API tools faq
paste
paladin316

Exes_32126de1466136e0b4f39560f3956fb9_jpg_2019-07-09_05_30.txt

paladin316
Jul 9th, 2019
2,075
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 68.33 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_32126de1466136e0b4f39560f3956fb9.jpg"
  7. * File Size: 1116336
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218"
  10. * MD5: "32126de1466136e0b4f39560f3956fb9"
  11. * SHA1: "1f2b679904a40552d24d430529e70c916504aef4"
  12. * SHA512: "50b49d35e8953584e1dc3a9263093ef1be4f75ac6daec1eb18d649ff9228d819166aa0949f9f0f336354ce10ad7f5a71295b1704b86f311c0e3afebbbc9905ec"
  13. * CRC32: "EA4042E5"
  14. * SSDEEP: "24576:o67iOScr1wsPJ0L9V/QvZzvG7L6U0Bshunf:o67iO3isPJ0LSvQ5hunf"
  15.  
  16. * Process Execution:
  17. "Exes_32126de1466136e0b4f39560f3956fb9.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "A process attempted to delay the analysis task.",
  39. "Details":
  40.  
  41. "Process": "Exes_32126de1466136e0b4f39560f3956fb9.jpg tried to sleep 806 seconds, actually delayed analysis time by 0 seconds"
  42.  
  43.  
  44.  
  45.  
  46. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  47. "Details":
  48.  
  49. "IP": "193.23.244.244:443"
  50.  
  51.  
  52. "IP": "104.16.155.36:80"
  53.  
  54.  
  55. "IP": "195.154.241.125:443"
  56.  
  57.  
  58. "IP": "78.46.151.57:9001"
  59.  
  60.  
  61. "IP": "128.31.0.39:9101"
  62.  
  63.  
  64. "IP": "127.0.0.1:59093"
  65.  
  66.  
  67. "IP": "104.16.154.36:80"
  68.  
  69.  
  70. "IP": "107.189.60.226:6193"
  71.  
  72.  
  73. "IP": "104.18.35.131:80"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Starts servers listening on 127.0.0.1:0, 127.0.0.1:59093",
  79. "Details":
  80.  
  81.  
  82. "Description": "Reads data out of its own binary image",
  83. "Details":
  84.  
  85. "self_read": "process: Exes_32126de1466136e0b4f39560f3956fb9.jpg, pid: 1960, offset: 0x00000000, length: 0x001108b0"
  86.  
  87.  
  88.  
  89.  
  90. "Description": "Performs some HTTP requests",
  91. "Details":
  92.  
  93. "url": "http://whatismyipaddress.com/"
  94.  
  95.  
  96. "url": "http://whatsmyip.net/"
  97.  
  98.  
  99.  
  100.  
  101. "Description": "The binary likely contains encrypted or compressed data.",
  102. "Details":
  103.  
  104. "section": "name: .rdata, entropy: 7.41, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000fb200, virtual_size: 0x000fb0b4"
  105.  
  106.  
  107.  
  108.  
  109. "Description": "Looks up the external IP address",
  110. "Details":
  111.  
  112. "domain": "whatismyipaddress.com"
  113.  
  114.  
  115.  
  116.  
  117. "Description": "Attempts to delete volume shadow copies",
  118. "Details":
  119.  
  120.  
  121. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  122. "Details":
  123.  
  124. "Spam": "Exes_32126de1466136e0b4f39560f3956fb9.jpg (1960) called API LdrLoadDll 112770 times"
  125.  
  126.  
  127.  
  128.  
  129. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  130. "Details":
  131.  
  132. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  133.  
  134.  
  135.  
  136.  
  137. "Description": "Installs Tor on the infected machine",
  138. "Details":
  139.  
  140.  
  141. "Description": "Installs itself for autorun at Windows startup",
  142. "Details":
  143.  
  144. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  145.  
  146.  
  147. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  148.  
  149.  
  150.  
  151.  
  152. "Description": "Exhibits possible ransomware file modification behavior",
  153. "Details":
  154.  
  155. "file_modifications": "Performs 1822 file moves indicative of a potential file encryption process"
  156.  
  157.  
  158. "drops_unknown_mimetypes": "Drops 1142 unknown file mime types which may be indicative of encrypted files being written back to disk"
  159.  
  160.  
  161. "appends_new_extension": "Appends a new file extension to multiple modified files"
  162.  
  163.  
  164. "new_appended_file_extension": ".crypted000007"
  165.  
  166.  
  167.  
  168.  
  169. "Description": "Collects information about installed applications",
  170. "Details":
  171.  
  172. "Program": "Google Update Helper"
  173.  
  174.  
  175.  
  176.  
  177. "Program": "Microsoft Excel MUI 2013"
  178.  
  179.  
  180. "Program": "Microsoft Outlook MUI 2013"
  181.  
  182.  
  183.  
  184.  
  185. "Program": "Google Chrome"
  186.  
  187.  
  188. "Program": "Adobe Flash Player 29 NPAPI"
  189.  
  190.  
  191. "Program": "Adobe Flash Player 29 ActiveX"
  192.  
  193.  
  194. "Program": "Microsoft DCF MUI 2013"
  195.  
  196.  
  197. "Program": "Microsoft Access MUI 2013"
  198.  
  199.  
  200. "Program": "Microsoft Office Proofing Tools 2013 - English"
  201.  
  202.  
  203. "Program": "Adobe Acrobat Reader DC"
  204.  
  205.  
  206. "Program": "Microsoft Publisher MUI 2013"
  207.  
  208.  
  209. "Program": "Microsoft Office Shared MUI 2013"
  210.  
  211.  
  212. "Program": "Microsoft Office OSM MUI 2013"
  213.  
  214.  
  215. "Program": "Microsoft InfoPath MUI 2013"
  216.  
  217.  
  218. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  219.  
  220.  
  221. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  222.  
  223.  
  224. "Program": "Microsoft Word MUI 2013"
  225.  
  226.  
  227. "Program": "Microsoft OneDrive"
  228.  
