API tools faq
paste
paladin316

Troldesh_08802d86457ac2dd077295c3c3ecc4f8_1_2019-08-21_17_05.txt

paladin316
Aug 21st, 2019
2,159
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 65.76 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Troldesh"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Troldesh_08802d86457ac2dd077295c3c3ecc4f8.1"
  7. * File Size: 958640
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "5f3854730a92b32028dee7c88f0deb6335b911c3c236dd0bce402e8a25f418e0"
  10. * MD5: "08802d86457ac2dd077295c3c3ecc4f8"
  11. * SHA1: "cd8252152a10007fbae77bfb80b185f921f4d1f3"
  12. * SHA512: "6d9c22db45985d03d541657f2c3d3f9e9f3d09ebd50b9fff549fa9bd5123e8187acf96a728d7763c2dcf35bd3532ccc4781efe786b4382b2799e216f37a5bfd1"
  13. * CRC32: "DF1E48CD"
  14. * SSDEEP: "24576:0ZnHBV17oCxNKEQJMg6PvIXYpS6EDNfExl8SLwz259aBEm20:0VHD17oCTK316oXYNEDxEHwzU9aG/0"
  15.  
  16. * Process Execution:
  17. "Troldesh_08802d86457ac2dd077295c3c3ecc4f8.1",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "Attempts to connect to a dead IP:Port (5 unique times)",
  39. "Details":
  40.  
  41. "IP": "145.239.6.188:9001"
  42.  
  43.  
  44. "IP": "127.0.0.1:33901"
  45.  
  46.  
  47. "IP": "51.254.241.50:443"
  48.  
  49.  
  50. "IP": "51.15.54.182:9001"
  51.  
  52.  
  53. "IP": "171.25.193.9:80"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "Starts servers listening on 127.0.0.1:33901",
  59. "Details":
  60.  
  61.  
  62. "Description": "Reads data out of its own binary image",
  63. "Details":
  64.  
  65. "self_read": "process: Troldesh_08802d86457ac2dd077295c3c3ecc4f8.1, pid: 592, offset: 0x00000000, length: 0x000ea0b0"
  66.  
  67.  
  68.  
  69.  
  70. "Description": "The binary likely contains encrypted or compressed data.",
  71. "Details":
  72.  
  73. "section": "name: .rdata, entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000d7c00, virtual_size: 0x000d7bf2"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Attempts to delete volume shadow copies",
  79. "Details":
  80.  
  81.  
  82. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  83. "Details":
  84.  
  85. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  86.  
  87.  
  88.  
  89.  
  90. "Description": "Installs Tor on the infected machine",
  91. "Details":
  92.  
  93.  
  94. "Description": "Installs itself for autorun at Windows startup",
  95. "Details":
  96.  
  97. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  98.  
  99.  
  100. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  101.  
  102.  
  103.  
  104.  
  105. "Description": "Exhibits possible ransomware file modification behavior",
  106. "Details":
  107.  
  108. "file_modifications": "Performs 296 file moves indicative of a potential file encryption process"
  109.  
  110.  
  111. "drops_unknown_mimetypes": "Drops 274 unknown file mime types which may be indicative of encrypted files being written back to disk"
  112.  
  113.  
  114. "appends_new_extension": "Appends a new file extension to multiple modified files"
  115.  
  116.  
  117. "new_appended_file_extension": ".crypted000007"
  118.  
  119.  
  120.  
  121.  
  122. "Description": "Collects information about installed applications",
  123. "Details":
  124.  
  125. "Program": "Google Update Helper"
  126.  
  127.  
  128.  
  129.  
  130. "Program": "Microsoft Excel MUI 2013"
  131.  
  132.  
  133. "Program": "Microsoft Outlook MUI 2013"
  134.  
  135.  
  136.  
  137.  
  138. "Program": "Google Chrome"
  139.  
  140.  
  141. "Program": "Adobe Flash Player 29 NPAPI"
  142.  
  143.  
  144. "Program": "Adobe Flash Player 29 ActiveX"
  145.  
  146.  
  147. "Program": "Microsoft DCF MUI 2013"
  148.  
  149.  
  150. "Program": "Microsoft Access MUI 2013"
  151.  
  152.  
  153. "Program": "Microsoft Office Proofing Tools 2013 - English"
  154.  
  155.  
  156. "Program": "Adobe Acrobat Reader DC"
  157.  
  158.  
  159. "Program": "Microsoft Publisher MUI 2013"
  160.  
  161.  
  162. "Program": "Microsoft Office Shared MUI 2013"
  163.  
  164.  
  165. "Program": "Microsoft Office OSM MUI 2013"
  166.  
  167.  
  168. "Program": "Microsoft InfoPath MUI 2013"
  169.  
  170.  
  171. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  172.  
  173.  
  174. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  175.  
  176.  
  177. "Program": "Microsoft Word MUI 2013"
  178.  
  179.  
  180. "Program": "Microsoft OneDrive"
  181.  
  182.  
  183. "Program": "Microsoft Groove MUI 2013"
  184.  
  185.  
  186. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  187.  
  188.  
  189.  
  190.  
  191. "Program": "Microsoft Access Setup Metadata MUI 2013"
  192.  
  193.  
  194. "Program": "Microsoft Office OSM UX MUI 2013"
  195.  
  196.  
  197. "Program": "Java Auto Updater"
  198.  
  199.  
  200. "Program": "Microsoft PowerPoint MUI 2013"
  201.  
  202.  
  203. "Program": "Microsoft Office Professional Plus 2013"
  204.  
  205.  
