ElfFileҪ ElfChnkoo L)l@6^=f?mMF&V &**XzSI 8&8J=u1ǨAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-ENDMUL1S4P6AB.SecurityfLUserID !  <TK!zSIMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)⅖)ANDi6D EventDataAC^oData#= MasterKeyGUID A-^= UserStorage `o9/GTFj|֘?C:\Windows\system32\Microsoft\Protect\S-1-5-18\X**|znI 8&  <T!|znI> 0Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`Sn A_C:\Windows\system32\Microsoft\Protect\S-1-5-18\**@nI 8&  <T!@nI> 0Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j$n~BMMeC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**F rV r/y[h`xAMsj5http://schemas.microsoft.com/win/2004/08/events/eventbAF=XAz      ? fA   AFFm AF  (FWIN-RF3TT6D8E75A  !  <T!FpMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`Og/eG^/pUC:\Windows\system32\Microsoft\Protect\S-1-5-18\**  rV   <T! wMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`WZ\IAvFsumC:\Windows\system32\Microsoft\Protect\S-1-5-18\**n rV   <T!nwMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jYsLfJ_C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\** E'b&E'bUa4UxLIDwEAMsj5http://schemas.microsoft.com/win/2004/08/events/event\AF=XAz      ? fA   AFFm AF  "F FILF-APP-RECA  !  <T!]Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`ұOϷNQWpC:\Windows\system32\Microsoft\Protect\S-1-5-20\**X?& E'b&  <T!?&XMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)4 Y`Hd:C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H $j! E'b&  <T!$j!&T Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)y#ty9AUdEC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X e& E'b&  <T!e&: Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)X %]DBC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X** : E'b&  <T)!:  Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)YƋW`EG5 C:\Users\Classic .NET AppPool\AppData\Roaming\Microsoft\Protect\S-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334\** f*: E'b&  <T!!f*:  Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)by&{N{C:\Users\.NET v2.0 Classic\AppData\Roaming\Microsoft\Protect\S-1-5-82-4068219030-1673637257-3279585211-533386110-4122969689\**p F": E'b&  <T!F":  Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)N%ΘC;h.C:\Users\.NET v2.0\AppData\Roaming\Microsoft\Protect\S-1-5-82-3682073875-1643277370-2842298652-3532359455-2406259117\p**̥: E'b&  <T!!̥:+Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)a{e/)FPmC:\Users\.NET v4.5 Classic\AppData\Roaming\Microsoft\Protect\S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236\**h: E'b&  <T !:+ Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)z&^)@ЮMtC:\Users\.NET v4.5\AppData\Roaming\Microsoft\Protect\S-1-5-82-271721585-897601226-2024613209-625570482-296978595\h**X.b( E'b&  <T!.b($Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)Y8 B=C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**HeDk E'b&  <T!eDk/Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)K ^Kp;>C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**#" E'b&  <T!#"%XMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jw"Fc1vuC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**bp E'b&  <T!bp" Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`PThML2C:\Windows\system32\Microsoft\Protect\S-1-5-18\**XP$ E'b&  <T!P$Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)+W`D^bIC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**Xķ= E'b&  <T!ķ=1Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) <dLiҳC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H'B J E'b&  <T!'B J Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)3--FooZC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**emO E'b&  <T!emO(Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jHI.NrxC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**X?ol E'b&  <T!?ol(Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)khMD3ЯjC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**X ߞ&C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**$T% E'b&  <T!T%ND $Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j9U>'O7tTC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**X%|R\ E'b&  <T!|R\ ( %Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)ٟX@0b6C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H&U~] E'b&  <T!U~]&Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)|êjGS50C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X'ezd E'b&  <T!ezd'Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)h}C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X+7n( E'b&  <T!7n(* +Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)g=L3 $gC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**X,GG0V E'b&  <T!GG0V/D,Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)|Ab@rAC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H-޳ E'b&  <T!޳&Q -Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)DxGr: C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**.U2EI; E'b&  <T!U2EI;.Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`Z@xC:\Windows\system32\Microsoft\Protect\S-1-5-18\**X/3) E'b&  <T!3)N/Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)L~@֢Ka_C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**X0,. E'b&  <T!,.\0Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖){}JC*)CmC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H1r2 E'b&  <T!r2c 1Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)Z;?VLfLK 7C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X2_oO E'b&  <T!_oO182Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)b*LJ ZC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**3Gp E'b&  <T!Gp3Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`̞]?KH=C:\Windows\system32\Microsoft\Protect\S-1-5-18\**X4CLv E'b&  <T!CLv@4Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)ޖ-FkAgC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H5fI:z/y E'b&  <T!fI:z/y 5Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)Sn#dH̉Y^C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X6 u E'b&  <T! u$w6Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)bBH@c|DC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H7՗t E'b&  <T!