API tools faq
paste
paladin316

Exes_b16d0f83bf1d7b24c3b2d97687a99c8e_1_2019-07-11_14_30.txt

paladin316
Jul 11th, 2019
2,163
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 68.45 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_b16d0f83bf1d7b24c3b2d97687a99c8e.1"
  7. * File Size: 1117360
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "6122e3767cd08da9e465a6651784440863cf847a51a588d7e5f95a3000ee72cc"
  10. * MD5: "b16d0f83bf1d7b24c3b2d97687a99c8e"
  11. * SHA1: "0d0c68df9b913e807c07b80dd9e6c2ddd9670490"
  12. * SHA512: "cc2ccc477d4c4c6180a7abc0ed1907bdd3ff988bd40782b4e097400c9637e5d5cd2fb18c851cb8b816af4c1f800f0fd01c84adcc8d48c515415f159661482a1b"
  13. * CRC32: "AEBC23E9"
  14. * SSDEEP: "24576:x67iOScr1wsPJ0L9V/QvZzvG7L6U0Bshuqz:x67iO3isPJ0LSvQ5huqz"
  15.  
  16. * Process Execution:
  17. "Exes_b16d0f83bf1d7b24c3b2d97687a99c8e.1",
  18. "vssadmin.exe",
  19. "vssadmin.exe",
  20. "vssadmin.exe",
  21. "cmd.exe",
  22. "chcp.com"
  23.  
  24.  
  25. * Executed Commands:
  26. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  27. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
  28. "C:\\Windows\\system32\\cmd.exe",
  29. "chcp"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Creates RWX memory",
  35. "Details":
  36.  
  37.  
  38. "Description": "Attempts to connect to a dead IP:Port (11 unique times)",
  39. "Details":
  40.  
  41. "IP": "208.83.223.34:80"
  42.  
  43.  
  44. "IP": "85.17.65.39:9001"
  45.  
  46.  
  47. "IP": "128.31.0.39:9101"
  48.  
  49.  
  50. "IP": "137.74.19.201:21001"
  51.  
  52.  
  53. "IP": "154.35.32.5:443"
  54.  
  55.  
  56. "IP": "85.230.178.139:443"
  57.  
  58.  
  59. "IP": "104.18.35.131:80"
  60.  
  61.  
  62. "IP": "104.16.155.36:80"
  63.  
  64.  
  65. "IP": "104.16.154.36:80"
  66.  
  67.  
  68. "IP": "127.0.0.1:31163"
  69.  
  70.  
  71. "IP": "171.25.193.9:80"
  72.  
  73.  
  74.  
  75.  
  76. "Description": "Starts servers listening on 127.0.0.1:31163",
  77. "Details":
  78.  
  79.  
  80. "Description": "Reads data out of its own binary image",
  81. "Details":
  82.  
  83. "self_read": "process: Exes_b16d0f83bf1d7b24c3b2d97687a99c8e.1, pid: 296, offset: 0x00000000, length: 0x00110cb0"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "Performs some HTTP requests",
  89. "Details":
  90.  
  91. "url": "http://whatismyipaddress.com/"
  92.  
  93.  
  94. "url": "http://whatsmyip.net/"
  95.  
  96.  
  97.  
  98.  
  99. "Description": "The binary likely contains encrypted or compressed data.",
  100. "Details":
  101.  
  102. "section": "name: .rdata, entropy: 7.41, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000fb400, virtual_size: 0x000fb390"
  103.  
  104.  
  105.  
  106.  
  107. "Description": "Looks up the external IP address",
  108. "Details":
  109.  
  110. "domain": "whatismyipaddress.com"
  111.  
  112.  
  113.  
  114.  
  115. "Description": "Attempts to delete volume shadow copies",
  116. "Details":
  117.  
  118.  
  119. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  120. "Details":
  121.  
  122. "Spam": "Exes_b16d0f83bf1d7b24c3b2d97687a99c8e.1 (296) called API LdrLoadDll 114100 times"
  123.  
  124.  
  125.  
  126.  
  127. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  128. "Details":
  129.  
  130. "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
  131.  
  132.  
  133.  
  134.  
  135. "Description": "Installs Tor on the infected machine",
  136. "Details":
  137.  
  138.  
  139. "Description": "Installs itself for autorun at Windows startup",
  140. "Details":
  141.  
  142. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  143.  
  144.  
  145. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  146.  
  147.  
  148.  
  149.  
  150. "Description": "Exhibits possible ransomware file modification behavior",
  151. "Details":
  152.  
  153. "file_modifications": "Performs 192 file moves indicative of a potential file encryption process"
  154.  
  155.  
  156. "drops_unknown_mimetypes": "Drops 177 unknown file mime types which may be indicative of encrypted files being written back to disk"
  157.  
  158.  
  159. "appends_new_extension": "Appends a new file extension to multiple modified files"
  160.  
  161.  
  162. "new_appended_file_extension": ".crypted000007"
  163.  
  164.  
  165.  
  166.  
  167. "Description": "Collects information about installed applications",
  168. "Details":
  169.  
  170. "Program": "Google Update Helper"
  171.  
  172.  
  173.  
  174.  
  175. "Program": "Microsoft Excel MUI 2013"
  176.  
  177.  
  178. "Program": "Microsoft Outlook MUI 2013"
  179.  
  180.  
  181.  
  182.  
  183. "Program": "Google Chrome"
  184.  
  185.  
  186. "Program": "Adobe Flash Player 29 NPAPI"
  187.  
  188.  
  189. "Program": "Adobe Flash Player 29 ActiveX"
  190.  
  191.  
  192. "Program": "Microsoft DCF MUI 2013"
  193.  
  194.  
  195. "Program": "Microsoft Access MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft Office Proofing Tools 2013 - English"
  199.  
  200.  
  201. "Program": "Adobe Acrobat Reader DC"
  202.  
  203.  
  204. "Program": "Microsoft Publisher MUI 2013"
  205.  
  206.  
  207. "Program": "Microsoft Office Shared MUI 2013"
  208.  
  209.  
  210. "Program": "Microsoft Office OSM MUI 2013"
  211.  
  212.  
  213. "Program": "Microsoft InfoPath MUI 2013"
  214.  
  215.  
  216. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  217.  
  218.  
  219. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  220.  
  221.  
  222. "Program": "Microsoft Word MUI 2013"
  223.  
  224.  
  225. "Program": "Microsoft OneDrive"
  226.  
  227.  
  228. "Program": "Microsoft Groove MUI 2013"
  229.  
  230.  
  231. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  232.  
  233.  
  234.  
  235.  
  236. "Program": "Microsoft Access Setup Metadata MUI 2013"
  237.  
  238.  
  239. "Program": "Microsoft Office OSM UX MUI 2013"
  240.  
