API tools faq
paste
paladin316

Exes_026547189dd08ed7446527101d838699_jpg_2019-07-26_15_30.txt

paladin316
Jul 26th, 2019
2,278
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.77 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_026547189dd08ed7446527101d838699.jpg"
  7. * File Size: 1069744
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "454bb3121291f7e541b052863e101351e9ce0ccdcfdc9a24561cf08057d5149b"
  10. * MD5: "026547189dd08ed7446527101d838699"
  11. * SHA1: "a2e70a0266d78ceb66c93d1f61c1f8d68d628139"
  12. * SHA512: "1afbfdceb6b629cb565e282324d28be686172db0661e9bc4c17ecd94e4f6a9dce28de99cff2c6ad7cfc3c7d1e4126ef9c2eb3ad5bf7fce28900c93126eb6fbfc"
  13. * CRC32: "73314B3E"
  14. * SSDEEP: "24576:t/C2Q8rQIzJrADKDdVesMRNpY1CHzmFRlYcEHt:tK2QAQI1r1dVesGNpYg6FRQt"
  15.  
  16. * Process Execution:
  17. "Exes_026547189dd08ed7446527101d838699.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details":
  40.  
  41. "IP": "127.0.0.1:35744"
  42.  
  43.  
  44. "IP": "193.23.244.244:443"
  45.  
  46.  
  47. "IP": "51.158.188.114:9100"
  48.  
  49.  
  50. "IP": "131.188.40.189:443"
  51.  
  52.  
  53. "IP": "51.15.109.221:26173"
  54.  
  55.  
  56. "IP": "104.16.155.36:80"
  57.  
  58.  
  59. "IP": "51.158.76.192:9001"
  60.  
  61.  
  62. "IP": "104.18.35.131:80"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "Starts servers listening on 127.0.0.1:35744",
  68. "Details":
  69.  
  70.  
  71. "Description": "Reads data out of its own binary image",
  72. "Details":
  73.  
  74. "self_read": "process: Exes_026547189dd08ed7446527101d838699.jpg, pid: 2004, offset: 0x00000000, length: 0x001052b0"
  75.  
  76.  
  77.  
  78.  
  79. "Description": "Performs some HTTP requests",
  80. "Details":
  81.  
  82. "url": "http://whatismyipaddress.com/"
  83.  
  84.  
  85. "url": "http://whatsmyip.net/"
  86.  
  87.  
  88.  
  89.  
  90. "Description": "The binary likely contains encrypted or compressed data.",
  91. "Details":
  92.  
  93. "section": "name: .rdata, entropy: 7.65, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000ef600, virtual_size: 0x000ef43e"
  94.  
  95.  
  96.  
  97.  
  98. "Description": "Looks up the external IP address",
  99. "Details":
  100.  
  101. "domain": "whatismyipaddress.com"
  102.  
  103.  
  104.  
  105.  
  106. "Description": "Attempts to delete volume shadow copies",
  107. "Details":
  108.  
  109.  
  110. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  111. "Details":
  112.  
  113. "Spam": "Exes_026547189dd08ed7446527101d838699.jpg (2004) called API LdrLoadDll 114100 times"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  119. "Details":
  120.  
  121. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  122.  
  123.  
  124.  
  125.  
  126. "Description": "Installs Tor on the infected machine",
  127. "Details":
  128.  
  129.  
  130. "Description": "Installs itself for autorun at Windows startup",
  131. "Details":
  132.  
  133. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  134.  
  135.  
  136. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  137.  
  138.  
  139.  
  140.  
  141. "Description": "Exhibits possible ransomware file modification behavior",
  142. "Details":
  143.  
  144. "file_modifications": "Performs 222 file moves indicative of a potential file encryption process"
  145.  
  146.  
  147. "drops_unknown_mimetypes": "Drops 205 unknown file mime types which may be indicative of encrypted files being written back to disk"
  148.  
  149.  
  150. "appends_new_extension": "Appends a new file extension to multiple modified files"
  151.  
  152.  
  153. "new_appended_file_extension": ".crypted000007"
  154.  
  155.  
  156.  
  157.  
  158. "Description": "Collects information about installed applications",
  159. "Details":
  160.  
  161. "Program": "Google Update Helper"
  162.  
  163.  
  164.  
  165.  
  166. "Program": "Microsoft Excel MUI 2013"
  167.  
  168.  
  169. "Program": "Microsoft Outlook MUI 2013"
  170.  
  171.  
  172.  
  173.  
  174. "Program": "Google Chrome"
  175.  
  176.  
  177. "Program": "Adobe Flash Player 29 NPAPI"
  178.  
  179.  
  180. "Program": "Adobe Flash Player 29 ActiveX"
  181.  
  182.  
  183. "Program": "Microsoft DCF MUI 2013"
  184.  
  185.  
  186. "Program": "Microsoft Access MUI 2013"
  187.  
  188.  
  189. "Program": "Microsoft Office Proofing Tools 2013 - English"
  190.  
  191.  
  192. "Program": "Adobe Acrobat Reader DC"
  193.  
  194.  
  195. "Program": "Microsoft Publisher MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft Office Shared MUI 2013"
  199.  
  200.  
  201. "Program": "Microsoft Office OSM MUI 2013"
  202.  
  203.  
  204. "Program": "Microsoft InfoPath MUI 2013"
  205.  
  206.  
  207. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  208.  
  209.  
  210. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  211.  
  212.  
  213. "Program": "Microsoft Word MUI 2013"
  214.  
  215.  
  216. "Program": "Microsoft OneDrive"
  217.  
  218.  
  219. "Program": "Microsoft Groove MUI 2013"
  220.  
  221.  
  222. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  223.  
  224.  
  225.  
  226.  
  227. "Program": "Microsoft Access Setup Metadata MUI 2013"
  228.  
  229.  
