1c5c91bf...283d

Remarks

Code Overwrite Detected (0x200001f): Code in memory was overwritten during this analysis. Review corresponding VTI for more info.

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0xb04	Analysis Target	High (Elevated)	11.exe	"C:\Users\FD1HVy\Desktop\11.exe"	-
#2	0x4b0	Child Process	High (Elevated)	11.exe	"C:\Users\FD1HVy\Desktop\11.exe"	#1
#3	0xb10	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#2
#5	0x4a8	Child Process	High (Elevated)	mode.com	mode con cp select=1251	#3
#6	0x9f0	Child Process	High (Elevated)	vssadmin.exe	vssadmin delete shadows /all /quiet	#3

Behavior Information - Sequential View

Process #1: 11.exe

396

Information	Value
ID	#1
File Name	c:\users\fd1hvy\desktop\11.exe
Command Line	"C:\Users\FD1HVy\Desktop\11.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:00:37, Reason: Analysis Target
Unmonitor	End Time: 00:03:11, Reason: Self Terminated
Monitor Duration	00:02:34

OS Process Information

Information	Value
PID	0xb04
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D58 0x CC4 0x 470 0x 474

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
ntdll.dll	0x77BB0000	0x77D3DFFF	Marked Writable	-	32-bit	-	... Region Actions Download Dump
11.exe	0x00400000	0x0091DFFF	Forced	-	32-bit	-	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77BF2DC0	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77BEED00, 0x77BFB250, ...	... Region Actions Download Dump
buffer	0x02BB0000	0x02BB0FFF	First Execution	-	32-bit	0x02BB0A9E, 0x02BB01BA	... Region Actions Download Dump
buffer	0x02BA0000	0x02BA0FFF	First Execution	-	32-bit	0x02BA0000	... Region Actions Download Dump
buffer	0x02B90000	0x02B90FFF	First Execution	-	32-bit	0x02B90CD1	... Region Actions Download Dump
buffer	0x02B80000	0x02B80FFF	First Execution	-	32-bit	0x02B808BA, 0x02B80662	... Region Actions Download Dump
buffer	0x02BE0000	0x02BE0FFF	First Execution	-	32-bit	0x02BE0EBC	... Region Actions Download Dump
buffer	0x02BF0000	0x02BF0FFF	First Execution	-	32-bit	0x02BF0382	... Region Actions Download Dump
buffer	0x02C00000	0x02C00FFF	First Execution	-	32-bit	0x02C007B9	... Region Actions Download Dump
buffer	0x02BC0000	0x02BC0FFF	First Execution	-	32-bit	0x02BC0270	... Region Actions Download Dump
buffer	0x02E20000	0x02E20FFF	First Execution	-	32-bit	0x02E20789	... Region Actions Download Dump
buffer	0x02CA0000	0x02CA1FFF	First Execution	-	32-bit	0x02CA1824	... Region Actions Download Dump
buffer	0x02D10000	0x02D10FFF	First Execution	-	32-bit	0x02D10834	... Region Actions Download Dump
buffer	0x02CB0000	0x02CB0FFF	First Execution	-	32-bit	0x02CB0000	... Region Actions Download Dump
buffer	0x02C40000	0x02C40FFF	First Execution	-	32-bit	0x02C40000	... Region Actions Download Dump
buffer	0x02D20000	0x02D20FFF	First Execution	-	32-bit	0x02D20000	... Region Actions Download Dump
buffer	0x02E00000	0x02E00FFF	First Execution	-	32-bit	0x02E00BB4	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77BFB250, 0x77BFB2D0	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77BFB250, 0x77BFB2D0	... Region Actions Download Dump
buffer	0x02CF0000	0x02CF0FFF	First Execution	-	32-bit	0x02CF0000	... Region Actions Download Dump
buffer	0x02ED0000	0x02ED0FFF	First Execution	-	32-bit	0x02ED0386	... Region Actions Download Dump
buffer	0x02E40000	0x02E41FFF	First Execution	-	32-bit	0x02E41808	... Region Actions Download Dump
buffer	0x02CC0000	0x02CC0FFF	First Execution	-	32-bit	0x02CC0A42	... Region Actions Download Dump
buffer	0x02EB0000	0x02EB0FFF	First Execution	-	32-bit	0x02EB0000	... Region Actions Download Dump
buffer	0x02EA0000	0x02EA1FFF	First Execution	-	32-bit	0x02EA1AC9	... Region Actions Download Dump
buffer	0x02C80000	0x02C80FFF	First Execution	-	32-bit	0x02C80000	... Region Actions Download Dump
buffer	0x02490000	0x02490FFF	First Execution	-	32-bit	0x02490FEF	... Region Actions Download Dump
buffer	0x02C70000	0x02C70FFF	First Execution	-	32-bit	0x02C70000	... Region Actions Download Dump
buffer	0x02DB0000	0x02DB1FFF	First Execution	-	32-bit	0x02DB1E5F	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77BEED00, 0x77BF2DC0, ...	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77C21E80, 0x77BFB250, ...	... Region Actions Download Dump
buffer	0x02DC0000	0x02DC0FFF	First Execution	-	32-bit	0x02DC0750	... Region Actions Download Dump
buffer	0x02EE1764	0x02EE717C	Marked Executable	-	32-bit	-	... Region Actions Download Dump
buffer	0x02EE1764	0x02EE717C	Content Changed	-	32-bit	0x02EE70A7, 0x02EE6B48, ...	... Region Actions Download Dump
buffer	0x00B20000	0x00B20FFF	First Execution	-	32-bit	0x00B20004	... Region Actions Download Dump
ntdll.dll	0x77BB0000	0x77D3DFFF	Content Changed	-	32-bit	0x77C22230, 0x77C21F90, ...	... Region Actions Download Dump
11.exe	0x00400000	0x0091DFFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Hook Information