  206. "Program": "Adobe Refresh Manager"
  207.  
  208.  
  209. "Program": "Microsoft Office Proofing 2013"
  210.  
  211.  
  212. "Program": "Microsoft Lync MUI 2013"
  213.  
  214.  
  215.  
  216.  
  217. "Program": "Microsoft OneNote MUI 2013"
  218.  
  219.  
  220.  
  221.  
  222. "Description": "Creates a hidden or system file",
  223. "Details":
  224.  
  225. "file": "C:\\ProgramData\\Windows\\"
  226.  
  227.  
  228. "file": "C:\\ProgramData\\System32\\"
  229.  
  230.  
  231. "file": "C:\\ProgramData\\System32\\xfs"
  232.  
  233.  
  234.  
  235.  
  236. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  237. "Details":
  238.  
  239. "Cylance": "Unsafe"
  240.  
  241.  
  242. "K7AntiVirus": "Trojan ( 0054985e1 )"
  243.  
  244.  
  245. "K7GW": "Trojan ( 0054985e1 )"
  246.  
  247.  
  248. "CrowdStrike": "win/malicious_confidence_60% (W)"
  249.  
  250.  
  251. "F-Prot": "W32/Agent.BAE.gen!Eldorado"
  252.  
  253.  
  254. "Symantec": "Packed.Generic.459"
  255.  
  256.  
  257. "APEX": "Malicious"
  258.  
  259.  
  260. "Paloalto": "generic.ml"
  261.  
  262.  
  263. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  264.  
  265.  
  266. "Avast": "FileRepMalware"
  267.  
  268.  
  269. "Endgame": "malicious (high confidence)"
  270.  
  271.  
  272. "DrWeb": "Trojan.Encoder.858"
  273.  
  274.  
  275. "Invincea": "heuristic"
  276.  
  277.  
  278. "Trapmine": "malicious.high.ml.score"
  279.  
  280.  
  281. "FireEye": "Generic.mg.08802d86457ac2dd"
  282.  
  283.  
  284. "Emsisoft": "Trojan-Ransom.Shade (A)"
  285.  
  286.  
  287. "Cyren": "W32/Agent.BAE.gen!Eldorado"
  288.  
  289.  
  290. "Microsoft": "Ransom:Win32/Troldesh.A"
  291.  
  292.  
  293. "AegisLab": "Trojan.Multi.Generic.4!c"
  294.  
  295.  
  296. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  297.  
  298.  
  299. "Acronis": "suspicious"
  300.  
  301.  
  302. "VBA32": "BScope.Malware-Cryptor.Filecoder"
  303.  
  304.  
  305. "TrendMicro-HouseCall": "TrojanSpy.Win32.TRICKBOT.SMB.hp"
  306.  
  307.  
  308. "Rising": "[email protected] (RDML:8EehikMpTyUm5FIlTt3J5Q)"
  309.  
  310.  
  311. "SentinelOne": "DFI - Suspicious PE"
  312.  
  313.  
  314. "eGambit": "PE.Heur.InvalidSig"
  315.  
  316.  
  317. "Fortinet": "W32/Generic.AP.1D3C286!tr"
  318.  
  319.  
  320. "AVG": "FileRepMalware"
  321.  
  322.  
  323. "Cybereason": "malicious.52a100"
  324.  
  325.  
  326. "Qihoo-360": "HEUR/QVM10.1.5B4E.Malware.Gen"
  327.  
  328.  
  329.  
  330.  
  331. "Description": "Creates a copy of itself",
  332. "Details":
  333.  
  334. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Harvests information related to installed mail clients",
  340. "Details":
  341.  
  342. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  343.  
  344.  
  345.  
  346.  
  347. "Description": "Anomalous binary characteristics",
  348. "Details":
  349.  
  350. "anomaly": "Actual checksum does not match that reported in PE header"
  351.  
  352.  
  353.  
  354.  
  355. "Description": "Created network traffic indicative of malicious activity",
  356. "Details":
  357.  
  358. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 157"
  359.  
  360.  
  361. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 512"
  362.  
  363.  
  364. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 191"
  365.  
  366.  
  367. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 505"
  368.  
  369.  
  370.  
  371.  
  372.  
  373. * Started Service:
  374.  
  375. * Mutexes:
  376.  
