API tools faq
paste
paladin316

Exes_34edc941ae42e97833f7bf2ac04dbaea_jpg_2019-07-10_04_30.txt

paladin316
Jul 10th, 2019
2,130
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.58 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg"
  7. * File Size: 1117360
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "2d510ba710ff8c4a48b60a74daf9e0489b343c1dec22bcf9369d986921439096"
  10. * MD5: "34edc941ae42e97833f7bf2ac04dbaea"
  11. * SHA1: "625c95785a2168813785e5efe77640749bfe3dbc"
  12. * SHA512: "01776de7a0a9c1f20e3866e6c689b7cc886f1e9bcab6c13a6e193921b854e68f8bfe9a68c3941d3ba18cf404f337546a409819f7cfcc4a3115a792d8709739ab"
  13. * CRC32: "CE10AF41"
  14. * SSDEEP: "24576:s67iOScr1wsPJ0L9V/QvZzvG7L6U0Bshu/P:s67iO3isPJ0LSvQ5hu/P"
  15.  
  16. * Process Execution:
  17. "Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "A process attempted to delay the analysis task.",
  39. "Details":
  40.  
  41. "Process": "Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg tried to sleep 747 seconds, actually delayed analysis time by 0 seconds"
  42.  
  43.  
  44.  
  45.  
  46. "Description": "Attempts to connect to a dead IP:Port (12 unique times)",
  47. "Details":
  48.  
  49. "IP": "127.0.0.1:54704"
  50.  
  51.  
  52. "IP": "208.83.223.34:80"
  53.  
  54.  
  55. "IP": "193.23.244.244:443"
  56.  
  57.  
  58. "IP": "104.18.34.131:80"
  59.  
  60.  
  61. "IP": "109.169.86.118:9001"
  62.  
  63.  
  64. "IP": "83.142.225.126:443"
  65.  
  66.  
  67. "IP": "154.35.32.5:443"
  68.  
  69.  
  70. "IP": "194.109.206.212:443"
  71.  
  72.  
  73. "IP": "104.16.155.36:80"
  74.  
  75.  
  76. "IP": "104.16.154.36:80"
  77.  
  78.  
  79. "IP": "144.76.107.124:9001"
  80.  
  81.  
  82. "IP": "104.18.35.131:80"
  83.  
  84.  
  85.  
  86.  
  87. "Description": "Starts servers listening on 127.0.0.1:54704",
  88. "Details":
  89.  
  90.  
  91. "Description": "Reads data out of its own binary image",
  92. "Details":
  93.  
  94. "self_read": "process: Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg, pid: 940, offset: 0x00000000, length: 0x00110cb0"
  95.  
  96.  
  97.  
  98.  
  99. "Description": "Performs some HTTP requests",
  100. "Details":
  101.  
  102. "url": "http://whatismyipaddress.com/"
  103.  
  104.  
  105. "url": "http://whatsmyip.net/"
  106.  
  107.  
  108.  
  109.  
  110. "Description": "The binary likely contains encrypted or compressed data.",
  111. "Details":
  112.  
  113. "section": "name: .rdata, entropy: 7.41, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000fb400, virtual_size: 0x000fb390"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Looks up the external IP address",
  119. "Details":
  120.  
  121. "domain": "whatismyipaddress.com"
  122.  
  123.  
  124.  
  125.  
  126. "Description": "Attempts to delete volume shadow copies",
  127. "Details":
  128.  
  129.  
  130. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  131. "Details":
  132.  
  133. "Spam": "Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg (940) called API LdrLoadDll 114100 times"
  134.  
  135.  
  136.  
  137.  
  138. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  139. "Details":
  140.  
  141. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  142.  
  143.  
  144.  
  145.  
  146. "Description": "Installs Tor on the infected machine",
  147. "Details":
  148.  
  149.  
  150. "Description": "Installs itself for autorun at Windows startup",
  151. "Details":
  152.  
  153. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  154.  
  155.  
  156. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  157.  
  158.  
  159.  
  160.  
  161. "Description": "Exhibits possible ransomware file modification behavior",
  162. "Details":
  163.  
  164. "file_modifications": "Performs 1644 file moves indicative of a potential file encryption process"
  165.  
  166.  
  167. "drops_unknown_mimetypes": "Drops 1076 unknown file mime types which may be indicative of encrypted files being written back to disk"
  168.  
  169.  
  170. "appends_new_extension": "Appends a new file extension to multiple modified files"
  171.  
  172.  
  173. "new_appended_file_extension": ".crypted000007"
  174.  
  175.  
  176.  
  177.  
  178. "Description": "Collects information about installed applications",
  179. "Details":
  180.  
  181. "Program": "Google Update Helper"
  182.  
  183.  
  184.  
  185.  
  186. "Program": "Microsoft Excel MUI 2013"
  187.  
  188.  
  189. "Program": "Microsoft Outlook MUI 2013"
  190.  
  191.  
  192.  
  193.  
  194. "Program": "Google Chrome"
  195.  
  196.  
  197. "Program": "Adobe Flash Player 29 NPAPI"
  198.  
  199.  
  200. "Program": "Adobe Flash Player 29 ActiveX"
  201.  
  202.  
  203. "Program": "Microsoft DCF MUI 2013"
  204.  
  205.  
  206. "Program": "Microsoft Access MUI 2013"
  207.  
  208.  
  209. "Program": "Microsoft Office Proofing Tools 2013 - English"
  210.  
  211.  
  212. "Program": "Adobe Acrobat Reader DC"
  213.  
  214.  
  215. "Program": "Microsoft Publisher MUI 2013"
  216.  
  217.  
  218. "Program": "Microsoft Office Shared MUI 2013"
  219.  
  220.  
  221. "Program": "Microsoft Office OSM MUI 2013"
  222.  
  223.  
  224. "Program": "Microsoft InfoPath MUI 2013"
  225.  
  226.  
  227. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  228.  
  229.  
  230. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  231.  
  232.  
  233. "Program": "Microsoft Word MUI 2013"
  234.  
  235.  