  229.  
  230. "Program": "Microsoft Groove MUI 2013"
  231.  
  232.  
  233. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  234.  
  235.  
  236.  
  237.  
  238. "Program": "Microsoft Access Setup Metadata MUI 2013"
  239.  
  240.  
  241. "Program": "Microsoft Office OSM UX MUI 2013"
  242.  
  243.  
  244. "Program": "Java Auto Updater"
  245.  
  246.  
  247. "Program": "Microsoft PowerPoint MUI 2013"
  248.  
  249.  
  250. "Program": "Microsoft Office Professional Plus 2013"
  251.  
  252.  
  253. "Program": "Adobe Refresh Manager"
  254.  
  255.  
  256. "Program": "Microsoft Office Proofing 2013"
  257.  
  258.  
  259. "Program": "Microsoft Lync MUI 2013"
  260.  
  261.  
  262.  
  263.  
  264. "Program": "Microsoft OneNote MUI 2013"
  265.  
  266.  
  267.  
  268.  
  269. "Description": "Creates a hidden or system file",
  270. "Details":
  271.  
  272. "file": "C:\\ProgramData\\Windows\\"
  273.  
  274.  
  275.  
  276.  
  277. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  278. "Details":
  279.  
  280. "McAfee": "Artemis!32126DE14661"
  281.  
  282.  
  283. "Cylance": "Unsafe"
  284.  
  285.  
  286. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  287.  
  288.  
  289. "Symantec": "Packed.Generic.459"
  290.  
  291.  
  292. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  293.  
  294.  
  295. "APEX": "Malicious"
  296.  
  297.  
  298. "Avast": "FileRepMalware"
  299.  
  300.  
  301. "Alibaba": "Trojan:Win32/Kryptik.e14b38d2"
  302.  
  303.  
  304. "Paloalto": "generic.ml"
  305.  
  306.  
  307. "AegisLab": "Trojan.Win32.Malicious.4!c"
  308.  
  309.  
  310. "Comodo": "TrojWare.Win32.Ransom.Shade.V@8a2fgu"
  311.  
  312.  
  313. "Qihoo-360": "HEUR/QVM10.1.665D.Malware.Gen"
  314.  
  315.  
  316. "Invincea": "heuristic"
  317.  
  318.  
  319. "McAfee-GW-Edition": "Artemis!Trojan"
  320.  
  321.  
  322. "Trapmine": "malicious.moderate.ml.score"
  323.  
  324.  
  325. "FireEye": "Generic.mg.32126de1466136e0"
  326.  
  327.  
  328. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  329.  
  330.  
  331. "Endgame": "malicious (high confidence)"
  332.  
  333.  
  334. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  335.  
  336.  
  337. "Acronis": "suspicious"
  338.  
  339.  
  340. "VBA32": "Malware-Cryptor.Kirgudu"
  341.  
  342.  
  343. "Rising": "Trojan.Kryptik!8.8 (CLOUD)"
  344.  
  345.  
  346. "eGambit": "PE.Heur.InvalidSig"
  347.  
  348.  
  349. "Fortinet": "W32/Shade.B!tr"
  350.  
  351.  
  352. "AVG": "FileRepMalware"
  353.  
  354.  
  355. "Cybereason": "malicious.904a40"
  356.  
  357.  
  358. "CrowdStrike": "win/malicious_confidence_60% (W)"
  359.  
  360.  
  361.  
  362.  
  363. "Description": "Creates a copy of itself",
  364. "Details":
  365.  
  366. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  367.  
  368.  
  369.  
  370.  
  371. "Description": "Harvests information related to installed mail clients",
  372. "Details":
  373.  
  374. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  375.  
  376.  
  377.  
  378.  
  379. "Description": "Anomalous binary characteristics",
  380. "Details":
  381.  
  382. "anomaly": "Actual checksum does not match that reported in PE header"
  383.  
  384.  
  385.  
  386.  
  387. "Description": "Created network traffic indicative of malicious activity",
  388. "Details":
  389.  
  390. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 279"
  391.  
  392.  
  393. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 585"
  394.  
  395.  
  396. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 288"
  397.  
  398.  
  399. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 102"
  400.  
  401.  
  402.  
  403.  
  404.  
  405. * Started Service:
  406.  
  407. * Mutexes:
  408.  