  230. "Program": "Microsoft Office OSM UX MUI 2013"
  231.  
  232.  
  233. "Program": "Java Auto Updater"
  234.  
  235.  
  236. "Program": "Microsoft PowerPoint MUI 2013"
  237.  
  238.  
  239. "Program": "Microsoft Office Professional Plus 2013"
  240.  
  241.  
  242. "Program": "Adobe Refresh Manager"
  243.  
  244.  
  245. "Program": "Microsoft Office Proofing 2013"
  246.  
  247.  
  248. "Program": "Microsoft Lync MUI 2013"
  249.  
  250.  
  251.  
  252.  
  253. "Program": "Microsoft OneNote MUI 2013"
  254.  
  255.  
  256.  
  257.  
  258. "Description": "Creates a hidden or system file",
  259. "Details":
  260.  
  261. "file": "C:\\ProgramData\\Windows\\"
  262.  
  263.  
  264.  
  265.  
  266. "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
  267. "Details":
  268.  
  269. "FireEye": "Generic.mg.026547189dd08ed7"
  270.  
  271.  
  272. "Invincea": "heuristic"
  273.  
  274.  
  275. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  276.  
  277.  
  278. "Symantec": "Packed.Generic.459"
  279.  
  280.  
  281. "APEX": "Malicious"
  282.  
  283.  
  284. "Paloalto": "generic.ml"
  285.  
  286.  
  287. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  288.  
  289.  
  290. "Alibaba": "Trojan:Win32/Kryptik.578d1ef3"
  291.  
  292.  
  293. "Rising": "[email protected] (RDML:dSfT5dPfv37DjnQWXnJeaQ)"
  294.  
  295.  
  296. "Trapmine": "malicious.high.ml.score"
  297.  
  298.  
  299. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  300.  
  301.  
  302. "Fortinet": "W32/Kryptik.GSVW!tr"
  303.  
  304.  
  305. "Endgame": "malicious (high confidence)"
  306.  
  307.  
  308. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  309.  
  310.  
  311. "Microsoft": "Trojan:Win32/Dynamer!ac"
  312.  
  313.  
  314. "Acronis": "suspicious"
  315.  
  316.  
  317. "VBA32": "Malware-Cryptor.Kirgudu"
  318.  
  319.  
  320. "Cylance": "Unsafe"
  321.  
  322.  
  323. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  324.  
  325.  
  326. "eGambit": "PE.Heur.InvalidSig"
  327.  
  328.  
  329. "Cybereason": "malicious.266d78"
  330.  
  331.  
  332. "CrowdStrike": "win/malicious_confidence_80% (D)"
  333.  
  334.  
  335.  
  336.  
  337. "Description": "Creates a copy of itself",
  338. "Details":
  339.  
  340. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  341.  
  342.  
  343.  
  344.  
  345. "Description": "Harvests information related to installed mail clients",
  346. "Details":
  347.  
  348. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  349.  
  350.  
  351.  
  352.  
  353. "Description": "Anomalous binary characteristics",
  354. "Details":
  355.  
  356. "anomaly": "Actual checksum does not match that reported in PE header"
  357.  
  358.  
  359.  
  360.  
  361. "Description": "Created network traffic indicative of malicious activity",
  362. "Details":
  363.  
  364. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 501"
  365.  
  366.  
  367. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 500"
  368.  
  369.  
  370. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 490"
  371.  
  372.  
  373. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 277"
  374.  
  375.  
  376. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 126"
  377.  
  378.  
  379.  
  380.  
  381.  
  382. * Started Service:
  383.  
  384. * Mutexes:
  385.  
  386. * Modified Files:
  387. "\\??\\PIPE\\wkssvc",
  388. "C:\\ProgramData\\Windows\\csrss.exe",
  389. "\\??\\PIPE\\srvsvc",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  391. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  392. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  393. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  394. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  395. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  396. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  397. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  398. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  399. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  400. "\\Device\\NamedPipe",
  401. "C:\\README1.txt",
  402. "C:\\README2.txt",
  403. "C:\\README3.txt",
  404. "C:\\README4.txt",
  405. "C:\\README5.txt",
  406. "C:\\README6.txt",
  407. "C:\\README7.txt",
  408. "C:\\README8.txt",
  409. "C:\\README9.txt",