  377. * Modified Files:
  378. "\\??\\PIPE\\wkssvc",
  379. "\\??\\PIPE\\srvsvc",
  380. "C:\\ProgramData\\Windows\\csrss.exe",
  381. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  382. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  383. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  384. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  385. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  386. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  387. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  391. "C:\\README1.txt",
  392. "C:\\README2.txt",
  393. "C:\\README3.txt",
  394. "C:\\README4.txt",
  395. "C:\\README5.txt",
  396. "C:\\README6.txt",
  397. "C:\\README7.txt",
  398. "C:\\README8.txt",
  399. "C:\\README9.txt",
  400. "C:\\README10.txt",
  401. "C:\\Users\\user\\Pictures\\Host.zip",
  402. "C:\\Users\\user\\Pictures\\e5SPr-KLFQYS0G-YAQT5roY6mcK0oZrVy-oliz05Fkg=.C30C4DA81AE308962B9A.crypted000007",
  403. "C:\\Users\\user\\Pictures\\Host.xls",
  404. "C:\\Users\\user\\Pictures\\2ZgB6zibsAWpwXc0wtT-sjajaHuINurYFZJ+cSgL-cg=.C30C4DA81AE308962B9A.crypted000007",
  405. "C:\\Users\\user\\Pictures\\Host.pptx",
  406. "C:\\Users\\user\\Pictures\\VQP37xs+rFYuzMrrlQ-ql9dx6cjIc47lOUfW9pTpEjw=.C30C4DA81AE308962B9A.crypted000007",
  407. "C:\\Users\\user\\Pictures\\Host.ppt",
  408. "C:\\Users\\user\\Pictures\\J3twGMMMNUn3M434LzQY+1BaQi0QH5EVqZalqEXoyV4=.C30C4DA81AE308962B9A.crypted000007",
  409. "C:\\Users\\user\\Pictures\\Host.pdf",
  410. "C:\\Users\\user\\Pictures\\idYh2KWdj-4szD1btDXg0cr8mpbVKHZtIwgucy7NvRs=.C30C4DA81AE308962B9A.crypted000007",
  411. "C:\\Users\\user\\Pictures\\Host.jpg",
  412. "C:\\Users\\user\\Pictures\\L4aDLGwDCKwljljUKgZYeAbd1wVL+X4LW0xlomGhCgs=.C30C4DA81AE308962B9A.crypted000007",
  413. "\\Device\\NamedPipe",
  414. "C:\\Users\\user\\Pictures\\Host.html",
  415. "C:\\Users\\user\\Pictures\\Zcs5qF1eXQ532oVP0Cqaz2OysEgSPzIn1-SCxYv6TOU=.C30C4DA81AE308962B9A.crypted000007",
  416. "C:\\Users\\user\\Pictures\\Host.gif",
  417. "C:\\Users\\user\\Pictures\\4Hv8invT5wQjMMm9So4uqlLtvgoOnddYPipy2gQCrsY=.C30C4DA81AE308962B9A.crypted000007",
  418. "C:\\Users\\user\\Pictures\\Host.doc",
  419. "C:\\Users\\user\\Pictures\\nQ8MUSdZQ8slUTMeZVr4fc-NA7vfVXAVEfy1iKhQh10=.C30C4DA81AE308962B9A.crypted000007",
  420. "C:\\Users\\user\\Pictures\\.xls",
  421. "C:\\Users\\user\\Pictures\\nv6L1ZvMU2miVUMjUu-+Gw==.C30C4DA81AE308962B9A.crypted000007",
  422. "C:\\Users\\user\\Pictures\\.jpg",
  423. "C:\\Users\\user\\Pictures\\1o6kWEtUUyg5kAGaok7Bww==.C30C4DA81AE308962B9A.crypted000007",
  424. "C:\\Users\\user\\Pictures\\.html",
  425. "C:\\Users\\user\\Pictures\\yXUfSHVfloXEppPOBYyzEA==.C30C4DA81AE308962B9A.crypted000007",
  426. "C:\\Users\\user\\Pictures\\.doc",
  427. "C:\\Users\\user\\Pictures\\Qy3U-H1fYz7QGtJoLQAUDA==.C30C4DA81AE308962B9A.crypted000007",
  428. "C:\\Users\\user\\Pictures\\.bmp",
  429. "C:\\Users\\user\\Pictures\\H8sG1rC8xffXD8ccwdUsbg==.C30C4DA81AE308962B9A.crypted000007",
  430. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  431. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\x7f1eG+LDsdXUwnzfzjXhb7y0faSUZ+J8-5NqJ44fbSk31D8YnUK8kTfRN2d7Dm9IwNSMCh4pN6ryyC-Zjhh6mJ3uFFY50c6F5ZJyhU6EUaJqg4PlUcNNOb24u+yqdUx.C30C4DA81AE308962B9A.crypted000007",
  432. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  433. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\H1uIPgVztIq0lG7BH6e7evC6pVKEDB+x1TNt+OPkQQ4=.C30C4DA81AE308962B9A.crypted000007",
  434. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  435. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\WDm27D-vcTyfNbfEgtHdlaQEnAaVsnaY8lOKMMGiwgMP8Z68Ln4+v-lHpaXOwd3z.C30C4DA81AE308962B9A.crypted000007",
  436. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  437. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\EjcQgoM8sJ7asjiIwP1ly-b+X-T9yCd42mQsd8Ae9fw=.C30C4DA81AE308962B9A.crypted000007",
  438. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\BZCXZLuArGuyQSzpalP5Qfaiu0ICNEwRBmGA67bPORg=.C30C4DA81AE308962B9A.crypted000007",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\QFICZZAWD2p0mkSE74IJWdelJg9lwodRfitNDCPw2-M=.C30C4DA81AE308962B9A.crypted000007",