  409. * Modified Files:
  410. "\\??\\PIPE\\wkssvc",
  411. "C:\\ProgramData\\Windows\\csrss.exe",
  412. "\\??\\PIPE\\srvsvc",
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  423. "\\Device\\NamedPipe",
  424. "C:\\README1.txt",
  425. "C:\\README2.txt",
  426. "C:\\README3.txt",
  427. "C:\\README4.txt",
  428. "C:\\README5.txt",
  429. "C:\\README6.txt",
  430. "C:\\README7.txt",
  431. "C:\\README8.txt",
  432. "C:\\README9.txt",
  433. "C:\\README10.txt",
  434. "C:\\Users\\user\\Pictures\\Host.zip",
  435. "C:\\Users\\user\\Pictures\\aHNpH0qVi93BcflpqtirZ-Iub+lVvYug86HyotAM+Xo=.C30C4DA81AE308962B9A.crypted000007",
  436. "C:\\Users\\user\\Pictures\\Host.xls",
  437. "C:\\Users\\user\\Pictures\\DjOVBot7Ub-wDLhAeVZphpXIHXF3f7JcQoyHiZoE9UQ=.C30C4DA81AE308962B9A.crypted000007",
  438. "C:\\Users\\user\\Pictures\\Host.pptx",
  439. "C:\\Users\\user\\Pictures\\O7OASVkncFUwss-lJBNmfb67Ef3pTyRiR4fs+mjZZLo=.C30C4DA81AE308962B9A.crypted000007",
  440. "C:\\Users\\user\\Pictures\\Host.ppt",
  441. "C:\\Users\\user\\Pictures\\WKdccM-tenOP-VnxcQRhCq00WkvqN9XcAjwRIVQrEfQ=.C30C4DA81AE308962B9A.crypted000007",
  442. "C:\\Users\\user\\Pictures\\Host.pdf",
  443. "C:\\Users\\user\\Pictures\\ncgtubHuMf6NK-Ru-C-xHF8i-GyuOtG2BR-K5e6FeXo=.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\Pictures\\Host.jpg",
  445. "C:\\Users\\user\\Pictures\\AaIYxZFfcxAfvX+O7dXWvDeHFxKYvhzyPM8096Vkt8o=.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\Pictures\\Host.html",
  447. "C:\\Users\\user\\Pictures\\WvDlPJOjwdLFCyRp+VqlULfOyLsZKf5cmwA7NAxI4rY=.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\Pictures\\Host.gif",
  449. "C:\\Users\\user\\Pictures\\BtgYvVIJaVGOUn6PB5tNwOq+qFNG6fNCBrwBonb5oew=.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\Pictures\\Host.doc",
  451. "C:\\Users\\user\\Pictures\\Q6jqiFJdWeuta4oXnMdz28l1Oq-usfpUcWfBgZiUiY4=.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\Pictures\\.xls",
  453. "C:\\Users\\user\\Pictures\\+j5wnccIAEBnzBaNQrEoGw==.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\Pictures\\.jpg",
  455. "C:\\Users\\user\\Pictures\\90-bYMOeqP5FdYwpi7lCVg==.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\Pictures\\.html",
  457. "C:\\Users\\user\\Pictures\\XQmzzJNW6M4N4YwpDbv0yg==.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\Pictures\\.doc",
  459. "C:\\Users\\user\\Pictures\\YTnx7nkKb831fljw3sathg==.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\Pictures\\.bmp",
  461. "C:\\Users\\user\\Pictures\\a1Va7xQ+kXrPXVrj8AiSgw==.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\wYwaBqlToNW+cPz6bcJ9iVAsoa5XHPIdV9rQ+JYEX1N9nT1MdKYhxk4lyL-yuVeLUBzmcLZmtxivgiSMRc5C7SVZjy0iuNRkx4R6vowKqhRlMUUhpDy3S8hZJ2VDj-Oe.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bD+wkCLIMjpeppYfVMAX6P8AILN31-jaGH0e4SpfpWk=.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uXpGlFjYG-LsCTrMS+tKTZcCaxbU0HnmLnGMhznBU4uZHrlKF-QiGbK+FZKrdK+Y.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\SyZyUidbhfFAvpowvkzeAsCPgPdb4nJ5ogrRe+3iiO0=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\kW58+0g1JfeD8XvUu7RBhg2-ryjtlbGephbB99n5Msw=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xlK7vIUOVWvxJRolhq4wXpyabOgOTq4iAe232eDItQ0=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\OnTzhqh7DjxKf7fM-aGFjmarZaekG40WFUTTEw3ii7WwSrCMJvAAV+F7FUtVT91S.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mTfCu15v88Q3f8utiuTZoj7q2SLlLNj0xdd5iokflzE=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\0Axa2Iq7aQ5BC9gXwTkDjgQ2fSlSppTat+VoR4vrnyHTleXcoJ4CDpQWaRPdxz3G.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xbOZ1ixyECOz48zURsIx5iDqGFtjRgamoMCddWYcmOs=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\V97IAxB9EK0AH6XEgYV-r-xn0ervkAcJrQN+AnlvjBA=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\appCIsSvO0ILHD29vVEBAWfZ7Au6GwPNOExGb9K7-oM=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\q9x8FrCE7LprWFqoJS4fIWMnX1ABaU4WArqysVx11+M=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\5s+swUGwNsi6+K1vahoFJuGDV10V6eKG+PKoIKZXzVoilW2AB5EQQaJi8LlzJn6x.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\792569EgJ36WuI4uxpf93CRcpcuTAR2N7o+Sa1GMWhw=.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\O+zZ6tRXJZ6IyJw4GQaCuE+L-w-b8q+mBEsLZ8f0eqkedm9i9chf38vcp3mp9Mi5.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\7wVVjXwOf1VBQEohGhvB3tjj5+LGkREYUvP-ywk9XZw=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  497. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\LddPibPOTzIlCOfxWxs6FtkxmyAKgfsFC09agGTOsvA=.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  499. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\V70rFjK4XlDCGXwMJTTfDY8Iq8igGDgnQXEa95nU2PA=.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  501. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yD0UjhHofqVHxUJx1AFM-iQQV9XCgCKYs2-yf5cle8M=.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  503. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\5OXnfRk-Bj-Wr1AyH1qQYhfyiDd09F8Mwz+0zi2rjFs=.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  505. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\2MPeuDojehQe91yJHgm2d1WFHsPNEhwaICKkr0JgxHI=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  507. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\yCbAPNB7csXsj90T7eSrLWd-G+r3RW5baxRz638tVC0=.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  509. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\KPC126L+gKdb01VZ-EPV6griQpnm-3znMpP3wMGUkwQ=.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  511. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\E4BHGeepdciwrPmXAgjv0BbCVXxkp6BWG0pR-pB-Fak=.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  513. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\r684CVGddkoUQ+HW6Yb+2guVu5Z-kT1VXAzFAAXIefQ=.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  515. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\pm8siJgN1fA0-96ApjgGFwiBiA9lJiVo1PgkwaxXnIM=.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  517. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\BcLexHA86W5UedMbqf8-+ZgpzhRvG0rxB2T+61Llwho=.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  519. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\HYqk3jxTbN9Q3MUAtuRHepHYzJgOe0S6a6O7jrUBUcM=.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\fysb9AbHKuX9JWZdGCyaR0gEGyQAHxelAm-FEGZzTd0=.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\1axxW6o8V+qFOFRDICTPpd1pQDC6PvX8Rg0khN+vxeVlpIdTcogWdPLHd3-pJ759R11PErdkwjnM5EnsMvjjNA==.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\ijGlzDqp5AQQ-D8xoaAADt+esm9zOOTvWapbPWF22qQ5szGBXoifMMp3fDwodYKB609p+R+UUlzzNv1DiWjd5g==.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\3Y3ejSztMPzgNFzg3l+RBietI5lNh2HUW7Z8P-1KcYkK+Zg3onlP-YcIU8-efnAXGVF+NhqZsOYtPWVpWWknoZn+pyQYmwqpDH-evEKnU47BHgsGJFpcduW5f2Ek59vznAz3MSs7VbClU2LAlsKizcnNCFyt5knFDONVEzfspHBG7O8WNn7HSDVWLxq1qRK3.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\etGzJ7MadnQ0pgaN2OnSzO4UlvmzTh1FC0ANyFvrI-2oLqb2rdr-ccV-iU5dAeYm4S4kUYKsH7HebbzHDp2Kww==.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\QmSKFPp5bTT3dobc6d2Pemqh46Hf101fYmp17+Of9ZIsRhMzYI8LcGMWO6P0HVrYIaptSB0xAU1m7N4OjstLZg==.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\NVVKOgautnIDybcJsl4NXSTxTbyr4tNuHOY4QD8VRVKGAgWocxTY9tszeubcg5i3-mye74wun-tjcOEQi5VW+w==.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\-ck27jAHyMd-CZPpgdSqFAhtsewfMeiR3s-tinB18LS-n0kH4jGk7LKbOCfFhA2rm5gzZUXxIevUM0hW1-bYUjuyY1aImV9pfMEYgihNbPZMMHMQX444h4ejFfY5JiIONYwE6eQkO4fsCIrBWqywDw==.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\8AyNQXT0FegfP9MCqV54+S2hhfgZVBormIiw7CfUp0mz9y+eIu-YOGzJnoZvbcjHb1MY5FVWUDlIlzyZmp12mp8GX0L6khoMvo8EOTivNH4=.C30C4DA81AE308962B9A.crypted000007",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\YFm5xLh2tWBxRsKeTJ1qUG7QOSiffVMHe4vdB69vSpqYzFIsSvENt3-J7P68NyIUrKeX9ZCsaeEVHfyNCZrE7A==.C30C4DA81AE308962B9A.crypted000007",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\OjQWGpygaMn889wgIzKcC3BbVbsSdMMNpSm-a7MUXPW8ggS+CPRn7UGUGQyYhwywwhb0B1FkjmziL1jUOVCTJVMDxw6y8iWdaZ+Xj3W+2JQPXgTz0mv-Rs60s8tYVzao.C30C4DA81AE308962B9A.crypted000007",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\QeYXOapPRIORNCYhJELAUZEXGnBGMf1G-Rp1eXW8ZMqzgcO4UGhEmMXlW49oppzB3WnXA0PmziOj1eFlL3aGawcN9OyAsyPc25Z+EHPxCn-IdgrwAchNwNijEfrdHqLvFQQEnneL1u+8hOSPw4OuPQ==.C30C4DA81AE308962B9A.crypted000007",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\u+m6W0Tefb5PaXagjUo9fk0LVtM3P5YFhNwFQIs6OigMXv78IqehjmiUmrm7UrPia8V3cAWNFNPqE4q8pjbPtA==.C30C4DA81AE308962B9A.crypted000007",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\zrg4ZBQP+82NlBnCMwvEvQfn3sO6CtWoXA8QBIww09E9v1aQ7cPKht4JH+9PzuvYM98BFMeVl4edbV+KWFGUKw==.C30C4DA81AE308962B9A.crypted000007",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\hvWZMIrTPwFqoOMaogzp3K-tfkw4yjcjYB2q8Xt0rC+rnYIH5Eu0FGgtK7vK6y9X.C30C4DA81AE308962B9A.crypted000007",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Bswo5NE-usSDsNglSe3KK4SgMiVV6oN0SfizxmB4d6LogwPU9mIr2n9GF5gz8OYQ0kev4gCrQxNW-gyViHgRSA==.C30C4DA81AE308962B9A.crypted000007",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\mUaKcw3EK+8TPl30Z7bxpBrz6wCHccDVmmNGJA690ciLL5kMcAwN5Iwz615QQKF44PgvEWIacZkP7LtZHTcszOz5xGpqVFxemWvmCfwQ5NzuEPXe31DfXFys7cp2YE1C.C30C4DA81AE308962B9A.crypted000007",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\IX8Kgxn0s5JCBsJNcxRDOSBfeeBc936NbWd2Y9mII0qNQKI+bz5r++TbJwgSzsy4Nv8ZastvYSqAoXrfqgl6vQ==.C30C4DA81AE308962B9A.crypted000007",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CJZXiNOeCLuTdmeEaVRr8LpfI9Sn9dNpM1nxbZejTStFPxuSPXONXaBiSYe4l9Z+jTvkGblRzIDrgWY6C8gnXg==.C30C4DA81AE308962B9A.crypted000007",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\KpitHzV2M11e6Wm0MY-XeSF302Ny-tB6qq15QxU7q0cjESFjaSmGolabIHgGzrZ3Xs36o8HvjsnBXr96IgRedw==.C30C4DA81AE308962B9A.crypted000007",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\hbhT9QtbmmyDNHgDMa2Om0eCRaMfpyWcDPhLgzRRtJGLupKuWoUm+OyJLsBu2QPaq1teE12v+kpLLz6GGruvIw==.C30C4DA81AE308962B9A.crypted000007",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wBJjQE1Kc4s+PTjTS83OJFksEIMa2b+hg-VBE-SGzns9DbzIg645Zfcl9iICtcD1iJfrW3UCv0VvvGqwHu6JDA==.C30C4DA81AE308962B9A.crypted000007",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NtMpvE3isBGc6vmrh2BCB3rcQNRmAKqbkA3gozHXQiXBAd4QwaVkPZ7-nO2t3szVaYNBYTfmj441omQJDnC60g==.C30C4DA81AE308962B9A.crypted000007",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jwkdMiGzdBSiS28Pzx8EtqdXzsXhrnJRG54V3b2eqRqYl0zHxdvoAincr8M395hZa9fD4i681ow4ePzOkdgpxAOgiYDo1fWylGLlFy7+yc8=.C30C4DA81AE308962B9A.crypted000007",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EmoPduiUK1EM0La9mLW1o40mcVPD7tSA6y5zEWIkTuOO81UzSVzkfOAS9t9aXWhsYxHsr7tk07M5UX5tgQP8Xw==.C30C4DA81AE308962B9A.crypted000007",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\BCug9U0IVF4fI+V9wAus7UEUfAT+hJIEVIHdvyPsw+AfoxN1a8qNxhOlUcjEnmEPP8BpcnC7ry1Jo-l1f2KJMw==.C30C4DA81AE308962B9A.crypted000007",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\icwm6i-UP5SiTHmxc9WcyCMGFhDCDNyu-y-AqqUt5pxu00Z8vF-CHc8ZVknZSnM+lpA8fev-1Bv0lMenyBoV-g==.C30C4DA81AE308962B9A.crypted000007",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+VamfukmOG1Dlpu8psRcIqgkzTWWHaCtL2rvKsrLNfqMyx0VVk54QYHafUZCPjfji7sG1P1mjTs9yR13OYxI7Q==.C30C4DA81AE308962B9A.crypted000007",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6raiaNkamU5Vzns0a77WNGbJG4KU8j+EmdETyYGTf5fASFqMvAtAh81fS-BRwnZnHib8DtXpiCVstOFrr2Uwpg==.C30C4DA81AE308962B9A.crypted000007",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\oosemQApZYZORZYOvKd07nTASYy-WpTfB4z0yDK4g30BMYxfkyIE1rBqxp8M-ItCFWcbAPUrGGN+5MZ7uMGrlw==.C30C4DA81AE308962B9A.crypted000007",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\axi5MFxiUHu0twfUgwrxrjK5IG8TlhKqB7uT9nkSHWQ4ge15FLk21mFXnKAJx3sLCa1AzfVEK9FaFv3W9RhnLg==.C30C4DA81AE308962B9A.crypted000007",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\2tMci81YGN77pBz2wj2VzjSiU9CYhM9YNcn6O4PL2fpskK3qQRz7FjKv40GX482BQFg+KWQh6TV13LOFEFLvOg==.C30C4DA81AE308962B9A.crypted000007",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\JFP6TwCF+VKJRTpfQk8bJ8-qCwv+ZBlsiJ46aT02DZ5xzKVzpjAjshX1ndnqMWt0ah6B+ARlWE+T4MBWQASx8A==.C30C4DA81AE308962B9A.crypted000007",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9ThWN55aITVF6AKhF1u2JTXdMinvYAfo6Xx43MlyYKQL5fZsolDnpzxwswrnVHaaBsjdgI8F2TJvkl6U3lBuLw==.C30C4DA81AE308962B9A.crypted000007",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rYLwQ8cq63YGb1ju+uQFirop7nu-0Q972ioPyeZlSAQxi+q3HclLv6NLFXSbV4cNgoVcY0pc2JH-+-u81wuDoWaQk-yUpF9qGXUYRTbPBOk=.C30C4DA81AE308962B9A.crypted000007",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XCjWsPhT7wonr2mWLF0rVEzAvf7BWGoKk8THWsYwjQcJr5wni9rAWJVPGYU+UKuPmrxbuY9umPBzcCql5PTUVA==.C30C4DA81AE308962B9A.crypted000007",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6M6SSe-i76IzoimjGXKKZUZclRNex6mJ6W4TDVycvY8hlQrh4rfe6hbGkzoozSzpvJMLJHcaGGf3qF9iy7kfng==.C30C4DA81AE308962B9A.crypted000007",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qJPRGSSAZmNpfr6Op0TI3+mPWVeTOAeRTHctsGqIhuWuHQhGQEPiuDnCO2b3rjIzQXnTnIKxnXxYtiIIh7nKpQ==.C30C4DA81AE308962B9A.crypted000007",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\PlfMruOZ6Ok-bsKNUlPk-XduI+JRAJPiRbqUuTeTGNtQuDbOV5oBZ1aUu4D6BQyrkRhif3HdjQ7rfAhLOoWn7g==.C30C4DA81AE308962B9A.crypted000007",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\MpCT+YK68EnVuayCoTdcn51ZyRFZ0sWxz+Ei+nHy0kbocu5tRsW1BUS3s0bbn-En8T+ssL+dAzgpwpUqrcWTEQ==.C30C4DA81AE308962B9A.crypted000007",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qU27eqa64RQonPCrEybkmcHR3lUSAlwYreY0Czq9hVAN1K8BLkOiTHA1dbqqwbZ-oG5+1noEvihC-awH7LyKIQ==.C30C4DA81AE308962B9A.crypted000007",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\ZUKz57DCWrAS50Bq1I1xhza7SOCsAJ1mz7lMQAYbxbfxwIPNAlFpNyjOJVjDo0LN.C30C4DA81AE308962B9A.crypted000007",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\BqsG6LZuDZguGfSXbsMnoR14xUyNLwv5DuHiVqlVkZY=.C30C4DA81AE308962B9A.crypted000007",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\7IJeMMD7GLzmm61nseZqmRwTXwbq0KMlRnJXhXKBvMc=.C30C4DA81AE308962B9A.crypted000007",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Bx3aMp1NwopAm432bbe5-rjTTZVPq8RqrebB7IJWLkE=.C30C4DA81AE308962B9A.crypted000007",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\xusOGI7O4JHuWwzJX1AYIfBNzK3P+k2G5vyi4iLrGBo=.C30C4DA81AE308962B9A.crypted000007",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Z3JqD5w91KsDAbGMVMvcc3pF4NA1lhZ0150oY3PAp1I=.C30C4DA81AE308962B9A.crypted000007",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\qDNySvb3Xgd017opmNU1xR1zGcc72GSCSv78vkEb5RscikkP6gVUuD9H5JZzubBMtYrzCswiJuYhu0cIMuxaSw==.C30C4DA81AE308962B9A.crypted000007",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\G1ObM9d+JDmFXARURRZdnWtYhnNWx9ybambsyQcB1hUKIA1N5inZ+lWbU0ogXNdaiuQdb0+XXm9ywGXF3d2MxQ==.C30C4DA81AE308962B9A.crypted000007",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