  410. "C:\\README10.txt",
  411. "C:\\Users\\user\\Pictures\\Host.zip",
  412. "C:\\Users\\user\\Pictures\\wG8JtUJ1GgIb4CEIiunERVqasFfX+T1fVqpRfpw7px8=.C30C4DA81AE308962B9A.crypted000007",
  413. "C:\\Users\\user\\Pictures\\Host.xls",
  414. "C:\\Users\\user\\Pictures\\WagifrxmoodbtCgdct+teSvSH-UWCAzRdp5CwZsF+lg=.C30C4DA81AE308962B9A.crypted000007",
  415. "C:\\Users\\user\\Pictures\\Host.pptx",
  416. "C:\\Users\\user\\Pictures\\2siDOVdINykbcFL8V9oMlg2OK9tNKsWqVoY2faC2QOo=.C30C4DA81AE308962B9A.crypted000007",
  417. "C:\\Users\\user\\Pictures\\Host.ppt",
  418. "C:\\Users\\user\\Pictures\\Er69uKzWqKUB4-OguQA8LLFa7zLDLM9foD8ccV+rmu4=.C30C4DA81AE308962B9A.crypted000007",
  419. "C:\\Users\\user\\Pictures\\Host.pdf",
  420. "C:\\Users\\user\\Pictures\\eKhb0XQDYi8f6mtwThWpuXOJ1KknS6Yfo5uvw5LIbS8=.C30C4DA81AE308962B9A.crypted000007",
  421. "C:\\Users\\user\\Pictures\\Host.jpg",
  422. "C:\\Users\\user\\Pictures\\35rug6HAVjhmqBS+hkj4dJcN6El8GWBcHa+Sep44bA0=.C30C4DA81AE308962B9A.crypted000007",
  423. "C:\\Users\\user\\Pictures\\Host.html",
  424. "C:\\Users\\user\\Pictures\\8j38nsziGevY6KAtSB4Rod2jrx3z05bwuB8yRBwcKQo=.C30C4DA81AE308962B9A.crypted000007",
  425. "C:\\Users\\user\\Pictures\\Host.gif",
  426. "C:\\Users\\user\\Pictures\\NTh4kM-hKP3yzGjLWwwB73cWiuVnAgrb8Ai-eCaeMLk=.C30C4DA81AE308962B9A.crypted000007",
  427. "C:\\Users\\user\\Pictures\\Host.doc",
  428. "C:\\Users\\user\\Pictures\\O3XoXQb+ajun6Rvhz2tgphn7P2vVJj+iIv-IIHPO87A=.C30C4DA81AE308962B9A.crypted000007",
  429. "C:\\Users\\user\\Pictures\\.xls",
  430. "C:\\Users\\user\\Pictures\\vAEGbW2y7oxKXt81Bd958g==.C30C4DA81AE308962B9A.crypted000007",
  431. "C:\\Users\\user\\Pictures\\.jpg",
  432. "C:\\Users\\user\\Pictures\\r5N4iv4Pm2Txf4t5JgmBVA==.C30C4DA81AE308962B9A.crypted000007",
  433. "C:\\Users\\user\\Pictures\\.html",
  434. "C:\\Users\\user\\Pictures\\+xTbqZrRo9Y74ovt32VpqA==.C30C4DA81AE308962B9A.crypted000007",
  435. "C:\\Users\\user\\Pictures\\.doc",
  436. "C:\\Users\\user\\Pictures\\-ib0IARWDXWv50xixVB7UQ==.C30C4DA81AE308962B9A.crypted000007",
  437. "C:\\Users\\user\\Pictures\\.bmp",
  438. "C:\\Users\\user\\Pictures\\WUKewIwDH4ERO8UisG0W8w==.C30C4DA81AE308962B9A.crypted000007",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\LKS8kZVQQ-ZHNDQZ2M0Yz0HYoZx4SzfbxzvKo5wpgjf6HXYVFfDQzKGh44NJHHsAQVVkz5E7aIDrXWVKt86MQIBZR0zffX-lNG4mMieEK5F-DE4zXDwRTaLGEDOKkUKA.C30C4DA81AE308962B9A.crypted000007",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  442. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\q8CiKpo8GpVZh44CgGsgzquOJNnGnzh1e2XNjFBzHcQ=.C30C4DA81AE308962B9A.crypted000007",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MdWnQc3F9FY5pFQBcddQECc4bQr6Ey8zJoO8QDG217hJIeJriHBNvJJEABBSXGsE.C30C4DA81AE308962B9A.crypted000007",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bd37Mw4YHnpNvxp6aXCdhrb3PAQtsaheKQ9XPJroehc=.C30C4DA81AE308962B9A.crypted000007",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ddime9ah1Wz0SyPPFkV1Jx0Lepc-z96LszNrzPscReY=.C30C4DA81AE308962B9A.crypted000007",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\wrb8pH7TcA9RutYX6ZhokDP0EqB6fmxWo8I3qhsONd8=.C30C4DA81AE308962B9A.crypted000007",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\7eBDcqJ2uR+wP0STM6FGs7vZSSOn4FXWB1ZKfPL8h7fvlieGfbJvAJgYqpzJVuFu.C30C4DA81AE308962B9A.crypted000007",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\S7lDzfTF4tx4OTCzC1BsaVZrQQsoEuS7ULaGPtusNzg=.C30C4DA81AE308962B9A.crypted000007",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Y-FedSobm1eP1V9wr3KLA4IigX7dCWJnEVi5H6hJby-MBx7mb1BUurdj7SDSSmF6.C30C4DA81AE308962B9A.crypted000007",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xA7q5RPGA59AedNKBHTdifle6rxz0+VPZtLGsKMfNRQ=.C30C4DA81AE308962B9A.crypted000007",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UvJGrv-MHtUZ5t069-uJIAFg4ADhJ3rBhYSwLJ5tYfM=.C30C4DA81AE308962B9A.crypted000007",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UroeeOU-gGUklLD0XDDT3TUi2XzzWlVhoOWdGEPJ9xg=.C30C4DA81AE308962B9A.crypted000007",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UoidgZfNHFUMT5WreNuLgX6T1PZT0YeTOiG+ZIKMTyE=.C30C4DA81AE308962B9A.crypted000007",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\edOAfxed4vEO2ZWCwrF8dkc-23g3NvH7W4Msi8oHtFI0P2jSAyLhXVjkMpZgLoJu.C30C4DA81AE308962B9A.crypted000007",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\8zFl+7jHwYrBsyyaUJNJaNcrLywgkU1b3IjfEAtfMeA=.C30C4DA81AE308