API tools faq
paste
paladin316

Exes_02fd84c6593960c03958cf58cf4d063d_jpg_2019-07-29_20_30.txt

paladin316
Jul 29th, 2019
2,088
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Shade"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_02fd84c6593960c03958cf58cf4d063d.jpg"
  7. * File Size: 1443016
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c"
  10. * MD5: "02fd84c6593960c03958cf58cf4d063d"
  11. * SHA1: "bc9cc64e1538fcb4fc156a1403b83e08c2fac15d"
  12. * SHA512: "337c17b32d4a266790c0f57c4468793edb36157dcfe396f8938473f1b6ef1eaac57437301e902cba3963947e320763c16e48b2795e5d9ef54cfec5508c099565"
  13. * CRC32: "93C98D3B"
  14. * SSDEEP: "24576:eSVujyq46MrDjZiRVvSdrZVN24SH5M7k7CydRzVRN:TujyoyjZ0atZVBSZW723"
  15.  
  16. * Process Execution:
  17. "Exes_02fd84c6593960c03958cf58cf4d063d.jpg",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com",
  23. "cmd.exe",
  24. "chcp.com"
  25.  
  26.  
  27. * Executed Commands:
  28. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  29. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  30. "C:\\Windows\\system32\\cmd.exe",
  31. "chcp"
  32.  
  33.  
  34. * Signatures Detected:
  35.  
  36. "Description": "Creates RWX memory",
  37. "Details":
  38.  
  39.  
  40. "Description": "A process attempted to delay the analysis task.",
  41. "Details":
  42.  
  43. "Process": "Exes_02fd84c6593960c03958cf58cf4d063d.jpg tried to sleep 260 seconds, actually delayed analysis time by 0 seconds"
  44.  
  45.  
  46.  
  47.  
  48. "Description": "Attempts to connect to a dead IP:Port (6 unique times)",
  49. "Details":
  50.  
  51. "IP": "193.23.244.244:443"
  52.  
  53.  
  54. "IP": "127.0.0.1:60129"
  55.  
  56.  
  57. "IP": "93.180.156.84:9001"
  58.  
  59.  
  60. "IP": "194.109.206.212:443"
  61.  
  62.  
  63. "IP": "173.71.141.89:9001"
  64.  
  65.  
  66. "IP": "212.47.239.151:8080"
  67.  
  68.  
  69.  
  70.  
  71. "Description": "Starts servers listening on 127.0.0.1:60129",
  72. "Details":
  73.  
  74.  
  75. "Description": "Reads data out of its own binary image",
  76. "Details":
  77.  
  78. "self_read": "process: Exes_02fd84c6593960c03958cf58cf4d063d.jpg, pid: 1960, offset: 0x00000000, length: 0x001604c8"
  79.  
  80.  
  81.  
  82.  
  83. "Description": "Attempts to delete volume shadow copies",
  84. "Details":
  85.  
  86.  
  87. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  88. "Details":
  89.  
  90. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  91.  
  92.  
  93.  
  94.  
  95. "Description": "Installs Tor on the infected machine",
  96. "Details":
  97.  
  98.  
  99. "Description": "Installs itself for autorun at Windows startup",
  100. "Details":
  101.  
  102. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  103.  
  104.  
  105. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  106.  
  107.  
  108.  
  109.  
  110. "Description": "Exhibits possible ransomware file modification behavior",
  111. "Details":
  112.  
  113. "file_modifications": "Performs 364 file moves indicative of a potential file encryption process"
  114.  
  115.  
  116. "drops_unknown_mimetypes": "Drops 346 unknown file mime types which may be indicative of encrypted files being written back to disk"
  117.  
  118.  
  119. "appends_new_extension": "Appends a new file extension to multiple modified files"
  120.  
  121.  
  122. "new_appended_file_extension": ".crypted000007"
  123.  
  124.  
  125.  
  126.  
  127. "Description": "Collects information about installed applications",
  128. "Details":
  129.  
  130. "Program": "Google Update Helper"
  131.  
  132.  
  133.  
  134.  
  135. "Program": "Microsoft Excel MUI 2013"
  136.  
  137.  
  138. "Program": "Microsoft Outlook MUI 2013"
  139.  
  140.  
  141.  
  142.  
  143. "Program": "Google Chrome"
  144.  
  145.  
  146. "Program": "Adobe Flash Player 29 NPAPI"
  147.  
  148.  
  149. "Program": "Adobe Flash Player 29 ActiveX"
  150.  
  151.  
  152. "Program": "Microsoft DCF MUI 2013"
  153.  
  154.  
  155. "Program": "Microsoft Access MUI 2013"
  156.  
  157.  
  158. "Program": "Microsoft Office Proofing Tools 2013 - English"
  159.  
  160.  
  161. "Program": "Adobe Acrobat Reader DC"
  162.  
  163.  
  164. "Program": "Microsoft Publisher MUI 2013"
  165.  
  166.  
  167. "Program": "Microsoft Office Shared MUI 2013"
  168.  
  169.  
  170. "Program": "Microsoft Office OSM MUI 2013"
  171.  
  172.  
  173. "Program": "Microsoft InfoPath MUI 2013"
  174.  
  175.  
  176. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  177.  
  178.  
  179. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  180.  
  181.  
  182. "Program": "Microsoft Word MUI 2013"
  183.  
  184.  
  185. "Program": "Microsoft OneDrive"
  186.  
  187.  
  188. "Program": "Microsoft Groove MUI 2013"
  189.  
  190.  
  191. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  192.  
  193.  
  194.  
  195.  
  196. "Program": "Microsoft Access Setup Metadata MUI 2013"
  197.  
  198.  
  199. "Program": "Microsoft Office OSM UX MUI 2013"
  200.  
  201.  
  202. "Program": "Java Auto Updater"
  203.  
  204.  
  205. "Program": "Microsoft PowerPoint MUI 2013"
  206.  
  207.  
  208. "Program": "Microsoft Office Professional Plus 2013"
  209.  
  210.  
  211. "Program": "Adobe Refresh Manager"
  212.  
  213.  
  214. "Program": "Microsoft Office Proofing 2013"
  215.  
  216.  
  217. "Program": "Microsoft Lync MUI 2013"
  218.  
  219.  
  220.  
  221.  
  222. "Program": "Microsoft OneNote MUI 2013"
  223.  
  224.  
  225.  
  226.  
