JustinHeywood
The report doesn’t mention any other manually waypoints, but one would assume there would be many considering the coordinates stored on the Volume Shadow Information (VSI) file are stored automatically whenever the computer is left idle for more than 15 minutes.
Again, the RMP report could not determine if the waypoints came from one or more files.
Maybe you could write to them and ask; what other waypoints did the RMP find, and what aircraft did they fly on the Captain’s simulator on 15Mar14, one day before the forensic analysis by CyberSecurity Malaysia.