962B9A.crypted000007",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yRenUhxvgPH0EidWdFqwOsgT5Ob1Gj3diD8L+t7OeXd03+rNBmrfzR+OqQ6JUhJf.C30C4DA81AE308962B9A.crypted000007",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\wrJH4WZDpZAxQ9EV59MtFwn0F1sJkDgDTs84MLaTgSE=.C30C4DA81AE308962B9A.crypted000007",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\unhZ9wpADpsvB6-03+wefqH82xNFrBxrOfVjxa+UMHY=.C30C4DA81AE308962B9A.crypted000007",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1maUT2jX7kzhHpQkALcOiRiir078Rjboma3048HGD+M=.C30C4DA81AE308962B9A.crypted000007",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\fcdIG7+YZ8BTiX7jsyXX0SszLKEspwTXdI72PLFYT7k=.C30C4DA81AE308962B9A.crypted000007",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\iHrFL6s3l9yyorFM6P1IXjlOtYp2hAyXo7ZWMpMw6rE=.C30C4DA81AE308962B9A.crypted000007",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\HRkWnMUZeQjA3nf1TnCVg7BHiWVw0PIWobeC9XYPToI=.C30C4DA81AE308962B9A.crypted000007",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\MMelgkyFR6Fe8DcOAWdKlRWN6hy+AcC9RpgsDOFJxIo=.C30C4DA81AE308962B9A.crypted000007",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\tu7AP2Bq1j2BCWDfnHRwL8rtMocvz2gHElXYUUM-EsI=.C30C4DA81AE308962B9A.crypted000007",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\oAh0pQeXzjpZB0Vv3bo0RXpcADswBoNi3URASrqwZdI=.C30C4DA81AE308962B9A.crypted000007",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\VN6bSdKEQpIpsGEjIaoUOgu4QLBY-3GfxjrRbUZRqw4=.C30C4DA81AE308962B9A.crypted000007",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\VrDnyZKVDkE8FWZVocEiYSNnbX8Gc0MEuwDH9gNpK1c=.C30C4DA81AE308962B9A.crypted000007",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\nlJTT80LZ1+kWl7hYbNnO3cOl169tkZ5j-+cIazyumM=.C30C4DA81AE308962B9A.crypted000007",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\tvmQTWelQRqPGyYHvneZnp512D-eUbVhUimlmpeiIj4=.C30C4DA81AE308962B9A.crypted000007",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\dMpexyO3uhmrYuQUI0QYlqDlrlbKIKSwWpGhyYspg4A=.C30C4DA81AE308962B9A.crypted000007",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\DUC-hw6ScJkCDbRrKJ+CgGNBn4y4vo2k7CtFKvekU3qxZjfE-l7g1YNbPY-s0vD6VvHyxzcPUxoq0jaXGlkwNQ==.C30C4DA81AE308962B9A.crypted000007",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Xx9n4tqTr2sxvg-HN3tje3X+ETIoBy87ZxFIAn8eHsCIYadflDqmntgO4hXoAhitkE2LWKRIC1zk9mTclHgyuw==.C30C4DA81AE308962B9A.crypted000007",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\bup3HyeySNseh0fcK+OJ3oKxKubNFbmK-OYz7ptXbzqxQ8650GpnZzadoPUw3hhtZi+CwmtRNRo2lFVyzbsU6T8uv5oaKnrpADYwxLWWndxU6YQVfI39WHvbsPv2guUB727FfeRibx245OQwEOxXhkjA8SFqfp4ZXZnBcdhNZH65HnkcgbXJs8Cu7Pv+mR9R.C30C4DA81AE308962B9A.crypted000007",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\ZMeNJkZrDKaBzeLI6eV2ZFAxTw0F8NiVInGuh5eSY9pzt9ScBAEAt+tbtoUVdgzu4lBocEntyeNG21N6-QJRRg==.C30C4DA81AE308962B9A.crypted000007",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\oOiePp-nDGqTkEWNlmSp6E9pnVZdk-5JCyJ3jMK4aBVyKyS36O4S0XpH20ltxA8LRuj7TR1aFqRC0NZAZzmjdw==.C30C4DA81AE308962B9A.crypted000007",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\lFgda6i8I0SMt5G6rgE42Fnp1zHLQYYe3djJ4O697KlH5pwa6aL-gmZtMQJlJTalA8od-qGcyX4KpdTzYCB0gQ==.C30C4DA81AE308962B9A.crypted000007",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\gwgd9hptxO-7gbCo4w1EBlU4eFUq9kPXH9SyrYGFgF9bKPRtBYAg2Y+E9OoAcf3gzW6LN0pFxmdWI48TZq4qWkj9rU9dvDcks9BLG2wzKaKqWnzo1ngyelAxIlTVePmUhuMthJURowBQGXAFP3NorQ==.C30C4DA81AE308962B9A.crypted000007",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ZzW+F64QBmugpfhEtSeWl23Llm5sSQhxo34svfqyl6I5t8a63c6boSHm5QEIEyq83AeFJ-CMzux84fIlvHDbJUIt7uMHDIkkLWM4azqg2II=.C30C4DA81AE308962B9A.crypted000007",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ucnyWe2-d79dBk33DOylj21eWbpYr-+x3tZOscd65Wg2ITqW4zeDB4vkDrAjwQ2heAwQgMbTwf6wHdpVqZYr3w==.C30C4DA81AE308962B9A.crypted000007",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\YMj7Krk4hVMd8MTtLolaglz0oYvAe+4VuH0FzrU822+-TwGS4mcAv58saj8UF16VsYM6fBlWMABNDYeKiYWCJ3kV4LZGBMDR-KzRgGEh4mCTaZl1QPhI71G2vWnUYeS1.C30C4DA81AE308962B9A.crypted000007",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\dwwAM7q1okk1TflPqwHBHXvl7Pbt9tqjtV47NN6Np1cmZixXve5RTF6ViCjQUkzahaMWJMHP2MT+ZQ1OUC8xzz2C3Gh8gY8CRfTs0bz6iEBLWtf4pmdfZkvPjud0nHW0wE2JXoWa1k3cyZhFr2nIwQ==.C30C4DA81AE308962B9A.crypted000007",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\EH5hCXf6x+XcUM-a0CJ5gumOE5MAEeip2gfmSqjhAzB-NBIuUXK8pmjHFDOVB9NxKfVYRzqvQ8hI+6Vr3KSHyg==.C30C4DA81AE308962B9A.crypted000007",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vjmpIcRHZr0hQss6xCrOvMumwHkTPN9r3aRImXMi177iEdw8z0BJYQ1xpDN8YD2ks0k6XtpzykCpemXh79BnyA==.C30C4DA81AE308962B9A.crypted000007",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ZFWSxOG9HFeLt95TjyoeuttH7bC68eRJAaI7XXFSu-RKOoHMqnLT+G9bR1IeD6WT.C30C4DA81AE308962B9A.crypted000007",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\-FsSS+TFtDBm-5g1Ij-RXQ0+GB11dWttElDTTFjSWU48rwkAGtQWu006rck7tROtjUXyZSHITxhcOPDngA66MQ==.C30C4DA81AE308962B9A.crypted000007",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\KNzWTbzD+2Z7WSMJGhI8ZDGpESbJF4q9euWG+IJCCLOz0hrXGyEwm4+hthT50glBMFNUYmiJFJQ+X7TDw5A3s0f+5xqynVRG-NW111kDhQ3-AVhKELvInIGOqu7QmTge.C30C4DA81AE308962B9A.crypted000007",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\tqatz9FSiD9nS4x0IoUVyVf6g6ppJSr-qwPoSzPaol69UUgFrPta8DUrICZjiCtF4qu4iu6UEnPbXxi6AsB5FA==.C30C4DA81AE308962B9A.crypted000007",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\lnpZskRRQaUbw6Hr1cNnzUYZBx4HdFZ+2G0w6YnT3nH4OHcFrvV+MxzEf2sBS3c0OZ1iueI6qkaj30+dxxeZeA==.C30C4DA81AE308962B9A.crypted000007",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wI8REy1OHPg-oepFVVbopeq0cOkjCupdhfMcsoy3laeaZFb2-BVUSOjHpWaXhZJ8GyZb9KIcabNxYQZT+WNHpA==.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Kn-Dr2zEhC1xr62eHjx+AqQtqWoi3zis7gAGVaUVNNQHk+iDTRozuj86dx55L41iu5FM331kACQLRnH338XDgw==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\SKHzH-Jk4BsMSlekGH6PS3ITiZXRO9BaN6Ny+OPhHSAM8fHsZ2-vfqxA0G-cg2WOxqXwkXsNe4kE95wZ65s8BQ==.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\USlOJDuEECexjK7P9BeL3N5I5ruezX7PYUf8GFyUJ5oMpOt3wU-QiNjH-i2S-WLNDiwk4KoeUMPgOCWTvL1+xw==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EVhTnK43LScNgantr2JnnDH8ydVJAeFoGmYk2l9KEk73cdj4WBjsvSwFmhLFMEgDbpRLrh4SBUy+ve8q2Vo2HINhbnovAKRIlJJSzO1YGzY=.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\V1oVVZ5we0QzJE9wgUfbQr1B3G5niQKekgAmX0I-5re443UyrwKx7fCFXlVIiZzgMus0yofurmVlws7s2BofxQ==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\w-q5OmlSboktU5zCwwjwWbcRKaei5WTK4jWKtOIwA833RSEyJd1EA5JprBbLW9vAPLhmikmLGWbc3SoNtXTf+w==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\iuTo8bpzqIO0IQk8e8J+iuDLv-ZOFGJU2Gl8Y73aLAuFd9whse01iN9k6+7P+5C3E6X7jqW9yy-EsZVrQOof6w==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\j8bDMD138obqfxtSFBpEHM+KHSydtPJVc89-GQnbY1lfxcHGvGKcttUXUfjuckL9Cta2H1feoCWNNWYBPs27kA==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\eD7oyIESQkKlJDQpdg3sRZnI3ud84fYcugHTIQrHgHTMQogzLTDylCs76JpDmVjfshxZ7yXpHO6CFj61OcVngQ==.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\anxvlD8heAMMxEQYkaG6ROzlfz1W6OUU5dLJ8IGH2gR9nF+ULmtdGzZo3cuqkLtN+wcSswYH2PZQ4rCAaaYZ+A==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mHHArzw5awqmODpDkcCSuQq0K6v05JA7hTS3QPVmiGVFgGBjN2w6ROiXSxOqOdvb8wVN00M9yb8Dr4fN7mJsTA==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZgrOS6xr11Rr8NPLlbv8BThUs6tpMidjYwNmPeVzn79RhhSzEIxCIp-iS6OFWQNUmZ5v8GZxxH0b-Rebq7hTyA==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aciookPyEvarQgphN2bprqaezcrQC6S9+ts5mgdjbmbXs1rWAW49SmoSrLitTzYT4mwWzDy19mj4L-nTngNbGA==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yAYzaBKpEy6SeXX-7+CTWRSbLohti-bRuw3pPLEKuQ2dV4zVMQwKKelLqhkgpBAYxe+Z84+Es-c9l2EYHx9PuA==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\b4kb1X-8c5pY6qCDb2SdPqbf34xHLhqJyJtpvdGem3h5aKUSckez+N9eGNYrxQ5z7ac2H7h0yiDSCG-CNUcT1KbCD9a6GMIDV2e0FYs-JTQ=.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\k7HBpKilPBqcn9zymo0yY-+Havieacc-qGVmHMxfg0XJHKIlWN+ffjlkYBZ3ur9j3TaIKq3gmOJ83bB5xNbyPg==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\q3v5jjMtqpPgl3AYKKgb2HQZxGUtauJGrfX9zGBsMfXMz9+WKmgziP10KXGBQfZnjwsdXQahqeU+7-XJ7liZMg==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZU9eKDj6Q9NI9j6Wlc-c7MPia85xtRvNoNe30v5F6ueRsWnAKzCGtLoRrbwmNqk0nRHozxorf2KTBUd9wdV8LA==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\G1Q08MZwyA00Z98QSAsA83twKlD5X9GA7e2Gt8z3EORSQrgvuB2UlNYybYY5mmzoevigfbnj-ryF3kACSs+28g==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3uRAE5Ssm4NpZCjQHXWQ5tfm4-pLzSnK4L0asyHuw4eLy4WPVrhvRlhm5oHGEzJhCYsAYLOv1dJREk6V6nlIOA==.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\3iAzIPq9ptFX5-+s42wmUi4iHf7ZGh28gGyoHu-D8cvSTGr5ra1mTr5ya0ouJkTBqo-CSnLqkLnaPZUTUwfaCQ==.