  442. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vbFqkqk+94RWrZmp1OQFka+yRc-plBcaXl+M45dmuC9+63gWzfR1Hat4+CuhwnNa.C30C4DA81AE308962B9A.crypted000007",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yUcC2i5jR8oi8D9WjRvuMTEq1n9ur4s0o+qGy1UIC10=.C30C4DA81AE308962B9A.crypted000007",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vvpzcMPA8XEzchln8ARwO+p8bGTgkq5Gu27X+M-vgv99GsUkYLJOGDgzz9mjOpKl.C30C4DA81AE308962B9A.crypted000007",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xaXzWIJZPpbapjFZA-ESCSheWoENaPtEg-LMU4-9r30=.C30C4DA81AE308962B9A.crypted000007",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\EpOfrIXuI5Y1zMn1eSrO61bxcRYWkR0d2a-iCM9loXM=.C30C4DA81AE308962B9A.crypted000007",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\XtHDK6PCgUwN0f8F0xO36e83uap6KLbdZq9reeglkc0=.C30C4DA81AE308962B9A.crypted000007",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\GrOTvYtV7Of9Qa6XDy52QD1RI3Qa-uD65s9STzmSi+A=.C30C4DA81AE308962B9A.crypted000007",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\SL+K2lupOfXFwrKzJBiER-VU7XlalZxuYy9Vuap4QOM9o0LcOZhVQ1y4ntIj4XUR.C30C4DA81AE308962B9A.crypted000007",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\11t8PwHQX8vssn4X6eJ8tFhJbZwPkCyug5IrF4Y-5dE=.C30C4DA81AE308962B9A.crypted000007",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\tocJOlHl5N+c46wAxbtJ89r7-2IyzBU5qoeFDLnbTWZSSGPQRFTHR0f1-IAg-pqu.C30C4DA81AE308962B9A.crypted000007",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Q-mmM6My2g1nrkzxX9dYyEdd5w2R8QOcE4J1x4YWdls=.C30C4DA81AE308962B9A.crypted000007",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\E132n6FDzNYTwJLJjHX4aOAGBh05iVgfY0hFt70GX-c=.C30C4DA81AE308962B9A.crypted000007",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TKG36FIYbsgh93nU4op0Lr9byGpX6GSyyJunBNHt0VI=.C30C4DA81AE308962B9A.crypted000007",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\G3Lm6d27YqAy6K3PlVOqkt6G3ssqySSXM1ANpYC8+Ag=.C30C4DA81AE308962B9A.crypted000007",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\aAah2SbQgyTfYZhIW7PGmdCoeoA4SObCg4TsPpHe3Es=.C30C4DA81AE308962B9A.crypted000007",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\ENNtHngLEdXfdGStsCu6D+1hSZVLrqpgF44iUFRSlyI=.C30C4DA81AE308962B9A.crypted000007",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\gQzKPEkHeHFTiCe+4JqqmvSNZX2SReIKBUyXv8PIKU4=.C30C4DA81AE308962B9A.crypted000007",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\bSvmcUNwuBXvPMzAJh8JD5gVFr-yqYhz5CcBqANGoWE=.C30C4DA81AE308962B9A.crypted000007",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\8sq+j-mz1P4YGQIL1Z8Otjlf1zjmS+VllaVOPSLxt+Q=.C30C4DA81AE308962B9A.crypted000007",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\+gaY-XgUYxrJrGiO8cG1Su6bkByqKZwQNopwwt23tPQ=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\kpxABkurOr4qekxN2NRRCIevkckkfIQlVqrBcjwrEBE=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\kMnFjlKhwyv0Wfv+zm8MMfZmhHXBre1Q4ht80FL5XY8=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\4o6PEZBNo5eVo0gnB57jNd8I3kg8jj1e8bneHy+xrJQ=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\HhGkgEpZx3pZ2J2xXUKo74UmSTy0OochU9uFRonMXyc=.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\CQxagaM+DXSmkslhERQcqhEilGU17PIQ5blT9B8m3R20yGEDoiJG1NmIJ46T6SX-m5M1eb4AxhNMQ2kjYTFvrQ==.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Y1T-iCsoRxugVDBZqja0wVdJ2fa0gVDitXljIrtaiINzKibltjQwLVcuJX9fbN0Oz6Izstt+LN4TLLAVWXZtdA==.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Zx9JOCo5Y6gUPT7BuWJRF35gBfbvT2aaA+9YDDlVlaSsczVgwMge+seSsjXqh98vIYA4oG-iOkt6AFJ0QZpgve1-h3oVQny-8zYIDXjFvSivrNn35D0OdJMC3BZqYjAH+ivf9t7JkSr1WeDrnBuhUBta+jInDkFxKizyPOdrsfxYZxsVhNOVH0QQvSnBxrRG.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\jzGPYAzPvpLDcMW5NtmiupwoQ5dW66rn8mkgvZqyfPfAqZvIjlPiPVoToVAYegeO5G4oGZwq+AJPzpCEQHSz-g==.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\+e88AZQLqjrVVVWxwfCIbrCLrCYpfB0zFHcBqGmQbQ0xPBi5610BDcD1iXCmfmP6uyrGel+hAUh+sWStbCg57w==.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\J6OxjuBbzGjvQEmgpB6nmLQFFTQJ-r6Sg77JROMbGvXe8DA7AWUWxcQnnCiYoCHiN9tFR4ePGBnltUiXlF3Nqg==.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\LNwflHdhxWSbhbXv5v8mkO7qn3ukMDAFd3njwjGLHklcpC6vQWpwR5lgtw1WKQPmWnK6ccuL5t73re2BEnnZOWMa1TF0Ba8iT0WY+jdctaKBqlX1O20bG9AbNStMzNAD-pdTfqyjuuDo0URWPBgs2A==.