  227. "Description": "Creates a hidden or system file",
  228. "Details":
  229.  
  230. "file": "C:\\ProgramData\\Windows\\"
  231.  
  232.  
  233. "file": "C:\\ProgramData\\System32\\"
  234.  
  235.  
  236. "file": "C:\\ProgramData\\System32\\xfs"
  237.  
  238.  
  239.  
  240.  
  241. "Description": "File has been identified by 60 Antiviruses on VirusTotal as malicious",
  242. "Details":
  243.  
  244. "MicroWorld-eScan": "Trojan.AgentWDCR.RAM"
  245.  
  246.  
  247. "FireEye": "Generic.mg.02fd84c6593960c0"
  248.  
  249.  
  250. "CAT-QuickHeal": "TrojanRansom.Shade"
  251.  
  252.  
  253. "McAfee": "Generic.bvh"
  254.  
  255.  
  256. "Malwarebytes": "Ransom.Shade"
  257.  
  258.  
  259. "Zillya": "Trojan.Filecoder.Win32.8919"
  260.  
  261.  
  262. "CrowdStrike": "win/malicious_confidence_80% (W)"
  263.  
  264.  
  265. "Alibaba": "Trojan:Win32/Shade.6a7599e5"
  266.  
  267.  
  268. "K7GW": "Trojan ( 0054663e1 )"
  269.  
  270.  
  271. "K7AntiVirus": "Trojan ( 0054663e1 )"
  272.  
  273.  
  274. "TrendMicro": "Ransom.Win32.SHADE.THBBHAI"
  275.  
  276.  
  277. "F-Prot": "W32/Cerber.ZX"
  278.  
  279.  
  280. "Symantec": "Downloader"
  281.  
  282.  
  283. "APEX": "Malicious"
  284.  
  285.  
  286. "Paloalto": "generic.ml"
  287.  
  288.  
  289. "Kaspersky": "Trojan-Ransom.Win32.Shade.prf"
  290.  
  291.  
  292. "BitDefender": "Trojan.AgentWDCR.RAM"
  293.  
  294.  
  295. "NANO-Antivirus": "Trojan.Win32.GenKryptik.fniufq"
  296.  
  297.  
  298. "AegisLab": "Trojan.Win32.Shade.4!c"
  299.  
  300.  
  301. "Avast": "Win32:Malware-gen"
  302.  
  303.  
  304. "Endgame": "malicious (high confidence)"
  305.  
  306.  
  307. "Emsisoft": "Trojan-Ransom.Shade (A)"
  308.  
  309.  
  310. "Comodo": "Malware@#svpmswn9wt5s"
  311.  
  312.  
  313. "F-Secure": "Trojan.TR/Kryptik.ssops"
  314.  
  315.  
  316. "DrWeb": "Trojan.Encoder.27269"
  317.  
  318.  
  319. "VIPRE": "Win32.Malware!Drop"
  320.  
  321.  
  322. "Invincea": "heuristic"
  323.  
  324.  
  325. "McAfee-GW-Edition": "Generic.bvh"
  326.  
  327.  
  328. "Trapmine": "malicious.moderate.ml.score"
  329.  
  330.  
  331. "Sophos": "Mal/Cerber-AL"
  332.  
  333.  
  334. "Ikarus": "Trojan-Ransom.Shade"
  335.  
  336.  
  337. "Cyren": "W32/Trojan.GTFL-3055"
  338.  
  339.  
  340. "Jiangmin": "Trojan.Shade.rd"
  341.  
  342.  
  343. "Webroot": "W32.Malware.Gen"
  344.  
  345.  
  346. "Avira": "TR/Kryptik.ssops"
  347.  
  348.  
  349. "MAX": "malware (ai score=100)"
  350.  
  351.  
  352. "Antiy-AVL": "TrojanRansom/Win32.Shade"
  353.  
  354.  
  355. "Microsoft": "Trojan:Win32/Occamy.C!bit"
  356.  
  357.  
  358. "Arcabit": "Trojan.AgentWDCR.RAM"
  359.  
  360.  
  361. "ViRobot": "Trojan.Win32.Ransom.1443016"
  362.  
  363.  
  364. "ZoneAlarm": "Trojan-Ransom.Win32.Shade.prf"
  365.  
  366.  
  367. "GData": "Win32.Trojan-Ransom.Shade.R9PGZ5"
  368.  
  369.  
  370. "AhnLab-V3": "Trojan/Win32.Fsysna.R256594"
  371.  
  372.  
  373. "Acronis": "suspicious"
  374.  
  375.  
  376. "VBA32": "BScope.Malware-Cryptor.Winlock.2014"
  377.  
  378.  
  379. "ALYac": "Trojan.Ransom.Shade"
  380.  
  381.  
  382. "Ad-Aware": "Trojan.AgentWDCR.RAM"
  383.  
  384.  
  385. "Cylance": "Unsafe"
  386.  
  387.  
  388. "Zoner": "Trojan.Win32.76844"
  389.  
  390.  
  391. "ESET-NOD32": "Win32/Filecoder.Shade.A"
  392.  
  393.  
  394. "TrendMicro-HouseCall": "Ransom.Win32.SHADE.SM2.hp"
  395.  
  396.  
  397. "Rising": "Ransom.Shade!8.12CC (KTSE)"
  398.  
  399.  
  400. "Yandex": "Trojan.Shade!"
  401.  
  402.  
  403. "SentinelOne": "DFI - Malicious PE"
  404.  
  405.  
  406. "eGambit": "PE.Heur.InvalidSig"
  407.  
  408.  
  409. "Fortinet": "W32/Shade.A!tr"
  410.  
  411.  
  412. "AVG": "Win32:Malware-gen"
  413.  
  414.  
  415. "Cybereason": "malicious.659396"
  416.  
  417.  
  418. "Panda": "Generic Malware"
  419.  
  420.  
  421. "Qihoo-360": "Win32/Trojan.Ransom.449"
  422.  
  423.  
  424.  
  425.  
  426. "Description": "Creates a copy of itself",
  427. "Details":
  428.  
  429. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  430.  
  431.  
  432.  
  433.  
  434. "Description": "Harvests information related to installed mail clients",
  435. "Details":
  436.  
  437. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  438.  
  439.  
  440.  
  441.  
  442. "Description": "Anomalous binary characteristics",
  443. "Details":
  444.  
  445. "anomaly": "Actual checksum does not match that reported in PE header"
  446.  
