API tools faq
paste
paladin316

Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7_jpg_2019-08-23_08_20.txt

paladin316
Aug 23rd, 2019
2,202
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 69.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Troldesh"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg"
  7. * File Size: 1207984
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "23116fc1eec2da9db5fd9a850eaadf6a5f11a6dc5839feef08edece86bf4cbff"
  10. * MD5: "79d35c1fedc5bd292a9f2de9df9f6bb7"
  11. * SHA1: "817d1a366ba014af172a5eed5c55ece8181815c1"
  12. * SHA512: "40d7b95fadb92aacd235dca34b2fdf0b549aca77d828bfa8fc5b82150860cba43a23dbe770a278bd824708b0845b87adeb2326e646a590ae378e2b8535ee0f63"
  13. * CRC32: "6B381805"
  14. * SSDEEP: "24576:BbJbIGB3LHQTrk6ZcHz6GX6JZJObz6yqKVvv/INbE63Ocp43B2JE:BdIGB30TrLZcjX6JZJqzbrvz6ecp43Bl"
  15.  
  16. * Process Execution:
  17. "Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "A process attempted to delay the analysis task.",
  39. "Details":
  40.  
  41. "Process": "Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg tried to sleep 864 seconds, actually delayed analysis time by 0 seconds"
  42.  
  43.  
  44.  
  45.  
  46. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  47. "Details":
  48.  
  49. "IP": "37.187.102.5:9001"
  50.  
  51.  
  52. "IP": "91.143.88.62:443"
  53.  
  54.  
  55. "IP": "92.35.43.15:9001"
  56.  
  57.  
  58. "IP": "193.23.244.244:443"
  59.  
  60.  
  61. "IP": "128.31.0.39:9101"
  62.  
  63.  
  64. "IP": "104.18.34.131:80"
  65.  
  66.  
  67. "IP": "194.109.206.212:443"
  68.  
  69.  
  70. "IP": "127.0.0.1:58556"
  71.  
  72.  
  73. "IP": "104.16.155.36:80"
  74.  
  75.  
  76. "IP": "104.16.154.36:80"
  77.  
  78.  
  79.  
  80.  
  81. "Description": "Starts servers listening on 127.0.0.1:58556",
  82. "Details":
  83.  
  84.  
  85. "Description": "Reads data out of its own binary image",
  86. "Details":
  87.  
  88. "self_read": "process: Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg, pid: 2164, offset: 0x00000000, length: 0x00126eb0"
  89.  
  90.  
  91.  
  92.  
  93. "Description": "Performs some HTTP requests",
  94. "Details":
  95.  
  96. "url": "http://whatismyipaddress.com/"
  97.  
  98.  
  99. "url": "http://whatsmyip.net/"
  100.  
  101.  
  102.  
  103.  
  104. "Description": "The binary likely contains encrypted or compressed data.",
  105. "Details":
  106.  
  107. "section": "name: .rdata, entropy: 7.56, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000f4000, virtual_size: 0x000f3ef0"
  108.  
  109.  
  110.  
  111.  
  112. "Description": "Looks up the external IP address",
  113. "Details":
  114.  
  115. "domain": "whatismyipaddress.com"
  116.  
  117.  
  118.  
  119.  
  120. "Description": "Attempts to delete volume shadow copies",
  121. "Details":
  122.  
  123.  
  124. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  125. "Details":
  126.  
  127. "Spam": "Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg (2164) called API LdrLoadDll 101763 times"
  128.  
  129.  
  130.  
  131.  
  132. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  133. "Details":
  134.  
  135. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  136.  
  137.  
  138.  
  139.  
  140. "Description": "Installs Tor on the infected machine",
  141. "Details":
  142.  
  143.  
  144. "Description": "Installs itself for autorun at Windows startup",
  145. "Details":
  146.  
  147. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  148.  
  149.  
  150. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  151.  
  152.  
  153.  
  154.  
  155. "Description": "Exhibits possible ransomware file modification behavior",
  156. "Details":
  157.  
  158. "file_modifications": "Performs 1759 file moves indicative of a potential file encryption process"
  159.  
  160.  
  161. "drops_unknown_mimetypes": "Drops 1329 unknown file mime types which may be indicative of encrypted files being written back to disk"
  162.  
  163.  
  164. "appends_new_extension": "Appends a new file extension to multiple modified files"
  165.  
  166.  
  167. "new_appended_file_extension": ".crypted000007"
  168.  
  169.  
  170.  
  171.  
  172. "Description": "Collects information about installed applications",
  173. "Details":
  174.  
  175. "Program": "Google Update Helper"
  176.  
  177.  
  178.  
  179.  
  180. "Program": "Microsoft Excel MUI 2013"
  181.  
  182.  
  183. "Program": "Microsoft Outlook MUI 2013"
  184.  
  185.  
  186.  
  187.  
  188. "Program": "Google Chrome"
  189.  
  190.  
  191. "Program": "Adobe Flash Player 29 NPAPI"
  192.  
  193.  
  194. "Program": "Adobe Flash Player 29 ActiveX"
  195.  
  196.  
  197. "Program": "Microsoft DCF MUI 2013"
  198.  
  199.  
  200. "Program": "Microsoft Access MUI 2013"
  201.  
  202.  
  203. "Program": "Microsoft Office Proofing Tools 2013 - English"
  204.  
  205.  
  206. "Program": "Adobe Acrobat Reader DC"
  207.  
  208.  
  209. "Program": "Microsoft Publisher MUI 2013"
  210.  
  211.  
  212. "Program": "Microsoft Office Shared MUI 2013"
  213.  
  214.  
  215. "Program": "Microsoft Office OSM MUI 2013"
  216.  
  217.  
  218. "Program": "Microsoft InfoPath MUI 2013"
  219.  
  220.  
  221. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  222.  
  223.  
  224. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  225.  
  226.  
  227. "Program": "Microsoft Word MUI 2013"
  228.  
  229.  
  230. "Program": "Microsoft OneDrive"
  231.  
  232.  
  233. "Program": "Microsoft Groove MUI 2013"
  234.  
  235.  
  236. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  237.  
  238.  
  239.  
  240.  
  241. "Program": "Microsoft Access Setup Metadata MUI 2013"
  242.  
  243.  
  244. "Program": "Microsoft Office OSM UX MUI 2013"
  245.  
  246.  
  247. "Program": "Java Auto Updater"
  248.  
  249.  
  250. "Program": "Microsoft PowerPoint MUI 2013"
  251.  
  252.  
  253. "Program": "Microsoft Office Professional Plus 2013"
  254.  
  255.  