  241.  
  242. "Program": "Java Auto Updater"
  243.  
  244.  
  245. "Program": "Microsoft PowerPoint MUI 2013"
  246.  
  247.  
  248. "Program": "Microsoft Office Professional Plus 2013"
  249.  
  250.  
  251. "Program": "Adobe Refresh Manager"
  252.  
  253.  
  254. "Program": "Microsoft Office Proofing 2013"
  255.  
  256.  
  257. "Program": "Microsoft Lync MUI 2013"
  258.  
  259.  
  260.  
  261.  
  262. "Program": "Microsoft OneNote MUI 2013"
  263.  
  264.  
  265.  
  266.  
  267. "Description": "Creates a hidden or system file",
  268. "Details":
  269.  
  270. "file": "C:\\ProgramData\\Windows\\"
  271.  
  272.  
  273.  
  274.  
  275. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  276. "Details":
  277.  
  278. "McAfee": "GenericRXHW-FL!B16D0F83BF1D"
  279.  
  280.  
  281. "Alibaba": "Trojan:Win32/Kryptik.1052c9fe"
  282.  
  283.  
  284. "Cybereason": "malicious.f9b913"
  285.  
  286.  
  287. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  288.  
  289.  
  290. "Symantec": "Packed.Generic.459"
  291.  
  292.  
  293. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  294.  
  295.  
  296. "APEX": "Malicious"
  297.  
  298.  
  299. "Avast": "Win32:Malware-gen"
  300.  
  301.  
  302. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  303.  
  304.  
  305. "Paloalto": "generic.ml"
  306.  
  307.  
  308. "AegisLab": "Trojan.Multi.Generic.4!c"
  309.  
  310.  
  311. "Endgame": "malicious (high confidence)"
  312.  
  313.  
  314. "Invincea": "heuristic"
  315.  
  316.  
  317. "McAfee-GW-Edition": "Artemis"
  318.  
  319.  
  320. "Trapmine": "suspicious.low.ml.score"
  321.  
  322.  
  323. "FireEye": "Generic.mg.b16d0f83bf1d7b24"
  324.  
  325.  
  326. "Sophos": "Mal/Generic-S"
  327.  
  328.  
  329. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  330.  
  331.  
  332. "Microsoft": "Trojan:Win32/Occamy.C"
  333.  
  334.  
  335. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  336.  
  337.  
  338. "GData": "Win32.Trojan-Ransom.Shade.47812N"
  339.  
  340.  
  341. "Acronis": "suspicious"
  342.  
  343.  
  344. "VBA32": "Malware-Cryptor.Kirgudu"
  345.  
  346.  
  347. "ALYac": "Trojan.Ransom.Shade"
  348.  
  349.  
  350. "Cylance": "Unsafe"
  351.  
  352.  
  353. "Rising": "[email protected] (RDMK:tR3QbLgrLusDdMxlmK2bIA)"
  354.  
  355.  
  356. "Ikarus": "Trojan.Win32.Crypt"
  357.  
  358.  
  359. "eGambit": "PE.Heur.InvalidSig"
  360.  
  361.  
  362. "Fortinet": "W32/Shade.B!tr"
  363.  
  364.  
  365. "AVG": "Win32:Malware-gen"
  366.  
  367.  
  368. "CrowdStrike": "win/malicious_confidence_90% (D)"
  369.  
  370.  
  371. "Qihoo-360": "Trojan.Generic"
  372.  
  373.  
  374.  
  375.  
  376. "Description": "Creates a copy of itself",
  377. "Details":
  378.  
  379. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  380.  
  381.  
  382.  
  383.  
  384. "Description": "Harvests information related to installed mail clients",
  385. "Details":
  386.  
  387. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  388.  
  389.  
  390.  
  391.  
  392. "Description": "Anomalous binary characteristics",
  393. "Details":
  394.  
  395. "anomaly": "Actual checksum does not match that reported in PE header"
  396.  
  397.  
  398.  
  399.  
  400. "Description": "Created network traffic indicative of malicious activity",
  401. "Details":
  402.  
  403. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 645"
  404.  
  405.  
  406. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 133"
  407.  
  408.  
  409. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 188"
  410.  
  411.  
  412. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 648"
  413.  
  414.  
  415.  
  416.  
  417.  
  418. * Started Service:
  419.  
  420. * Mutexes:
  421.  
  422. * Modified Files:
  423. "\\??\\PIPE\\wkssvc",
  424. "C:\\ProgramData\\Windows\\csrss.exe",
  425. "\\??\\PIPE\\srvsvc",
  426. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  428. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  429. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  436. "C:\\README1.txt",
  437. "\\Device\\NamedPipe",
  438. "C:\\README2.txt",
  439. "C:\\README3.txt",
  440. "C:\\README4.txt",
  441. "C:\\README5.txt",
  442. "C:\\README6.txt",
  443. "C:\\README7.txt",
  444. "C:\\README8.txt",
  445. "C:\\README9.txt",
  446. "C:\\README10.txt",
  447. "C:\\Users\\user\\Pictures\\Host.zip",
  448. "C:\\Users\\user\\Pictures\\ojezq9+uFqOfdvpOx4O+oqLfivnNaj4aWtYFpmLqEww=.C30C4DA81AE308962B9A.crypted000007",
  449. "C:\\Users\\user\\Pictures\\Host.xls",
  450. "C:\\Users\\user\\Pictures\\pFPB7rzKwa6k-nH1CnJ9oWlHdO8hZhl2Us64AGJjFOA=.C30C4DA81AE308962B9A.crypted000007",
  451. "C:\\Users\\user\\Pictures\\Host.pptx",
  452. "C:\\Users\\user\\Pictures\\5k8j8Ym+eJpr+kOgLsJukyh1tETQ-VS2tItoSmTlkUc=.C30C4DA81AE308962B9A.crypted000007",
  453. "C:\\Users\\user\\Pictures\\Host.ppt",
  454. "C:\\Users\\user\\Pictures\\m+tI1Jcgg8ah8+mzTfNcDUQdbRd0C4Npjb8Am6DHAl8=.C30C4DA81AE308962B9A.crypted000007",
  455. "C:\\Users\\user\\Pictures\\Host.pdf",
  456. "C:\\Users\\user\\Pictures\\XFXQh1wqR01KswvItOOOi2uRRNfOXYSMaRknDZeIHuI=.C30C4DA81AE308962B9A.crypted000007",
  457. "C:\\Users\\user\\Pictures\\Host.jpg",
  458. "C:\\Users\\user\\Pictures\\b+IkbNjkD6bZ45pgX1wwve+xnY5gH+b0MWp4iuHN8fs=.C30C4DA81AE308962B9A.crypted000007",
  459. "C:\\Users\\user\\Pictures\\Host.html",
  460. "C:\\Users\\user\\Pictures\\jeWVOt4bnU1fr1ozwGzPYA5UB2IyJdp5elBX6+WNSa4=.C30C4DA81AE308962B9A.crypted000007",