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\j80CXIHKqv+UNaUL7atPz3ejFDvJCjztB1Ou2yl3o78ApGCEbB5OY43XxiLg7OLG.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\9ZHSD7B60ZFRc9OCrSFVf4tLdtr0MnTE6wl4pL4B4Kg=.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\sT09Zk-uCCtvOMCBw2-6Hj2wEho114TRFScj5qYYz5k=.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\daVeDhrAyrrS6anXEVqc5-UZyWNaL5rN5wGAsIXJNqU=.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\fdQkDAMJ175rYFDDnw5nuthyBsHo1O0WmR0p9zbPtNE=.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\oHPIzw0MS+raQ3FX5MtiZIowhDzLY52FN0IQ11H+4Aw=.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\cPQLx16pgxsiGngUtGEE-CiEc3SYDeQsKN1wkt6dyQYXU2LRVZXLcOy2SzzBFVpo45CGrBMizAFRt-kkRgzxNw==.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\tvE7+aiKmfHzaOx7qmEq1kRdjnm0-JNanD99C5XLhzYMvfy03AxrIZg+GWrgd+S+hmO4XtH5+Oa2EoBrIPXc+Q==.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6QeLaieJEuz5fjOlpfmhsKufTau+k0pecp-lvFQif4E=.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\wdLzTWfXV0V7yDaRGtc3lHbvmnx7+gqwvZv5o8CY23U=.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\+3BhAX4SS18Hbb14xamT7+KjMSracObgHoyA8uUU5fiihujA1MQps4ZmjaCqS+2tIGXaejBG2LmYP2qsomEpANYvfsdhhB6DVGe0Bcwlnq0=.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\H0mZx2xxnOgWp-2qmhxKYd9UZovGLsooGULMon4TTIrYpadEbavjVEfMSu4jaWTs.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\b3-vuX8PPYnnFE-sgwxpd2DbRFtpIKMSpMv1yDvmDkE=.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ei9XL68gR0Ve68ILOBoNiqx5vnlwCrzE3qfsp8ic-ywCNPoJ1wdWX488-lH51drg.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\-XguHDKw-GEQdOAD+uDZ7xNAUXBNUI+FOo0JaGFEPZSyMMq-tu2Lq8E-juoID1K2TRcL24Xrn2xxbVbiO3ieGdIv6YcBm9UWlld0wgUnxVM=.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6UarrQr4PJldoind-CsG67pLUrTq8wNrXFqMWRlTLmY=.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\qxwYPesrZ1qHuE0+Sbtm4rIpCvIAt25-GlowlB6-KSo=.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\bC9XCKtUeKj8pV-4-Dalaw==.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\wlsg1FsbXQbDEKPJG3+GBFNFElAaj6AoZR-asdTE8xM=.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IJSCfAD59l-ozNUIZ+pxVvNnccs5llwKUBxM1SsW6d2eVMevShW0AgmEk7w1DneLdhrmVzJ4V2lHLcHTlZPYMA==.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\CeOCbmlSYlSu0j5h0rQju3PP4+6-Nh7jmobbZ8SRkaKUe2ssBvl+QC6Q--EUY+kb631vDHAlWq8SkvBwiEcnUhLVojQcYltNLkHLYx8LN5d7ve+Mi+Td4Fzg0GOd95U9nodFW5n9qLf8v2fF4JDDaA==.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\I4pct2bM6K5kCorALR3CqV8DYf4stAhVYzPp0Lq-mfGQZaQ0Nv8clTd6hlOOz6DGQg96mgIr2oJFJHLtjP1piA==.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\Z3pjDg+UlbSFGtGioZyRZxZztLeBg74HB6GVIYLe-dRaT4ymdYlY6Knb4x-uoycwSUskUexZxOT-ZDjr6FsSqdbHF7zGe+DrgKzICpmBj6Q=.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\ik3A2rheExqSPbrvIP9eDwWuMeCk+TlIwiXU-jD8dTM=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\B3mKAzDTCYLCHYefU6YA+a2LM2wNDHKreAsLJ-B2eNk=.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\CyM55DXjwVBQm-DS2AoTOpSouo2rCIRkuNmcMyA-Q+o=.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\at04nHgc96AASVWEW8aOmT7Tszu7NVqs5NG+sDXAmDMvigpdbJIg0aNPbzQPZVdybeDQXwPeqmdQCS0cO9WBqb+BE-ivhw3hq2cOI9eo3JE=.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\hPg+FekEUdhl97aO6VECIV-lXB5OxHRBCJXkO-7CDz0=.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\lmaBcAiNT7V7s7+5v2zi8W4+f+z2HEYJ7UAmIAgT-rQ=.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\vtSMBCrxfC8lbLCm5l+MF0kmif-WAAnseHXS1W6dimJLsgTvDAqVtT0h9c-lNxEK.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\slLTOmwp98qUyf110ZeHGw==.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\r+fR0PJw-nhXTZLRaPmqYZS-cfgH9EfuuoTKZlfbW5mKWgLG51X7RIVXnwxXPYbO.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\AaY3RFdC4Iw-0exyDYQYGU+CjNuJzw3YRlD6GBODu4w=.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\9vQPo9ihfuGRMT+3CnMTo7FzOjNd9uSTomrwq0sHRlE=.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\YDp5VC9cf85s71kHoNSRdMS4PdxxbhnG2dRN-cYLOL8=.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\pBRnon9bR1P9F3g3g29mUxcdYot1SYPixWKPYCvPiuPDFv1a2CTXlkZQZ-4Hnv7Ri1mEIKRrFAbgRbWh+kpUKw==.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\BpsIpEOUGgzKg-Vv2905AfmfmyLrWRbsVaMIjP4-xhNfIb-uJx0e2prUpvJcJLykedPisf6lm1pAjdWXUXwe7Q==.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\D2DgJUsPDervw-5y4UsIlfG63okxkf2yzch1Bx01GJMc1NMx5KRc+G3r5Epiz2XFepXTZaMkae-yO7bS2CBjiQ==.