  236. "Program": "Microsoft OneDrive"
  237.  
  238.  
  239. "Program": "Microsoft Groove MUI 2013"
  240.  
  241.  
  242. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  243.  
  244.  
  245.  
  246.  
  247. "Program": "Microsoft Access Setup Metadata MUI 2013"
  248.  
  249.  
  250. "Program": "Microsoft Office OSM UX MUI 2013"
  251.  
  252.  
  253. "Program": "Java Auto Updater"
  254.  
  255.  
  256. "Program": "Microsoft PowerPoint MUI 2013"
  257.  
  258.  
  259. "Program": "Microsoft Office Professional Plus 2013"
  260.  
  261.  
  262. "Program": "Adobe Refresh Manager"
  263.  
  264.  
  265. "Program": "Microsoft Office Proofing 2013"
  266.  
  267.  
  268. "Program": "Microsoft Lync MUI 2013"
  269.  
  270.  
  271.  
  272.  
  273. "Program": "Microsoft OneNote MUI 2013"
  274.  
  275.  
  276.  
  277.  
  278. "Description": "Creates a hidden or system file",
  279. "Details":
  280.  
  281. "file": "C:\\ProgramData\\Windows\\"
  282.  
  283.  
  284.  
  285.  
  286. "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
  287. "Details":
  288.  
  289. "FireEye": "Generic.mg.34edc941ae42e978"
  290.  
  291.  
  292. "McAfee": "GenericRXHW-FL!34EDC941AE42"
  293.  
  294.  
  295. "Cylance": "Unsafe"
  296.  
  297.  
  298. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  299.  
  300.  
  301. "Symantec": "Packed.Generic.459"
  302.  
  303.  
  304. "APEX": "Malicious"
  305.  
  306.  
  307. "Paloalto": "generic.ml"
  308.  
  309.  
  310. "Rising": "Trojan.Kryptik!8.8/N3#86% (RDM+:cmRtazr8YN03gq04axOrud4yCuMR)"
  311.  
  312.  
  313. "Endgame": "malicious (high confidence)"
  314.  
  315.  
  316. "Invincea": "heuristic"
  317.  
  318.  
  319. "McAfee-GW-Edition": "Artemis!Trojan"
  320.  
  321.  
  322. "Trapmine": "suspicious.low.ml.score"
  323.  
  324.  
  325. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  326.  
  327.  
  328. "Microsoft": "Trojan:Win32/Fuerboos.E!cl"
  329.  
  330.  
  331. "Acronis": "suspicious"
  332.  
  333.  
  334. "VBA32": "Malware-Cryptor.Kirgudu"
  335.  
  336.  
  337. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  338.  
  339.  
  340. "eGambit": "PE.Heur.InvalidSig"
  341.  
  342.  
  343. "Fortinet": "W32/Shade.B!tr"
  344.  
  345.  
  346. "Cybereason": "malicious.85a216"
  347.  
  348.  
  349. "CrowdStrike": "win/malicious_confidence_90% (D)"
  350.  
  351.  
  352. "Qihoo-360": "HEUR/QVM10.1.6C0B.Malware.Gen"
  353.  
  354.  
  355.  
  356.  
  357. "Description": "Creates a copy of itself",
  358. "Details":
  359.  
  360. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  361.  
  362.  
  363.  
  364.  
  365. "Description": "Harvests information related to installed mail clients",
  366. "Details":
  367.  
  368. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  369.  
  370.  
  371.  
  372.  
  373. "Description": "Anomalous binary characteristics",
  374. "Details":
  375.  
  376. "anomaly": "Actual checksum does not match that reported in PE header"
  377.  
  378.  
  379.  
  380.  
  381.  
  382. * Started Service:
  383.  
  384. * Mutexes:
  385.  
  386. * Modified Files:
  387. "\\??\\PIPE\\wkssvc",
  388. "\\??\\PIPE\\srvsvc",
  389. "C:\\ProgramData\\Windows\\csrss.exe",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  391. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  392. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  393. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  394. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  395. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  396. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  397. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  398. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  399. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  400. "\\Device\\NamedPipe",
  401. "C:\\README1.txt",
  402. "C:\\README2.txt",
  403. "C:\\README3.txt",
  404. "C:\\README4.txt",
  405. "C:\\README5.txt",
  406. "C:\\README6.txt",
  407. "C:\\README7.txt",
  408. "C:\\README8.txt",
  409. "C:\\README9.txt",
  410. "C:\\README10.txt",
  411. "C:\\Users\\user\\Pictures\\Host.zip",
  412. "C:\\Users\\user\\Pictures\\tBrZ+5hx9NLzBJIzmcNYllsPRHYbNOUP4g9+GpFX+hk=.C30C4DA81AE308962B9A.crypted000007",
  413. "C:\\Users\\user\\Pictures\\Host.xls",
  414. "C:\\Users\\user\\Pictures\\BgsO+Cjsode3nznVA0AExjDWQggvh4NRpL3aWH2+M3Q=.C30C4DA81AE308962B9A.crypted000007",
  415. "C:\\Users\\user\\Pictures\\Host.pptx",
  416. "C:\\Users\\user\\Pictures\\0w75k2Bf5bQgse4bG73ikwEE1OeforzkvJFl+dDxkME=.C30C4DA81AE308962B9A.crypted000007",
  417. "C:\\Users\\user\\Pictures\\Host.ppt",
  418. "C:\\Users\\user\\Pictures\\xxev7SO4XgAGSIFm4IGgnLuybbWahZLO-zKYOeYLI50=.C30C4DA81AE308962B9A.crypted000007",
