  632. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\H6KDbkdVmFqD6M6IojtSQiJqmgNCf2UiNLKoftcVr0RZq-c8WIQ6owFE3-h8BMux20q4DSnTYQ8GvuP8qCXtvfLd0owtDQAHGWkJqHE68aA=.C30C4DA81AE308962B9A.crypted000007",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  635. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\OiJfCByw1KPzVUOyPRhri3at-sc9OwEbyn91a5r6twU=.C30C4DA81AE308962B9A.crypted000007",
  636. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\pI2xBAaYWJSpkmOGh29bds6c7uImDM2E72aTHdhhjNM=.C30C4DA81AE308962B9A.crypted000007",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\zUM2YBeLmVQy832yoga7hA==.C30C4DA81AE308962B9A.crypted000007",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  641. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\5L8DB6PpNkOIcrjg+AXhWHoYsaAwysWvgc++DYx303o=.C30C4DA81AE308962B9A.crypted000007",
  642. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\BFWz1tP14taMROjFDq2zHZVMEKSHRZzAu2UM6q0A8tfhV3gmu+yZfrJX87gLdh5Sz9T9m30uy3V5DEFCL5XYTQ==.C30C4DA81AE308962B9A.crypted000007",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\ID3nZ8nl-0M58nm+g0x9cn6HYt66vrwoItboIvjfgky7Vs+eGtEnZ14WFXpaACnHHjyCX2sqdJqndWnyECKM1D0Nejy--WHZyIz2zr05WFFS4P7NBOa+9Lqm9lsJltVx0fSRz94qzR2WP2qzEAyBjg==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\M2UIpdOfeEQaOyut9-PYOWxEdXziQ8kkU3it7KU2grHDDJmAoBfWHstW-pBV3nnzvPiKsE2DojAieGEn8DWVQQ==.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\qV-xSGW10E6Y+dvEDHC8sD6PbYEik3ZWUhW1v3zxeAzODLGiHWcb56Ykd2cWPAUWSEqEJYWOY8jSXA1EeUgRmikwGsq4u++XfctVMx5pFtA=.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\XePWMy+snn1kvRDF9rPU586-rGBf14WH12F+iUUs7D8=.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\DOKPswMyIs7kzxu-xEJRUkQICcOdyPqmjrcGd1AMGDg=.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\zfvBSLSjCi-xT2XjWpiKjfxSkfYAU1XWk1mM5YiyBo0=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\1dQFwWkjb6qHjnckcRogZC2uH6MsgpSHiKN8HGxInSLsT5LnE8aLIsuqV9-yTUB0i25DMRtzJuOCAMEAJzhEriClU6UZ+FXX9CoMNNaUd9Y=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\5E18wmfDqGvoE18fOiMXQ9du6tEegMHacaWXRwiadLs=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\RCaDrBheZemxMU99JewWwk62El8VudrpyV7RYJCirus=.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\vmx46d+N3imhi0peLfZ488TmA8Uq+YTqPKsOxX+Lyk-iIuC0AM8SnKbd+bQrvlwT.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\FhPLyjFd7-Emde7C3dCL7A==.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\M4vQQvyM7k1O11+4wx1vCtsPpmgJmZ9aaxwxbDnIAwdgoYIWWb+VqcCNP5vCzbq6.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\xEjmjsnlYvzq+a2PFqYAzGwPwN8ofWUegKKMzbGr6iw=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\oUGztdgBMgooTn5L4i2DSoAoqXr-iAqw3c8W+OSoAwQ=.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\1JqY8UGw70r5LLMKL0XcNtPyM-gAy6zcVou1YzWqOKs=.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\h8SwUIvwWeI6u8ctVgj0fLoKMkeDNFY37b3ZrLpCMbNCfB84xFdO4ogNOPom9Rg5f+8o9y-9DQvlQDf8h6Qp4Q==.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\pvjkUgFrmQqzmWmrPZ0U4ewq-XMJXdQ8cYBg-+JKmW0M-TfFx1gss20qAfyEI9W+gSehgfbdGF59RFW0LOXV1Q==.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\8MVdxaSvpnO3yPyS5ly0rUZ9HNUzlavIRQWZXcIp1o-0ta5Vlvnvj-KZeiGb5ow9oiUmn6XWRhMTMQnDzB9hxg==.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\g3iUkPKBVDysU4NAbcZsVgrtzadMrQrOm7gUXdjrWJ2q8rMR4LGuuYgHH1gYg0X0VgHHoceOk9g761LS1ftqCg==.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\ieQNaTEloA1mkjRf3l8H0pGYnP1US+o3TpRYx4th40JklsxFtl0+uQT1apCQY8c1fRqkUSumiBbt38zfAwWjSg==.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\pb02+lA59yuHlcKxsy+aoDA3YU3st2gEU2kph5Djg1bQngQhHDcZyXOmw-H0WBJSfERPX8yANjUc88eM8-GwUg==.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\n3DAzrk1Jf325zEdhncSq3Fr5dh4GR2nrLqaN83fOMBm7hOmggiY3i-nX3NzdWISYiKk01n0I4-5GQoXUGGilg==.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\5sCVnwr04i1dP8yOC-zJkg==.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\KZugSxfzto3LL-tMQrtJJk4cZNLY23hXhFqBeHlHFJ3rZ4MhOY7vZX5iYxLzt4sW3OHMY+0+2ms7yO2yKNfSdMEHUeuk1KS6EppeUr6GQodIYXrjMFN1+nILFhwjykpXPYiVnOanBQwgCR30x7sWMYGqgsv7d55POQqmA7tuvcc=.