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\9UBnVFP8F5JlWnzteZOisX27S3LwJTUejlcvFhVLHlrufQNziYZFo-3f7jsn46sDHv+SAWhJxSxUL1-a1GfsBGZuQdNu1xrkshfDWvBEyrM=.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\kQI6Pi3ZBvKmAS5Xmy6VFqJZBXjlehC8Qq9Qrj--5vXQaWGMJX64Zv0zYGLZW6QISstOZ+qth9qfMcvenl34nA==.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\qadI9EeMD77-IkrE+da2LZbTWBHrWA23jdsxDv2JggwjK7zXKJ33NwLtJXCAEe1UmMU-Mvqcgfki29dhUyVwyfi514Jrkud1Bj5f80M6G-eojFKxTET0+89lzk-5GPxW.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\gJtVI81reRt-7565RG0zZXdgb2oNYJ+ARR-VtYoK+1tNfMj7agkqfNsPn642+Ov0f9RMeiGaH05hr8N9XXEVwgCV7GQZ-bY8bLKSRkxS7QtIOvNeL0iz5Ip+8QEdEgBSh2F-f8gSibTHjFw7pauarQ==.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\qc0vhDmXTP+Fvgb8UZZjcXsQpSoG+tWZXwXMyYHquWgYHUpbi3uaYXqoc1r6AI6dkUm1rtbcxbQEM9IEsB7uIQ==.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Ybws790YeQCwQX1tjnyYhgcDxQDXZu0kMrZ-MA0zm5hnepSqnFeOJ58b1VU4JV7cUB6aZB6qnWS4tb5Um3Gk0A==.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\BBLWvVnWm0MRI5LUNQKJYqrHYJKP2L1FC4Pfa4fAuRYn11V1iLRdRa1CsXINZKtc.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\h+ocoq0LVouDoPKwIgeF478NasfnmrMoH-n0XAmudxyoti8Ucy5vQfdvB1wUe5zc75x970iFvGy5RVtLg25M6A==.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vz-kC2JDwwpeVaZj-cU09ljmFAVKf-lZI09IMA2aCtMMd6b-UM2PPoRua2owJcixjgGluD-Y4URjRQRkI5cJTsccW-RUAP4uU5VoBlzkxmaMQaLoSUYnFU693GEDe0Zk.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\BAIHzL2iERcYS3241GSO09AsDmDEsyjk8fzIQx2+RiuQbAxoiDu9OXgZforFFItGlKEgoHhPNuSa+fjw9EVB9g==.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\quCV3qGd3IJdy42ME02z3ZUj-Fgi5Xe3xREPjGATFzTlharea9KnbcyPoAhMZ4iHy7NWvIfiNuCnGDw+RCB8yA==.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\6oUkjv5u7IIpWLgpn10G3qKyupzMi1ZetRfDyM4k-mTM2HnbhS5NFSZsCuq+znQ3QpaIQk0VIK5jnIanDc0HNQ==.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\+L9+QpzAq0iP5sDlmLRIOibrK30B1UojHhOqbzrt0BsnrorbqOn0GTb+1PNSYf1A7J10RK+s3B8wEvMdZH5EGQ==.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\82teWsH88aYVbjCVyqKS63hqUWKT2p-FgvBs-bn+ocwgCintPjrzGn4RyXtxuWa4WKBTBITnXWfKyYbT8r5QDA==.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\vU63ZtP4KWyxhAA0NC5mNYeTb25EzXUg2g6cDKvVsjTt4VkBjn7URTM7ChxuqHYeWGN2xJ33KHGoCRg2aGa9cg==.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\ProgramData\\System32\\xfs",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QXP3rglWEpmTFOiOJDXSM73DxAVb8DYqZJ7PZ5triYvn4EAeVJGwql7nWVJ3XRjMiMx79y5iIb-aKwXeDXs8Oz3CfNYG4MveUWqyniV4buQ=.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\F7U3aqIBI03oYFB3E6tIsC-jF8B+zpCOPmx6Fvu00SEFi1vd161oYWpnM5-grg0yt1-9euL6WVVtN7++rcALLw==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EmBp9ThqVjRg-inKqLTPYRQEVAiGWOD7em06HA08W91BpTjm2ZqILYir5aEa9hSM7fBuHC4JLQDYcUs2JmXUuA==.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Siip2ucIDlpiHbGkDU59cGED-Tp8uFPjtD76u+xIWiaBbwKzW8NAZbSEAsscQE+xpAPMmTEYNB00WpAuzb8jbQ==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\gvYqqJFwyvRxdqnHkyOtpo2y+OHEkCqGFOtCWPydarZamJQkP5aexTvkrMSGAi337FFgm163O1hEivvpEfr3lA==.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wXKGJ+Y2xNwmU2JLhUWwOvMQya0b1ebW7A6gDa4SygaioN9xFl2cMyYTSJTOeLhOvJBKWm1TS-4E9WqRpzKi8g==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\8wMeRl6VXjHhO2VY+IR3Yu+GylJbf5JlATOdXWpLb1RwjsoRhW9yFkm3HeaI0ztNmhatYm6Q4ZagsVuWTtTcww==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\zVigVu0dQzh1tNXnGIpcuHC65jwI+Izib1NgS+i6nuc5w-Wj3-jfe7qiybqTtia8d-nDYpb1AoRjpDeh2HkOfA==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\WOYGdXI9j-KmjXRY58zasrAlirVVykFmBNvvB-QAuZvMdqC0pUYxtU-U5bhGBLbCt5wTCeCOOJAUfIcY34gUMg==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\h-nL0SDDSYlPcV5BqSAxkyCg7BOt3JGFOBUtRj8Yn+JbRHunRH3Iydwo0Zl5uas-tlYmCBoS7JRVgiR3vMru-A==.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qQWyPmTvB2SjFAriDMOnXhwzEvK58OrNuClaxIijna+GNgZHyv3spmDKanqp8WrWQhJmysykP-cqs4jNKdE5oA==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\izcDr7cYT5E6utCIxsG5hrg-XE82Kta6yzl3kYUV1tScpbrhsdYAEcnALFZx0W6dANc52uotHSuDaqyDWoBNp2bHFdoGaQjVMa78UblBoHE=.