  419. "C:\\Users\\user\\Pictures\\Host.pdf",
  420. "C:\\Users\\user\\Pictures\\oIm6bGcQyITLlybuUwry0XFhKVOSFoexYLuN5mdiE5M=.C30C4DA81AE308962B9A.crypted000007",
  421. "C:\\Users\\user\\Pictures\\Host.jpg",
  422. "C:\\Users\\user\\Pictures\\60dzfER0AL0H0H3F7HEuR+REFC8IsO1KAndR0yQiKxQ=.C30C4DA81AE308962B9A.crypted000007",
  423. "C:\\Users\\user\\Pictures\\Host.html",
  424. "C:\\Users\\user\\Pictures\\QQIj1+BWHo7WiJ8ZZNZOQpZz0sktk8Tue68kITzx6V8=.C30C4DA81AE308962B9A.crypted000007",
  425. "C:\\Users\\user\\Pictures\\Host.gif",
  426. "C:\\Users\\user\\Pictures\\AFEqpE5EvNDfatvlmZDKDS-tpUm0Wo4tae+9jbEIXv4=.C30C4DA81AE308962B9A.crypted000007",
  427. "C:\\Users\\user\\Pictures\\Host.doc",
  428. "C:\\Users\\user\\Pictures\\bt3dhkL9FPifk5EMSbaieM3+EX0cTYKVs3SjMYtCARw=.C30C4DA81AE308962B9A.crypted000007",
  429. "C:\\Users\\user\\Pictures\\.xls",
  430. "C:\\Users\\user\\Pictures\\5Wf5+yiPOQUr4-cOcfSA+Q==.C30C4DA81AE308962B9A.crypted000007",
  431. "C:\\Users\\user\\Pictures\\.jpg",
  432. "C:\\Users\\user\\Pictures\\6pbCFLJR8l1IZYoM4XW6KQ==.C30C4DA81AE308962B9A.crypted000007",
  433. "C:\\Users\\user\\Pictures\\.html",
  434. "C:\\Users\\user\\Pictures\\Wdx+bRx7J4dqN5Ut++tsZg==.C30C4DA81AE308962B9A.crypted000007",
  435. "C:\\Users\\user\\Pictures\\.doc",
  436. "C:\\Users\\user\\Pictures\\clBuXd6nRSzDfk2AhCvaBQ==.C30C4DA81AE308962B9A.crypted000007",
  437. "C:\\Users\\user\\Pictures\\.bmp",
  438. "C:\\Users\\user\\Pictures\\DeJFYsF3rDAsTcdf1rVYJg==.C30C4DA81AE308962B9A.crypted000007",
  439. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  440. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\ZIN4m6TxM3usxXPghhgjC55hNDDpGvvAwI-vFSwGPHbP4nFXw7VHqAkAC23zduZU1XPWPo8J9dzja0hvNgm0uxAS0ikH7W5KvnuXn4E4ClGjFsro26ZEOEaiiuAPtG3k.C30C4DA81AE308962B9A.crypted000007",
  441. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  442. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\n4THnWmPo8h9l-G1eFVxI9gCbq8W81c+B+OJRKFAGJQ=.C30C4DA81AE308962B9A.crypted000007",
  443. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  444. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\nq2TTxFPmvukX9Eh5KTNIGIlIL9Y53PU7RPzJwjo03HjAPxXFSETeqhtwTHQy0YD.C30C4DA81AE308962B9A.crypted000007",
  445. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  446. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1GbE9nGMTvULvngKI+zrt9NtqIDOZIU3Wt7mfejbpdw=.C30C4DA81AE308962B9A.crypted000007",
  447. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  448. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\4teDfeK30HUIdhO90vJ0L3VMW3xdLL0UEywiTt99Zxo=.C30C4DA81AE308962B9A.crypted000007",
  449. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  450. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xQ-zAi9id1UBAW7pOJiK9oesTkXy4JMMf6zwKPTWgfo=.C30C4DA81AE308962B9A.crypted000007",
  451. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  452. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\whdvgcUQYkx9vQzMumQxeuKniSrQ2TlOjNFvYqlyj+NXuuZH6kUL8-Tp0lw6vuQv.C30C4DA81AE308962B9A.crypted000007",
  453. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  454. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\WBrP0BIy2UNZ+mvaTTJj9lS08wocD39M5kWwzdqusKo=.C30C4DA81AE308962B9A.crypted000007",
  455. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  456. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\0mLBqOg74OBYV615xnP4qLCDSCdt5miKkc24hTZ+2ocPspKyWVkkhiUda54FInLy.C30C4DA81AE308962B9A.crypted000007",
  457. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  458. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yJqWjGoU0Raxw7ose-jKgk9VTB-EqdgcJLZ+iWQyNEE=.C30C4DA81AE308962B9A.crypted000007",
  459. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  460. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\S62mip7rTbSt+cbdupOf4wFdrq2kE3u2UDvTm7zYdKM=.C30C4DA81AE308962B9A.crypted000007",
  461. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  462. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\VzmPdLkNJGzDSsoyofgdwPCyPZjkm7PqTV1KKsxeWNk=.C30C4DA81AE308962B9A.crypted000007",
  463. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  464. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\zrljID1K9qByfGOu7K69TmY-qj2QFuLVwNobRDAXJiA=.C30C4DA81AE308962B9A.crypted000007",
  465. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  466. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\x+Xv7Bq0Q-4fJ+zlmo-ZUBMnxf0FqwCwJqO44EWEusGW2He3qrVgGHStbmxPUPaC.C30C4DA81AE308962B9A.crypted000007",
  467. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  468. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\jghgXtPHpiigl+ogHUtxGtA1MDuxwqsLomnrUttUvBQ=.C30C4DA81AE308962B9A.crypted000007",
  469. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  470. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\q9hiY99VwW0yU6Ve7FDTpf5iWULooobbzsB9l8k6bmp5Eh3Xg-+tq1hmUDRsCBwG.C30C4DA81AE308962B9A.crypted000007",