  256. "Program": "Adobe Refresh Manager"
  257.  
  258.  
  259. "Program": "Microsoft Office Proofing 2013"
  260.  
  261.  
  262. "Program": "Microsoft Lync MUI 2013"
  263.  
  264.  
  265.  
  266.  
  267. "Program": "Microsoft OneNote MUI 2013"
  268.  
  269.  
  270.  
  271.  
  272. "Description": "Creates a hidden or system file",
  273. "Details":
  274.  
  275. "file": "C:\\ProgramData\\Windows\\"
  276.  
  277.  
  278.  
  279.  
  280. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  281. "Details":
  282.  
  283. "MicroWorld-eScan": "Trojan.GenericKD.41558898"
  284.  
  285.  
  286. "FireEye": "Generic.mg.79d35c1fedc5bd29"
  287.  
  288.  
  289. "CAT-QuickHeal": "Trojan.Dynamer"
  290.  
  291.  
  292. "McAfee": "Trickbot-FRDP!79D35C1FEDC5"
  293.  
  294.  
  295. "Cylance": "Unsafe"
  296.  
  297.  
  298. "Zillya": "Trojan.Fsysna.Win32.18426"
  299.  
  300.  
  301. "K7AntiVirus": "Trojan ( 00538d6f1 )"
  302.  
  303.  
  304. "Alibaba": "Trojan:Win32/Fsysna.c662bb07"
  305.  
  306.  
  307. "K7GW": "Trojan ( 00538d6f1 )"
  308.  
  309.  
  310. "Cybereason": "malicious.66ba01"
  311.  
  312.  
  313. "Arcabit": "Trojan.Generic.D27A2372"
  314.  
  315.  
  316. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  317.  
  318.  
  319. "Symantec": "Packed.Generic.459"
  320.  
  321.  
  322. "ESET-NOD32": "Win32/Filecoder.Shade.B"
  323.  
  324.  
  325. "APEX": "Malicious"
  326.  
  327.  
  328. "Avast": "Win32:Trojan-gen"
  329.  
  330.  
  331. "Kaspersky": "Trojan.Win32.Fsysna.fnwz"
  332.  
  333.  
  334. "BitDefender": "Trojan.GenericKD.41558898"
  335.  
  336.  
  337. "NANO-Antivirus": "Trojan.Win32.Kryptik.fvehci"
  338.  
  339.  
  340. "Paloalto": "generic.ml"
  341.  
  342.  
  343. "AegisLab": "Trojan.Win32.Generic.mDuT"
  344.  
  345.  
  346. "Endgame": "malicious (high confidence)"
  347.  
  348.  
  349. "Sophos": "Troj/Ransom-FOT"
  350.  
  351.  
  352. "Comodo": "Malware@#92t3141iz9yt"
  353.  
  354.  
  355. "DrWeb": "Trojan.Encoder.29207"
  356.  
  357.  
  358. "VIPRE": "Trojan.Win32.Generic!BT"
  359.  
  360.  
  361. "Invincea": "heuristic"
  362.  
  363.  
  364. "McAfee-GW-Edition": "Trickbot-FRDP!79D35C1FEDC5"
  365.  
  366.  
  367. "Trapmine": "malicious.high.ml.score"
  368.  
  369.  
  370. "Emsisoft": "Adware.Agent (A)"
  371.  
  372.  
  373. "SentinelOne": "DFI - Suspicious PE"
  374.  
  375.  
  376. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  377.  
  378.  
  379. "Webroot": "W32.Malware.Gen"
  380.  
  381.  
  382. "Avira": "TR/AD.Troldesh.cswxi"
  383.  
  384.  
  385. "Microsoft": "Trojan:Win32/Occamy.C"
  386.  
  387.  
  388. "AhnLab-V3": "Trojan/Win32.Bunitu.R285495"
  389.  
  390.  
  391. "ZoneAlarm": "Trojan.Win32.Fsysna.fnwz"
  392.  
  393.  
  394. "GData": "Trojan.GenericKD.41558898"
  395.  
  396.  
  397. "Acronis": "suspicious"
  398.  
  399.  
  400. "VBA32": "Malware-Cryptor.Kirgudu"
  401.  
  402.  
  403. "ALYac": "Trojan.Ransom.Shade"
  404.  
  405.  
  406. "Ad-Aware": "Trojan.GenericKD.41558898"
  407.  
  408.  
  409. "TrendMicro-HouseCall": "Ransom.Win32.SHADE.SMA.hp"
  410.  
  411.  
  412. "Rising": "Trojan.Kryptik!8.8 (TFE:5:c58S5XuMEHB)"
  413.  
  414.  
  415. "Ikarus": "Trojan-Ransom.Shade"
  416.  
  417.  
  418. "eGambit": "PE.Heur.InvalidSig"
  419.  
  420.  
  421. "Fortinet": "W32/Kryptik.GLWT!tr"
  422.  
  423.  
  424. "AVG": "Win32:Trojan-gen"
  425.  
  426.  
  427. "Panda": "Trj/GdSda.A"
  428.  
  429.  
  430. "CrowdStrike": "win/malicious_confidence_100% (W)"
  431.  
  432.  
  433. "Qihoo-360": "Win32/Trojan.6d6"
  434.  
  435.  
  436.  
  437.  
  438. "Description": "Creates a copy of itself",
  439. "Details":
  440.  
  441. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  442.  
  443.  
  444.  
  445.  
  446. "Description": "Harvests information related to installed mail clients",
  447. "Details":
  448.  
  449. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  450.  
  451.  
  452.  
  453.  
  454. "Description": "Anomalous binary characteristics",
  455. "Details":
  456.  
  457. "anomaly": "Actual checksum does not match that reported in PE header"
  458.  
  459.  
  460.  
  461.  
  462.  
  463. * Started Service:
  464.  
  465. * Mutexes:
  466.  