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\cKp2PGFdW4bd8dWiv0L-dFcosCKqxLNh8cH2xCbYP+p9CfB1cU0Ggli0RPSholoH-Us--0Zt0iel7YjaQ+sMi8e1YO0szt6nQqt8WdOx7L0S6iNbpmpREJ8ngCvsuBPCGxxJXf89opAyWMsziilOavra0ExYJ6dpUi-UsnGLhQ0=.C30C4DA81AE308962B9A.crypted000007",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\JgUCIz5BXu515iimQgx9zzGQSAT3yO1t32ZNyOfEnKHX1GT9-XCw3heevtTSwHG30UBF9WXgqS2m+q+v1coRy1PhPqoTjKA8N4Koa8QJPHNCLcnpKyVzPek-FlQti3Xf17HBsoHBqo4Y-NiujHNa8XWTyebkIpDXgdV0iqWPGwU=.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\77WOpXWXglbJtthAmSp3yB6OXgkoRUr6SCecN3lV0aHFvXgzTQ9pUkqQuvpVopR6NaoIae9Ui9bEZwVCFht-pGGC+yX05tWGGpxafujbniXe0FjZTKYXRXZ-O-3qz7yeiab7JF3bUBIWpDlG1sCVui-G6qxp9poFRgNxO6QtnBU=.C30C4DA81AE308962B9A.crypted000007",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\0bqhMuLNGH76bPlOCylxcc5SoKTBmUcNCsX4QbvLXPN2J1dQMCeYrtsGXCDGVbNv2o1HiP17WoMdq+qCYbYkMmy5cTewAVbI9wPmChUZD0XNjZIMyKFkAsF+DHiafeu+HgPxbDkJO4h-LiFqjnHVJlqk8AlDk8QIqKU3+DdOseE=.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\Trt8eQvlRekW5u9VgL8TQjPS6ieKF9y2T9CRYY3BcQh4dOWqAwW7umL3fzzoyOSGuFRi2S65HSz4FDM-IReWSg==.C30C4DA81AE308962B9A.crypted000007",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\sU1BDOlbdBIpG6I8pE9sQ3trJRRtTAUl1SOTuSnKvpHZ2fdyxRlHwi2vuT1d1HI0qkws8hP42G08i-+9v38T0DEbiQppToWKIpeR-qr+tvhLCK9Hmo+MsoXyYbIqh--4joxJOjs5bzqzvhIAvArUSULQkK5q61ANU8o5uY-UEnE=.C30C4DA81AE308962B9A.crypted000007",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\wI+en+4jaapaW8LckFkOKlCCdjJPkPxYVBNMN8GjAxrRytqfDIErBopgyr9upL7iweb7kvb9L6H0PJ7wCOirhhY3Tv-0a924cawJsicRIh79v4XYbf9z6PrpBcFfPq+XMgzAe6hW2rjFHLLhiKcRZAoDFCz+LjP3S5pPtzpYDmE=.C30C4DA81AE308962B9A.crypted000007",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\YTZDREMl-GQFRaLRJJsf71tRTA3ESXktUxo+aM0X5wdGdVgXY5ApzhmWPGfeTm0jP9QfpsrWjMbFwQ9JEjo1RbvzT4LgnZSw8xnliuioCXCQ7Zhp-FElNKRiPXVm66WJgV0mIV5HaeZCj+ovzRVyuJJOBqIB2nZo7Ku3xJf9pZM=.C30C4DA81AE308962B9A.crypted000007",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\Tho2py7EEWiFu6Z7p6B6ma3rb9H8fo8+EZOxFmA475Xpcn2ag+KfHnA2NMKxPbR0e3WCws8g73KrI782Z95qhijXBgIpXbiBF44m7seTrym0mmjyablmrYlMvBcm9VPZNYa5EwoN5c71lkrsWhPZBG8oNXVb0IvyeTc2HQgqrkA=.C30C4DA81AE308962B9A.crypted000007",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\7R5I4h1BGpyuiOvxMSqoLQDXROCKpOTpDmZnZMQF-6TfK0z3EeSJzvL3mahmL58uKPGOq+HO6gDBIRUomK7rkPHrBn7na4xjox2ecLkhq-g=.C30C4DA81AE308962B9A.crypted000007",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\sHbkZm8BM9oJGbWgiKBNKZ9kBWIuHYqdnFwYon560ef2ls7UXLjPaY44RVja2zOA.C30C4DA81AE308962B9A.crypted000007",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\2sUs6i3mSIPizaOqkhYar5wkQxq-H9nH+QIyego00Cs=.C30C4DA81AE308962B9A.crypted000007",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\U-+YgOEC+ilNHOOmVE9koAVZTLLQUhtoCS5v84NyBtt6AG+vqFHL35Lrkh++Rk+nFZDSGf2BSQ88WmVVkNSR-Q==.C30C4DA81AE308962B9A.crypted000007",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\+V1JiDaDc5lIkNmHciM4ZP9blZ8x6oajLpd+rjeavXI=.C30C4DA81AE308962B9A.crypted000007",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\pWIr8G3-NCRMde2gXJPDnpNnJTek8ZMsEyXmuuOi7is=.C30C4DA81AE308962B9A.crypted000007",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\qpDNLzSj-goMk0alrCmykSR8BMNc9jadDWER9sn7M-0CQxgWdlZHlZgAoBbuoMDd.C30C4DA81AE308962B9A.crypted000007",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\QyawbSTvpO-P+38CWNWVl95jLYy5cYUrnuem3dLqAHte-yoGOwjYPrm4rh65tsOfzanmJpkR6gCwoMzrO8dlhw==.C30C4DA81AE308962B9A.crypted000007",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_964a397b6cc4583fcf8719811a2c3f0d.jpg",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\MdQrudiprkV1OtdP2NLk1OZJPbpwlOyRqybolDT4qLbsvUYgOs4MZGgcSKGyQZe0p9DSv8+DwaIBnsKFfBrhX8E3bKrq-d2qU787oI7hjrdeW3cbRXLaYTITFCQQbvmIt8uFMXgu7viiB2BDh91ihwY9l5ru8AC3IfIXSZ0hWNM=.C30C4DA81AE308962B9A.crypted000007",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\4HFn1fQFIHFpJYS03l1YmsGZuXVoXn6-gYrX4FVbwlNRhUBTFqHxnFly0cxCkCWp.C30C4DA81AE308962B9A.crypted000007",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\kPgQeOBtqDUdqaBwopXgRRuIqO5WW-rP74fcdIqheeQ85cg9k8ip0dTIns6mOOa9QfvdYvX23+8BmdstDd4vmQ==.C30C4DA81AE308962B9A.crypted000007",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\zSqRdhVrHNM3x9+huU5HZ2+oq4-EX-KJxVcxiWbW0hA=.C30C4DA81AE308962B9A.crypted000007",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\6-qg2Qb+1qIRyu2ymPeOktP3L5xn1xn0OdGhjXtVmLo=.C30C4DA81AE308962B9A.crypted000007",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\SPTj1pEAbCmu-FNG+knNGVAOylU85PVg5tF+ao5l+g317oybffEbvCpasYQvu0h-wW24Bea3D8fHc-Hri9QqpQ==.C30C4DA81AE308962B9A.crypted000007",