  471. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  472. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HLh-iwO8AQALHpQ8jpLcz-UBEYYCwlkzj46fio0bpBA=.C30C4DA81AE308962B9A.crypted000007",
  473. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  474. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mQN3kpb7HPLWrltCDsKBHIs8tzXOAbD+ZoG6DGDxpRE=.C30C4DA81AE308962B9A.crypted000007",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\F+U148LGLply6BHCx60PHjhv0QZIYYv2-ic5jaLtwfo=.C30C4DA81AE308962B9A.crypted000007",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ZbdVEX3NvRTTKL7M4V1A2Xc8f1fRTc5Zi+etDt53gGk=.C30C4DA81AE308962B9A.crypted000007",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Y3vo5ol-tcfAkg4zwnZVn+VAx0R59W6wbGUn5a3dvX0=.C30C4DA81AE308962B9A.crypted000007",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\n6KpRm1QBTgOc8BfjLLk1PHojGvLu1t4uPm7y0ndKt0=.C30C4DA81AE308962B9A.crypted000007",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\cu-LErgY7xbFCPRZtz4wi0ox9AdUWw+Rg49bJHHD22s=.C30C4DA81AE308962B9A.crypted000007",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\nx67Mc2y0x4lmJ1ntjvSUBFiItDDGqymPgzV8Z3OBak=.C30C4DA81AE308962B9A.crypted000007",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\K9EOLlePJXDfdlPepsuT910mPv7u5PnGbDW5Wt9Jo98=.C30C4DA81AE308962B9A.crypted000007",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\13t9uGACrFXwtf4LIhsAbSnJciuc4q-XcIMRGOljEQM=.C30C4DA81AE308962B9A.crypted000007",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\KFShBfqGL+iRjsuEF4lOB-QBRufDTiNnJxgEOLXIL1Y=.C30C4DA81AE308962B9A.crypted000007",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\2afD6jaP43l1vKTu4Lh5dw-3i8PIzC8eEWBa73pCxG8=.C30C4DA81AE308962B9A.crypted000007",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\ALjroOUapStkjzPC67eXOReW13WSBnEV4wKFveiljBc=.C30C4DA81AE308962B9A.crypted000007",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ld2SByKfM9hOngpDI3a1K1MyOfJBupy54ekUKZBnbCc=.C30C4DA81AE308962B9A.crypted000007",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\X7g0Zg3UCEHAwNZAke-njdsYc-9hrGdAQf8QButLH1M9qq3qplKBEUSzcE5OOD1WQarqBvij58t8reNWxDCemw==.C30C4DA81AE308962B9A.crypted000007",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\43+BnA4Z-Qbc81-szRSJneh9PRX9x8g8zy-qblI9ey1hBQPgSw1eOokoZLRKo3rxdJd2IDDl0bjlvGv3QQ-e7Q==.C30C4DA81AE308962B9A.crypted000007",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\D+WEFnZUAFie54vlpHMLjse84p1wWqJSpljtvOBe72PAWmc56VmSlKdezr6qo+QBfGonmHpu9w1wW2acVOCpkNABI8idkMGgfzBFVFLz1w2JolgLCsjCu-NV5ETnbgl+bnKs7rqE3guNdFEzIrqOAHy8PqyL9GyPPWmY7Gwgan8PuFe1-o1-9wd147BUIUER.C30C4DA81AE308962B9A.crypted000007",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\hZuBydDoam7gDJFMukUjZ4vUZz38dJRjHpeVhiOYxQgLdGRCGCTE1BpuIEieGfyQ-5UGpGMv10+8d7uKeAaviA==.C30C4DA81AE308962B9A.crypted000007",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\4ngkVc4qajqwq5EPXyiW169m65f0+qdgEVmPRRS7IocHZnZGDe3FF0PdSbdl6wuQDjWSpwONbfeCjjgtKHIqng==.C30C4DA81AE308962B9A.crypted000007",
  509. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\RDXICd2-JalF-Ceu56W+B8V0rrte3wUPTJ6IN3tcttGjIckG0uA4og40vTPyzg5AXuQ4RyxKC+wBbzhD+XqjMw==.C30C4DA81AE308962B9A.crypted000007",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  512. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\NOWL2E+ZN67Y3iUJMg70VBcg53soaQ5HPxcIG9oNyYcwHXB6QKIueoDGkswwUR5XFyaFxUHOO37nDC3xYvmt+YJiZLdv8m8yUidlD-UrI0vm5HO1i7VsaTW7UD5Swo3enxO0AC6gMQeUR3s20qoFhw==.C30C4DA81AE308962B9A.crypted000007",
  513. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ek2rGlFDzzBpwJFjmMKuXvTXxcagh-OiIVe1Ni1JI2tQvuYZkDWdhiHQGa-4fBPNV2b6cp3NvFKEzioGJ3UxtIqhamNZqvrbrv9w2COzls8=.C30C4DA81AE308962B9A.crypted000007",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  516. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1HvVMV1azveduKoz6KV5Ure0lh1vnF+wsjqyy6Ayf9sIspI7HB4CtXWpNFg4Uk6Qx5PcePbZ57agoEb3aMuxVw==.C30C4DA81AE308962B9A.crypted000007",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\SqjerD808IF9SheH2Oq8jS0bHpTKtRYwtSp9SjGy+nYKBhzjghnIiuRAikvpmgGsb7jxBr9zum1BWHpwquqgrkD-B-TUusffPG8XBiEnNRvah67mO6vzF5nKaVuLlYp2.C30C4DA81AE308962B9A.crypted000007",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\IYw8S3C283ZLFklLekiYehbG66d8WiJLc7jBZ+6xibt0NHyg4FekqcIED4Fbntw6mG7p2yFtB2fEdiMyZItvI0k+WkHRTG5wvcdkQRquJ5SRoa1Zaiqs1EoFB2nZoex7Py61xudEpDp5BTEJ+QKgpg==.C30C4DA81AE308962B9A.crypted000007",