  467. * Modified Files:
  468. "\\??\\PIPE\\wkssvc",
  469. "\\??\\PIPE\\srvsvc",
  470. "C:\\ProgramData\\Windows\\csrss.exe",
  471. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  472. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  473. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  474. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  475. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  476. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  477. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  478. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  479. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  480. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  481. "\\Device\\NamedPipe",
  482. "C:\\README1.txt",
  483. "C:\\README2.txt",
  484. "C:\\README3.txt",
  485. "C:\\README4.txt",
  486. "C:\\README5.txt",
  487. "C:\\README6.txt",
  488. "C:\\README7.txt",
  489. "C:\\README8.txt",
  490. "C:\\README9.txt",
  491. "C:\\README10.txt",
  492. "C:\\Users\\user\\Pictures\\Host.zip",
  493. "C:\\Users\\user\\Pictures\\JtZhJvldPOYDA4h7gQKPe+Gjg2mNEkZUz8EzJWZ4JYA=.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\Pictures\\Host.xls",
  495. "C:\\Users\\user\\Pictures\\H9Mf4imhixeSTR32n47zKTGBENi5d1j-w9rG-B7stQ0=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\Pictures\\Host.pptx",
  497. "C:\\Users\\user\\Pictures\\U9G4IIMyV6AQ6FqlSY8yMD8nNzRTSASObzGRauZTPk4=.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\Pictures\\Host.ppt",
  499. "C:\\Users\\user\\Pictures\\lhmn3VdSdHQA3Dsq7PYplKWATo7HIBPMJPfuhzCCFhk=.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\Pictures\\Host.pdf",
  501. "C:\\Users\\user\\Pictures\\vGS4vqzKcwEcxScc9zH6N7Vp4F+DUl4yzN0j92+LhlE=.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\Pictures\\Host.jpg",
  503. "C:\\Users\\user\\Pictures\\gCDSf0uRTbLCmJlGxR3k7MmA8vfMTI4uNeG3klpTi+A=.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\Pictures\\Host.html",
  505. "C:\\Users\\user\\Pictures\\6P+GxLnZ8U69SVwQ68N71Kmp4CRW85ayafH1+ABlPO8=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\Pictures\\Host.gif",
  507. "C:\\Users\\user\\Pictures\\SY0yXHaMR8V+VhF854-t0Rw71X2bAfTU8bfP0LEeoTQ=.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\Pictures\\Host.doc",
  509. "C:\\Users\\user\\Pictures\\n3Ab5+HFYATmD3+Qt39DFCkDp5RcS4UXJ143QlQcruE=.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\Pictures\\.xls",
  511. "C:\\Users\\user\\Pictures\\m0afhisZMLVQvJaIQ+SXyw==.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\Pictures\\.jpg",
  513. "C:\\Users\\user\\Pictures\\1VLpwSmxunnW5EgUrza3lg==.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\Pictures\\.html",
  515. "C:\\Users\\user\\Pictures\\MzJcL-2msWkkngoRaxwnPg==.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\Pictures\\.doc",
  517. "C:\\Users\\user\\Pictures\\llYA+bzybe2KNObYWVevHg==.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\Pictures\\.bmp",
  519. "C:\\Users\\user\\Pictures\\79r7dkpQV1WcPf7FNBhC4Q==.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  521. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\hGMtRQcWfWD4oNF0rFquml6SZzjslz508g-qD6PAkxUE4Dc4Tmegh2sUsrgq1uTG22+R9hBga77A65nxeIga+SwG550tlZu0gI5thTtTk3MF99UU9rx1OHW0ecnke2Tr.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  523. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UpJ0g9fMUX+n9EtQVkjkIprOSLBT0PoVBJT9wUo3Wi4=.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  525. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mwIFofr0PBjCU51AScwh1WZ21xhfweSja6AulLPSqq8uQrBga2LDg+kWNOZi+LKd.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  527. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\U0I5b2sZTJ9v83CjzKAdKE2EvxiedRgd6it9m1gBQyM=.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  529. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\fUEc9iXCtMMXsOZbbN7hPjptblP5RkdDVKUWu5EOg1o=.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  531. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\NO9uVcpQOftuakq5IUBpZIABQOeuyUHCwD5FyqsxQfA=.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  533. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\fKYuW0rWvETMNxWXWfJB2jzTqVsLYdKz46VgXPz6JePlSlWgcCBYUAVMehzr1AMJ.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  535. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1FvowrgIWxd+GcLqqd+JKbhlTylX-XOtg-uKE0optk0=.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  537. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vnED0WOTvzIwXi1Kl8-LR5FtxAgj11O04RAJ-Wux7xCojXuL55Hi1zR3tMPE4V8j.C30C4DA81AE308962B9A.crypted000007",
  538. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  539. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\2IdWyPeSZJ6oJK117ho4+Q99YYsbw-t5U9yGvXvIPDc=.C30C4DA81AE308962B9A.crypted000007",
  540. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  541. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TK6thEG5NUOqRWdJpDfWe4Ok14jAVbNTqH9wEGvFtug=.C30C4DA81AE308962B9A.crypted000007",
  542. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  543. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\OkR1ADEtVPJ8kMLp5xtgjuFikOcJJkXuOC8-XyLxwU8=.C30C4DA81AE308962B9A.crypted000007",
  544. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  545. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\c1btYcmuvHjMi4zk4EvGXtR0g-81+JUPuaSrD9MSF3A=.C30C4DA81AE308962B9A.crypted000007",
  546. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  547. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\eB+04O-Y7FrMdd1pTBWRk0B3CRDTVygDB75io0EHNQeBcNl37wyv3BIGM5Tz2ipo.C30C4DA81AE308962B9A.crypted000007",
  548. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  549. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\n-tm83mAQOELOVRzMX7cK-EqYJKbBY7ykX4ad8dQyqo=.C30C4DA81AE308962B9A.crypted000007",