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\iZ5p5ww6qTR-DJmTD9pp+faEqcaFHjY5kkhrH1gRWOFLC+E6rnyXJbuWuZJg-AzGq+-ZLPitBmBmfGkhXr8ZHA==.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\CtaBvC4NTqMiaapc94HofUGxyugWol87BqcrmQApKE4N5GYjGxPTgsEhp6tr3hlom2ixcI3+5KgN-4tT2AefFQ==.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\dKyoZE1oi4ZDYCw3klXrY3doogYNZQ3eip65d11F0q0XXNuo6Iu58Z4ZLOtaIhO4PjdnXJfCf46+B77-5-KMDg==.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\Rc0i3Ge5NDbUycc-uF6pURUwZLpRTS56HcD2NWEfiTbpseE4FB7AoLw1Vxzni4xOYTsUabf6q756NQjkM3Plqw==.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\-HZoc+OqgAkEcb5LEd3OoQ==.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\7-N6aJjv2h4kXUyTpeFYX8w0VR+z2Kpj+hlky4VPQPq8aHq3nyGnbFtIQ6C44PfqEQoF2wjm2MtC275OtKWgYSUWQLNPC529ixWmjPipszl2kuIH38iHAiCJm+ZZ0zbdU8efnTiwCch7EoAl7ITugnPLmNeOTdu9817mmbjzbMg=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\T20qFLL60ME2Z8mC1qVYGkxmyNnAzJrtQ-PXJN8EAGA3U94zM3hpvI+5M4DmniSSS2vaajSThuHeSOmg8i0WrFc0UrSpuFqF-D+RkudyYYGlFci8Io8LIBWn7gzVH0NePyonuFcF1rkPWeWzVRPvWgrjbEX9nrK8D8LLUbEEeKc=.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\NMuWbm0RqwO2NNO290KFWCcL0zXHzQRy8q9Ohps8LR-gtDxKcrtHpsQ6jQgXsJLUH9h2+dZWNC0sQzXDfy2nSI31mLk8BT4CbaJ9lEDL5Spx2iLAC8+E-sMKCq15AhDhQjhe+n1AMjwZUk-yQLo2gJCLdaeyhHIDwi1qCeY4MOk=.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\EmNbxiJTGEUgvgzimmzx65dgJSJIQJ-Y5HmOhSksZfX6HBhBPe-yPCPjV86DcsWUZz2evXcG5c9Vw+ELLutwXUB90QQJMqMXf-A4V5PIFJnTkLvv1ghwBs3122U4wemMeijXVORGBOtemr+iCzC5nWPCkhV80yqfaQKdKn0xkD0=.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\J7jBXxNCzI2gS6KiDue-LM+atu2KlmZ7aNSK9pIZsAHucc0rBZZyfV9ME2tD-qT+Ex-nnQgwIk2OhI+vXxn8qJDwg4rus6PT7DtYtZ-fj3HZQ68vBrlkLjr0ES91FHubLBRWZJHAZANVIqaUkoOgVbw0PI8CUr+0HBfeGdPaWCU=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\fF4wq-VSQax7GZrUf-DNvITOeR-Ol28moHpJKO3Bl5Cp+n26lbnRz7iDOCPHXRGS9h+Xbc6ksyulsvQLgEzjZA==.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\cqAlUPdwQyLuClpHDQaBWKWdpJsYN5FbsdGHg-oGtOaLRTKHejb8TYkUzilCnm4DkS9iotwcxZp55o3NdhoqU2Pj41-g2HPyGXjlc+3OxjcjPm6bycj9G2tjV5Yg5I3-6rK3sHQwFrYHWgiCDu9P1804HsTjn7n3A8sZ9W2l6HQ=.C30C4DA81AE308962B9A.crypted000007",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\nV7MOJb5FpfuksauC90ESJxy0Z3R7QjXCAywxIHUc7e7TlVu-CY0Cp5bLgfhaGZjcBhtBjYQXRmE9j5SbFxiIrJiZm1fh4N6dFDPoeDg4bGrsBR8gWnbGJzhgrCgLhmvxIMvbNuS2Nw9DIT9J3XL0cWDDafZWdXpGF++E35Hnho=.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\6P4PHPPpryTR74b-ZM1tyl-xTwyH4gqsSH3LFOdKjSq-7q1qSDsweAsLgFvOtoWiCeMm3Yn9ziYfqexNibxQBY1bI06gYk-q+5bo4d4Qx1kGRIUZ3FYLn-3sLp8BCtcb2xUbMjWoPuvX-TUD253u3LPSyHbDH1lPp7OU-nbo1V0=.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\0BXxtuVvvkRyq-mu3NGOnSSRICp1BhUYfqBwgkgmagnrqBDQYJtMVhnMySkTIoqvHo9MyH+t3yGqAGYHYoBwgYC75AEdXQCWEM34VArbbgHCbG+HRCIOY1sqcTEyE5Ls2p1e2qO9MLfzomXPaea5f9-VBbiKkPl-+CH8KELGdv0=.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\ZCsus4ZgomkGDiuwJUQaYXoW9A5of+zvzbUFfFcKXfFk7jeaanJr0sKNK1ew7U1GUxLf79ehItnxzDd7uMdk9OTXX+JG-oGo9wLVB4P2izo=.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\bFKnhW9uLReJS5HjqdJxBrtpEmrw-vcV4HMsJEimDp4e77onF2Mk9Xds-kwItKc5.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\jcXlkxvoLLjY0pUh5nabLbsXimV41go-JheaQWITYOM=.C30C4DA81AE308962B9A.crypted000007",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\CRA-WORb3-thqsIRN12uK+669KEVyVvUMxD8oMmR0pC2b-d1tLEQLXelZHMr0HYbZquBBpF3W9NOxDg+OZEDug==.C30C4DA81AE308962B9A.crypted000007",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\pXRjotQFTFJQJ0mLBhEFojzI6tIuEQxhqeQvAA4HuXg=.C30C4DA81AE308962B9A.crypted000007",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\DK8xnrypUeas3+lpGv3ZaIee2ngYTu-mHvhM1aCVmL8=.C30C4DA81AE308962B9A.crypted000007",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\CozQlb-G9Gn72NMi9LTG4Iim3iTSY9Avte+u3Al6-dI7PuLFx3slxUy3LjHSHTfP.C30C4DA81AE308962B9A.crypted000007",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\es6E7NA1Qtw+KgG-iFN9f1IelVvT5pmFSih+ENWxRfJpyOIEl8x562eCnYvLGd1CNIpgv73PFGc-bACVt+OoBQ==.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_026547189dd08ed7446527101d838699.jpg",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\+wDPjDG+ZP1sDDMK9dzq8pWR3h8tpAwNNW+ALhAI8WEKfqE2xhUaYz1n7gx-Qb07LRkK4DiuZgq-yb5o6IibEcjP5dWnvT+e4QI+-dhQB7jiNu9UmVyvxcMu5fe4Zp4ow3UAsfVsbsxCfVpjuOlwKsQFKzH7iukAtH6zFP6ozew=.