  461. "C:\\Users\\user\\Pictures\\Host.gif",
  462. "C:\\Users\\user\\Pictures\\iRb41E2u17lwTa80RNEYoZAPhEw4BcbrUMgAgUFCG6A=.C30C4DA81AE308962B9A.crypted000007",
  463. "C:\\Users\\user\\Pictures\\Host.doc",
  464. "C:\\Users\\user\\Pictures\\qGk4QC+aQS7B1w6unEMKaGXif7Iecdutxb5qB5gAgiU=.C30C4DA81AE308962B9A.crypted000007",
  465. "C:\\Users\\user\\Pictures\\.xls",
  466. "C:\\Users\\user\\Pictures\\LnZ9nviK9Ss1Fl1ohFmToQ==.C30C4DA81AE308962B9A.crypted000007",
  467. "C:\\Users\\user\\Pictures\\.jpg",
  468. "C:\\Users\\user\\Pictures\\bgSc6Np7YpPTcOFo4aD32w==.C30C4DA81AE308962B9A.crypted000007",
  469. "C:\\Users\\user\\Pictures\\.html",
  470. "C:\\Users\\user\\Pictures\\f+Zmiy6HT8goh4lqsrRePw==.C30C4DA81AE308962B9A.crypted000007",
  471. "C:\\Users\\user\\Pictures\\.doc",
  472. "C:\\Users\\user\\Pictures\\kE4ESdelE7iOfgZ9ZO69ug==.C30C4DA81AE308962B9A.crypted000007",
  473. "C:\\Users\\user\\Pictures\\.bmp",
  474. "C:\\Users\\user\\Pictures\\BSu0Mi20DCkJLxrQcwQjxA==.C30C4DA81AE308962B9A.crypted000007",
  475. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  476. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\x3028-BtWLzZk+19vxaFCGRJV7WrOv55FJHm40CjwlnYJiS0HhkqteXx7vpZYiLj5BqojVRgWO2IT0BOawxZf54o2dupxcLcf0W5P62I39J6HrRsQdjo-GtKRAjC0kWJ.C30C4DA81AE308962B9A.crypted000007",
  477. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  478. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uo5YBlTiLuyESipm-lPMSD5DYSt3WVvPfyJ3GOAclfY=.C30C4DA81AE308962B9A.crypted000007",
  479. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  480. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\7VcHWt2bAjb7Tun5ZZFC3IsCRjAz2ppX9NdeEHHJ+aeEs-p1qx55h4aUmkhG0ESv.C30C4DA81AE308962B9A.crypted000007",
  481. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  482. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\AGmPZoqv0biUsd5ljtDkZHkAKp0ogaljVEwkzaqXRTg=.C30C4DA81AE308962B9A.crypted000007",
  483. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  484. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\jByGrNBpEcm26jiodZMQ0h7WQxjkdOg+DhVb9kHbZcY=.C30C4DA81AE308962B9A.crypted000007",
  485. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  486. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\VIiyxsg6NYjDozJwJHtUS5UrrqO-URMkG9DJBbUeLLU=.C30C4DA81AE308962B9A.crypted000007",
  487. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  488. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\SPrfNkrQ-KPwtRQ0Fn1zqEmJHTuAgCsD7ixlaaFHsTjNwp2Lsrnxq7fyYHVgx9Z+.C30C4DA81AE308962B9A.crypted000007",
  489. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  490. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\e-92Bv7BX1xjrUclUExS9nISCGNV0nQItijMAcVmZWE=.C30C4DA81AE308962B9A.crypted000007",
  491. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  492. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bwtjrwSYk4Ik+BkkkZ3rK26f0BFz7ntsd5qnTChYRCM1NchxlKZaXh474-is6yjI.C30C4DA81AE308962B9A.crypted000007",
  493. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  494. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\xSYHHsBLC63bUh6wz1t-nqf6N5ExP84VeuNHeqghn-w=.C30C4DA81AE308962B9A.crypted000007",
  495. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  496. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Et+GygMzqDkcr0m6NFAGTdCJrrisuQmivrthBJZOrsg=.C30C4DA81AE308962B9A.crypted000007",
  497. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  498. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\tpB+0WJZNsAw8dpoJ7IA3+h79yZDIdh6SOA1h90ELwQ=.C30C4DA81AE308962B9A.crypted000007",
  499. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  500. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\bT3nGi9gERSuChEoZQAnuQKN2JlTxNE0X80ElkVjMK4=.C30C4DA81AE308962B9A.crypted000007",
  501. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  502. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6MPCPztWwmjOQ5WMWrG9-H9jM+yvKIjt-uAKM9Jl8KPfwlzg8Vj+JEs29ehPQwOK.C30C4DA81AE308962B9A.crypted000007",
  503. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  504. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\TNbbzSJ57k6UjJ5skLd7G1iQbWTFPElnE2vMd66ofcg=.C30C4DA81AE308962B9A.crypted000007",
  505. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  506. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\a2GDEPSVKWnWXKjxkf5lX+lFGH+EkAMQE0f2acxkpTJH1Se0pBIs5cPkaalKJb9Q.C30C4DA81AE308962B9A.crypted000007",
  507. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  508. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\spi-8aZC899OEi9Ffx7yNt-rCes8TJLMhsHnFSylNfc=.C30C4DA81AE308962B9A.crypted000007",
  509. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  510. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\gmMJT4scFZ0KTUmuYghwUAc9Tw8jPiDydG9jC8GaYhs=.C30C4DA81AE308962B9A.crypted000007",
  511. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  512. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\8PM0T9uTDUc5kSikzHLNS6MLjcMwxJBA3a+sqVUwmG0=.C30C4DA81AE308962B9A.crypted000007",
  513. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  514. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\0M-klrWAhTiTybgKNBga-U7jEqq5tGT7WTg9Zkmd-pI=.C30C4DA81AE308962B9A.crypted000007",
  515. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  516. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\pCVe5TyRYRXX85U+4icIIi0DILNU2gz49IyEcgS6krE=.C30C4DA81AE308962B9A.crypted000007",
  517. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  518. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\JhHLXm1ipGXMCTcz0JBMiQLyIquoRVIQeZI474BxNYU=.C30C4DA81AE308962B9A.crypted000007",