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\c6rX2CFIbLvDAgY+fuz+MnDnG9c8bJzR+IL7F1++FXY-uV5W3o+XPsA8-0R83udyoW-G2MIoO7-Nsr3DlaMTPQ==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\U7Aj1g7nBBoDl1ZjPVbOn4jJeU6F0n5VM2EwMjty0n7ezzJbe2ulgX3dPE31cQ7VoJvQW4wNkE5U0N1kfoNhtw==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\H2fxV29GHYp45M0U37mcUxb+4UTOBW5roa70mzDfWapFbN32VDRUZnINphyz8adV+YwNcfK4t2jSivdgUMLQOQ==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GfagskcWGCNrqixk6p9lTFW8IlsKmGpbVNufEj6zWQLQxJ21SMU4YaxLuRPb8XOBObO7iT4Y-jzU0V5-lhNzhw==.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\8AQeFzSSBNF9Ndutm7AIDPm2efjxB1z7H5AjyqXU6mjjytIskDMFsJPMPITGb6rXw7Gcb4i3A0ZCe4LUqsAtvg==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\N0zBmVTUyP-ZWbLxOuRZhSsjjmHU6jxtjbPsdK40Fd1h1ZqCT9tWXQ4zkJOMbdPESIjdtzhBI7Ry+YcotIujsQ==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\BDolfSJy4hY4Gjf0IAmeclopv2CgWoAKUMaqIRoJ01sdXXdLXa6CMAs9GLmt5YGl.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\qy-+V842HcCAUYkA2mcmIQliTC5HHCB9Rg4po9V2EPI=.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\wTLkpzYO4ZDu5HIelGPQxuAlbe1B60Z5qHlReyVibIo=.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\PRtF93FnhdtSadFZpEcc6mV6T9QnG1DfzvQtkO4kElo=.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\007-Wzv4WDh5zXZpFuWkDefh-zm9Rg-uNphh6kRAhSg=.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\N3xgM3QPBIgBcYIi5iCraGuD9qwp2FByj5QFnyOHVFc=.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\p5UKY9lyAsuwt7K2OoS6YsY20fG04+gYcbjaQRX0v1mhb16La62Dk8jOu6cisjtz8xj37oJpuZRSZUgljzs4bg==.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\0U0D9Vi9IqiDWvvtOspLs8IDpf+lUVrb4LdmEGePLMZaRfzjceyUVVVvFxOrXsj1IgUmytC7sKPLM1kJd91iXQ==.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\sPqa4CxjNbWt2lpYc-TeQoH3is7AroZYN-4VyqOUa3I=.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\BtHTLBC60g5C+PZHhIhegoh4JdyvFFp7lQdViCITkxw=.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\9nS5Smz0dl4Ru5G-QCulKGmyBaxzInhBhnLK0A52zf8swHepTATnQkGoZSUqXxV3CBVaud9aVC0CKBQorTQIuA-ESp1zWU6RjJMGVUGLX8Y=.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HeITB3iQMuZLOW4tZuLSNOm+ZGTzC8S-Ax7eEVlzhKNS39CymUru813x5hsa2L-h.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\adzYe0AqvhdRli2i5qZCrnFLuaqwBZ+AKd-kdKSVtds=.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\g1d-n7QTOYdrBgJ5BGq0ElCWmg+H5NuIiJ-WylnWUixPeGM7IYqL4lYRdBc+ZWbZ.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Q3RRu0P+X4bNhr6aLsBckkRVotKkiBOl5Iac8VEdPOwbQ1p2dKaJm-roYHTn+f2NZp4zbUClEGa0+CaNzSZ-Fi4mPjTMfZvDMCmb2XPsTbs=.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\56mTMi8hWNPrHysXsAoueWYRLU4QsPRNDoSuXhxiJv4=.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\s5ReFvQC4nEXREwA61idrWdsrrvHGizaE5bZdlYLobM=.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\8gnN8TsPWcAjR+nuu8SQgw==.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\9BVypwP-E+kN6M-tyatXPknNxluaMb3orWak8lvpBgs=.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\of8IwgP2163O8c0scDNuiBOR0-Z0mwQqXRA+lJt6e78z3JLwqhCQEtB2pQN4Y2oNvzXH-y6TZZiBMVo65gWr4A==.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\83wrK2FFTTw40JbygvV-5jVh-FDR29uj6X1jCWnaDs2-Tk6RWEj335fX8d+5RXVJ2alppsqQRycDD2eKDM0pmA==.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\jRzIS-FVX3XNlTWINhqKxTc4pG4dZ2S5ZZuuFnzmmzITK+qwCmv0ItgDB+lyVXsS4a46Eo11cgQG85-CzhZFgBLxPGB+813IBfvKXLFoaLI=.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\oaucyRHHwuMaQxK-ss+RR71EiMTRds3LDwdixQVg6Mc=.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\iyn6Fz8qyUQb473LPjbFOHlDW+39AYacpH3OJVFstvA=.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\USvq2-jX0pckMCK3SFNDXAS+pmFkA4aA5+AbeMGwBNM=.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\41SMEp-ae9Pw5-BkQDj5Aro0iZsOGxPV7ufe4qqBMM20-8abI3H5w6xLaG7wXjlHGNzCQTt0-UFHiP43QcuXh9E0j53i0rHSdZ98X69aBiU=.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\hbo2oM9Q85tNPEC9UiyxZdSZdzby6VU4KFd8NoGKJYs=.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\vUHFKNsXsyIvr3xEiKWa9jJeH0uR2j8FVqrOcrpT+g3plCarcfpTdBTHVRbd7DZnO6FdBRCz-5htov5C3uz4jPEU-5KXXU-gFX+qVvzEcFQuV4iFcU-Yp9QJyb0QvncGtvVJJfwtmVkdJ0qW27lNaQ==.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\IThJe2CP1vaL5MvizAMzcLKSBla2jAEALvYIwnIYKkk=.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\gOBQyyOQX2fkdaWlTRjkd9jf2M79QlEwphitSgPVafIoqOnFbBZvOSsYBYQwHllE.