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\tukBVWnvNOk4MsfcpeGvVtWoHoS5bzgfeeI-FoL3iQZPKHGdo1k79xfLhxSgRaKY.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\8-UlO8NKL2fc-eIhh6o4BChm6PREjnXY2kvOUqA3QfaQgTymbkkfFtHydf55lHGaRi2h5HcSm4QZGoqqF3SvTA==.C30C4DA81AE308962B9A.crypted000007",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\8LoWsDmB3A3bUt1g4VTRY+6jmUzvrPzS3f1+WmKrdXM=.C30C4DA81AE308962B9A.crypted000007",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\wn-vJe8udv4gOi9b11I41GCBs4jofwOCecjPw0+9QCE=.C30C4DA81AE308962B9A.crypted000007",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\B+xkKuPJ9GW+IDtazyu3rzzG1UuGZHJxyhpqw779jtQHcShgCd4MYxD2JsSI0VQym0KkNKZG3ZzVdUWdi7PM7g==.C30C4DA81AE308962B9A.crypted000007",
  703.  
  704.  
  705. * Deleted Files:
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  711. "C:\\Users\\user\\Pictures\\Host.zip",
  712. "C:\\Users\\user\\Pictures\\Host.xls",
  713. "C:\\Users\\user\\Pictures\\Host.pptx",
  714. "C:\\Users\\user\\Pictures\\Host.ppt",
  715. "C:\\Users\\user\\Pictures\\Host.pdf",
  716. "C:\\Users\\user\\Pictures\\Host.jpg",
  717. "C:\\Users\\user\\Pictures\\Host.html",
  718. "C:\\Users\\user\\Pictures\\Host.gif",
  719. "C:\\Users\\user\\Pictures\\Host.doc",
  720. "C:\\Users\\user\\Pictures\\.xls",
  721. "C:\\Users\\user\\Pictures\\.jpg",
  722. "C:\\Users\\user\\Pictures\\.html",
  723. "C:\\Users\\user\\Pictures\\.doc",
  724. "C:\\Users\\user\\Pictures\\.bmp",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  746. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  747. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  748. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  749. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  750. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  751. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  752. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  753. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  852.  
  853.  
  854. * Modified Registry Keys:
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  858. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  859. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  860. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  861. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  862. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  863. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  864. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  865. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  866. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  867. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  868.  
  869.  
  870. * Deleted Registry Keys:
  871.  
  872. * DNS Communications:
  873.  
  874. "type": "A",
  875. "request": "whatismyipaddress.com",
  876. "answers":
  877.  
  878. "data": "104.16.154.36",
  879. "type": "A"
  880.  
  881.  
  882. "data": "104.16.155.36",
  883. "type": "A"
  884.  
  885.  
  886.  
  887.  
  888. "type": "A",
  889. "request": "whatsmyip.net",
  890. "answers":
  891.  
  892. "data": "104.18.35.131",
  893. "type": "A"
  894.  
  895.  
  896. "data": "104.18.34.131",
  897. "type": "A"
  898.  
  899.  
  900.  
  901.  
  902.  
  903. * Domains:
  904.  
  905. "ip": "104.16.154.36",
  906. "domain": "whatismyipaddress.com"
  907.  
  908.  
  909. "ip": "104.18.35.131",
  910. "domain": "whatsmyip.net"
  911.  
  912.  
  913.  
  914. * Network Communication - ICMP:
  915.  
  916. * Network Communication - HTTP:
  917.  
  918. "count": 10,
  919. "body": "",
  920. "uri": "http://whatismyipaddress.com/",
  921. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  922. "method": "GET",
  923. "host": "whatismyipaddress.com",
  924. "version": "1.1",
  925. "path": "/",
  926. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  927. "port": 80
  928.  
  929.  
  930. "count": 1,
  931. "body": "",
  932. "uri": "http://whatsmyip.net/",
  933. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  934. "method": "GET",
  935. "host": "whatsmyip.net",
  936. "version": "1.1",
  937. "path": "/",
  938. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  939. "port": 80
  940.  
  941.  
  942.  
  943. * Network Communication - SMTP:
  944.  
  945. * Network Communication - Hosts:
  946.  
  947. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!