  447.  
  448.  
  449.  
  450.  
  451. * Started Service:
  452.  
  453. * Mutexes:
  454.  
  455. * Modified Files:
  456. "\\??\\PIPE\\wkssvc",
  457. "C:\\ProgramData\\Windows\\csrss.exe",
  458. "\\??\\PIPE\\srvsvc",
  459. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  460. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  461. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  463. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  464. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  465. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  466. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  467. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  468. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  469. "C:\\README1.txt",
  470. "\\Device\\NamedPipe",
  471. "C:\\README2.txt",
  472. "C:\\README3.txt",
  473. "C:\\README4.txt",
  474. "C:\\README5.txt",
  475. "C:\\README6.txt",
  476. "C:\\README7.txt",
  477. "C:\\README8.txt",
  478. "C:\\README9.txt",
  479. "C:\\README10.txt",
  480. "C:\\Users\\user\\Pictures\\Host.zip",
  481. "C:\\Users\\user\\Pictures\\Hq6jh9v95QXDPOEx3csOLl41n4CNlbYd9YsWcpK2Feg=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\Pictures\\Host.xls",
  483. "C:\\Users\\user\\Pictures\\qRBz6m29yA2kUnxpJpUZTRUPoCjnXiwUj1aDyNy1BCY=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\Pictures\\Host.pptx",
  485. "C:\\Users\\user\\Pictures\\HEhviKsVbjKhmV0ZyIhAKw-1ONKbxo5IdbzOQ0l6gLA=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\Pictures\\Host.ppt",
  487. "C:\\Users\\user\\Pictures\\T3jIKHnLfroH3hgA5MErMq3lszw8m8FkJFsorewAUQk=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\Pictures\\Host.pdf",
  489. "C:\\Users\\user\\Pictures\\MPBJv48BtYRYka982tSqK95oVvYLmTkln07+IJ61bi4=.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\Pictures\\Host.jpg",
  491. "C:\\Users\\user\\Pictures\\JMdQPL++uh9M4TKGL1nGlUUbA-9idDg6LxOVbA1FrRQ=.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\Pictures\\Host.html",
  493. "C:\\Users\\user\\Pictures\\8QdjQae9RRNmogdr5ksbQbQifqQUgBXWP49IXAF7y9A=.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\Pictures\\Host.gif",
  495. "C:\\Users\\user\\Pictures\\uPccJpgEUWwR5LNd2wXvMnscN+dZQQ1glPMmkGUvBaU=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\Pictures\\Host.doc",
  497. "C:\\Users\\user\\Pictures\\HPJWMq3PSBc-bmOW44ZLr2-DYg7RpchkAI05uSDb1xo=.C30C4DA81AE308962B9A.crypted000007",
  498. "C:\\Users\\user\\Pictures\\.xls",
  499. "C:\\Users\\user\\Pictures\\EhrxSltD6VTyFbwhtODCgQ==.C30C4DA81AE308962B9A.crypted000007",
  500. "C:\\Users\\user\\Pictures\\.jpg",
  501. "C:\\Users\\user\\Pictures\\WH8dG8KZCuHdmw+iTivnGA==.C30C4DA81AE308962B9A.crypted000007",
  502. "C:\\Users\\user\\Pictures\\.html",
  503. "C:\\Users\\user\\Pictures\\v64DUKv9+55waYJaVkivhg==.C30C4DA81AE308962B9A.crypted000007",
  504. "C:\\Users\\user\\Pictures\\.doc",
  505. "C:\\Users\\user\\Pictures\\xW8+1P7VZZniAxswgTBXPg==.C30C4DA81AE308962B9A.crypted000007",
  506. "C:\\Users\\user\\Pictures\\.bmp",
  507. "C:\\Users\\user\\Pictures\\z2acQeMBe1atu907KWR87A==.C30C4DA81AE308962B9A.crypted000007",
  508. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  509. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\s4pMSgd9qYogmvcNCQeH2HuZsUqloY+5GnXh9DQJH5ekorX-pBqsnEzJsbLPYvyx4eTpow6fQYZunaJfp3zwjfi12tUt6zTCBombdAx-8C5RY3yn3FV7RDhKTkNoRbLH.C30C4DA81AE308962B9A.crypted000007",
  510. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  511. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\JEQa9HFRTJqxET0Ynilrtw9bTTvDDf2iTcjmJTJZRT8=.C30C4DA81AE308962B9A.crypted000007",
  512. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  513. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\g71tCwHmxfz7DfNX4uMu6um-Hdr5ya1v+IzMVZxwRlEXByx3h07gBjIYJ2t76D2G.C30C4DA81AE308962B9A.crypted000007",
  514. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  515. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\XJWlkEtl1hmT7Oi6uNr1fZw6EjyTj0myI5bIqC5PqkI=.C30C4DA81AE308962B9A.crypted000007",
  516. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  517. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\lR3PBfEGmgkr74k8OPYl-Dt7PIw9fCmu7lPBS3LH5Yw=.C30C4DA81AE308962B9A.crypted000007",
  518. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  519. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\-Y6Dvi5gtho2xM5Wv2PgOVNvGTXedkn6BbMcz2RNuLc=.C30C4DA81AE308962B9A.crypted000007",
  520. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  521. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\M05jR1uFn5RScp3ssmBpKm18sT12IUbjdBM650Vhp67I5WPt3zOSWkgaqJ9FGOOR.C30C4DA81AE308962B9A.crypted000007",
  522. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  523. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\DUH8a5jlM8XsRBNcwWVQVZhDnDiWcpligNg1WhAIa5I=.C30C4DA81AE308962B9A.crypted000007",
  524. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  525. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\N6NBXGXR4m6IJYdSHM2nsTufwQu9VPNC8uwyZxb4m325JiA+KcgsIur8ktBEy-3D.C30C4DA81AE308962B9A.crypted000007",
  526. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  527. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mga4iy0T8WQPPw4q3tLipCM5ybQtXmioCXJ9BCHOVUY=.C30C4DA81AE308962B9A.crypted000007",
  528. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  529. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\mkM+UwNG71yddlpyyvHk3StEeFF+6nvBQNKgPBzpys4=.C30C4DA81AE308962B9A.crypted000007",