\i1M7oWJK2tejIc7FRVgiRvlHGg8lRXuu+as9hgY3Jww=.C30C4DA81AE308962B9A.crypted000007",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\iBh7wU9WnPxnqAw7jXn-oteQ+74LJ6o8iX+CVmtVZq8=.C30C4DA81AE308962B9A.crypted000007",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\XCk2W6jlLJZPRFMmOwCqk5YKIJ5OVDEykk6I2eL+3tqqK8j0PhuH5G8P005jUWK6YUTs7ULnxxz7HqicWDHNag1H3NwnL2YEnKlrrsduS84=.C30C4DA81AE308962B9A.crypted000007",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\lGC+i0ShVpdQy2aun0nEBfw3Xwgg2Q7xtRgPrOxXkfBcb+gx7Ecn5U8vn-n-U7wF.C30C4DA81AE308962B9A.crypted000007",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ibZmgutSvrKAkxVQVkF5fpf5Y-QC3HMZYmYd2GofEmk=.C30C4DA81AE308962B9A.crypted000007",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  629. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\M1ePiVAcPELvpvSnVHUCrdvwjE+TIZAiMlzIHLHzWJOePx+h+aTIfCngz-FKT6f5.C30C4DA81AE308962B9A.crypted000007",
  630. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\BnyhZFMBdaN+0fTvvN2+CHSRgV0oAqf4hxfSgFfyHBDojFZiO1ze0jjlAUCI484n-IKCS7S+1-e2BOJ8mx5DWr55s0+apHjIZlwTfeMmbKw=.C30C4DA81AE308962B9A.crypted000007",
  632. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\qUBESXBsqEsPKRI0XFw-Osipv0wppgD90zFGMMcZ1Xc=.C30C4DA81AE308962B9A.crypted000007",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  635. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IPE3Ep-frcHf6zULV+EScP6oQ6QNE2WTr6RsFSeXxIU=.C30C4DA81AE308962B9A.crypted000007",
  636. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\akAlDAUlmBQOEypjv0RZUA==.C30C4DA81AE308962B9A.crypted000007",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\fGTM7w+liut-R2rrzEad0AeHFWX2JLTGakFAkk-wGUY=.C30C4DA81AE308962B9A.crypted000007",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  641. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jGj07yTV0nVGxDeLmV9YKSswf6pYXaDrlZEsnP172jE00TnA4AIFN18MnJKmRtlm5DQjzHwm7AJRRawyrqgf1g==.C30C4DA81AE308962B9A.crypted000007",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\VsQS+vqrIjNuCUOhiGzE7egXkuj-752NpwaQ8ktIJvPiJR7SHDC414puH7waXNDZ3H2HmptasmthX4skTHUGGNhuZOf8mINtVOvp0qHYsW+heKNhxiFmzndxuA-bYiEk+3zZAPJx+zaLp5vd6az7MQ==.C30C4DA81AE308962B9A.crypted000007",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\Eh61NT4opA7lUCPIIhjEUaUqstzJeOq5bwvGbeaOev-yABReJwGe82N2U8VfIfkGxAu+6qFm3XmK+YwyP9rUpA==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\KEl75Gakxo6t34cCP6SH0tidrw4GwqD-5shpY6K40wATzTF4JKWS508Qac-n-tsQDHE6npLUWhOKq3AMlMM2nW7Y2KxCW7P54IoMT6qSE-A=.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\h-UcGws5Xg8VwffhjTQKEYlry7vMlHRnaCPYsw1CwhE=.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\mLqEz4krxk3m7jgkCrG3UmwliVrW0i1EsfGUtWto2EA=.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\iCujkgNcpC9YQpntzpqB+qlv4IiYRoH-39JLFF-OhpE=.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\XpE-Y3epQrebJZ4i8cY9YY-NRjZB9jirKn-3C64Cnv+XumCce8ZJF0bXk9fXoWaijf4Ve8wATn0+H+uGqRft8SGLvNYSIKm8wJsjLD7WrsA=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\M1YObdSvBpp7rtPyCnfTIgYOwu8W8jQCW5gb3NAex-o=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\P4WKhf3wFhxjGGSTeu4VCzhOBXGpOjHXTzVJnn+-H6g=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\a4KGBHpva1r9dSSmfAV0xqXrpSxq52NOntbCOcCOSMu-HycqLvqB7gYFjIExyB62.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\3ZeI19eSVN0F1mA5kPKK1A==.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\N38jooYPF4Y9Qt0TCJnz-43jvCLCz7I7cupNyjOBuyhdEjXuJJycqdnYJuqVZue2.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\mikLe9TtQHDbbvtuBg38dJdhEXBkc8K94fshnF5uQ-Y=.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\ItfEPR+ElIq-3P5u4KdT+0DuIp24mwnZVa6r3R+4LdA=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\VgX24w5Sa1OKOcZPV4-71g90oYQMqRBg7G1+jVzj+j0=.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\KKLI9CBCriM8o9kmuzXr5LxNWzYwwQQf8RTsswr8G-3tGMIeej-ZmKIyJKSOoRXICml8b5f4mddx7CWEtBl0PA==.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\FWsoPtLwW-99UCNzyxDFGQ2gQ75VcDfKp3BM1CBuweB-L97Ob-mpvv87y5knPI6dCVk9KL3Ptw-7T3yqqTvpnQ==.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\kVyM8blsNsctiyY2ppzdYqiOx+Fw3azUi8pQkCrzhDjb3RB50Pgr6NL96+v8Sc8uQbNm3Aq2Dxe3Nw9Z94f3OA==.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\WN79RFD89DvaApfNMtJeUAqUA9Tskt4ALlFnsD+g8G-HouK0xP9hxLgSOlGU-LG3+lR1Uk1IzpxfZ9ESxsWamA==.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\kKCNY+sBQ+Jly+rKbb+Sg1IVm+sDRYugRsdLHLVtUDK4lqUO5jp2QygCN86mkGCbXKhjdixuypTyT4KXm8ioBQ==.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\CoXIxutbFRdUZ-ISohmcnA==.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\XR2WUSw8ErVUZI3KbUcsqrs5vdRjY3Kd1fbkVLZarQK+4xtO4BnUVmtI4M25cByXw0rIvYXKSyHRpXV9+MdvC5GafRnRItqpachWq2g--1uoJC8HRvxQOnuzMjmmYAssorZccesxR6IS3Zaqj15Y+bVTtOiwhnRB8U-A-PkOnE4=.C30C4DA81AE308962B9A.crypted000007",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\PDO+67wVMZRRxtC86skdR1eR4oq7+E03R2zHYfXYvu2k1BQ9hkvnQ5tJAV4gp7w4vvz7LcRihg+2ILndrbI2SXuZsbaZ5ZWtA2u8WTQibQm-GTdh-HE+UpwPodjtvWFW7z+R5uYBvU218xlRTKpT7OuylQHbiDQW+2N0sKfH9-8=.