  521. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\HAsN02v2AU9Y52EsF7nUvIf-hwvwExckSKWAHnuvHlfL-GV5qg2y1asdqQE8A1sjM4PA+vLN0gSxbhpXpuEZ4Q==.C30C4DA81AE308962B9A.crypted000007",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  524. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\UkHiW783TbV81x7YZauOQ1qn22NfoVUBv1FWPU6gLsSoljMF8Cv0bueCMiY3l6GSlSRS8vIKzvYcKKID0o5-mQ==.C30C4DA81AE308962B9A.crypted000007",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Zlfr5pc7yQR-MACqEUp3XlKVc29oWrDruOSSnfqHTsyW7ET4gs-AwcwbLV39wFHG.C30C4DA81AE308962B9A.crypted000007",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Yu6JZr8jl-rNDH9K-qoZGAXvblIhkm-SG-OVEXK49M66qEZpHzJJlLutLUW7sNzGo+7CV+ktuxYWHOtu4zDdWA==.C30C4DA81AE308962B9A.crypted000007",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\VEuP1pcpSrANLhbiPdzTpsE+yKU4QIEy1oyqBuf81H1wCtNctCdGHlbYf1u4NwTu5FwWBaSMUz0y41-qTnkMAxW5Lg2XE9tbR-0Kq2cRZQBVYyt3Iw7DbtFqYA7nWjyS.C30C4DA81AE308962B9A.crypted000007",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\PtdsPX8kBBte+DdboBQxkC4wH1j2mI0CjdVPGe+914TVLslficBLwTgCZPHz1Odow6rnx8IXU+ZxesrFfY5SkQ==.C30C4DA81AE308962B9A.crypted000007",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EzgpQqJA2gKWuf0MXHhhRPOaiwT5hlaHn6pUE01rixt88zkCEQSL990rNpCN-wokT1QRUxZw+tZ9TLxflihMsw==.C30C4DA81AE308962B9A.crypted000007",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QJH8tdT0aQjvPLjoVBrLSFPuVe+ETOh0AD6f6iI+uqrUTuubraxTWenTmjV0rm5LZmnvhs5Ob+MYOlYWrAwu3g==.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xDF0gNfu2rSAGukGIAxracjjoVzYnpCB7E+WiJ-7K0qplzzDmRlPB0casTCNNYryKcFaAsgrF43Tev2MSEi0JA==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\dEVZ2PXXZbt5hhxgFPb2SNg4trilA0hynPsuFVhRyylJbgRM5RIdO6hFpeVRVk8wCQUo8OozAZ4wACF9ieOcOA==.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mvRONjv-yR+EuIz3EmYxY42lE4VCP5UjqlpHz3QwVQrHa5W4NuG9Tc79mX3WMzNDNn+kTursfOt3b99hXmftMA==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\zIYnnJHM5TpGcqBOrnhadSE3fENl3Vs1tSPTjqO48BEXUaUW1R77MCnVej9y0zuB+XN-tZdsmnC7xAGkNkMDwZH0qe-iAngDZ+Fb4tkuCJc=.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\YylMra26N-jae08BuCshDY0zu+8syER4+JhWhnhrS-cnoBP32BTqCeJtZhWpacMYoYeQR48rZQUrFZ0vVtncAw==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\MKuVINLA5i+iLbktsWo+B-XLi2Tmrszf2-VvlVFFznmmo2myi5AC0dz-Tb0fMPELqZLpIr8rke4++RvZBC+n1A==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\w5OkPkYM-Ig8PxC2HqczDOtVAGvKnuv3Hit4tWQ33KXPiz-8EAzDr-Mox8drlEe-O9GMj9JbAXmEtIKfPSKdtg==.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\naowpycFbyjKgYcNz6IwkDvq9QGmo07incwKTPGqYJd4bdic1XfajvJVR+LNRvwfcjMP4MYBuFw96D-tVvC9iA==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\vrYTv7fIOU2evb0-T9URZGGsbmkqkAD2Hu0PBfQ1aXXMIXeq2EMoQePZaMxq8TunElbecZ8XIOsGx30xCCac8Q==.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\clow3fkd0nlH2KT1-pS8EuBEFLxxSHHZ2hyr4Duf-WkbZA9bBLrFztk7XgyIvk+SXBEXDWraLW-cLqORXvptnA==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yBU1-iyYJWbkl30O3D2ZBN+4HL8qem11ElGZo8g+P65Y4awlXsueQWz+Cz5IRhb4o7g0H7kcBEDucfD1NwE1Dg==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ivnqb17c-McRb9+3SMjIlV6QbK7pVvyqC+4aJO8rRRGv+C5s8qPxz2nz8nvaJCoesdQMCD-KYZJ4-DTeaSmf0g==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\5xjl51lUr4I5vTFqfTrG-yQr7urs-VaQEQZpuxixuXtmuEBK+jYwvctvJTHm6vK3d6P7UxeZ3qLLQ3daw5SVxA==.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\XZMdgqUmJ972e8w--OdVKcDFGatF9rWB6X6PZjy-1ud3Sj9jjcmj1H8jpgcxdOG1RqrHXDEpOPIxMKh3jLRsDw==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\KcQG5WBdt1ft97GpZpmuipOJu5B-3hkmQ0+qHatpHqxAG34kpgbvqBZCr1a1gO5qBiyKhLN5263zdIj2-E+3ruqfYjvNPTyE83sunFdUx6I=.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\gsCAUaiA9J4wPly8mzuglKSGoHPz3fwC3M8Mpb9-FaM9rG52q5RXW0OCiKDEs8yltffhQMjAu5iToyJilCm0zg==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\G0lU4SfAXzBJiERyb0w8ahgpk+bxme6jba2ssJOAvFr0jjNUv4+prr6VOXrSoYtU6soFhlRutRaR062fewpSCQ==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\2QHWDTKjoDJtEHk8vrgnWJ-uiqAhqfqwXwNnBKOyUMVHVLdHCMmVHuWQ9p7W+d2x4p-8jh6Zt4V72qjNGv9aeg==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NT2+Nm47M8+x5o-vsj9ioIoB4S6dWrvx8dM7fzta8OHxlUU5N9r+jWzzwlUiFxbx5VpeUo5XfZp6N62QS1meZQ==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\WqtlqBJ1+CpdLN11zeK9xZq2Enj3f8-uDozepN4OeRug4vqpY4THGPjJTou-GL0WXrveCp1JL7rFaToLgK8lNg==.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QLBbV9pWqonx+RuUWRYJ7Bep6FTkydUU1SvR5WBfd48lGlkQL1cDn5VaKnF3rJiq+tlH+AF0LfQ1QWvHtwZtng==.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\T4+M9-jDjlUb2pJuzLYR4mkrT0h+zG1nUd90LZHaO0ZnDAZOqAVozb7QNocdR12r.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\zqmCD+HTKku4E6r9x34RiPFvHk5yeMPiycLxlf4zYGQ=.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\zCybyvkGd92ElQF9kqRNpa6-z57hn--fA3LD79vzj7A=.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\sfah6+E4GCHLOwzgu41rAP7kiJ5klfR5p+nRBmo9Ttc=.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\J4UY7j4ABcq5IZb4hKn+38vGy+Eq-N901YIc9DGvGnM=.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\X13Phtr7dXiI8oacNfS6WbEsUHuHFjNGuwgRSSlIzqc=.