  530. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  531. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\DxuEYK-cB94O7b9hzK0J9ZFsWn-8eESaxs8WoPpYbSM=.C30C4DA81AE308962B9A.crypted000007",
  532. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  533. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\msOtG3m3gE8MDeZLMppKdf2K0BSF60OL1lMYhcn73QE=.C30C4DA81AE308962B9A.crypted000007",
  534. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  535. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\ygPEanj-SkkTDg45JBRa-DPMAqFqcGSCVPUEN9GWi9-Iqwn5CH6xVjuiuOhcEZe-.C30C4DA81AE308962B9A.crypted000007",
  536. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  537. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\inNQ1xYDw3ACvuHt7-lqvEiMeOViI+++Z7+ffzPxuHI=.C30C4DA81AE308962B9A.crypted000007",
  538. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  539. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vbsWkhXusG0DnjBVbc3JWH-oDva4a17qXq+o6QQRn2SSTIgdqOct6tVB0SPq2dKl.C30C4DA81AE308962B9A.crypted000007",
  540. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  541. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Z2gwwy-PGF6agadmTx+g65ubQAXdWM14l+dB9xXYJGE=.C30C4DA81AE308962B9A.crypted000007",
  542. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  543. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\pdHHR2cDQXmKbW9G0SF6nYxaqLJ2SGVm4SY2VfXWAGw=.C30C4DA81AE308962B9A.crypted000007",
  544. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  545. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\siNZGzlRESjcZO3U1jzKFUR9Mp+oGu2Ejuogk88wUCE=.C30C4DA81AE308962B9A.crypted000007",
  546. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  547. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\JmW-LuX8Pyp3mq37ATo8+CWOpFTcWg7NjebHnEfhfOs=.C30C4DA81AE308962B9A.crypted000007",
  548. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  549. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\AtAGSt+fdSr8VUrHJSVHgOpE9NxMwdlyJtss48Q6zh8=.C30C4DA81AE308962B9A.crypted000007",
  550. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  551. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\K3YvHuV1mHg20I-i0MWLizLUmAMVsyD8HEeunJ9+hG8=.C30C4DA81AE308962B9A.crypted000007",
  552. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  553. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\-r750Pi+FGdhEo17AfX8Pqy10jk+piiWOceMN80rjvk=.C30C4DA81AE308962B9A.crypted000007",
  554. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  555. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\555H-AX+qjSrL3UJPoFdI40kXQ7lfiV67IWwriIbcZA=.C30C4DA81AE308962B9A.crypted000007",
  556. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  557. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\LFx6zFWFPvdQMcodDbumC84jwTXEWepia67kdc5ZLOg=.C30C4DA81AE308962B9A.crypted000007",
  558. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  559. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\yqSGHIVE1ScfTNMFQCRDMr-w1PdSzkeC70QT2zs0MNw=.C30C4DA81AE308962B9A.crypted000007",
  560. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  561. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\x0s4EslFT4CU+HLyMi78T86DFTwMek2uj54LBnIJezc=.C30C4DA81AE308962B9A.crypted000007",
  562. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  563. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Gl4d1i2WbnOfjqCuzhD96taRMmY2k2cQXl5A6srm3hE=.C30C4DA81AE308962B9A.crypted000007",
  564. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  565. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\t9z2HaRpYpoDLKRDSH6tVO-1JiweqY94Kvn-cDeTaKI=.C30C4DA81AE308962B9A.crypted000007",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\2a9mZ9j4WcroaKQ-z1A9oKURFQVacUkCcQ85iKP1mEg=.C30C4DA81AE308962B9A.crypted000007",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\zBvkgNk97VRDtsJd-n0blfNho7bUePcr3wP4TZA0kvSxUynHu4QFBS7StH+XcQuYoO2I6ksp5YHHZPiOWd4oRA==.C30C4DA81AE308962B9A.crypted000007",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\CskJ3KULoaYwGMpstDDTM-CEsstKh15qqwH2zWEtE0hAaSZ8Q6fIVHhrdDNiAouznPifVlIpbUaFXoteesppIQ==.C30C4DA81AE308962B9A.crypted000007",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\GDR+4h93JOOmNw5dKbrXM+K1-bk7vR8FXlUcyTd0hWuSduixqhPC384aLcoqhzc9xeRE1kIVbjkUARUdGcc19YOx2tFzYK0KHvpNAPET+N73i5K9DlMjuicz-NkNX2dXbgK7jq+tU-FoSMb9snFPgZAA6k+8A3v3hCI8LOGcjKSLC9p6eGeeY3ogaPW8a2Oz.C30C4DA81AE308962B9A.crypted000007",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\6IsMpdpqzFgVsexXk0dp+s6C9tiwGPS27gQNHU3qNTItf4bCQ0kF21oeiTN0l-IVAOt7YYJyz-NdSBkHLN1Vdg==.C30C4DA81AE308962B9A.crypted000007",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\hcM4V6QrpGTI2beRMjRvemiVcnp86nCRxDzeV36F1PwdHucF2zcplMpKwJRFoB2biFHf4dt6Bj6enIYtdZPXAg==.C30C4DA81AE308962B9A.crypted000007",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\2leRzcMBuOjH-eKuaCdwGZcsPlOZFlSWyWtKn1aV6iMnGN31poyJ9XE+YekSpWKWMJqFuyPaJeSm0iZQ7Vpqow==.C30C4DA81AE308962B9A.crypted000007",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\b51Iv1bvAuyqZde2V6aKZoDOrpqGa3Hw3fVlw7w97qP+TODxTUi9BUWzHib9EI13M4qiW1w9I+PgWvoQ0CZ-lKmiFdwMmONWczoUbuf7KYdK1R1jTPEKwSStK2wtrrFZlU4Xr273aGop1-aSTuqtGg==.C30C4DA81AE308962B9A.crypted000007",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\pZElgOR1FBQKwLpaJF0ZQzo0aAfXVWqZfJE++GO9rqbsUlAm5NnJ9HXq-S6+KDo-f9dcoiaNJs2G9qP1CXV-BArLPPKTj1peNOHp6YIC-5o=.C30C4DA81AE308962B9A.crypted000007",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\UnfAZCmzzaOGyDO09r1msgZhnyxczl1bc5mNalw1kT01K-X8GbW8zS4zNaQAaxeMcBzlHtz6vyNGz1eLaSwjSw==.C30C4DA81AE308962B9A.crypted000007",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  587. "C:\\ProgramData\\System32\\xfs",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\0zk6f2nGHO1I0Mh19U9uvsFKs7fgoxiJlLKKgBSaRzve8hKBbY8YRl+l0VJa4Asefq1dKvaqvuyuZOYtG8Pvh+s-sQ2aTOuvE6uS4dYr3orFMsac1eKxbS1aQddopXhg.