Type	Installer	Target	Size	Information	Actions
Code	11.exe:+0x17b4e8	ntdll.dll:DbgBreakPoint+0x0	1 bytes	-	... Actions Go to Installer Region Go to Target Region Show Code Modification

Threads

Thread 0xd58

266

Category	Operation	Information	Count	Logfile
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Load	module_name = NTDLL.dll, base_address = 0x77bb0000	1	Fn
System	Get Time	type = Local Time, time = 2019-04-12 00:02:32 (Local Time)	1	Fn
File	Create	filename = \\.\SICE, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = \\.\SIWVID, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = \\.\NTICE, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
System	Get Info	type = Operating System	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Wine	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetNativeSystemInfo, address_out = 0x75ea5130	1	Fn
System	Get Info	type = Hardware Information	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Load	module_name = winmm.dll, base_address = 0x744c0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\winmm.dll, function = timeGetTime, address_out = 0x744c4370	1	Fn
System	Sleep	duration = 50 milliseconds (0.050 seconds)	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = System Directory, result_out = C:\WINDOWS\system32	1	Fn
Debug	Print	process_name = c:\users\fd1hvy\desktop\11.exe, type = DEBUG_STRING, text = %s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtOpenThread, address_out = 0x77c22f40	1	Fn
Module	Load	module_name = winmm.dll, base_address = 0x744c0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\winmm.dll, function = timeGetTime, address_out = 0x744c4370	1	Fn
System	Get foreground window	-	1	Fn
System	Get window text	window_text = 6809246	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, value_name = DriverDesc, data = 77	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Hardware\description\System	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Hardware\description\System, value_name = SystemBiosVersion, data = 78	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Hardware\description\System, value_name = VideoBiosVersion, data = 78	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Hardware\description\System, value_name = SystemBiosVersion, data = 78	1	Fn
Window	Find	class_name = OLLYDBG	1	Fn
Window	Find	class_name = GBDYLLO	1	Fn
Window	Find	class_name = pediy06	1	Fn
Process	Enumerate Processes	-	2	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
System	Get Info	type = System Directory, result_out = C:\WINDOWS\system32	1	Fn
File	Create	filename = C:\WINDOWS\system32\ntdll.dll, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_SYSTEM, share_mode = FILE_SHARE_READ	1	Fn
File	Read	filename = C:\WINDOWS\system32\ntdll.dll, size = 32, size_out = 32	1	Fn Data
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
System	Get Info	type = Operating System	1	Fn
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
Debug	Hide	c:\users\fd1hvy\desktop\11.exe	1	Fn
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
Module	Get Handle	module_name = kmon.dll, base_address = 0x0	1	Fn
Window	Find	class_name = FilemonClass	1	Fn
Window	Find	window_name = File Monitor - Sysinternals: www.sysinternals.com	1	Fn
Window	Find	class_name = PROCMON_WINDOW_CLASS	1	Fn
Window	Find	window_name = Process Monitor - Sysinternals: www.sysinternals.com	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Window	Find	class_name = RegmonClass	1	Fn
Window	Find	window_name = Registry Monitor - Sysinternals: www.sysinternals.com	1	Fn
Window	Find	class_name = 18467-41	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = dateinj01.dll, base_address = 0x0	1	Fn
Module	Get Handle	module_name = cmdvrt32.dll, base_address = 0x0	1	Fn
Module	Get Handle	module_name = SbieDll.dll, base_address = 0x0	1	Fn
Module	Get Filename	module_name = SbieDll.dll, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 256	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAllocateHeap, address_out = 0x77bf2dc0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Load	module_name = user32.dll, base_address = 0x74b70000	1	Fn
Module	Load	module_name = advapi32.dll, base_address = 0x761b0000	1	Fn
Module	Load	module_name = oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Load	module_name = advapi32.dll, base_address = 0x761b0000	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Load	module_name = gdi32.dll, base_address = 0x75b70000	1	Fn