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\41rdfIJGzUkNw53DocWMbyh9LfEUIoNBrgOlWDanS1psG9S0G4AI8IrOhmF3tWAWEb0tlowkF5dI2qO2sA4FDA==.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\j5+HHNPsbJi2kM1jVmpx5GKOSuJMEag8jLv1isBpZHpGHCnpw3DYY+raqc5MhQP0yxcP4dv83oHNQn-DYCdAWw==.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CP3+-2GDGZvEYhoqbYu+sgLsFF26L3d1i3s7tSl7sE4=.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\z1VJPq8hDkEAf0Y1XMyHhDH1wgbw0oXksI2ur+nWrqw=.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\LVp3Mp7k6xPmDLEHr5WxqStGVUFUIupGfumgF4ExesG3F7fjHim9ty0qDaKOggewb1AwBTZ4DNefwpnbu4y9g0jxQ24py3EL6-Wgsa0Shl4=.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\nPNHrD11D2cVKlmaiN5K+KKJB-HWQptesn90iolFk2kymYB9spgErKorintVNQaX.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\57U-2npGhCkTX43e6hGD0SWQGuJTK1Ha955ac104c14=.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\vpBaFbmxZYoVHsn3uqTXYEH0v9j6LF7xANfh-R9J0Uon3baAwXvF+ijFxw8fpJyI.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\3OnKSYg3RwbyYOECv5ptYNrJHz+NelhDXctewy-yi7n3rquwR9nYnmTylD1NUf+3jZIfuD5U1+4Z3ApnCl8CvLSenyMSEfvnGULdxz9G8rc=.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\AZkF4Tuc2Pro0o64v4za1ka5BJf-Rj00j7QEY2ETHj4=.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\yHjsENOWuPttEnb9ka9PDLA2XPmsNq6SS9FdVK7GvGo=.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jbBZbdgflt15f4vO2030Mg==.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\rvAsBTKXX8r8q+ZHbm1lbt-9UMxPCUTDr0RRrbJb4bk=.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\mb3idHxX4jyL+YiyWr4-jDZHwa2l6M6wTHZPu0x-wvPzR5jU1pH8dW4KZx2QVZsmjSaYXCMl8Hqq4xkfrDcmag==.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\lGxfTmhT+l+O1sqcEfWlogVFDXCFZ7L0Xr4oNesCZUM=.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\EkEWJy+lvvi6fSDh4R6axVjCuFxW0v5ldRhuaQBn+bI16eaGq2fdKbaslHVNdZMJfagBILNMpJXWorB7km7Y+Q==.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\5QCHD6r-nGsqQh7Kqhdqx8INEvCEJS6fazlektMfzPVuDc4g01cYtKyhepsBVGORd1uepkbhcbOT3LCnhLFu6AiSaaBRuMoIFIwDnQIDqS0=.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\0LTjx2pSwWuNwvRsRQVNAH-fzyp7oWadAukxPnekapI=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\YyXJczOUttndW4eJSHG726ragPta7B+kFTyMY3IILD0=.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\1JZt0+1LJh8YeXHPOKD7z4FC5RpkhwXn-qEspC2cR0k=.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\tGXvE9uDkNQCyxd0QLhDX4PpmGqfko6v7ExcdzWD0MtSPPBXhmWBBZEW2-FTmrOi79OIK30zmayn54KhlZdap6c39bZr3JKbz+ne-C-AqT0=.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\PxQY0WdX3j71zBPf1x6yJoB2UslGZIvKBjMcOiVQfOM=.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\BK0E2g6lpfswfjh-Re3HK-oCcvYnxEyKikyg6QXmLd80myzP3Ipb3v4KQD4BPKQBd0FzGIz9sz6p8E8qPnKzmsIzyyVYNiAB9gFd9W5D-CyEw5nMk5YR3sXL94OXFm0OzQ5LVFcGB5TjLHMFpryNuw==.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\XOYuwkiZmHVKJHbiDvpd6iK-3t+kscikylAfHTAa0ZrViTvMBHMWrSTga62WOG7L.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\u81NBy4Z+F5Xvtt5LX+SUg==.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\JrovZ1T8bZRU0ERScXQVpjVJjgHOJKlC4eh4i+NHuXE62atEQ3MZ30r0cNjQTfbz.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\221yaD0gY05+cbRhBxtffRcG8pcbNYIFFk+VM-G2K54=.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\7m1Zmwl4PYnZHaSY4nIb6nXhDbXALgMifKoGD2kIVyI=.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\AERupw4TciTwmeKorh12MFs90bM0lOvIodEJvWMCmRA=.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\QBxlGpSCUVBY7D5c557e-2eAMH4B2PtsLxPNZeCRxRV3t7SWDqGcmLmjF-TX+5kXfM5Ue8t0Z9XWSRIRFmU+1Q==.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\4e2x1H4PXmgUM815AmW3L640fyxZPl5HNqW+z9vnKrCAa0vnqDo827OcIJy8xpCuFDtb2y8Q6u38uISxa+cbHw==.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\4QmDG279PdInZKLQFNj5nrmmn2sF84-WwQt4JDXkz6YeRa0oi-3Osp3kSTJZW119WojGoBG0OflKWX4n5O87ww==.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\e6WUEfG1btNPA6WjiqHg3MlRLfN5fsfPHPoGVI4hTeNA-yu7EipNTUodGcMQVGAumI+aHBYcUNNbjUq55V4CTA==.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\VDqWliBzc1bG7-t-N1GoRQ==.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\+mwEOuvcg+1Cjad4jubZSSXbA+MxoHHakrViDDieizDZrgIA+z7q+x1hCwwJpfJILkRccXtQjG+PVADG2foBPATBLoZou-3HObxnigWFlMifBsbhh-zdBfnDAHHs2Uvc93s1oJtk+mTByenpStIw2OV51Oq8WNtTq630a-dCaiA=.C30C4DA81AE308962B9A.crypted000007",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\n7quaOuyhrPjzrKOjbz3HVmOV1CYgwporCcovlvd2tNgK3jDwIPiz+cHbpjPJ4lGHX99HZVQB0VSMDQria33stGCOiE8sTx6neSgMuzOlH9tD1o1AIxI7xNWBWNLqpKEJcMZ4vgZB806ePAJnO2hA4fNV4MsN-7z5EnT4Zv8XXo=.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\QSFrxhTdN3FmEnHixibsqnkJGiaxv+MohD1HvYMFp1MPwf6q3x6MuVaQUgIc2JqQcCaFPPgZge22bM4SRh6Qq6eYTKExfaTdEgjDI0th-0mh81A8Q1o0RX1w9KycdLFHf6VBc9Tnm1ikiivgDb9gbkEhWvAw39FOcrjDD6r9kjI=.C30C4DA81AE308962B9A.crypted000007",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\VTujLG0sIaIGjLb30J8Qkj7l2CdnOuR7Ey2lsaqm1Uym2ppkEk9z-l+xC4all6Vipv+bS46bSBksyPNbEihemME-PANsmKLgEBwMoEelAk+o2pCb334rtcUkd5bky97T6O6p0KA0rJDtHy9ePd-qgyGHZqJPNooZ+D+kUHyEmO0=.