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\zc-AzrLAjRwmUkYpY9VhBcMjJBMAWGJ-5y4uOl-bkRhyDh7RZTMoQeIA7sUYwXyJ82nA5ppU5+x+vThTh+v4Pld982CU8uzPT-zvHaD5K9tyJ+YnFZiBKa8GYfa-6KVT1+qjRpDDQpOAYswXsOs5TA==.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\PvQAR4CsM8GUlPmtC6Uc2jTKS9hhMmCu9P8Oak+l-Ff5WXHcDYDpn30f+OnQdBmkaIEcHxUFUtxmQ3trvhyytw==.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vNZseyu6MLvJB-8XUu0h0BIMgmY6wS66EVrEk7aABk6GQfSrkqxatxdB6-nt47cywggYqfW9BN136HgJyKd94A==.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\0QEDbTmmaW7O-cr4Fffi+w6IjKLcZ+moIYi31B+wMckzIE2Nmn0s32jFjhWB02vL.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\bSq0568bXcH0vBuhWtYhVRVnNH4HBGJNQ0TdvkosuaRnIQI761zUIjQZk3sDZ2AKmH843TYBUEbTi3R60K-AVA==.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\rACjzkFD+UCLKSK7lPxnPLlMMi4QErw5k1J7c9dY0zt+JGJcRUAGuv33-UwcPuV1NRy9otSv4FnHF6ycEZSWyJWSeswVB1GdPj+Xr-s678WJg934VTi1UTr0kaD-b-k5.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QgC1TS4YQ73VeeMLzNEMR1tyz9KdnhOOXqj8fh1MdGSBb5ewCfacc0iogW9hQludFDieigHu-BfEICbDAURoNw==.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HaJE4iRR20zZGeVRgnaQ0X2OFrksTyarid0BrokOBWH1FqMImeYHZe0e+4kAoDghpD0ZM98zsTsDWMYZ+wT3Ng==.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ezT-6bcFMucU5KaW9XNqh6o6+u3BCWQu8jlSGw0IV16rsAZPtLDUa+SyifMwpfMsoEgoXk2gn+hIaRoNk9JjFg==.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CrXfsPtfdEWvhIH6HLkggB1n6j1IuteW98AEC2ZFTPJ7xo38jdxcHzcM--c4PCybdx8JtwJwUQS0R1HLUTksaQ==.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0Mo75KxD634c09o216e80p1Gh33xxI0YNaUc+wh5eJAU+IfDaDbxHcA6WNwGRDnwGuyMV7uDicGkiratv8UpvA==.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\DjuvhwNoVON-qU0GSPu-GQzKy8LxhbkDIcJ6sTb-K-k1g9pHrDEMqIgLNtdnvMB+fSPHPZf+SZMpVNd+2HXcvQ==.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\numEFzmyV+SnMzzu6msx4s1GJBfvCjDMcM9icHiTWrnIu47CjB5pBXeprPIWx1X-o6X24TBB9eYuclowQTgV7aHqfWj9Du0rlUP5k6TTkT8=.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\JfUkwQ-8RHMWhqMXdPv+FiuNHIec1tBRUZCN2WelBj0DZEBr7sicis1INOUgPAgn7NplYqWWS27CTlYSwcTa5Q==.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CyIVJORG3OC+GBG2qmwg2ZBfBGGEH8d-0TBZrAAGymRMPU2bUY44LjyXZGD3hgLclQ+mPGqIm4ukWeilatgx7w==.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\PLn3SZneJphZ2Tpp7hkFCj0b3Y7rjh8pqRtJu617Sh4b+FwDubVz7lqacbnEp06ypTQeKp2UrJ5Z0vdl99vhfg==.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZqxHjyy8cUCKaEZa802nuYGLzAp3Y8oJlqeSTtNR2e6X+y0LHRaFTxc-mv0A79y0JWUhd6N45e3wXvXys0DKKQ==.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VUoV3762yuF2hGQEppMxTScz4TfbNd41CPn6blJzTjf1MeASrpHm9-ayaLSw5JwsVZGVRjVZmuMW8AX+9q93SA==.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xFPnOpbQMKDvDi8ufKQWnHNYQ4yGncrC-cbiGT5m5xssh1JaeNvC4VCmlIng6FgaXtvNON6obA7pQJf1o27ouw==.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\fyawgXYRDnuw8J19SblnWC3O6GFOaQ-6XGCS2LASHhjQ8ZVjZP+WkmUCUCSHls2tlNJZ0fD9R4mDrkVtD-w7DQ==.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  630. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\McQegUdq4G+0mS-2KjgjJeKd6VBxYkermJX4mla3itEk-zqgZkA6ldvaJamux6vDMCIzEeHHVs9gFYmWS7RctQ==.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  632. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\whAW3XF6F7Gprw5r95f0UD+xED2KMw3xkJv-wxIA+j1egV3d0dVOYYW4SC6kC3E8cn6zX4jIE-Pe1gjJbDDYyw==.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TA6cmygsVwXfSWOIVEjw+GyP6KcZAvuQFXEXE8ZBcf5b+GZ-yrTH2DplG8qc4UZz1dgvtQdr3d4THDe2+5fJQQ==.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  636. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\SRPCJ++hv7DeD-0kETK4lhhrezAz+JIO9MoDRzIHUlQI2yvs2xOKcmnh-0Mb8-XJl7HaxKhe079qWeJLPwMj2Gb-iAytdr6LLykUf1zfiEE=.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jRJDHWQdPRR6izGpHGQx17rLvUsMJcTMskC9v74R-9mUQLyk4lQ11W7Ok85Aqt3Ho4k4pbpnFpWAW-PBgr6oJw==.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ZGQ-yzEb9YQP7zMieDkVGSHXns2lpOQ6dZRrPE+ey1jyRdXX799szBscigipFIPLmX+UIQWZ7PBZlD4nyGz9Ww==.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  642. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\tO7zBzlvJf-dy4CjFjKeTpP5iLNpaYsMZwqq8tYNv3cflXjccLMdler1M3NnNfRsAGD9u97-mwKukYrE9niqEg==.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  644. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jUxUyRWdud2OKAQbB4JeXcn90t-GYCTCpW9PcTB+S6H4d8yBXM2odD9jXLZ5ItOh6KPNuRYqnVbOKpYubEdprw==.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  646. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\hDmcvfBDB-Ky07pSpqE9CxbepJkHHmvucdmEau+XbvUc3cBj40Red1u4VHmFwo8EH+MWIlJFYepYfaI0bAsZmA==.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  648. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wQUTv4cJlS0fe5N0k1aF8BKnyZlIgK7FjkE6UMgccXkPD5q-Gv6Wb69kRyH2VfauZ3PJNeHU4yYl+IustHCWsw==.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  650. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\d+GwK-CskhSdVywyqbb8suITJynIb2+fW8tsKsK3aFTAIW0-JAcXP0BHO--E-HOQ.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\GD26pZFLG9fQ6DUgP6XAoIlQENmYmmyUsyG7qomZ3v0=.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  654. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\bg3v04PPEJ-p4QG4ftrmu9ugSblaj-HujKl61X+J-Lo=.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  656. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\PvNRYtSiQmlIReYjEgWgwvWyLmBSZ-nPNnxsgkx84iM=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  658. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\2-nUY62ktp21R6X0vFDsbmMjnYOdUA-vO1I0roOnjNM=.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  660. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\mxM5H73mlXk39gUCHm5JmYpKEX8pkJ0zaSrBpekdMmk=.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  662. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\fJawO-Zjkm-HHDMIXTBq1F-Kc03PpyFofw1gNm491eQ2rdAgpFKfua4zk5LTHxy14yLyOA4fIdk4b2Xb8OtNmg==.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  664. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\U6UQowMiDwPDZy3VmfEpKAncZNaFuraQVdZyIE695266wtuBYVfzSi8aZFmomjon9Z7OxC5MmjF7GuH6uMf-gQ==.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  666. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\LOA1CH5oxUpOBY9bd1WkhqrN5sFm+ZEyKR6L1uSoRH4=.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  668. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\dqC8WT9Jh4Jebb2NqIWk8bKl-uq8V8Jw+dmCKTrAApE=.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  670. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MO1isCkqAqYwM6nH7A3EkhVBnjihq185raxUBIjPx57U+iIVI8AtWhHmy7Xk1UTZ5B8wceK+wYASMTldf-25EOrPpghxMeQnz09dpA9xz-Q=.C30C4DA81AE308962B9A.crypted000007",
  671. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  672. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\G452f2VJZ0bExhSkj-fbiPWmF3Jpp3pvZlZonxNTxYN7PNy2S4s0DzX6g2wnsOVS.C30C4DA81AE308962B9A.crypted000007",
  673. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  674. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\P4Ex7mR4nygs73+V1g+nlo8f3C7bO9ZftO9Kq0r8j4I=.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  676. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\yjPaprcP9bJwx8qEIKyakTZrLYA0tn6ol2-Np8UWYDFrgFA3FTwl5MPSG52jwWZh.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  678. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\rjEqhEA6VfHxinWjUFn0Jypb7pV5MxnrE+InluhyynyeF9vO9j5+k+33N9mkDm9zIdrnFk3ol7qxGQjITUFegEUzHq+vb3TnIO81Ko5mrnQ=.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  680. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\KHjPFYI3W+S2F+B73rlUnDPdzSVkOiAd+sgzXfgPh6E=.C30C4DA81AE308962B9A.crypted000007",
  681. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  682. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\0sNhW0ur8J5xPCfHPuuIJGPmoQbt7VGXdN06iA-TYP4=.C30C4DA81AE308962B9A.crypted000007",
  683. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  684. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\UZAnmSuOuxdE-Ze63HbHKg==.C30C4DA81AE308962B9A.crypted000007",
  685. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  686. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\X43Wp4+nIBjAz3AFr-N0wOZOZBREGH-PQo9Bno0Ar8Q=.C30C4DA81AE308962B9A.crypted000007",
  687. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  688. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Z+-nsBLjd7qUhTpQ6IH4Mhh8XKUn8QlTBY0KWowCpm2cKDvqBOVNYmNXO9ecDJpeecrrvfj2KrNMw8Xpf3VGRQ==.C30C4DA81AE308962B9A.crypted000007",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\3NBkyAndDK+yeD1btpiPYzMyJKcA7FhZK5sbrUoY0ldg55z4Bc28mw9-CqBpb4bf1NYEoWFYZHgipns5tt1AaeUbwqEZPu873Xx94jZNvUrq2GpwPcptl0m961Zc9QshVujgdRXOwXIBM8Wl755Zzw==.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\bZFgrxobPo4tPfsVEDA328ZtQPpNGBGq3mQRs006ZX3hVxObbXdKMIZ1h5tcm-m8+On+JFuaUSigzKf9AD8Zsw==.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\TwyRNeINpBNUFWzNd2dOJsyK-MvgM4Mdo373Quv+JzHgcgpNyAlR1cv0HO8fxKPMrrStht+aCCBvE1ySEhalqhEdO0+jgSuAT+cnlCsmd5Q=.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\xrBNbZitiYFWT2a1VCwHKQvhycB2bYmM+q7z8PzCx-U=.C30C4DA81AE308962B9A.crypted000007",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\uf5TgAGTz3VJdOS3afRTXhmfh6sebKPJa7DkiiXyajA=.C30C4DA81AE308962B9A.crypted000007",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\LFUS2dXyRHdTFmK+UCizseZ6iWs3FuCvqMYetU86sKk=.C30C4DA81AE308962B9A.crypted000007",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\NfZGtZTseTy7Eo-9p5DECQBhDWBXVrs1+S003OtQyZHzC1SVCJBQJFukaAMNJZEcPa7Ka3GGDVwvmdqod5a1N-Sye9ywBDAliiqocGI9iow=.C30C4DA81AE308962B9A.crypted000007",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\sNb53EYIGjLoHgASjNlyf9RpEoqV67JFyG6GTnmlH6E=.C30C4DA81AE308962B9A.crypted000007",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\XhYughcBzDS+ew7R0-WS5karwFCEelSKkERvZI7Yakk=.C30C4DA81AE308962B9A.crypted000007",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\t-xlwB4B8AOjldzqhEVhxAAL0WRT4wKgzieUcb4mQJxUV646DTjna9sDNCT3OI1h.C30C4DA81AE308962B9A.crypted000007",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\AgXfMeNEb+AADyEmKxjjRA==.C30C4DA81AE308962B9A.crypted000007",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\dQdm6WgPjYUrHEKuTC-ScuO0hoYZ8iBfLLYaXb6NcBWGw46TS5SyrRF1Eurv6Keq.C30C4DA81AE308962B9A.crypted000007",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\M-PpF0WZ9rSFBGQvSXbSUaIgslKeU9JDeUpQ6myKjkw=.C30C4DA81AE308962B9A.crypted000007",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\5WSC5d+6hEnGJV4NWG2-LxOMVVLURQzAS8DLPNsV58w=.C30C4DA81AE308962B9A.crypted000007",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\SH+M6VbBbkFgL+qke5qHA8yKR5nTmPNp6r9Pt2g14Hk=.C30C4DA81AE308962B9A