  519. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  520. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\hKPg7doObCtVTvht4+yRQnk3EGJDhdxGTqJEojxJ1zQ=.C30C4DA81AE308962B9A.crypted000007",
  521. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  522. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\HbCjk5VoKpjA8kJlU7y-fmvlPyd6LpywW6n4vef4TYg=.C30C4DA81AE308962B9A.crypted000007",
  523. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  524. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\YyuJ8SIXlqM4DuexX4SP6+0oXDbUgD-cRlssHCIKCLw=.C30C4DA81AE308962B9A.crypted000007",
  525. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  526. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\s8wsSc5hhVyfpvAuHeJAPHKqmGE8Em4SPxlazhiDIiw=.C30C4DA81AE308962B9A.crypted000007",
  527. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  528. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\NFgE1le+akSrX9763cYlR8+4w+xTm3DMTl5NQKVKJNA=.C30C4DA81AE308962B9A.crypted000007",
  529. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  530. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\fpXukQHJ4rrRko6fXj3P1Aj1BbufwwkRw93u+nw7xbk=.C30C4DA81AE308962B9A.crypted000007",
  531. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  532. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\WZjsYk3rtc7ZJq97cDgw4VGdC8O+K90uVX9cCKI8pZ4=.C30C4DA81AE308962B9A.crypted000007",
  533. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\Y5tXdRiJyYB7wVvxx2WJkf4YVMrpaiMN1FQz+rKrn3I=.C30C4DA81AE308962B9A.crypted000007",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\8JTm1SCbTb9jSQJpMUJAUpFbIfKX+ArSJboTQG-iqe-TBUC87tmF2Tof4qL85a3KLR8aar8H1r2MrvG7lgu8eg==.C30C4DA81AE308962B9A.crypted000007",
  537. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\QtEZFB9iZI75JbsvwkuylHCp6dXj2dta5rY3IsnaCsqbQpskCpbXw9dXEqr5u0Wap3W1RZVCqkX-ILHfwwyL2g==.C30C4DA81AE308962B9A.crypted000007",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\xk6Y-apfPeWvlYLzVkxBa+P+ChXq7VL-bmajOqeYgN15QTKxxanYQA2KzaJ-bkPi5-xKhyNIjZyciJltyBqq7eE9ONSrxB6EpdbATIS2ftxWMLPIJ-Ti-CzkDmBm4oQuz2wpSifHxwBSzLs06G67NbfJhyQC8K3v7YJk4GYwQmhAShjVoNj8lkFWPRBDv0zi.C30C4DA81AE308962B9A.crypted000007",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  542. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\NrX+Zx8vOgQ9ZD6vlKv-vSzEFtakpgH+qu3pBJ8aQXQiCh5EsVyAt+cZ4x9wpErVoJOrcgGjaa3My4rvYAPJCQ==.C30C4DA81AE308962B9A.crypted000007",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\D9Qe4H-NW2BodJ0EVOqrShXyFUzVn66O2fZpCidefHfQuXSp2YXikX6ZP+VTZnoE+q-Z5KbpMe0ra9s1Jj+rSg==.C30C4DA81AE308962B9A.crypted000007",
  545. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  546. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\DsQ1GYTcSrZgsa3nejeg-O0YIST400DkvUeSh7nu6k6cUx4fK-mepSZJsmRmJDAwy6c5GCGQ0qWguVfxzsAGxQ==.C30C4DA81AE308962B9A.crypted000007",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\vV1dFIkSMiRaXOYafdzLN0E7RE7mtbLSjVNlqvkSVnyiJiBPosmZeQB86pZkxd8s8Qb+MWF3koXWwp+r7TUYuBIVVvih7IbYkkQbBsnZY55c3skrT1KA5pXeIzcoDbThy8uKTuyPp5Arhc6oI7qyYw==.C30C4DA81AE308962B9A.crypted000007",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\cPADsCW9hI6NQSNmqRlbTU2ZbgVb4ZfzxhSXcUS5fiNPpdT76bgngEavm4EjOlm+ST46Pdi7kT6WEyN00Ges++TX4zc1+8mNZ8FkBnG8mm0=.C30C4DA81AE308962B9A.crypted000007",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ltgOafnOzhsJuUAyUDOy-sxX9EOLdYwBAd0S3OI6+T6TOV4Os080qBX5CLzozMMB5wNJFpUIMV8NW4TG8upX7g==.C30C4DA81AE308962B9A.crypted000007",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  554. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\F0sZoDLKeN9pul4SpJg5f7Hw+-KSrCDFrSLdWCuMNU3QyUHWea3Oqnwet4VJ69ZV27DQ0tAEuBQKyCPAEeCZ2dtzvlmAsepIVgoG9O4lvDtunWTB61c53IAiNOoljiAt.C30C4DA81AE308962B9A.crypted000007",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1q8qlE+2BUjrKjgRIkXVxLdq2eQ3fxeloGdmaBkUmW6DJlDwqHJk23eB4xMqN7ee8TBQm7i1J5tziVTupOC6NU6+GfO4MkNk0RxXwQcSlbSEjZAUJG627qvMIWb3lQZZpS+RNn5rq3XhynOYhvdmag==.C30C4DA81AE308962B9A.crypted000007",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  558. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\uF5IjQ7u6KMczsqecRD8h0Wk8nssi9YteqB-xDF6nfif897NKubsAXpa3fmfqk0C4xfMPPLxj-O477B8BTg+7Q==.C30C4DA81AE308962B9A.crypted000007",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  560. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\8Xk0AYNwiQuBzO1m0WtG-boL0ntBU6Lcx9SfYTmuU9JsUxBMXyi31xtxenoGpsS9btxuNDwM8xMpTx4QXCfkbA==.C30C4DA81AE308962B9A.crypted000007",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1purtMnwjCqYxPLD1en6jx5bl35mz-AMMmj2bb7iBxMQfFCpfa3-2ZquBtS9JPtq.C30C4DA81AE308962B9A.crypted000007",
  563. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\oIOk7cVeqhqhlCymm0AZhkRhSzRQaTYDrcVpdJQq6CdM-ilye+SN+4UYRX3zDELSb8VZB7wcw0tga3yczGUvZg==.C30C4DA81AE308962B9A.crypted000007",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  566. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\cNZ0yYRfhB35FHS0xHbPlcM95N3Nm6UaKBZs5lmpfZfKuUi2bUYo1ueRSLkHPE3sDQSkmAl36Yp1FvYEmgQHnofzNSfH8X+zc0GAfZwu0nuA1fsv7aSjDJTZ2gbND7k9.C30C4DA81AE308962B9A.crypted000007",
  567. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\8OEDCKBNAujoGVAeaR7VLgyKy6nl4He8LLmGo7Cauhu7NbDdA3aKf62SeLLR0Nip2r66d-iS79So5w6+Vupudw==.C30C4DA81AE308962B9A.crypted000007",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  570. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aOVi7cROhBR1Gngx97Rr6EMX3Jg+vqTswPEZmVp2tmL5C82u6fxneuuR1hLpZvwDyIelGOUkINL2qy42TS6XdQ==.C30C4DA81AE308962B9A.crypted000007",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\NbU5ozCXuhtKwRpqtv6XGYU5dghrUv+K2xrPtZahw1AL8pqJ4q5j0PxF-DO1hWVJlAo6kOJ10E38Z91K9nTcTw==.C30C4DA81AE308962B9A.crypted000007",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\BJ98XbT94VGosqcicDSvA2RUE-z-GdBTQ2tLGvX28IZbAx8N+brEuzQcbXu3rOtlmFJ-4FINwkOrKREtAJRz0A==.C30C4DA81AE308962B9A.crypted000007",