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\VitIaPN6mWBFL+-7r3N0q+O9r5HbXvMw-iQgQp+jqw6tI-iz2OFE9GPaqwzzI0o7UcgJbqDVUUDoU9Bx7pO1415utPc6WbggI5Y7-5H9TBOhVa32vcwQG-JZwsTqerVJj0mfpZ5+DnkJzjKQZ7WgiUVxvCg1TtUSXNNqXWvUDws=.C30C4DA81AE308962B9A.crypted000007",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\6uB0eSzs34Fuoz-uqlbDHQfX6bdgexoTQPDfQ-NdvSw2uAEMx9JyjBU-PQSoLJyKAJXbGbwW1Nz4hWqhNVSHMmLUYdsSVOSgxx7mHyIzROK5-1iFomQfwnDphSMbPyNLMiOS1b8E9njEDo9+xclqDm8zcjq-xFMQ5DkpENCRjLg=.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\mI9MxwCP+zNnl+VPBdrzIFE7pzVjd4nG6mUW0iq+UnhgCeg+GZEV7HKGt9TJnwqvhWCkR3aUr8WD7gjSBNyus4O06le0itFfJkLxs3e2sahKVfgidMh9tmMxwrqXBgMluE2PXYnK4Iwmj1B97ZAOBTgq4Z9pCAjqBgFda7N6F-0=.C30C4DA81AE308962B9A.crypted000007",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\F6xee90ab1DLHEe6-1gDb8WnX2cfUAIzBxE-UuQC1WhxP2Y23t2yr0xoOTY-t-VEypXzLVCNRP4VqiwgIRTo2SbEeD9SJtz21FtTmoLzF-7YHB-y9tZFdA-VYGXCrF4Pp3H72WAmMWrq3EEue2V7gYpVKaGeVdg-ywqTCXjsNaU=.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\u-sZz55DJNPJos8hL3eoGdygEhFbvX2+qEGNpdDdtBj4vGzwOQPGrN9szIy+fssyRyfN4tg8cUsyMVGjvxtJ9cIHFmcbGorMFbo3+3sl5E5hL3UMZdfxrJzqzYJ14bA0uixSDqZVDHSBA7Pddc1ZrLpD0Xc73zEQ1kshg7BCdwo=.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\7ZPnWhOV8hI3Q4ymZ6M1-fQo5JmwglOTcSIP7DAHDJdMQDec2JnU23CHWdiEvI6IlOq7qwigJc4JLe0CmdJWPQ==.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\rwClMHuXmhe+dsNFhAmXhOXcxz+TJvogC6vPRM5EjMR004L3nqtLyj0o6EqSSoLWVEC9oAhXAV7IDgZQStqJbl+KQ2kRh4GCvraBGrjLMDsEZk+IfSWRUD2jiNB0-ObO9gadWL-vkg0Bj8-RvmNBDgynR6HSvSs4oFpNmS2a4I0=.C30C4DA81AE308962B9A.crypted000007",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\REhjgrmgutg13CsGPSreoL5zSCj5-3rx9w20y-UqvfYNig3TMFnICPPrapUn683Wuzm75Mz-foNv+KiT6qh3qXnfL6kr7yivk4vJvCc1YpCu12ET+LQcLNc9krwp9hWgf2vyUJOWpOrwLVbdE4f9VWcBvBZXF6NeH5uuPFaTikE=.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\Ho5tn1rh9sDaBRD-r5Sd7Bs3mOpXQrQV99bi2JtV55Yplw2Elpwm4tckpVxWS+2znEbuos2xZ8-RC3EQmJB19YxbCJGmr1BZdVHYLHGiFKo=.C30C4DA81AE308962B9A.crypted000007",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\LvsyNtk8B1r823a9SZ0isL29E-fqEesLCmT77ETvOSNpLI9DkvXwLvfdieR2YrCY.C30C4DA81AE308962B9A.crypted000007",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\DrWEWDQM5vUqbDuaVzyOo2PXoFfD8dhQueWiS5ppcc955xJs7Fxko1rL0rWqbDmrEPDjFT469u2ANobxv-fQaA==.C30C4DA81AE308962B9A.crypted000007",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\YzDDD8NrIv5VUvPy7qjDOEZDQuDUL5U0vKXha+hTgjQWrqjncOPmG3WzYGRxacu+SHBmV-ItBpyx2U08RoliWw==.C30C4DA81AE308962B9A.crypted000007",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\sIsGIL8YNQChTy+cpPjmn5Ph1CvIWxhdVFiWGN+Ipbg=.C30C4DA81AE308962B9A.crypted000007",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\6yu9GgZ9gV8xFBolxLXJq+HFoPvYGrJt4+mOvR0LWfQSxKp7-oKtti1FrWtC8Q+yDKu+BGJQzcn542mbUnsx6A==.C30C4DA81AE308962B9A.crypted000007",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\zAb1FAjMSrI2UmOKrnFQgtfk8VkDwFG2gyY+OHRUYRs=.C30C4DA81AE308962B9A.crypted000007",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\4LpqqdF9veWa97wkOZIK-zLj6+Vrw44UgdtY9d0D+CQ=.C30C4DA81AE308962B9A.crypted000007",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\Tomf3jhSYXceSzuv9o7piUOxzeAEikBMlTFJAKtrG0e+WgPUQhhk1JNx4tckdMto.C30C4DA81AE308962B9A.crypted000007",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\aoGjkx7MY5aH8mRYcRkSBLmEcnENu5Xe5QKHkpq5FKP8OVGGtEeAKTFLhXA4hQ4Y4mquffZZhgurrbet2NPzIA==.C30C4DA81AE308962B9A.crypted000007",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_32126de1466136e0b4f39560f3956fb9.jpg",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\K9t4Kd6GNiJqIT3OoGbqloCg1R7lvNcwhEkV3znCo7IJd5Wzs0zUv4qn+8M2amYemxA7y3locFVZISLClc3KQmN8Xch5I-u2VEW1doHnNBi1Uz-l1yGRn9EqWyLAiePBENVjgNossTDKJcM-lo6bIgKmdve8nZPfOlkwHIT9C3E=.C30C4DA81AE308962B9A.crypted000007",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\m6QjfIK90Q-OQYE9Sn19WvIlHLAioJIyp+KF3GNIZGlYAPKfVZHQalO30DorFcPG.C30C4DA81AE308962B9A.crypted000007",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\i6MsZ0HZBgRk3TeU7G1-AoXsQNB1yI5MTm8NOmQH78Dg5NWdod1W2Wv-UnciH4PDNVcXCMc9bC8dqFFnTWvzbQ==.C30C4DA81AE308962B9A.crypted000007",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\F4Wj+S-8sogSkiG5UFzkZz5mUKKdBKxuVS3ga-TaG8M=.C30C4DA81AE308962B9A.crypted000007",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\acrYS7pP9P6zOISgtSC8nZV70WZHLUXtvNkn1tK6-40=.C30C4DA81AE308962B9A.crypted000007",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\hNw0hn8h96w5UU9n1xLJnoKHdPD3NVlaKPDuhdauZLXLxhaJ1HdEfurTHAbuGXQEQRBFlYiplI4dDvkGyb7ejg==.C30C4DA81AE308962B9A.crypted000007",
  726.  
  727.  
  728. * Deleted Files:
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  734. "C:\\Users\\user\\Pictures\\Host.zip",
  735. "C:\\Users\\user\\Pictures\\Host.xls",
  736. "C:\\Users\\user\\Pictures\\Host.pptx",