.crypted000007",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\1tGkFNnxMhN6gvIgo8bqz9dy5Yan3Dgeg1tyjG6SdBo0cMp-oRE35IucITzY+ljqSv85airCy-HcziTj7fL77A==.C30C4DA81AE308962B9A.crypted000007",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\wk-6XBIbHCMGUxjTwUAaCGh9OPdP8o9E2JzCeVv0kg9Jd3fLt+6XKDjKtB8fFb7QoJVObKKmsyFlxuhJuzhTfg==.C30C4DA81AE308962B9A.crypted000007",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\kpcpNJZi--S4bzEFolXNfjXL6J9I6qal1FTeidNwu3mxaLuk2qeliyctNE3xxf+p0jknkhM6Zv2FmPqzQ+yWRA==.C30C4DA81AE308962B9A.crypted000007",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\KhtVFU8GeTI-d2TkrA0g6qw5rbt7VoPeDHHpYiwDQ8JCZHOjEKWCdWbYXd-W+jHAlDqTFjXaP7ENMwtmvfWupQ==.C30C4DA81AE308962B9A.crypted000007",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\bxEey0iJSpev1tBD3NhOWD12owEyvwKpX+KdFfxCa9S6qLd7W1uqq6juGVck9KNp1YUYkbMR4aNqxxdPZShpAQ==.C30C4DA81AE308962B9A.crypted000007",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\IiV1AyWSaEtzQJKSxsZVsg==.C30C4DA81AE308962B9A.crypted000007",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\AbQkQp-shAqlczSPws9Bn5ylgiEOhxSFP5dRw7dmN+Lm1HHEs2VFhYkua-KEoby+WvRsd65bjvRtoVz41QuWEKfskqIPgLibO1AngyO83kOHvEi-gzlDqLeDIqtfShZsIi8KMeZU3SE+Bfb0T1QGdQWpZ2EC3WWHhSPrgfdi2PQ=.C30C4DA81AE308962B9A.crypted000007",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\5Sw9F1PlGuwAeaxbPZXz511VxZQJueChYrVTxBAH7FSp2xvUx82c95Z2km4ssQv2PKg8BHKn+6hmiuvx4AgXz9t0Sx93jwv52nxyAq46P3pGu0BOQYcMFQDVvaAaYJx0krYRgCJSqewUv4OFTcFNKFGm4lEItD-muD8OTo52a80=.C30C4DA81AE308962B9A.crypted000007",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\Q2tYzyOpZbo8b+nu3+qyxTaVO3k7ADcxbG8ArcQEO8TI0xrfsYXLV1ztsjcBDDzTiv5EYQ3xcfSwvHeVQKJERuMEbMTgyHVnWP3RGdy9WODeK9vNiRz2sjRG868RDCK-CU9kMk8uqqXkuJxTPoe1ATdbitrospvfCqM+kk-1b98=.C30C4DA81AE308962B9A.crypted000007",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\scSPQTXK58n3XCifzeOqFlgFEGFersl+gOEjHKzhSD42drnCrY1TN0VaLNLKpLxnf6P-E+11ailOX81fzOvZ2iOiqgfxB8jz2RbEtIlXigu+7JNyq+sTKUl93f2Z1EQGdmxHKgb7jIxgHaCkyms6p3IJ8RioFcWkfqwmLGsd+m8=.C30C4DA81AE308962B9A.crypted000007",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\fdmRQ5NhRuK9xa2gFTJz03MutyLwUcjsoxpNRWtkaLVAcvXhZ8ZirFptgTalaEaSn343BcNgHV3CCc5OvganJ0ApDQOVj4jRxIyDReHijwskPQ0SVcCUJ1RhsYsvue25XRWLFoNt+KaN-5P-26hVn1JZSDC4g7iEhHuVCszYM+s=.C30C4DA81AE308962B9A.crypted000007",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\8h924aut+GfW5VFR-Q6Eh1fob6HBI1gXuaSKwFGx1ydA-8Jft5ZFeeDLdFwCMVUeV3X5IUyly+I17Mni2I5hsD01dXaGXjDjSIYSamuVdj7rwLQTh+LQlnw2UVrVpo-v6hZARFhqYua6aViOtZkkpuWhSL6Rh1NH53Ub9eIQQsg=.C30C4DA81AE308962B9A.crypted000007",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\1P3J3mxVep1xvanvMQ9tGmS8smlysn2U8nTZh5FKxwSjZGXV8B5emu7atnyuwsVjCNKATG-w9Tq34r1j73-RhIohjZ-neCpez2MJZAd51F3KD1sgl8zr-wKUJz2AywZ+0nijvXalc2F42KqoRi1cG6yyhRcCeL6hpYJ+0iJL19E=.C30C4DA81AE308962B9A.crypted000007",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\cel9HboOmuAscwanpmoAp0TXRmLBHrYpEIhNUrHPofzhMbqOlMpOAU0qNA2cco92HtUHMgdrIT7UwzcE4vWnYQ==.C30C4DA81AE308962B9A.crypted000007",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\EOjR-KM19ALm0R6MWYD377VumpQSGZ+9dFLUXms9sHIsuHaDVS-lIPFsHgImmxH4Komhdc9XD0vXEA9QwLKrYOQwFPe9u2jMI+kPZTprdhmYp8qGYRH9njzzBQXoYnNK8xLQFktFfmm5niMGXEJGE5pywEBRLWQ8fxQPWfDab-w=.C30C4DA81AE308962B9A.crypted000007",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\VrWFf3c5B4My4K-3g3DL-zuu2i7csxxS7UbPMAQhDFeV39OQgba0vHWzutalzpKL0v0P6Xs3LRTjds+DDgLAWBehvhxjsOdl1QLXf4-bVSn8m8HNNNMDfHws6OqANVjIICuN-urwEomn0lvYTmGahoEmhsj3dcgscDgt+3vjnfM=.C30C4DA81AE308962B9A.crypted000007",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\4s7jm9nEHFHYgp9CdymbbNkIOQBQr3zEjT-G+x1tJCnvkNgwdVWGuVmslEgmw610KtXzPhsIZJWNwxSBkZ+-chGX-8hn5s-Id94WTC6cjeo=.C30C4DA81AE308962B9A.crypted000007",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\pt+p7sh5BgBXAOPvFhHWNXdRdvD7s7UdQpgX+yqT5xvb99HHTnMaKVVGf+JAl6Wf.C30C4DA81AE308962B9A.crypted000007",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\8t+MGYEcp-sAxw7zOLIB9WeiZDjtIeYDRCnJX9hxJl1LvD1Pq8mO5HN6EyscXtIpW9ozqMXD-un3mBNbJYCXGA==.C30C4DA81AE308962B9A.crypted000007",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\fl1CeWToFLUz2HgZnRPFed0BMf1+cYThO7bpr5Ya6iOB-LxNy8tGukpwdZg0KYLGqojSRQxEDyD4j7gGZcxVsQ==.C30C4DA81AE308962B9A.crypted000007",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\ffL6-75WiB3alSxCjoYJfpr7kftDTQgNLC--7V-wObw=.C30C4DA81AE308962B9A.crypted000007",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\UJ8ruCrhAsCeyloF6RB9ufgdKnbgfXi9cgQEljOqfJwKwgR+ExL2WUSArvShRXxuQAM3VUjAYsv+Mvl94+AwJQ==.C30C4DA81AE308962B9A.crypted000007",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\-5bBxMKCro5P76lfH-Gm-ZrtW+p42mYz6CGZatoLbJA=.C30C4DA81AE308962B9A.crypted000007",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\z-LPRy3ZbZ7Fc8DoNXtF3bDr8pQvBwYD07qAQ5uYyVM=.C30C4DA81AE308962B9A.crypted000007",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\laaCNsmbRD3fcXZN4GBi2qgPlbz75UfNuh90U498aS4LbJ11R5sgBopyCstA8iH3.C30C4DA81AE308962B9A.crypted000007",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\47I2Of8EalCdgpyK3ND439XjW5pRz3dZ4po-vPw77YZStzlKeA4yHy3-7fuq6qeSncBsTGRrvSgwvG1a29Akxg==.C30C4DA81AE308962B9A.crypted000007",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_02fd84c6593960c03958cf58cf4d063d.jpg",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\AtdGogAWYe7JAkTYPFTatISOPyf6NWv9hs2oTaWt7uOeR5L-g23jpycdl6wzlH4sgH-3auMmXAHdZDZgfrV7wVcK-IpFAmt6vFwr76kHxJIYYlGtuQehqxUegqcggibASSCQ2V-sgFD5WUFfRkCCCXSeSFNPfy0+y+ENmtOaj8g=.C30C4DA81AE308962B9A.crypted000007",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\Y4qA5UOESuyZClKQ80VrzMkwu98gzXM7bSq4VH+xvyask9PqCqS8pXATTuJTHHG3.C30C4DA81AE308962B9A.crypted000007",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\n2nnnsRUZAKkAXTUA3XCqMlwrylcqiyP1SiG1yf9IltSAzx1nilW64P+0NQ8Coa1n0PEL24e9Jn4op6Lv79Clw==.C30C4DA81AE308962B9A.crypted000007",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\3gXb41ddYegBY9pRwQDZ4fALjZ+aq0nxPJZ+WJm5iLQ=.C30C4DA81AE308962B9A.crypted000007",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\wX6sGWGl8Tl7L0+OjOaWGT5oqr9C7AFwcKYXcw69Gmk=.C30C4DA81AE308962B9A.crypted000007",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\TGwXbcJyS00QufvF6DLNL7LercJ-+4Rsqeq7zAYOYcDskxne90Pu4aemrei7ofbZI2l3WkBVVcNKsYNj5b6Bfw==.C30C4DA81AE308962B9A.crypted000007",