  550. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  551. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HviBhprzXXVu++y+lli3XQhrfYk0mFhATW1oC8TaNiggVvXb2tXTmSHtP2XXUtnV.C30C4DA81AE308962B9A.crypted000007",
  552. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  553. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\XvVIIELQDci51IlUvIPk6M8TlB11KMjDPu5K3I8yD0I=.C30C4DA81AE308962B9A.crypted000007",
  554. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  555. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\wNj35Ibp8Q6mOloe8cTrFttiIwiv0TWVFaziv-vvf0o=.C30C4DA81AE308962B9A.crypted000007",
  556. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  557. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\RuioUg0on5OsimohdJPLBFmKBlusapsh7ozXLLq0WXU=.C30C4DA81AE308962B9A.crypted000007",
  558. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  559. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UrKcz9bohCWcGrMfpMtlLZdbN4o5iCOM5X4AtCmCQqI=.C30C4DA81AE308962B9A.crypted000007",
  560. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  561. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\g3g7YjSn3Kih8xusQd3IKVC3TL19gXjuo88AG5yLiSY=.C30C4DA81AE308962B9A.crypted000007",
  562. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  563. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\iIa2hJJni11yk6yPHylxkL8zsN-IJyhLbqiCnhZ8Vqk=.C30C4DA81AE308962B9A.crypted000007",
  564. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  565. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\zxPt+MHdRq0w3sF+M-98cHRSqfXBqWhlPHy9qaPSAH8=.C30C4DA81AE308962B9A.crypted000007",
  566. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  567. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\XYfWkLTkq9SA5OGWcMrr-w6uzoMOViqWeZhVxchLsHg=.C30C4DA81AE308962B9A.crypted000007",
  568. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  569. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\gLhr7x7cqvlfN5tf9x1G87fWyp+JTLujpgXeNWpy+FQ=.C30C4DA81AE308962B9A.crypted000007",
  570. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  571. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\QtjbNO2XGvrMJQSrc7gwj0oKSnrfPJyBjEdxvwGoSiM=.C30C4DA81AE308962B9A.crypted000007",
  572. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  573. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\dJ5qO8CnwAWDOb0TcwbJIfAnDztxZg8nc9ZYfqLSoX0=.C30C4DA81AE308962B9A.crypted000007",
  574. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  575. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\FGGzpz-PVH5hYWo5QQSrqPxxPouc3j6Xiaa6WlTwmWU=.C30C4DA81AE308962B9A.crypted000007",
  576. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  577. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\YP0X-mOpfL62iPYH0-keKc0ACSbV7TE2X34eLzzPrn4=.C30C4DA81AE308962B9A.crypted000007",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\tsNNGG-wA9W8pp9dF+UeP6DXCRn-MZiAX9cNE62VtjM=.C30C4DA81AE308962B9A.crypted000007",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Ox8TpuSWp1S+mf3G8BYo0TpgVcpc5sQ0Pd7tf3iCGLTFFZCUxsTM+T5NBiMXBCtQ215sdcwyWKCij7-hQM6Nrw==.C30C4DA81AE308962B9A.crypted000007",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\LNcWuCXL2eavaUsHVc5zh883OtCAVmviIgB56yOI5yLiU7r2GoLrKdIxKI3UrzqUpe8W44qcm3KLJHOlE8lR4w==.C30C4DA81AE308962B9A.crypted000007",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\QUg3kwlGbC6MnU50eYNEvl6EGeCXtXOVQeqTv2xkpq-zdWKNHOF4NfFPZEWWzvTIbSBWG3+Pj8G1WNgXRNZFcBV1bA-rlPAOlBTOvp1QbFOiKJVELbg1daqgppV5B4xwfKesW5iUxxbXqq3doknWKKaC4SBt0h+uZthsh2THbnCtKvrHiKDCra9-SxN8tGUU.C30C4DA81AE308962B9A.crypted000007",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\nwPUX2e5uH5gCpboAcbNNImRxJYfWQDUyDSLMzFY14DKnIUG0f-zel9V-syAcnUU+Z1hlJ0LR9Ur2UEt2mO3tw==.C30C4DA81AE308962B9A.crypted000007",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\7oP4cKuVsAg6H7CA-rbsfBVELDBJkG1kXb0jB1RzvzQXNV-PMlTeduSJqqG4A4z9675mJEAlGVaRM4vMQLgzxg==.C30C4DA81AE308962B9A.crypted000007",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\HmeaqCPGyX0kieQr5InFNtG9vl8f4w7ZHNEHyW-um42EZu96es0lwhpZH-uPImlojvtIb8iHkl21CqBqm2kQTA==.C30C4DA81AE308962B9A.crypted000007",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\bn5SOX5th3M-fSBCjEYsrkGPMh7l4K8MMkPEYuHCS4V6j40Q6yfxo1xqsZFwvL8Ah9DU+kfjWLUrYslymWCjdNTYHONqCdgCaRrDQ+fxJSNc6BIEI1tg41bYoAwQLiLqE-Cgx61dVnMAJg6yVCcFXQ==.C30C4DA81AE308962B9A.crypted000007",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\SQT6Pz-C2OrTIaPC-EWgh+E6LwKHAheA0eovV1P51Bw9so8ZGXrm59H9DjYCmmBxmXxcllp03c3lm6LERP86YUNTvHIkt-RLW1nP+O+T02Y=.C30C4DA81AE308962B9A.crypted000007",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\CcmigwXBYxfdIU5cUXv-Bj5Petqz1dNQS9x1eB2vDAX80PnQnpCEYtZfbHJmQIRYDtOLruTjhfdHPrAyKfAgLQ==.C30C4DA81AE308962B9A.crypted000007",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\jCftYydZ6I2ZrlDW8u-2x++jbz7Xk8j9Uj-W+yGOhDAdzisPrS9bT7wGhALYgsACC5y3PvHDXCLZQfcEDv79S0jfJ7J1+f+SemN0G54U65HaJ0HxESZRq28EjL5Tgx2O.C30C4DA81AE308962B9A.crypted000007",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\yq3R-HK5jy7dF1jlSgj1yF8W96QYV1tISPctZU9FzkGDCVFQARnMq+w7hsEaUSZk-35QgJizjtrRxt4rVwZXzg9rlNuhCrVHmHHnAn6XOwUNChDA1uU3XJ-YNfrGVlGqAhwTA-wu6wIj73-KSdLBzw==.C30C4DA81AE308962B9A.crypted000007",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\pTKMJpbHka1IPEZjm48i6KW7S0pvvDwlTXMRvxSFnzj957Plp69GTTapsB8viFW570oJcnoSQat3J3Y7L8pOeQ==.C30C4DA81AE308962B9A.crypted000007",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\L3P5nGf5hVU6Gu7LBg7FO3ZreHlkXMaBKbg3cwdCh-f9EpNbdQq863IMDXmytLsOrgJSdIMlI7ZOnQmW0USRfA==.C30C4DA81AE308962B9A.crypted000007",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\2LJIs+OyajbU5Ijh8JfWumKcSx966jmYljx5cJUWoH7Iuzc+OXwhzPZIQYq+LQmF.C30C4DA81AE308962B9A.crypted000007",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\uvKK198X-WACvVLBo6qf9pUs2Ex+aVo6qnY13hAKeFHI3wc0s2-iErXV+vlnnIyKU3ucjS-ioSZrUOPZa2X3Zw==.C30C4DA81AE308962B9A.crypted000007",