  737. "C:\\Users\\user\\Pictures\\Host.ppt",
  738. "C:\\Users\\user\\Pictures\\Host.pdf",
  739. "C:\\Users\\user\\Pictures\\Host.jpg",
  740. "C:\\Users\\user\\Pictures\\Host.html",
  741. "C:\\Users\\user\\Pictures\\Host.gif",
  742. "C:\\Users\\user\\Pictures\\Host.doc",
  743. "C:\\Users\\user\\Pictures\\.xls",
  744. "C:\\Users\\user\\Pictures\\.jpg",
  745. "C:\\Users\\user\\Pictures\\.html",
  746. "C:\\Users\\user\\Pictures\\.doc",
  747. "C:\\Users\\user\\Pictures\\.bmp",
  748. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  749. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  750. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  751. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  752. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  753. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  754. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  755. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  756. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  757. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  758. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  759. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  760. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  761. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  762. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  763. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  764. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  765. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  766. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  767. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  768. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  769. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  770. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  771. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  772. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  773. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  774. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  775. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  776. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  833. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  834. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  835. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  836. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  875.  
  876.  
  877. * Modified Registry Keys:
  878. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  879. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  881. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  882. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  883. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  884. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  885. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  886. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  887. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  888. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  889. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  890. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  891.  
  892.  
  893. * Deleted Registry Keys:
  894.  
  895. * DNS Communications:
  896.  
  897. "type": "A",
  898. "request": "whatismyipaddress.com",
  899. "answers":
  900.  
  901. "data": "104.16.154.36",
  902. "type": "A"
  903.  
  904.  
  905. "data": "104.16.155.36",
  906. "type": "A"
  907.  
  908.  
  909.  
  910.  
  911. "type": "A",
  912. "request": "whatsmyip.net",
  913. "answers":
  914.  
  915. "data": "104.18.35.131",
  916. "type": "A"
  917.  
  918.  
  919. "data": "104.18.34.131",
  920. "type": "A"
  921.  
  922.  
  923.  
  924.  
  925.  
  926. * Domains:
  927.  
  928. "ip": "104.16.154.36",
  929. "domain": "whatismyipaddress.com"
  930.  
  931.  
  932. "ip": "104.18.35.131",
  933. "domain": "whatsmyip.net"
  934.  
  935.  
  936.  
  937. * Network Communication - ICMP:
  938.  
  939. * Network Communication - HTTP:
  940.  
  941. "count": 10,
  942. "body": "",
  943. "uri": "http://whatismyipaddress.com/",
  944. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  945. "method": "GET",
  946. "host": "whatismyipaddress.com",
  947. "version": "1.1",
  948. "path": "/",
  949. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  950. "port": 80
  951.  
  952.  
  953. "count": 1,
  954. "body": "",
  955. "uri": "http://whatsmyip.net/",
  956. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  957. "method": "GET",
  958. "host": "whatsmyip.net",
  959. "version": "1.1",
  960. "path": "/",
  961. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  962. "port": 80
  963.  
  964.  
  965.  
  966. * Network Communication - SMTP:
  967.  
  968. * Network Communication - Hosts:
  969.  
  970. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!