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\I7zU-gxZkRsazOG9WQLU1g==.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\nTEN66pMaJPLkV36tL9pcoMIpzzv+Kq4GWDiW0+MPUWP6CcEPBEMQerare94x0xB.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\qsQchVigLfso7oNiG4usj0iBVrrs2w5cmOoJ4QSOBlA=.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\q0SiH4tB-XNSncl942TMnJ5EETQ4AOE+2mKc9WPcrHE=.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\p5uq9Yh9ex8yumQ8vH99AoHVnrZPBJ4yMJQZLkuzYPc=.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\C3lq3V1Lh5Hy32xz6SPuuDfyW63C+6u7-1xNQ-DzPdQg7R9HP5xhHav+RUGtVANUu0G2k1Okh3qw2qZgw3ftsQ==.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\8TNzQ+YwKk1aiSTH2zYKo11FiX8YuaSqxe0VlEpsAewjx79I93cR9soajepD1DX85WjHCPqarkGhmaL97+ffBg==.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\TEN4cocbloAXkNAkL5+7vN-OgyqbgZ05jVdsCIgoa5ea+PBObUjt97us8wzSKtfzNmrGmh0bv6intau01QUy1g==.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\XrcADM+jAr4dcMk5BQ1pTEGKtfuJXB9xWvrMVNPPJxvpu+4Viio5-nBm5Ffgol0eEtNldw4VDqdDmkYHQRmF1g==.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\l-nXyOY+Bxqj2-1vlB+oP9zxcXje2Gp9bo6HOVwa8zOlpMsSGrNHBcTYe0-6Pku5vkMu9-vYEKiDhogRqW39dQ==.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\bHuVp0UFOYyVrFKyfUdTBSuva5NtMSbnXVa1YEu-IYfHZbZWO3agYj6lujRY+TyN3jV46e2RcxmEZ7kn6rUIvw==.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\yxneKKTPMIgefVUeDYg3Qw==.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\7fY0HEIBoYRh1CTGkgKHOND6nY4luCky2KTyKVGXMsBgKetk5-iKE+97dKo21Gr18QKiFKvgCNLCNBail2NAxq6TrOXZ9ocVp1uGh+vlZWfbDkWwdFHBlnV4qPWpJcZqAIJHmnWF0eMHVxmcbcZuIwcFNSj1KBd4wUWkgW3+HiU=.C30C4DA81AE308962B9A.crypted000007",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\5WOlRmgURUN+ioSz9vXG+u9mM7uo703JGPtTcWETqvKr+rbXVG9nRYLhiy43WQLpeRSW8pB+gSaxv7xPuvL0ppFY6mdFlqf4zsYi+olmPsvAyl2NCw+AVd1dTIvGfQfBigmtRJxdQX6IEog5atPoL1giDDRvZ3zkCtdzAZ9bYdA=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\BVEtHZCNZBFt+wYNGORexorLFvL28GZU2GbjgP41eXJCkRmgUPe3fXfRAZoxo7DujRDBIRye7p7dpJSzw1OJBZKvMi5B1+4gRRgMciTRGm7SfF6QjyAr1KF6+UWKHp+LkKPaEwzZG-sKAuLvwsE8oFnk1w-Zu6VVx6HlRk6U3E8=.C30C4DA81AE308962B9A.crypted000007",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\xOqUS249nwMFym+JPoL4VlbyUs09zmmQjuOuPJpjCrSNCgGlxO-c-AGt0oY1nmzrXlRRBSjjxyFuM0+Fb1jbAK39hDfk9A47ML13Lxpbr8w8c24r9DuM7t9ACLLvZgL+Ll6Ed-uZK05WaM6H0pw2PE1k6PTSiwctbNmRzaA2YVc=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\4k1SLn-JVeBbgiAJjOwgZe-5b1Z3StT0CYCOlJaocenXUoOmB2LZraOCduQ7pWzHs-7dV1knf1LLu6ZABqo1qu2g6g6ZblrgED8UcehBb5FW8+a7qmKmBUxzCNOQzHlKPMRK4hIpBedQ3bBizqR2icGXzbntD8rTgunhtW30OKs=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\j6wtqslQnbX8HEbL8xxwUQepnDCIGLqCNj4-E9Ae9BzfdIo-BAMP9womGa9WzHfKy9qtp73HDo0-5C1B+FeMJw==.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\DJglDKY806iDPONTQiO36StBnGHHWoO2j+laDyq5b17j0D9BQeNPDA9TIMewHtYPi40n-resS+2gFivh7NdQB4WUu184f3ruIvBHv3Sb3mGegjXsJdkiEr-8-Cg2i7uRbme5XJeiGvVrcvTC+aLxZVgpfpU3soN1SFjcO-S8GPI=.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\EMBjadcOLvzrRvJcSspj9WwHiIvIeYz3lXZDHP3SpR-U0WEscEq6nPloblfs+BqNe8GcE3gmEY0Qkaw7sER9YK3pG82vQJIHZd4lxEuXRnI8org6WM+wxBDQcSUc4lrMv65Y5xO8EgpEMrZ4pdJLm1z0YlYNPvwFOBP2CJ0rf-o=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\C6xnNekurXwnrq9hT37AdpbJlOnXYLsVLtWM+Ol+4m88vDZ-Oe4F1Dorz3yrc37X9Z8BJ3DhBlAz02A1IWODQVqkbFRtza3GtljZsJAX3zPjKIbBl2gemviZk7tPm8msX3d64ThBpolVU4EQenyYjMZ1C24ak9+5EtpwkqsBjPc=.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\lPt05NLXbHoGzjAgX0-MgUrNIw5MxSCCZmb-7I-Hi3B4j4YARRN8eQ+ebb5+BzGQ1LkryCxiWzDWfmVsDMlM2ahEQ6XSiFLQe9akMSrga-VaJvSvuwIQkI5BDvLj6-Nm8a485BYIuay2zEhJ5xN-el5fq4jr6lxh03TdqEEr850=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\FcwjRUJqDqGsSpd6oazK5Kt6M6zQTk050u8aAxzzrm6LbHQvJPYv2Nr-ernv1hbtrQXw9q4KDOGIBjkaVJHViPQborPEiM1ZZs6rbWFfXY0=.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\wS9NWg7HqYoMHiY5rRVUazt-OcMMMqvcXP1lIT5T1AdavA6oLnuUJsj0MTQDxLWv.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\Oi7O2f64GHym4qSBgTNFUWvHAEtkZLx0yaKk55eSXzK3+NNLjNyRn5jrc4KI2VZaFoc6RE4CLEQnoe8k58PwNA==.C30C4DA81AE308962B9A.crypted000007",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\LRt6LnHa2l0Y8vbJpTCdOg8hj44l8c6tpLH44kyVzCE=.C30C4DA81AE308962B9A.crypted000007",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\nBQ9C98Y2aSDVgyN+MraKNDj4kilOwgfZUuNW6BDt4bZK0C3TwBec+od3OElzX7xDn+pCWGlFgJamvA9P7W6hg==.