  728.  
  729.  
  730. * Deleted Files:
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  737. "C:\\Users\\user\\Pictures\\Host.zip",
  738. "C:\\Users\\user\\Pictures\\Host.xls",
  739. "C:\\Users\\user\\Pictures\\Host.pptx",
  740. "C:\\Users\\user\\Pictures\\Host.ppt",
  741. "C:\\Users\\user\\Pictures\\Host.pdf",
  742. "C:\\Users\\user\\Pictures\\Host.jpg",
  743. "C:\\Users\\user\\Pictures\\Host.html",
  744. "C:\\Users\\user\\Pictures\\Host.gif",
  745. "C:\\Users\\user\\Pictures\\Host.doc",
  746. "C:\\Users\\user\\Pictures\\.xls",
  747. "C:\\Users\\user\\Pictures\\.jpg",
  748. "C:\\Users\\user\\Pictures\\.html",
  749. "C:\\Users\\user\\Pictures\\.doc",
  750. "C:\\Users\\user\\Pictures\\.bmp",
  751. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  752. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  753. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  754. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  755. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  756. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  757. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  758. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  759. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  760. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  761. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  762. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  763. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  764. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  765. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  766. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  767. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  768. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  769. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  770. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  771. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  772. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  773. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  774. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  775. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  776. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  777. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  778. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  779. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  833. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  834. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  835. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  836. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  877.  
  878.  
  879. * Modified Registry Keys:
  880. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  881. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  883. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  884. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  885. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  886. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  887. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  888. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  889. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  890. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  891. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
  892.  
  893.  
  894. * Deleted Registry Keys:
  895.  
  896. * DNS Communications:
  897.  
  898. * Domains:
  899.  
  900. * Network Communication - ICMP:
  901.  
  902. "src": "38.140.184.1",
  903. "dst": "169.254.255.254
  904. "type": 11,
  905. "data": ""
  906.  
  907.  
  908. "src": "38.140.184.1",
  909. "dst": "169.254.255.254
  910. "type": 11,
  911. "data": ""
  912.  
  913.  
  914. "src": "38.140.184.1",
  915. "dst": "169.254.255.254
  916. "type": 11,
  917. "data": ""
  918.  
  919.  
  920.  
  921. * Network Communication - HTTP:
  922.  
  923. * Network Communication - SMTP:
  924.  
  925. * Network Communication - Hosts:
  926.  
  927. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!