Module	Load	module_name = user32.dll, base_address = 0x74b70000	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Load	module_name = oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Load	module_name = comctl32.dll, base_address = 0x74400000	1	Fn
Module	Load	module_name = comdlg32.dll, base_address = 0x750d0000	1	Fn
Module	Get Filename	module_name = SbieDll.dll, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 512	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\11.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ	1	Fn
Module	Create Mapping	module_name = C:\Users\FD1HVy\Desktop\11.exe, filename = C:\Users\FD1HVy\Desktop\11.exe, protection = PAGE_READONLY, maximum_size = 0	1	Fn
Module	Map	C:\Users\FD1HVy\Desktop\11.exe, process_name = c:\users\fd1hvy\desktop\11.exe, desired_access = FILE_MAP_READ	1	Fn
Module	Unmap	process_name = c:\users\fd1hvy\desktop\11.exe	1	Fn
System	Get Time	type = Local Time, time = 2019-04-12 00:02:48 (Local Time)	1	Fn
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
Window	Find	class_name = FilemonClass	1	Fn
Window	Find	window_name = File Monitor - Sysinternals: www.sysinternals.com	1	Fn
Window	Find	class_name = PROCMON_WINDOW_CLASS	1	Fn
Window	Find	window_name = Process Monitor - Sysinternals: www.sysinternals.com	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
System	Get Info	type = SYSTEM_MODULE_INFORMATION	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ntdll.dll, base_address = 0x77bb0000	8	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAllocateHeap, address_out = 0x77bf2dc0	1	Fn
Module	Get Handle	module_name = c:\users\fd1hvy\desktop\11.exe, base_address = 0x400000	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\11.exe, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 261	1	Fn
Module	Get Filename	module_name = SbieDll.dll, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\Desktop\11.ENU, base_address = 0x0	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\Desktop\11.EN, base_address = 0x0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\user32.dll, base_address = 0x74b70000	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\11.exe, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 256	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\user32.dll, base_address = 0x74b70000	1	Fn
Module	Get Handle	module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.15063.413_none_55bc94a37c2a2854\comctl32.dll, base_address = 0x74400000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\user32.dll, base_address = 0x74b70000	1	Fn
Module	Get Handle	module_name = 6Ur1QHeM82M1hW8ujI7oJN0Iy, base_address = 0x0	1	Fn
System	Get Time	type = Local Time, time = 2019-04-12 00:03:31 (Local Time)	1	Fn
System	Sleep	duration = 594 milliseconds (0.594 seconds)	113	Fn
Module	Load	module_name = shell32, base_address = 0x76480000	1	Fn
Module	Load	module_name = user32, base_address = 0x74b70000	1	Fn
Module	Load	module_name = advapi32, base_address = 0x761b0000	1	Fn
Process	Enumerate Processes	-	67	Fn
Process	Enumerate Processes	-	1	Fn
Module	Get Filename	module_name = 6Ur1QHeM82M1hW8ujI7oJN0Iy, process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 260	1	Fn
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
Debug	Check for Presence	c:\users\fd1hvy\desktop\11.exe	1	Fn
Module	Get Handle	module_name = c:\users\fd1hvy\desktop\11.exe, base_address = 0x400000	37	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\11.exe, os_pid = 0x4b0, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE	1	Fn
Thread	Get Context	process_name = c:\users\fd1hvy\desktop\11.exe, os_tid = 0xd58	1	Fn
Module	Unmap	process_name = C:\Users\FD1HVy\Desktop\11.exe	1	Fn
Module	Create Mapping	protection = PAGE_EXECUTE_READWRITE, maximum_size = 1701600	1	Fn
Module	Map	process_name = c:\users\fd1hvy\desktop\11.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xbd0000	1	Fn
Module	Map	process_name = C:\Users\FD1HVy\Desktop\11.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x400000	1	Fn
Module	Create Mapping	protection = PAGE_EXECUTE_READWRITE, maximum_size = 1701600	1	Fn
Module	Map	process_name = C:\Users\FD1HVy\Desktop\11.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x1c0000	1	Fn
Module	Map	process_name = c:\users\fd1hvy\desktop\11.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xbf0000	1	Fn
Thread	Set Context	process_name = c:\users\fd1hvy\desktop\11.exe, os_tid = 0xd58	1	Fn
Thread	Resume	process_name = c:\users\fd1hvy\desktop\11.exe, os_tid = 0xd58	1	Fn