՗tMD 7Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)4#\K /T*C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**8Z E'b&  <T!Z8Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)joquW@B$mDC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**X9hB E'b&  <T!hB$9Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)XFTC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**:x E'b&  <T!x:Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`3 6G&5jC:\Windows\system32\Microsoft\Protect\S-1-5-18\**X;lWN E'b&  <T!lWN|;Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖).I3j)GJsK%MC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H<I,- E'b&  <T!I,-' <Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)V;!LI,W=C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**X=8 E'b&  <T!8:o =Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)+<2i@%xlC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H>P=N E'b&  <T!P=N>Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) :yAZpQ( C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**?g Q^ E'b&  <T!g Q^?Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`k7[IUb C:\Windows\system32\Microsoft\Protect\S-1-5-18\**H@Z8 E'b&  <T!Z8@Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)&MiA z׹N9C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XAЕ E'b&  <T!ЕAMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)(hĀHtiyC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**XBF*4a E'b&  <T!F*4aBMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)23 I-BeC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**C4Y E'b&  <T!4YOT CMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`pGm N8_9RC:\Windows\system32\Microsoft\Protect\S-1-5-18\**HD/2 E'b&  <T!/24DMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PIHF 6Ut,C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XE~6 E'b&  <T!~6- EMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PYLkhjGC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**XF}N+ E'b&  <T!}N+05FMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)t4R=D$;_C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**HGr$ E'b&  <T!r$GMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖){`򜀚CHRDC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XH Ej8 E'b&  <T! Ej8 DdHMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)S (L@}C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**I=SɁLL E'b&  <T!=SɁLLBIMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`}0ǁHQC:\Windows\system32\Microsoft\Protect\S-1-5-18\**XJ륇j E'b&  <T!륇j( JMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`G"[V/C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**HKx&m!l E'b&  <T!x&m!l5KMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)#p[MXzEC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XLpt E'b&  <T!pt*x LMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)s] KFp("J qxC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**XU}aF E'b&  <T!}aF N UMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)^0E̸bQC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Vf: E'b&  <T!f:VMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`mZ@GLJ4@C:\Windows\system32\Microsoft\Protect\S-1-5-18\**HWӿ)A E'b&  <T!ӿ)AhWMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)O NMSNA zC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**Xm?6C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**X_VZ E'b&  <T!VZ_Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)~ ,DR8ʒC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H`^=Y E'b&  <T!^=Y `Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)(5FOvC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**awZ5  E'b&  <T!wZ5 zaMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jZG28)EgC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**XbX  E'b&  <T!X x bMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)x E'J᳞C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Xc Y= E'b&  <T! Y=pcMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PEd#C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**Hd̗' E'b&  <T!̗'=D dMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)GOG&C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**e^M4 E'b&  <T!^M4eMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j/ŊK]C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**fw' E'b&  <T!w'*fMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`2 EgEȞC:\Windows\system32\Microsoft\Protect\S-1-5-18\**Xg-ԕH E'b&  <T!-ԕH# gMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)B|p[C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**HhƐ\ E'b&  <T!Ɛ\1*L hMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)I#1@WKC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**iz)_ E'b&  <T!z)_GiMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j}P.qN))C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**XjZ2 E'b&  <T!Z2jMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)B+JJINC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Xk/ E'b&  <T!/ , kMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)?>쳟@\]mC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**l(Ny E'b&  <T!(Ny%dlMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`e-q%Fk"C:\Windows\system32\Microsoft\Protect\S-1-5-18\**HmˇE E'b&  <T!ˇE0 mMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)>кtG~J瞇؎*C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**n9/ E'b&  <T!9/Q nMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jAAojHs屖C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**Xo0]6ȸ E'b&  <T!0]6ȸd oMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)~DrII`Go.֋?C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\DataX**X3T E'b&  <T!3TMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) 6sBB^fC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\pDaX**teb E'b&  <T!teb.jMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j;|A-B qyC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\at**}cw E'b&  <T!}cwMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) `Po {M61AC:\Windows\system32\Microsoft\Protect\S-1-5-18\rat**Hf=  E'b&  <T!f= Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) u`kj[CjmDC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\DaH**Xs2[ E'b&  <T!s2[9 Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) 6LW LC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\ataX**ޖMK& E'b&  <T!