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\Miyw-rKKuGc0w8V-odND0WmyzhNL-OtxgE2A+xkmiBc=.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\2odjHXiAlY60wg3iHrUhGELY5GaJfWBsh2B8C6bXDko=.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\t-+HufOXup4-hI9XSu3UbkVUWemmNoUuIbLO6DI8HpnzM2aiwmUjjYHVj8AZRmlA.C30C4DA81AE308962B9A.crypted000007",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\Z0-oD86mPyk3zdDEsy+1CfrvF6TdgHGlTTW+6+kdn9OpBdOAAwhxo+lClMFH+oFwicHKIQBwyMEU0oqBWgkD2w==.C30C4DA81AE308962B9A.crypted000007",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\DwS+CFAQBgHFkpCzAID4wgw4nEyU5NvYhLfOxcLXE5qtfj+sbaysa1p7gIzNMYs9QAtKh4Gl1aMtCw55DJJqsuiBCJp8sEqwxDNTaBQXzMf0+We+shQOj9Of5kARx7FYGv-vWQx2M7qYR3So0OZ4-nE-AVDW7NAawA+SwZesS9g=.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\2lkahRhcsZqw8ChaegOKeM+uG1M11nNDtDEABaioYsMCjbpvL-C3Vb0Vu4VPs2gR.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\jRM5FUzJDtAH9vsrilm5RnQdAFSavS0Hd07WzLHBC4E6eARVAvoqFoa4x0nMGlIcYGFKB7g4LAYZRyFxsfzdzw==.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\JmQoND5JYTDtifjgEVcO9UnnSbekyiZo89eLrwWYM1E=.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\1kpdibrM2SMhOcpKXqyXvMNyjWGTU3H6cdXgLar3hSE=.C30C4DA81AE308962B9A.crypted000007",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\VJyczmeed5g5EC-RFeRIW60PFtqNmKGen9rkC2ITg89QccQWqDGZr3DqIyZSKln5O0hqBI+2j0VXxmFqawpWfw==.C30C4DA81AE308962B9A.crypted000007",
  694.  
  695.  
  696. * Deleted Files:
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  703. "C:\\Users\\user\\Pictures\\Host.zip",
  704. "C:\\Users\\user\\Pictures\\Host.xls",
  705. "C:\\Users\\user\\Pictures\\Host.pptx",
  706. "C:\\Users\\user\\Pictures\\Host.ppt",
  707. "C:\\Users\\user\\Pictures\\Host.pdf",
  708. "C:\\Users\\user\\Pictures\\Host.jpg",
  709. "C:\\Users\\user\\Pictures\\Host.html",
  710. "C:\\Users\\user\\Pictures\\Host.gif",
  711. "C:\\Users\\user\\Pictures\\Host.doc",
  712. "C:\\Users\\user\\Pictures\\.xls",
  713. "C:\\Users\\user\\Pictures\\.jpg",
  714. "C:\\Users\\user\\Pictures\\.html",
  715. "C:\\Users\\user\\Pictures\\.doc",
  716. "C:\\Users\\user\\Pictures\\.bmp",
  717. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  718. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  719. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  720. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  721. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  722. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  723. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  724. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  746. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  747. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  748. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  749. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  750. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  751. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  752. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  753. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  843.  
  844.  
  845. * Modified Registry Keys:
  846. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  847. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  849. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  850. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  851. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  852. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  853. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  854. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  857. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
  858.  
  859.  
  860. * Deleted Registry Keys:
  861.  
  862. * DNS Communications:
  863.  
  864. * Domains:
  865.  
  866. * Network Communication - ICMP:
  867.  
  868. * Network Communication - HTTP:
  869.  
  870. * Network Communication - SMTP:
  871.  
  872. * Network Communication - Hosts:
  873.  
  874. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!