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\5V2V1jkSB-qTvCJ-KPo9fwjlI1f46cMzTd8dUou9CYkSHnHdaZOVho+kpHZr4WXqPBeTk-tig8s5U0bYMRs0hd+SomKSSf6t4RzlRrF5SCRyBclM+WwPREykei3S3g+w.C30C4DA81AE308962B9A.crypted000007",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\80nzkhwSZtSJ9lw5kr39pCar77uEPnKHasK5ITuTU1Fh07K8IgHxeLFPSNIM8iwJgtK1Qysa-dIClSJSovuVrQ==.C30C4DA81AE308962B9A.crypted000007",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\WNN2kSJFGoAUmiwPqZrvYa19z+cvt-cJAfAVLHoGp-Xmv0-xhz2OFPAif+FnMGqNONlvgCSVR-x7YWH9VfUVgQ==.C30C4DA81AE308962B9A.crypted000007",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\spCb-CkJFEDWGAL0OEQw6KG4+TqgxWIvy+QTsMqwcZwSHlqxBrFHAle9GdNdZqY17azLuc-RJWr8GbFTYxYyEA==.C30C4DA81AE308962B9A.crypted000007",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qp-v3JhQ8vMdZjNjMLWnb-SmedYU3+DBaRSR+yb154zYoFo2By41x-x4xu5-x90I0cMxch-ssvdEhvS6YBC3Xw==.C30C4DA81AE308962B9A.crypted000007",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\on8pd4gkRenKJGtKJzuknyOJoWExIx0snTnOn3WJ82qXeSIuI09zhROuf6eCzuf5jm8a9Htd24yX0G9yFg4+CQ==.C30C4DA81AE308962B9A.crypted000007",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\C+QBsgQku5IR8SxoTyrXAVKVjjpP4A04cM0RGBZ69CYJ0-nM-B64pKQ193LIJpShLbDvIvqRmfNJpuQSfeHClA==.C30C4DA81AE308962B9A.crypted000007",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TGzBVCFyeAolmymqy2iR4XkeABvkXOhdzl0eIiIgUKpi07Vstl0QqDwPPKbskenzthRUs6q6MRjIPldOqFlI3eDCFoVQISjmOwmyIm60L64=.C30C4DA81AE308962B9A.crypted000007",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\M0MgWhstdHbHVsmJsDeIEEHK6TcaFK3PrWDKWSxHvULSwKh15Xjzz6RLAEP0MST3UZJyeonISr6puCF2RXGtVg==.C30C4DA81AE308962B9A.crypted000007",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  629. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\o9AM5vadIKE5XsF-XsS2CMsOBm-euiMH4sr-+7G6bHIJoWP+qi6Ie3lADW2X+PzlEtQVH4-3rtIlQJwN50quvw==.C30C4DA81AE308962B9A.crypted000007",
  630. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\2GN2ZHusA8vm8nroubQQfUmUquPWp8hgVKcIGFzDHlUnvGATAmMEtYq9GK1kU94eic9of0WY6ec1woY1vh0dtg==.C30C4DA81AE308962B9A.crypted000007",
  632. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yLfZgEjeWZ1gtNoHQAxGgP6CsXAUfLjWnEqkDlpS-AEaRIOZ-jLnYM0BZsoXtdHGvjjcSybEEt7AgIjUFmwkzQ==.C30C4DA81AE308962B9A.crypted000007",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  635. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TMnaQqFGstsdHwHBGfJjWFsgxQfoGMjwTLJXFYKpzsISUbDbkCSyLHmqxQz2efPphLsD52mY1s4wED5GET5H4Q==.C30C4DA81AE308962B9A.crypted000007",
  636. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\cEt1jR4-85lOVTbEVMJpsXciHQ0MWH+sFI8CpdXm0YK54oF-+flTWZY8B5nXPNiv0devNcxBXL++JEonMz+HCw==.C30C4DA81AE308962B9A.crypted000007",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\YqpdlHVr1Mn1dxiQsaWgKnlHKIKnqkgMcvQg-jJYNY6URB2u1uKf1jZMfqjhwNcZCS-CSgIyEFy3KHeFoyX-bw==.C30C4DA81AE308962B9A.crypted000007",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  641. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\gja55cebHPVy2ZNaopkPTEW9ZA3tC+dA2jy7Mw-WSALjB1sNmhBWVMXtk2i4KkTW7RZ+OUGOBJ++awN8M+jUQA==.C30C4DA81AE308962B9A.crypted000007",
  642. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\guvC4EUED-pTvfjojEcZur0V87dbp74234rmErwQjFRGf3FDT5EeitVEqg8DkwJElcuN0lzk0ozvM0vkVRUbLw==.C30C4DA81AE308962B9A.crypted000007",
  644. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  645. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eC5Fs-TLN8WH23peMIShM8pYcMME7+D6TCHwymVTJSMU3nXaxzRFGjlLJwJ+mqxHJhGsCrXdpuURLGcHV-QkIg==.C30C4DA81AE308962B9A.crypted000007",
  646. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  647. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\np8g-qpUnB98lktWUH-ucwmg7NBqlm5Q82N4J3h40-qlNMDZAfbKRfUUKi6Agdf3HEqo5S1ywbgIMAgdptt1fesrPGY8x8Fa8xEYu3vnqfo=.C30C4DA81AE308962B9A.crypted000007",
  648. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  649. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\glZPoKIJMzfwi4FiNpMqnQA2Bld+8U3F4DGaGUDtDUVzszk-i7eLNfsiUSVWeYseBqg6TZornx0dGBJ7GNDeZw==.C30C4DA81AE308962B9A.crypted000007",
  650. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  651. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Bgke6o9w4alJ0SaVl+qtrzuzxGxiTwyZeMwV0Kll5IVFZYFYvs1EqsSbAHX48LjkJpEIEqkSBAdZ+OADfDJU9g==.C30C4DA81AE308962B9A.crypted000007",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  653. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Jv6FHeTXI77Xf6K5PFP5MLU1QbQQG7fzVCRkwWAVo5o9LLwDA3C9I95qARNvLXXZ9VA118QfrbtmwtXsk4iSDQ==.C30C4DA81AE308962B9A.crypted000007",
  654. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  655. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aeSModqjMzj1HQqUhnWXDGO7rwvDKt8dlJj+rsKaZBtkylSAUQ8oNSiegDisBoGODql1SvB5TrN7tSmnwsiDbg==.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  657. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\SH22NeEEMp4RNCz--R2LuLvznNr2LpT9XA7zBvzBncD2v0HoUYYr0yBgIQ6LDlUZzweWEB9q9B4xaDeWUjGFnA==.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  659. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Uv7-u1fsQwbjrVKoNM2IxhpKyaMwAqSYAUlx2ICAT6rSZdYElasyX6vL3EGCx3Ef4uSQ1BEHjbqt18NM+LcrWA==.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  661. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\OSXsL-kUcG2iAC7PQHxZ2I+DuWbMG07vafY0ouYZMCCXtXTZ2i2XoPMCKcRitSdr.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  663. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\j65viNGbDNBJMMByTmVTYUK6r0rte-zpinqyBZ2gTkM=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  665. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\+D5pxufnP8WemZhqF0qmbDgBxXTs3T8nlQ0rxrpxxD0=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  667. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\9mZGncxMxaW8eMRzS-dMJCfpggza22KyFhRyvTEWnoY=.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  669. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\47JwRzvwv+KYwI9USA2dz61FNJxpD8u1ZEXO3VBAhOw=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  671. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\RtHMgOP5-65yGJLikJNH0UO--OsV9WXo5VlzAD50LAU=.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  673. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\8ppY-nQRk8uBczmpxC08WEEYdUqTkhyllJsakMPhlPBAp0ABsGU8mml01yMx0mGfPyd9jJI4uZ1VhDbMulPrXg==.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  675. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\mX-+4BsVcZF0SzbmIgjz4qMs9g0IbeTK9Mvznhbr9d8VRXpQZ9zglvOrPozFbbI9u8MlDi589OLUzhTR0FNUnQ==.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  677. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\yjHAJNWRAuY6oeRJBWpdVfNbF1PACJTQnlDeyJubvrM=.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  679. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\E8vaFke-Q8IpD+QQ4OXVMlWNBHjuFo5czWD5eQVeaa0=.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  681. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\rKxURrtTAqiZK0a5pJA58v50l1v69H8gT4ReTa-ewenKW0hvSmkwSoO5bIvTIJp1h8h4Q5g3vVE-6ja2Yb2Uh1FMgmRHgvTpQOF2CqRojm8=.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  683. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\wL5zzMTD03y4I2IuerJHUId85wdZQq62sicOBCsmK3Qawk1IOrN0k-oLxsk-6ITD.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  685. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\trjBIj8sbMMtBtOGoMLL3hX2KnI3A+AYA-UFaOkbihk=.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  687. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\PMUyfn1y8bqu6XsT7eevczcvlapon2xt3xQSeHeQyC0cD4oEFhFqkR4+e4r040lc.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  689. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\9dA7DauTzMmfB4nh3Fw4mwGrRFfMeuocOXpej6-wmvpBsZltbxMo7NrZL71ksLU-JjbUWEHPdcUNpitSyVtErsGTT4PYCSxQ4JkaBris9FY=.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  691. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\+3-NsEF4uOoHqaENCcm3hl+iXeUrn1gZARTaRPF3isQ=.C30C4DA81AE308962B9A.crypted000007",
  692. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  693. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IJ-xcghAhsrONxgvCmFEPqP8v2leKhKbqdYFyWiuYg8=.C30C4DA81AE308962B9A.crypted000007",
  694. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  695. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jJpCYZt5uXb-S2WTDhTcUA==.C30C4DA81AE308962B9A.crypted000007",
  696. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  697. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\sOqE-nwNicDXJJZYSSQW++VaiMCIgIMpZLtlXA8pHtI=.C30C4DA81AE308962B9A.crypted000007",
  698. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  699. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\9usiESMnLbniqkcqLXtMAKS2Ghb11VWm3+JtmT5myqWqsFFlwJtqgLIR6ZFfyApmqIszjU8VQCDjP2YHmdvTBg==.C30C4DA81AE308962B9A.crypted000007",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\t+M1OImSSnUhqCcbmAR7OWxbns0aTFNJ6MsHrWkEtUSECegVHL5zCr-Wl+Nrw4b2EIvtUK6LDgUC4lorzmyqkFCmD1sLgv6tQcOqPi2J7Xo14dL5HxeVLeEGKz5rTwpP0yW2JQkzaacKZJVKgGQlCA==.C30C4DA81AE308962B9A.crypted000007",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\cfFbwn49SlH1jH1x8XrucqO1mOb-8XXZH6qu0nNxYpwLma1oww-S3QsvnDCbcrJyR3ichdWo3q3Bz3cRGbirOg==.C30C4DA81AE308962B9A.crypted000007",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\E46t2SJwWbfzo4jj695j7jj8Zz28HWcs41jQeXJFY1nqaCEpKifmr55W6sgla3iqBW1TO2kezzcjyUhttnKp7OrYfDLu3oMuOhAzULzfmFs=.C30C4DA81AE308962B9A.crypted000007",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\o1niMKLRs-KH+G4XLupTRPEQmo2xiy-KL8MPA8oWD08=.C30C4DA81AE308962B9A.crypted000007",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\hfQcmKxWz7EQyIJKHpvjiBqD3VBkdv7zVOaYQYJst+U=.C30C4DA81AE308962B9A.crypted000007",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\X1bbJXf-sWEG4+xGlmpdSqwfMc6Gyec6BMIbzGAg9LM=.C30C4DA81AE308962B9A.crypted000007",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\589Y5aVeQrqrPdWsokQpnjAvzDe3T883KU140x+DIQ-qtj6w0w2yyS-9iaG7gkMvKM1ECs0JUNJI863yWJDDIlPesm90D7PMyQM0+2Zu8Yc=.C30C4DA81AE308962B9A.crypted000007",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\g7mcYA8tYvyVCI-7Nvx3YreZYy-ylLGRFCXwHlNDi7o=.C30C4DA81AE308962B9A.crypted000007",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\UIa1lrgvLvDvB8zXdZNxN8mL8KpricIdwbPrlx7kOjs=.C30C4DA81AE308962B9A.crypted000007",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\cVlNweFBrGMlEDIwLSMW0hDExl59wFw8VDf4bVa0WeAmitoYsVwn69Pfs9+Lxr7i.C30C4DA81AE308962B9A.crypted000007",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\mc1UtdjpSwOU8uK3FwbKOw==.C30C4DA81AE308962B9A.crypted000007",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\KpYrNovFVhaASU63k-c9Bns3MJmQ-PUb4UqUs1NEl2SFEuaidabNdjNNo+S3-DDw.C30C4DA81AE308962B9A.crypted000007",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\rcyDqXIfT+wLHznu42pCzqkEDRnvejLN9WySw-IlYHw=.C30C4DA81AE308962B9A.crypted000007",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\FSc8rsj8pk2O0ytS66rZqkGQJP9-6R9GxMv8eUUoyEI=.C30C4DA81AE308962B9A.crypted000007",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\5b2hDiVhB7ij4dWLmRREJodbfkNP34HcphXAMEzWD68=.C30C4DA81AE308962B9A.crypted000007",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\Troldesh_79d35c1fedc5bd292a9f2de9df9f6bb7.jpg",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\5fHZjhG-9u3FZpsHz6Ey4kn5MiDlfMZLTG6YwKxvqzcBB6zOXK4-BGUe2bcW+GFEIozgljpNAIbsOztYTHnQBw==.C30C4DA81AE308962B9A.crypted000007",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\kQDK6AjbeCwhXwgNGRW8Mj9s-EjJxzzNs5qsOwRosorahtXT3YNIF7b-1cYAx4neXPEsvaz0Ol-oSelttG+uzQ==.C30C4DA81AE308962B9A.crypted000007",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\y5LtXSL7LpiMHzwhK6mfisQ2rIGx9eo2PUbpbipsaVrjRNPkn540JAfsFnBDATSRor0gT7UdMuuSZtVbbYKh-w==.C30C4DA81AE308962B9A.crypted000007",