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\UIs9n+KotXrncqmU7uYx9g-oJFplb4bQHk0vUweLH0Tmb8OjNm656x4P6SUJPHfmfkS8VyjuuiWTxQWA-Q1OHvgaAmQX6kfaqerS714K5-ZyaW56iNR+TwkVR3k8awIFpjZjmcaq+tCdFZW7G3Z0rfeiUCclq+xKd4ztIDUfIgU=.C30C4DA81AE308962B9A.crypted000007",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\lmxUWwZzUp77Ew+dJV0jXBH5yzRH5RZngLJ5nkUMbaVr+ZWDjHM4xXfPWORdzV5uSsNFewJ3Qn2QTlj6fcXe11e8V1m320T7wU4iCu6cWooJE3CLnw9DJRiXIaQ7SIPboaD9WNuoVh+BRIvJqrN5rytbinbuk0L7fYQ6-fFI8e0=.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\9e9egDT6wn46y0Zl9D+Zom5meBMqSkawBSTBtveIUFiTBxiGVbgz7-rQsZD10ozerVnjr-LkDTFJha5Otge2ha4BJYYdxh3IMD5yvAydO-nuyoV+SuvMqHtJv7nEdtISANf8MeCTTBe1W7H5iFqUmXW0+F0XVCYYL5OlD9cjGpM=.C30C4DA81AE308962B9A.crypted000007",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\yAOHftMXHKDaZb25esmpomYunqiuNCjeX44+jEkPEfNb2Urs7iJYOLvzDg1Tgx0DxIRzvZ5soH84Y05ZAlfw7vN9Ei82ECL03YCjx3IAPVoqMNMm+pRRx3rDbGrXqHa1t08V-3aeVBvP4TjmL5gotQaUNW-cBIz16NaMaWVzzMs=.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\Q97qQ5EfWo1JV8QYHOzHv+ZJycdfGRc2kSa3CRBUgRTuVKGvcbv8q8XRx-ihIICDVFtVavxrdnYPygUU-mHNV3vj7HyFl681U6c9fhkf+eez3zO1ygq5smP-2UGwLbGMrJgHW26LIYUXnkEhUmsppjlaJJHFGZR0yAmGB+n+xIs=.C30C4DA81AE308962B9A.crypted000007",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\l8OprEwk4SoUGgWwEf59LiCtAV9dlq+x8576Nzj6Ify-M1qmVTTKrBa2Nw+zQo0SzNt0ojVZ6IyS7LQ3vxg1UFe1-X7Stdl-vFvvIgGMzqkflEmJU4XmZCRSSJzsj29Ip0XpHGo1oBaSDQCSrCQLy0BOF96qPZbaZqO3r2GDv3Y=.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\OVrsnAeW4GleH6q5S0w2N1souxyjQ7f76x5jwIsUeYPzSg0QP8FEl2oZ6cgwKxmYzQBCP70yZUtK6-ei0aR7ien2HOacyEpNeI0AjcTeHoE=.C30C4DA81AE308962B9A.crypted000007",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\Mva8Xi3oMQojPU7pIpVMYdWnMhRIvEzblg+TSkOhE3TEcCa9ScksZCrWmuTh77lClT+z7808-otkYmXXKZBawg==.C30C4DA81AE308962B9A.crypted000007",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\3KCfNG0BiiQFQGWwU6lM5l5hJDa5JNprPNMY9yxKZwrVo1rsoNIHsll8TrA7fJeX.C30C4DA81AE308962B9A.crypted000007",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\cI4VwV-0pUdtDGlvQ0+QaJjapJ1Da4V3qYGSo5Szft2Zrsgj3wNve8KQfW84jR0DR34gPLy9EtFwQFJ2B6dh9A==.C30C4DA81AE308962B9A.crypted000007",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\BIcxOwORE4VjD4Y9s6MLSfBTuHp-7FqPu-lZN1g2dmKzTL8VSnPdI+5EN39W+sg4z3jC41SRHxwj5KULiyVWYA==.C30C4DA81AE308962B9A.crypted000007",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\f4BpeXeTwnvgKgMk-J+K5+4WWIG-Z9ktYYbW5QHvMto=.C30C4DA81AE308962B9A.crypted000007",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\zu9aiO2eR2wdDPoyNFxaoUv4eZ0ZGhv6OqtBZTsA0j2Qouxw41JB6ggWu+kVxZlj-tEsY7Tcx9kWevOVDhs2Jg==.C30C4DA81AE308962B9A.crypted000007",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\zO93kfN1mDT7XA5Nmb0718U9cPX5CJhHdy+iE0TXahs=.C30C4DA81AE308962B9A.crypted000007",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\XDO9GjHWDLvqm686oHRt38tNvFxlA6E5wQhh40NlNRs=.C30C4DA81AE308962B9A.crypted000007",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\I4mTO0PpzEOOffhPqTCNNmRMiSlg3l5-hwGEQgzUirnndOy4DGxilVlA-p97e3zD.C30C4DA81AE308962B9A.crypted000007",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\wAZ2O+9IxafsXDxPNxSMj6c2aQU5IU0dGEuTn+nvk+s9tKUoeNyFLAes2utbcydDAIcXDvw-9LL-6wZSjChwfg==.C30C4DA81AE308962B9A.crypted000007",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_34edc941ae42e97833f7bf2ac04dbaea.jpg",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\oOeLXnDZkX4GGc5H5PXvjrcjRx82L9MxLP3yucVTpRPfYtQHSd4HebZGr5+B+M4xUm80FTeLnCPVlREjdyo88A==.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\EinBAF2TOLQnETjfFNJ9Lt8TaO6pjIF-kK8Pwt3ZcOtG3FxMQs7voJIDwGG-nvHn.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\VJC6ZYwaT4Otjf5DAv-22T-p-JuGNUnG9wAJ-Vx0YmGJkOCpYRRo7M5u6O1JUJ1J55ZSwMjQRT-eoAUp5HkmrA==.C30C4DA81AE308962B9A.crypted000007",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\mGD+36WRhiZ40gsfCkPo7DvJxa-kdGaMSYmCxBdBZwI=.C30C4DA81AE308962B9A.crypted000007",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\xCwS9lclwPNUliHMUalMY6cpQD2RVR6SVnX7ZLpjyFg=.C30C4DA81AE308962B9A.crypted000007",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\t5b-J-JFhTwm2rkj0bk+EftZd1AkUDsOz54sz0+vCWmO6aLznJSz17M7NXdJIseNlRqtpzbClv+tQZgDZrWxpQ==.C30C4DA81AE308962B9A.crypted000007",
  703.  
  704.  
  705. * Deleted Files:
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  711. "C:\\Users\\user\\Pictures\\Host.zip",
  712. "C:\\Users\\user\\Pictures\\Host.xls",
  713. "C:\\Users\\user\\Pictures\\Host.pptx",
  714. "C:\\Users\\user\\Pictures\\Host.ppt",
  715. "C:\\Users\\user\\Pictures\\Host.pdf",
  716. "C:\\Users\\user\\Pictures\\Host.jpg",