  575. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\cNmAMsVGdL9zeTNWACiDSb8EmbQTnv-33KPnsU32eyPHQmtUw9EDBNCV2H8+SDaBhzgxEPVITRdMy0LZDaRa+g==.C30C4DA81AE308962B9A.crypted000007",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\RnPBDav1J1ADd0YguM5NcTqtRtCfuTOxyN9+mbGWXtpLCTY4XhmwM5KwUpGy2RRTLpudkOuJ97m1HzZLHmBdFA==.C30C4DA81AE308962B9A.crypted000007",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\1ikrzh49FOHbtS0QnKQ53x+V557sRsEtESiN1FQlp+kYVu208VS2KPBeaz7j-j0iTgr9MRN5wsXqpn5NgRSFz1FW6vZjsOfupCUkSEXWgoA=.C30C4DA81AE308962B9A.crypted000007",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  582. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\aBqTdonSu6xnk5qBlI73g+ucMbuFjUHBDwyps4QKto4J726t2V27SKhu4AKrFyEyFYLCpg1ss9GejUpeyId5Lg==.C30C4DA81AE308962B9A.crypted000007",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\rCVNvrERhZZcveXAi6g9a2tQPP1iJRaaDgDwderSkksmKcl8VuEGxfR2ru-voi1iQz2vbCR85Yw+X8m3p6fM8g==.C30C4DA81AE308962B9A.crypted000007",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\q9EMPHrMs-x7gGE70KQHRb6P++Z5rBAvs-gd9BLF8HTjztr3A+S0qnBBBLvI45DYaNC1QM9zfj1RADKaia8yAA==.C30C4DA81AE308962B9A.crypted000007",
  587. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Z3xn3if6e-cj3yECc7JyGaQv4Fm+OxUR2lisWHu39jQWDDCotuvIKm2QFd8XM3n3xaFcsYZ0nS9pzywNwE1Vkw==.C30C4DA81AE308962B9A.crypted000007",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\L0ZX9CnoAFP5HhtxkVSuBKCYlRKxhQPa+m1omXQWc9q1Soq9d3HXnUWPsGhVnVBB4jJwrxCtSuLsk5VdGtTc5g==.C30C4DA81AE308962B9A.crypted000007",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\DSFC5SCIyMzvCRcUUWgNzhVd-ig92Y4iZb2Z7hArxNErFy34ZcfTby24G3H-sc66iVTJ4f6Q+BI0zUHSE3pipg==.C30C4DA81AE308962B9A.crypted000007",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  594. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HLEHkGnzD+BE4O0cUnYnFxIFtJaIQXAb3imqyMBenJsHw9I8NuvpzmJuYskhRuLNJCq-xW4zhqRPF6DWJXJgXA==.C30C4DA81AE308962B9A.crypted000007",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\q7uYx3EzG83UP3+4gp5Cdno8LcocRYQfUimXqWw6HXzGlWDV-XRmIDnhAceD4JrGyhjZuLBw7Wwfsq229ShdTA==.C30C4DA81AE308962B9A.crypted000007",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Aux1u7+CO485ZQvrgZ0eidIo9bTM4Xy3rg7TCGXs5ba0rKY9wc5hce8qD2LEtBKgHOyul4vcj+BbELiMi8NXQQ==.C30C4DA81AE308962B9A.crypted000007",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\MZwQkkjpARNjdDe8iBYwc-iG6jXLxs5drtYs10UpSWesuo2wExvCVX0x86pc2YFjwBv-LnrGNL7xA4NA+r2wiA==.C30C4DA81AE308962B9A.crypted000007",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\OtnFYxQfc1I8aEKmyR1yKJpudTfd1SzAhlZ1y7b1wTlV9mmpQDLVngXjyV-gJN9Ud2-qFrxFpQMCx0u3dr-gN7bdWAok7XwQ3sJvS7T3JhM=.C30C4DA81AE308962B9A.crypted000007",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jzKCaijjSuJ0kf-E3AazEOvadc3fT3eSwF3ALE5TKHBryyfAkNSW9BhMSzUMijhsQr6mRYns2Nc8LL0Zjf6laQ==.C30C4DA81AE308962B9A.crypted000007",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\v0cyzuy9VQVEJdHUHLwZtWr7paHkqI-77ai0XpvcDPsXSOW8+xYSDAA+CUqAQ+m6B3zZfLVhUSOxLGDrf33DvQ==.C30C4DA81AE308962B9A.crypted000007",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\DPch4AfeJ+EUhSRXIJwKtsArw6ys8gdzPbmEjeMjdIrT4uEd-rYK5lZAS1Xsx165jJcCjwfgFPQH2N3ZM33gKw==.C30C4DA81AE308962B9A.crypted000007",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\yp7hjvyFwbEBsAG4MmVocQdIA1BFuiatS+npY0kxa1f4H51OxyvdEOa04wVWbBIuBx0KUJPvIG9hEDHpcmORbw==.C30C4DA81AE308962B9A.crypted000007",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  612. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Po5P8u2r-naCgE4Mz4b71BkZ4vI5JXfDLFZHPCKR-H-TUrIfi4Ky1sqHWuh-mTmiAxeS6Fsw9rKXYyD187WbMQ==.C30C4DA81AE308962B9A.crypted000007",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ladjfQkeOEtn0mQKQcPAZAUSsTLVHzbktRYx7rxFZWmMk6loFLbpjrRj2S46lV9eQipR+iJjozDMhTyZPqtB2Q==.C30C4DA81AE308962B9A.crypted000007",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\L0QWiMge5a1VOvruhAIPz6cTEHdTE7ewGiEUhbX3301PRjLYGmtafZQW-64tUXzF.C30C4DA81AE308962B9A.crypted000007",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\FD9+KoQ2awf8Xi6bSc0gldlx4EwPoAj3MJhbZTVeyMQ=.C30C4DA81AE308962B9A.crypted000007",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  620. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\3dHY3G97rTeaRuk8gL5LFDy2JS2Imc5DnGym97lkDK8=.C30C4DA81AE308962B9A.crypted000007",
  621. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\CGf7slnie-ATy+g8YW71FZLVr2sjcH1tlGcC6URGtdg=.C30C4DA81AE308962B9A.crypted000007",
  623. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  624. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\arNBp0I+eYAq5ZaFIsF2DoOGBOI3AUm2kZ7WJ2sR7fg=.C30C4DA81AE308962B9A.crypted000007",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  626. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\6s-pWmCxKHRDCFYVuAhc9G3s5lFxKDcr8py2P6T9Lu4=.C30C4DA81AE308962B9A.crypted000007",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\XB2L-rrkn0isXjrATw9P4wTwhrTLAorgZ4rNiBLDoFX-ehdvJUmPkcZCqJQpa93Q59LIxSR78INfGTbVqWJYgQ==.C30C4DA81AE308962B9A.crypted000007",
  629. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  630. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\tNfmO1KJ3-2Sf00IaPoOn3RN98DHdg4baxXAZrFkq7SYDEjexV-uNmtOCrO3U9I9XRh8Mg9VP9pAKMp2-5qeFA==.C30C4DA81AE308962B9A.crypted000007",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  632. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\WwvD9zN9aDKm7b2r+lIorizJjy76Yo7qVhuQkNn0rYA=.C30C4DA81AE308962B9A.crypted000007",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\sPgXNsX37UOXGJu7o2LjEThy4oM0KHpfVnjAcpbxDVc=.C30C4DA81AE308962B9A.crypted000007",