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\CSI0PGVcH+qb8CjpDwR-H4VSMuzg61QAVGOXH0LrRIrWBN57KQeEkbHp5aUStCH4FEO-sz8Vb1C6kv2kHnTm+g==.C30C4DA81AE308962B9A.crypted000007",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\UvB8aYeHdbZc2iM7bgjMfw==.C30C4DA81AE308962B9A.crypted000007",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\ePQ6T9qd+KnFSQdlH9Kyzk3Df9TzGXtlPuWn4F9bDEz7PzJ1spdWWfR0YsxAyTm-ZyCZ47QVCdcnB-iibmNGt849xBE1GJ4MKA1rquPa86xq7KMvA1uIiH7IPd4fzzlo2-8cplivpTMWvTdwIOaCPzpWmTJe8cXBS8uQOAWvvSQ=.C30C4DA81AE308962B9A.crypted000007",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\VfmV4BoTT7OUFEgKx8MZQQSA5YMdPUVVh+tA7jTkhHqcTTa9e+AeJuokoK4SSR-PJ1tyE1rHEBw-CDIKWoXzh2OCfnT5wK8SyS85SK0GqgylTeGMKO9RbPYYFU+Z6pxVcZLVA3QpD86BMjsbJe792Y3w8jU4WEHCjX9SCbBkQTE=.C30C4DA81AE308962B9A.crypted000007",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\C2PhGk3w4PcQv2qndhXSCVXG1-AFCcosbpKOyiLTdTYlHZXqwHF-ZwNwbDJjaGiJsx6cidGJIidGaHtocRBmeIeTApvLGPlDzrWVlFJKA4Io74x76+4t8TTtT04AHnfMdKLmun74JUa9nq4xPmuMJPMiepPiryTQ0I62CsFEhf0=.C30C4DA81AE308962B9A.crypted000007",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\3GwMIiAowF+gTgF-vakpLbFmsnm48UgzhJo36DQIcB2qRdYzxfAKrNkpVdDrwLBXiel5GbtABf3fgnWUROjWjbflsgMhz1nVPSbwiZgAzJ8UQOS3PIzenGQFaTGp-95zo87JzfIa8Zv-qJmwu2TX0eQ29rVCvBCMKpOzRF2i+2g=.C30C4DA81AE308962B9A.crypted000007",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\axcJroeOBezoAo46OJCt8QetAeiJZQTBB0VPJqOwo6tPhNyPqoxvtv15l+zwo-7cwD49o3ydAgr8cP2zI+lyxb2hc9VJXEvRk57LSQQ6kQR5t+c8I97LM1fya5bOlGGdxuZNz7uKvycGjT+d36yRis9DjKYBdIexdei6emaSfdI=.C30C4DA81AE308962B9A.crypted000007",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\Mtl0k9QwB+v6r6B2-NK3uMfB2Mj39tCPtj44o0WImmqafzqUqCA8fy+MWmWUr5oZni-eZGOUidfbaI0sg3z6nQ==.C30C4DA81AE308962B9A.crypted000007",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\43LzepdKWSDbiBewxggwq+KQ5FAo4hRCRPNRDDUN2BhGF+HrG-HXLAUcDkpgIwi2LBC7ko3TLRHjhkR9o3NDUqlUlPlyQ9kcfArQcF9jq6YywlKQ5dKHyQ1955e00vXoocgD+BwGxX2yeAOmxPjLp22yoyxy3-3W1iWg6A1wbFI=.C30C4DA81AE308962B9A.crypted000007",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\2sTEKEV-oAvfDYZA-RqMcxBkNGgKVuHVL5bcbX8EKsPia367MWj+rpF+7dOzSJFL5AbJupSpbYX+FGCQWEA6LPQugpNBhaSY+OVVIwnpf1dNX8iosLMp8iaN2OSjdZL+wA1+p3svTrFFfomkOq6Ip75tCTslksjx6Z2yPOQnvEA=.C30C4DA81AE308962B9A.crypted000007",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\HD2cOGlCJLnzXSWgVtf65wma+XXrMW2DIULrd-+f8ir96uQyAkqPKt4DxX4Frr5oN4TFvmOkpFoa54AqF6dsH6kkGUd30wWuAVwQo98D3Q8H8h88QgrjAKT6mpNjEYix-jMWPPiapcZanzawbi5oVRFVE-YVs2EN9tNUsxaK60U=.C30C4DA81AE308962B9A.crypted000007",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\vEu61EJa+F-mvC4ahVXj6h3llel-drR-lcKSmIf3tWWZvJ0LLlh8z81+EwqvrwU-UKbv2Nb8ifzYKSPtDwwI+-7N7gr6gXB6JE4KOzb60-sRazNE9T0SPUSb8peCTNvDphCgx0PFGRa-XS12F4xB2WvDK3glQYTEAXEplqJkoho=.C30C4DA81AE308962B9A.crypted000007",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\zGI7ZSMrnOhOATfMJgys9hTUi5kx1dyx3NddlClHhQDF+upx3XIVQ2SufmL-ian23eGBCcBU1EsQMG8+FRZrMHgwMpL78BERxLf6IIv-s5s=.C30C4DA81AE308962B9A.crypted000007",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\l-3GqwQK5zCWQhScXwF-yc0GssPuZ9WF1Xo4EYlg4-SCr2nC1TvRkljzUQZQm5w-.C30C4DA81AE308962B9A.crypted000007",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\i3Bco5oieBOFj0Zx28zjMFlg-eC6K6HxPEo6bNT3dnhbkO2KnHlhbeCG74k0hzDEhfrKALVo3pN3M9Lt1y2Ifg==.C30C4DA81AE308962B9A.crypted000007",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\8fxrGKn8VaW2pOJcEa1Ig7tvulGv-BnyW7MMb4lCSf2g5qvgiVGyFD1qsNUgDTQcExrzoKvOPf562V33-rHY6w==.C30C4DA81AE308962B9A.crypted000007",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\FRDS6l0VrlbxlqBRV5ts9b9T7rkC3PNHPgfpmvrnkSaZMX8KXzy6YezoY1evd14LIpVeYiwEeSbmarU3PAuVpg==.C30C4DA81AE308962B9A.crypted000007",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\xchJXGUfuMbvFP4wfy8bDQJLQrEoAJvcN-A2oPGjWcw=.C30C4DA81AE308962B9A.crypted000007",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\5rQ7TTGuwIv07E82eLmPdTp1bbVUlmRKCSdpOiW6YirvD9y9pofD0M55OWCA8OsLy2Rp61X3xNF6-IleuhkzLg==.C30C4DA81AE308962B9A.crypted000007",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\zArAgYizXGObHiSgdw6S5lIfqUs31ENYSihoLCXVHNo=.C30C4DA81AE308962B9A.crypted000007",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\8IQb-ygKCmBQmNH2AnsEefRPaHknY+CJHSbkR1tqCgg=.C30C4DA81AE308962B9A.crypted000007",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\4nVIruDzg3GJRVvRE3B31VxJMQNg4V+aS4VkrFnrchTRs4uCWiiH4OycH7Y2gmLY.C30C4DA81AE308962B9A.crypted000007",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\QCk9GedQtB9FAdt7JDLPOeEsC0WlDjjkXzzd+11BsymPrfYBbJqKqDk5zSoC1bBnP0u3Rij-MAUhYWxdimsoleDzT5A9-ZWLy2tJonEcUUCPnH55M+g0FH33HjBx+2fiuYYC-g6MqwFPtIBpa-w5ebCjNhvJL8Q0S6U+oXrZRXs=.C30C4DA81AE308962B9A.crypted000007",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\8H9jJTPNQHkjIvrXeFlxIehia-gs3DOCERs-1FTLW5-6-23S9CurRwV-O79kATcyTxig1R9LItiGk408gF8l3Q==.C30C4DA81AE308962B9A.crypted000007",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\tfJN+u2OKEdW8SAzGg1Mi0eo0T62WS5ETQOLxHSLHzIPiy706EcgG-ZLBP6rC0BX.C30C4DA81AE308962B9A.crypted000007",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\PMgmO1MASqWG9opccT2vCt8TAkIcNXteB668TGxAwZhRK3D6tKnHnn76Ko9M9b8jc9ZEYtE9pZB6B6sAw-VWjw==.C30C4DA81AE308962B9A.crypted000007",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\oVUg-TeqlBXJUfYx-5lN8SnRVVZljkVay95+r-qkjGw=.C30C4DA81AE308962B9A.crypted000007",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\l9LW5Ya2+am9CJUfZfKTgPSUzVJBYdeZJoImNlHEexU=.C30C4DA81AE308962B9A.crypted000007",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\Qy2StRZER+WFGEMDUsa01432TfGIKLx4cPzkhT5plgrl9NkBwDsuCC0oiFGwosQGlYZalGSEpUs32lCC4j4n2Q==.C30C4DA81AE308962B9A.crypted000007",
  784.  
  785.  
  786. * Deleted Files:
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  792. "C:\\Users\\user\\Pictures\\Host.zip",
  793. "C:\\Users\\user\\Pictures\\Host.xls",