  773.  
  774.  
  775. * Deleted Files:
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  782. "C:\\Users\\user\\Pictures\\Host.zip",
  783. "C:\\Users\\user\\Pictures\\Host.xls",
  784. "C:\\Users\\user\\Pictures\\Host.pptx",
  785. "C:\\Users\\user\\Pictures\\Host.ppt",
  786. "C:\\Users\\user\\Pictures\\Host.pdf",
  787. "C:\\Users\\user\\Pictures\\Host.jpg",
  788. "C:\\Users\\user\\Pictures\\Host.html",
  789. "C:\\Users\\user\\Pictures\\Host.gif",
  790. "C:\\Users\\user\\Pictures\\Host.doc",
  791. "C:\\Users\\user\\Pictures\\.xls",
  792. "C:\\Users\\user\\Pictures\\.jpg",
  793. "C:\\Users\\user\\Pictures\\.html",
  794. "C:\\Users\\user\\Pictures\\.doc",
  795. "C:\\Users\\user\\Pictures\\.bmp",
  796. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  797. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  798. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  799. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  800. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  801. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  802. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  803. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  804. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  805. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  806. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  807. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  808. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  809. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  810. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  811. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  812. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  813. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  814. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  815. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  816. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  817. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  818. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  819. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  820. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  821. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  822. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  823. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  824. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  833. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  834. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  835. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  836. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  846. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  847. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  848. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  850. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  852. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  853. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  854. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  858. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  861. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  862. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  863. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  866. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  867. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  870. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  879. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  880. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  922.  
  923.  
  924. * Modified Registry Keys:
  925. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  926. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  928. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  929. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  930. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  931. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  932. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  933. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  934. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  935. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  936. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
  937.  
  938.  
  939. * Deleted Registry Keys:
  940.  
  941. * DNS Communications:
  942.  
  943. * Domains:
  944.  
  945. * Network Communication - ICMP:
  946.  
  947. * Network Communication - HTTP:
  948.  
  949. * Network Communication - SMTP:
  950.  
  951. * Network Communication - Hosts:
  952.  
  953. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!