ޖMK&Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j# N߻9wC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\at**XD2cf E'b&  <T!D2cf>wMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) Uu{R*Gu^C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\ratX**?Ag E'b&  <T!?Ag$Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) `ZdG;6C:\Windows\system32\Microsoft\Protect\S-1-5-18\/Op**5m E'b&  <T!5mMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j,Q3,F4:mC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\-C**X39Ѵ E'b&  <T!39Ѵ9L4Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) oo,LU;bC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\ratX**G E'b&  <T!GMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j) J+/wqC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\I@**HT E'b&  <T!T)V@Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) pKvd-C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\ptH**)5< E'b&  <T!)5<x Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) `W;'I䯢C:\Windows\system32\Microsoft\Protect\S-1-5-18\s-C**R` E'b&  <T!R` 9 Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) jȯBHbt nC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**X=g{& E'b&  <T!=g{&Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) A[?WMjBAC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\eX**}|C E'b&  <T!}|C Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j4ERB\HXmC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\** vT E'b&  <T! vT Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) `6B)HYC:\Windows\system32\Microsoft\Protect\S-1-5-18\,**X X E'b&  <T! XZMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) {z-7JD(HC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\ FX**%] E'b&  <T!%]72LMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) j {cBJBl;C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**X J0=m E'b&  <T! J0=m[8Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) ?CFͱ[qC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**H|?n E'b&  <T!|?nS[Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) 7*HNfqC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**H%s E'b&  <T!H%sMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) `;cLF]VC:\Windows\system32\Microsoft\Protect\S-1-5-18\977**)P=N E'b&  <T!P=N>Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖) :yAZpQ( C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**?g Q^ E'b&  <T!g Q^?Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`k7[IUb C:\Windows\system32\Microsoft\Protect\S-1-5-18\**H@Z8 E'b&  <T!Z8@Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)&MiA z׹N9C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XAЕ E'b&  <T!ЕAMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)(hĀHtiyC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**XBF*4a E'b&  <T!F*4aBMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)23 I-BeC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**C4Y E'b&  <T!4YOT CMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`pGm N8_9RC:\Windows\system32\Microsoft\Protect\S-1-5-18\**HD/2 E'b&  <T!/24DMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PIHF 6Ut,C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XE~6 E'b&  <T!~6- EMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PYLkhjGC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**XF}N+ E'b&  <T!}N+05FMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)t4R=D$;_C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**HGr$ E'b&  <T!r$GMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖){`򜀚CHRDC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XH Ej8 E'b&  <T! Ej8 DdHMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)S (L@}C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**I=SɁLL E'b&  <T!=SɁLLBIMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`}0ǁHQC:\Windows\system32\Microsoft\Protect\S-1-5-18\**XJ륇j E'b&  <T!륇j( JMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`G"[V/C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**HKx&m!l E'b&  <T!x&m!l5KMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)#p[MXzEC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**XLpt E'b&  <T!pt*x LMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)s] KFp("J qxC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**XU}aF E'b&  <T!}aF N UMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)^0E̸bQC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Vf: E'b&  <T!f:VMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`mZ@GLJ4@C:\Windows\system32\Microsoft\Protect\S-1-5-18\**HWӿ)A E'b&  <T!ӿ)AhWMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)O NMSNA zC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**Xm?6C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**X_VZ E'b&  <T!VZ_Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)~ ,DR8ʒC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**H`^=Y E'b&  <T!^=Y `Microsoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)(5FOvC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**awZ5  E'b&  <T!wZ5 zaMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jZG28)EgC:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**XbX  E'b&  <T!X x bMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)x E'J᳞C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Xc Y= E'b&  <T! Y=pcMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)PEd#C:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**Hd̗' E'b&  <T!̗'=D dMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)GOG&C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**e^M4 E'b&  <T!^M4eMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j/ŊK]C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**fw' E'b&  <T!w'*fMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`2 EgEȞC:\Windows\system32\Microsoft\Protect\S-1-5-18\**Xg-ԕH E'b&  <T!-ԕH# gMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)B|p[C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**HhƐ\ E'b&  <T!Ɛ\1*L hMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)I#1@WKC:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**iz)_ E'b&  <T!z)_GiMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)j}P.qN))C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**XjZ2 E'b&  <T!Z2jMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)B+JJINC:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-500\X**Xk/ E'b&  <T!/ , kMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)?>쳟@\]mC:\Users\exploitfil1\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1004\X**l(Ny E'b&  <T!(Ny%dlMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)`e-q%Fk"C:\Windows\system32\Microsoft\Protect\S-1-5-18\**HmˇE E'b&  <T!ˇE0 mMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)>кtG~J瞇؎*C:\Users\admop\AppData\Roaming\Microsoft\Protect\S-1-5-21-3299923977-2355747492-3265540621-1001\H**n9/ E'b&  <T!9/Q nMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)jAAojHs屖C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\**Xo0]6ȸ E'b&  <T!0]6ȸd oMicrosoft-Windows-Crypto-DPAPI@NFMicrosoft-Windows-Crypto-DPAPI/Operational ⅖)~Dr