  794. "C:\\Users\\user\\Pictures\\Host.pptx",
  795. "C:\\Users\\user\\Pictures\\Host.ppt",
  796. "C:\\Users\\user\\Pictures\\Host.pdf",
  797. "C:\\Users\\user\\Pictures\\Host.jpg",
  798. "C:\\Users\\user\\Pictures\\Host.html",
  799. "C:\\Users\\user\\Pictures\\Host.gif",
  800. "C:\\Users\\user\\Pictures\\Host.doc",
  801. "C:\\Users\\user\\Pictures\\.xls",
  802. "C:\\Users\\user\\Pictures\\.jpg",
  803. "C:\\Users\\user\\Pictures\\.html",
  804. "C:\\Users\\user\\Pictures\\.doc",
  805. "C:\\Users\\user\\Pictures\\.bmp",
  806. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  807. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  808. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  809. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  810. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  811. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  812. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  813. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  814. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  815. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  816. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  817. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  818. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  819. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  820. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  821. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  822. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  823. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  824. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  825. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  826. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  827. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  828. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  829. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  830. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  831. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  832. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  833. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  834. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  835. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  836. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  846. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  847. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  848. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  850. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  852. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  853. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  854. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  858. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  861. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  862. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  863. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  866. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  867. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  870. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  879. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  880. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  892. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  933.  
  934.  
  935. * Modified Registry Keys:
  936. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  937. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  939. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  940. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  941. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  942. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  943. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  944. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  945. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  946. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  947. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  948. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  949.  
  950.  
  951. * Deleted Registry Keys:
  952.  
  953. * DNS Communications:
  954.  
  955. "type": "A",
  956. "request": "whatismyipaddress.com",
  957. "answers":
  958.  
  959. "data": "104.16.154.36",
  960. "type": "A"
  961.  
  962.  
  963. "data": "104.16.155.36",
  964. "type": "A"
  965.  
  966.  
  967.  
  968.  
  969. "type": "A",
  970. "request": "whatsmyip.net",
  971. "answers":
  972.  
  973. "data": "104.18.35.131",
  974. "type": "A"
  975.  
  976.  
  977. "data": "104.18.34.131",
  978. "type": "A"
  979.  
  980.  
  981.  
  982.  
  983.  
  984. * Domains:
  985.  
  986. "ip": "104.16.155.36",
  987. "domain": "whatismyipaddress.com"
  988.  
  989.  
  990. "ip": "104.18.34.131",
  991. "domain": "whatsmyip.net"
  992.  
  993.  
  994.  
  995. * Network Communication - ICMP:
  996.  
  997. * Network Communication - HTTP:
  998.  
  999. "count": 10,
  1000. "body": "",
  1001. "uri": "http://whatismyipaddress.com/",
  1002. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  1003. "method": "GET",
  1004. "host": "whatismyipaddress.com",
  1005. "version": "1.1",
  1006. "path": "/",
  1007. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  1008. "port": 80
  1009.  
  1010.  
  1011. "count": 10,
  1012. "body": "",
  1013. "uri": "http://whatsmyip.net/",
  1014. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  1015. "method": "GET",
  1016. "host": "whatsmyip.net",
  1017. "version": "1.1",
  1018. "path": "/",
  1019. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  1020. "port": 80
  1021.  
  1022.  
  1023.  
  1024. * Network Communication - SMTP:
  1025.  
  1026. * Network Communication - Hosts:
  1027.  
  1028. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!