  635. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  636. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\zvGizuGyhjtxRAP+1S1rwtxIAl-YmkPRHJRyPC108ip5wAzfSN19Kx8yO8nm+rZQGw9Cnce8aBD+LjV7ZT0y-R-PTGpq7Ty92ED7hWKeiN4=.C30C4DA81AE308962B9A.crypted000007",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\gT0+2u+VymwFspoG8r7md+NajYBhZ2X9ihR+kKIjGmE9YGQy3UE1Z4u0LNvsQuxk.C30C4DA81AE308962B9A.crypted000007",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\pJDkneU1v+dxteDG6BD7mXGAZizra4NF+v0e9n-udWA=.C30C4DA81AE308962B9A.crypted000007",
  641. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  642. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\kpbiHsro6qfJex0bT9XX4986D3Mjen2n0fAo4mtklqD1joH6XaykoqDAEIFGJQHF.C30C4DA81AE308962B9A.crypted000007",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  644. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\yw9dzVFO6DVJ7HgOkwzCPTpcA8G-o9L+BGOzn4vj2zpznm4zU0rfCFXNcxtXYBjN8B6ttCxOlbWyXAT3+Ag4GsGu2UJ1KtNm0WvBpAXr0O0=.C30C4DA81AE308962B9A.crypted000007",
  645. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  646. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\piYnlgCJqJqD+yhgI88Iy3w9Tn7cxL7Ojt9ZGKW8J0w=.C30C4DA81AE308962B9A.crypted000007",
  647. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  648. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\P88Jwv24k8R+zpO2q3j3WFfAFbcNsekgNUbT1abLZSE=.C30C4DA81AE308962B9A.crypted000007",
  649. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  650. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SAhj9cvx+POML11P+EMrFg==.C30C4DA81AE308962B9A.crypted000007",
  651. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\LvgWPk9AjCcxfZPUVOjg-pxZLrjWFNQoKXoX8BQRy+0=.C30C4DA81AE308962B9A.crypted000007",
  653. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  654. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\OBEqQ76W5rC9pXK9U8pB8H-8+EzNOvhDMZfISk81kvoGcgM1-1QUrhzdHUnP5UPP+TJHzrWVz48v84jhhHpGkw==.C30C4DA81AE308962B9A.crypted000007",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\afBR3PvWTUqsnzpwKJiSUi3vIB4QzWAw0r53zVlSD8A=.C30C4DA81AE308962B9A.crypted000007",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\+YmesHyFT36sCfqyPIpwgXpZdV8YLwbTGmtc1bkfN8gh8I0BdxviU8LGlTqxETpWve2+0lJ8Pc9ARGdS6Arhzg==.C30C4DA81AE308962B9A.crypted000007",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\5kwe9XAbRNvdsmvEsBy4bG8AcswHGPfJOzqST9b6lGLeQXGJ9UovCoHbNBox65C3bx5wKv7JbWZEugl+Ukiezytyfs7UFVmYTbZr9wdqffo=.C30C4DA81AE308962B9A.crypted000007",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\iJa8rJvtH5O62jy7rNG2K2LrqE0GeAaLhnR72YglwFc=.C30C4DA81AE308962B9A.crypted000007",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\kmJplbllUf0OyG4fW1IoT1YVjmyPNtZm-Z6gVTzS5ok=.C30C4DA81AE308962B9A.crypted000007",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\nRJHSgl4XVBN4ae+le5XP1pUbI5ab-gxhqduW3B5Luw=.C30C4DA81AE308962B9A.crypted000007",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\PSsnd2Pzkxrq+NRPdOEkp4Lmj2AsCsfkwO-95RSsyCsGIJcyawLVNFa3c+nDOG1vEH5xw6yoGUUe-YuB-t3PNBReLQ0YBTZXcYCkrUYJJkg=.C30C4DA81AE308962B9A.crypted000007",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\B4bUrHEM7UCLLb56h0DmgnuZ0FPr3wYwuk1MYJhVwVI=.C30C4DA81AE308962B9A.crypted000007",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\uxGhW9XgYn78ETzZCseniUWvDq--3w0ztu-Kezs1ofFMZm2uXjCU-NXyWjxFwL6r1d1g7qK-S7IWEWTMQM8-iqi2TxU2CwFULcFxzlxBF2hPDveWxZ+8Wrq4lpy7KuMmJlGyoe-k1CPjG1WyXQKCMQ==.C30C4DA81AE308962B9A.crypted000007",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\vggk7EUeH8c95ls5j734X1PY35esX4JBvliw4YNzRmE92SLyv7qbZz+1fBeVUD7E.C30C4DA81AE308962B9A.crypted000007",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\rQxP3C-DA2p2oRbLJzEcdA==.C30C4DA81AE308962B9A.crypted000007",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\8dWw4NBqcODvcoDUC9cXw4WElmPqLIxipHJgNFO0xnIEFaBa65Sf5eBo4XBjp4tW.C30C4DA81AE308962B9A.crypted000007",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\73AuGydnQC3wghVibz5qJHiBvH5w2b6PII+tIUzTuJQ=.C30C4DA81AE308962B9A.crypted000007",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\3IvdbzD1ZArl2qDpCaBn0Y5gUV98m8rhy09PzE03KYM=.C30C4DA81AE308962B9A.crypted000007",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\m0eTEMxX7LhPCQs1l5vVOPOaruO2IHpHrm6s9yQSoiw=.C30C4DA81AE308962B9A.crypted000007",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\CVYrDz-ioo0IsV-CiAwhSFbiBiegPYWd2TNu87H3M49X9kQKo8MP3zzxa2GIGGgZpXcQkLuGHy9ZPz8aWzuFvA==.C30C4DA81AE308962B9A.crypted000007",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\BMXfW2ADpnLYIPYoNFUUPEpa1Eb4mhRLCsyCtBVxbTAOYz+9RRMCUcUwj+2wlEG-vezrFZbddhelYHA+jNF6+Q==.C30C4DA81AE308962B9A.crypted000007",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\T0E1cuirJ3Yud5ski0EIlue-6zus1q072zUwU9K8LU7dx6jqc0jaeTvKx8D0yhUPGM7LtrGDAVNRCqcvendxcw==.C30C4DA81AE308962B9A.crypted000007",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\wLwPhyF-XOzC+mSohQ0BrKM0+AMC-9FMkk033ucTK6cgvddNDklmpEB3koj3uzmnMYvVbSoNLo3z26fdjfc80A==.C30C4DA81AE308962B9A.crypted000007",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\v1+txAfObYoJFYysmvpcGA==.C30C4DA81AE308962B9A.crypted000007",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\CFgGxxW9MywS9TVT-8F5eAgWC9C0RRbcqIx3Q0gmPA1lXu-Tnpr3OUvxKLMoDHixHSh9ZBH-run1AIH2Q125C3yRIF5ZjqKVZJy-NlupzTOG9xYOpI6CnUHpSKHIsJBRsYpjI59bbe0QLPxVpoigUe8RAx+SL+a9Q9K2JavLp8Q=.C30C4DA81AE308962B9A.crypted000007",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\Ct7tzBTRa4+LxTsfgBUjyfypk5oxpiHzzM34SYvJgm62UL+t0DW4LgjksGWmeG55-d2i0R9m+bQY51iRzf7T1ZVGNjrqepyD6kUdgkTf1UoF4lDshEcb-4Pe-i48LdmQcCYXev+rVRzHSwiXPAV21YD04pIp2ZZZvwbkP5jbCEQ=.C30C4DA81AE308962B9A.crypted000007",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\3lP1X-lwynHu1+ViAiTwxL3KQSAOScAJzOdcFXXikWwC9f3TQHQfLyKc7mjcdslNwA1RIZ33Xc9j2ianTjw8awO+fU8Wr4vUja7d2dI8Hc0kadRbTkqLFDvn7cHNzXi8ZZsZLurTjs3ynURBjieLVMztdW6ygRi5R9Ytud21k7M=.C30C4DA81AE308962B9A.crypted000007",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\dl1Yir7wiZjZA5998qnXHihTRBxlL8ge1ah4UMBFQan6fQWt36buI8EJawWA0Rk9bc4ord4q7GCoSTGWQkWv90RnzuVp5GajazZT7navNP-zyqAH3ZlV-w5TPKqs+tLjJ9LAKi9I9lgWDf+BlLt0KX-4PixtgbZF8g+hmjbaUbI=.C30C4DA81AE308962B9A.crypted000007",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\HifGYYh3Puk9gf9fRrKjXq4hJbEpnvYPrZ8zCStdnxSa7iZi5s1OoUOgtHSUvZc0As9D7witDvghyHcrJyFmKPTA11wHSDxGvZYzrSRMk6fOL60AzRoNzDb-giKfly3glF3uJEj+isyJxK0T4HCdfkgWo+UZAJJaXRXOOHPhmmQ=.C30C4DA81AE308962B9A.crypted000007",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\2edfkImDuQGTv9+xtk6e6vaf99Ya0CM05pJ8lTDn5H7WNzFaonajfMrNzlxbXVkl-f7-zoIzJnbOUmyaOGfFfWXMObsaWzwSa1OvsDmnMjRRR4IkxUOqYkM4HeNdyf0Hw47nPN0UPCxv5ZQjpjGbLEkQCAq8YD2e+Ek4eSJJDmQ=.C30C4DA81AE308962B9A.crypted000007",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\wiFEm+6+c-PkwieCcfS0sUZM+Ro8Rh3-dOpNugxs93mhFWLRQ2z5i72AOAQWvh40SSC3WCo3fhsVZZWQElMKRYaCpv-HHbPox9+ohnSQpSHgcx-65ebiyNRIn0RhjRwgt5DHta9+PS9tZhqjbXD3xicIUmGJ7gTr4oRq8CLGrJU=.C30C4DA81AE308962B9A.crypted000007",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\W7jmB95OAO1J3iVtV5Wg4b1RgeDrBoBvKEQYWY8mUMB-hmqaS6sLdrH5jjNPFCl5oWvaDQBqPBsDCOXzkUO1vt3yFM301eSWNadA6oI02-N2dxTKCy3nDK8aiNVb2aOuWVdjMQWjnQyhMTrfF2l0IMKQU7phn0nQxPp8+iEfdZ0=.C30C4DA81AE308962B9A.crypted000007",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\Pg1W5K4U4zMA6LG-oI88f0am4x73KegAg5v7bGTRUcCBsQzsx7A8BMl7HlEH+xDV50EFXvDpW682+KVdCjTvYcv3oNxiDRh9Z1UnmeR9L7PTEYYgr02G7iFwMtJhy8bOG10ta2fVW6iJyimhTQpzAWzeQI807DDXdfj3e7Z-7x4=.C30C4DA81AE308962B9A.crypted000007",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\lD5CIT6AgqSYi7hzNsWrIyw0ODSvTkyEZzrFAkg+Rvy7yu26pm4aYsSuod4shWN0kwAQyMPUxaXdwNKz29oAU-mGLzXUz8r-O3GdXj4HpepNKO0ARp+1CqKmqfNYPCU5kcmriNLsRoO31J+ddK3F12xHRE+6p579Va0bBePn3sY=.C30C4DA81AE308962B9A.crypted000007",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\dQQ8syb3uOsXab7OzErRdxHj45XaUlYjx6TZopnwtR8DWqdq8UxvnMX8NepzukDoBMunJuzSo-wa0aRK6DT3YAJ27R965mf8BkSrImB-Jrs=.C30C4DA81AE308962B9A.crypted000007",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\8dVBmXeA1NG50AetNeeapQswYxXD38YqV0-csz5oN5rhA+oEXti6-JssVAywC8es1ZS2+QHwVcpaqUQJJ5sgew==.C30C4DA81AE308962B9A.crypted000007",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\fCgINjEi2LhSpFT3DYOYH8gpVQ3NMqSqJvYmB8nLm6fPZ3lA6NVMDyicw-6Ko57Y.C30C4DA81AE308962B9A.crypted000007",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\ZRgKqlv2rfCrZsjUaMxYHIEzEsl8jLGhVaFZPyCLyqSMWu+llBl-xT77Myu-UtwD4brxadhsZPNVT9d2hdIqDw==.C30C4DA81AE308962B9A.crypted000007",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\hFmNtTU2Vwl2tf4ye+aPCm6b5vwlzQwcVRN4RxfzXDk8hE20eNR4YOyqPLeSx2phBWlPNblnhnDJ3+Pht17o4g==.C30C4DA81AE308962B9A.crypted000007",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\wplpR4LeHcAAyf1mJvTf9-XWaZ8RQKZ5t+81kzzVFe8=.C30C4DA81AE308962B9A.crypted000007",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\YhEfg8uzfJmLv162bi25cOY0MA9zx7tB44CjAwisTfjgkjUil8SbksgAjnSo2ERE1Csyjs-4aAKsHc+Ay5VkAA==.C30C4DA81AE308962B9A.crypted000007",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\5CNQFRhLMuaotX-EtRWUh-4q7gBCQ0+xk8UmB7PWML0=.C30C4DA81AE308962B9A.crypted000007",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\DFgeYwYplOcar-DFNxfYIjNKxOsqq9xz2bSlPhiSyGs=.C30C4DA81AE308962B9A.crypted000007",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\ge5Z+QmczDFjQE98YZ0Eos4bRg-s3WPifblP6HP8q+hUmHlScqpRRS-KQlp-pRzB.C30C4DA81AE308962B9A.crypted000007",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\S45XeTsB3ANIiI+bPWuNRznvBCxqhxSERGrxF8s83unROR5hFQNxU6EMHNhUZJesXVS5vKOyjIONxtqCqIJ9uA==.C30C4DA81AE308962B9A.crypted000007",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\DfIb15Qs7B+7PMh8otl-4tbcr0XZ5s7ubg4IjAET969y3EaPKv+RD3+veDZvp1oNSwaGlk3WN0UQ++VUrK7sxg==.C30C4DA81AE308962B9A.crypted000007",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\wC964mDgXDyKjHPfSeXF6fVa9KQUYHQi-fGaXK14QvlKtjDd8S7yQ90ssCU3frKY.C30C4DA81AE308962B9A.crypted000007",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\ADST0ukLTovc+3W53qxlJsWOP23Gerrc+5Iyvxp17bsPIMI+J6-pMkxWaUrOKz-rxTM2JQImWpktMX+XRjVS1A==.C30C4DA81AE308962B9A.crypted000007",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\vXSluoXaosodUpxxIl5QMsnrCNh-q82wMJ0Y-faEJDE=.C30C4DA81AE308962B9A.crypted000007",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\cAlp+sJd8Q4zR-+w5AVr408-UGDlGx0WjwMflQKpEkY=.C30C4DA81AE308962B9A.crypted000007",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\jfsUTr-vB3ky0aGMzEszMHuSDc1AibX9XikfPGCWzCDKbkiTb3oJuJJ95GZikC5wejr4+8Y5p3EmpJXDKM4tOA==.C30C4DA81AE308962B9A.crypted000007",
  738.  
  739.  
  740. * Deleted Files:
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  746. "C:\\Users\\user\\Pictures\\Host.zip",
  747. "C:\\Users\\user\\Pictures\\Host.xls",
  748. "C:\\Users\\user\\Pictures\\Host.pptx",
  749. "C:\\Users\\user\\Pictures\\Host.ppt",
  750. "C:\\Users\\user\\Pictures\\Host.pdf",
  751. "C:\\Users\\user\\Pictures\\Host.jpg",
  752. "C:\\Users\\user\\Pictures\\Host.html",