  717. "C:\\Users\\user\\Pictures\\Host.html",
  718. "C:\\Users\\user\\Pictures\\Host.gif",
  719. "C:\\Users\\user\\Pictures\\Host.doc",
  720. "C:\\Users\\user\\Pictures\\.xls",
  721. "C:\\Users\\user\\Pictures\\.jpg",
  722. "C:\\Users\\user\\Pictures\\.html",
  723. "C:\\Users\\user\\Pictures\\.doc",
  724. "C:\\Users\\user\\Pictures\\.bmp",
  725. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  726. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  727. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  728. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  729. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  730. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  731. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  732. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  733. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  734. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  735. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  736. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  737. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  738. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  739. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  740. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  741. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  742. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  743. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  744. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  745. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  746. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  747. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  748. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  749. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  750. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  751. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  752. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  753. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  754. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  755. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  757. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  760. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  761. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  762. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  852.  
  853.  
  854. * Modified Registry Keys:
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  858. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  859. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  860. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  861. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  862. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  863. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  864. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  865. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  866. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  867. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  868.  
  869.  
  870. * Deleted Registry Keys:
  871.  
  872. * DNS Communications:
  873.  
  874. "type": "A",
  875. "request": "whatismyipaddress.com",
  876. "answers":
  877.  
  878. "data": "104.16.154.36",
  879. "type": "A"
  880.  
  881.  
  882. "data": "104.16.155.36",
  883. "type": "A"
  884.  
  885.  
  886.  
  887.  
  888. "type": "A",
  889. "request": "whatsmyip.net",
  890. "answers":
  891.  
  892. "data": "104.18.35.131",
  893. "type": "A"
  894.  
  895.  
  896. "data": "104.18.34.131",
  897. "type": "A"
  898.  
  899.  
  900.  
  901.  
  902.  
  903. * Domains:
  904.  
  905. "ip": "104.18.34.131",
  906. "domain": "whatsmyip.net"
  907.  
  908.  
  909. "ip": "104.16.155.36",
  910. "domain": "whatismyipaddress.com"
  911.  
  912.  
  913.  
  914. * Network Communication - ICMP:
  915.  
  916. * Network Communication - HTTP:
  917.  
  918. "count": 10,
  919. "body": "",
  920. "uri": "http://whatismyipaddress.com/",
  921. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  922. "method": "GET",
  923. "host": "whatismyipaddress.com",
  924. "version": "1.1",
  925. "path": "/",
  926. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  927. "port": 80
  928.  
  929.  
  930. "count": 1,
  931. "body": "",
  932. "uri": "http://whatsmyip.net/",
  933. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  934. "method": "GET",
  935. "host": "whatsmyip.net",
  936. "version": "1.1",
  937. "path": "/",
  938. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  939. "port": 80
  940.  
  941.  
  942.  
  943. * Network Communication - SMTP:
  944.  
  945. * Network Communication - Hosts:
  946.  
  947. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!