  753. "C:\\Users\\user\\Pictures\\Host.gif",
  754. "C:\\Users\\user\\Pictures\\Host.doc",
  755. "C:\\Users\\user\\Pictures\\.xls",
  756. "C:\\Users\\user\\Pictures\\.jpg",
  757. "C:\\Users\\user\\Pictures\\.html",
  758. "C:\\Users\\user\\Pictures\\.doc",
  759. "C:\\Users\\user\\Pictures\\.bmp",
  760. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
  761. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
  762. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
  763. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
  764. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
  765. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
  766. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
  767. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
  768. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
  769. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
  770. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
  771. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
  772. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
  773. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
  774. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
  775. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
  776. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
  777. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
  778. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
  779. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
  780. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
  781. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
  782. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
  783. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
  784. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
  785. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  787. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
  788. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
  789. "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115fn=Parcel.thmx",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114fn=Gallery.thmx",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
  833. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  834. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
  835. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
  836. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
  846. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
  847. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
  848. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
  850. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2015.log",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011a.log",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\JavaDeployReg.log",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_installer.log",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\au-descriptor-1.8.0_211-b12.xml",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeSFX.log",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
  887.  
  888.  
  889. * Modified Registry Keys:
  890. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  891. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  893. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  894. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  895. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  896. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  897. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  898. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
  899. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
  900. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
  901. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
  902. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
  903.  
  904.  
  905. * Deleted Registry Keys:
  906.  
  907. * DNS Communications:
  908.  
  909. "type": "A",
  910. "request": "whatismyipaddress.com",
  911. "answers":
  912.  
  913. "data": "104.16.154.36",
  914. "type": "A"
  915.  
  916.  
  917. "data": "104.16.155.36",
  918. "type": "A"
  919.  
  920.  
  921.  
  922.  
  923. "type": "A",
  924. "request": "whatsmyip.net",
  925. "answers":
  926.  
  927. "data": "104.18.35.131",
  928. "type": "A"
  929.  
  930.  
  931. "data": "104.18.34.131",
  932. "type": "A"
  933.  
  934.  
  935.  
  936.  
  937.  
  938. * Domains:
  939.  
  940. "ip": "104.18.34.131",
  941. "domain": "whatsmyip.net"
  942.  
  943.  
  944. "ip": "104.16.154.36",
  945. "domain": "whatismyipaddress.com"
  946.  
  947.  
  948.  
  949. * Network Communication - ICMP:
  950.  
  951. * Network Communication - HTTP:
  952.  
  953. "count": 10,
  954. "body": "",
  955. "uri": "http://whatismyipaddress.com/",
  956. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  957. "method": "GET",
  958. "host": "whatismyipaddress.com",
  959. "version": "1.1",
  960. "path": "/",
  961. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  962. "port": 80
  963.  
  964.  
  965. "count": 1,
  966. "body": "",
  967. "uri": "http://whatsmyip.net/",
  968. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  969. "method": "GET",
  970. "host": "whatsmyip.net",
  971. "version": "1.1",
  972. "path": "/",
  973. "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  974. "port": 80
  975.  
  976.  
  977.  
  978. * Network Communication - SMTP:
  979.  
  980. * Network Communication - Hosts:
  981.  
  982. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!