Process #2: 11.exe

38954

Information	Value
ID	#2
File Name	c:\users\fd1hvy\desktop\11.exe
Command Line	"C:\Users\FD1HVy\Desktop\11.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:07, Reason: Child Process
Unmonitor	End Time: 00:04:47, Reason: Terminated by Timeout
Monitor Duration	00:01:39

OS Process Information

Information	Value
PID	0x4b0
Parent PID	0xb04 (c:\users\fd1hvy\desktop\11.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F08 0x 3A8 0x F8C 0x E7C 0x 7B8 0x 904 0x DA8 0x 8F0 0x FE0 0x 200 0x 7FC 0x FF4 0x AF0 0x FE4 0x F34 0x F88 0x C14 0x FB8 0x 39C

Injection Information

Injection Type	Source Process	Source Os Thread ID	Information	Count	Logfile
Modify Memory	#1: c:\users\fd1hvy\desktop\11.exe	0xd58	address = 0x400000, size = 102400	1	Fn Data
Modify Memory	#1: c:\users\fd1hvy\desktop\11.exe	0xd58	address = 0x1c0000, size = 4096	1	Fn Data
Modify Control Flow	#1: c:\users\fd1hvy\desktop\11.exe	0xd58	os_tid = 0xf08, address = 0x77c24210	1	Fn

Dropped Files

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\Desktop\11.exe	2.00 MB	MD5: a43f5a2ef5f7f21d30875ae2a809b3aa SHA1: 48d200c9946bed8d6b9c48dd93bc07ac9ebb044f SHA256: 1c5c91bf6f4b2764070f050f0a64731cca2a68a419bfb4702cf8132b22c7283d SSDeep: 49152:WCxqXPyL9P5LRx2PWferUr6y4C0rJx31+JYlkD0o7XyUNmqy85VpEmQEDj:1Rx2RC0lt1OjyUNRFbDj	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.31 KB	MD5: 1533494dfd694cab376ae691f6fafa52 SHA1: f7b120d7932b58ab8b035a3bf0d1d767ba3510dc SHA256: 68477d229eda8395d8562d869323dd0a1accfb56bb895bca53aa6b934e9ce3fd SSDeep: 6:Cei8o6qbW+EFOVH6cvlUQlSaLpjeCl/XVfDxTJHS0Z+JqVF4l:E86yqvlcaL1b/FfDhQ0soVFG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.09 KB	MD5: 822e60947834a31ac447244429c422c1 SHA1: 6f8dcd5f42bfaebf9dad9ceb16bb0f619070dd14 SHA256: 31f69d3cd6f85d05c132c81ad0b75271118972b49f305c33762c05ad99a5cf4b SSDeep: 384:eeB+U5w6c5glfuhr7jqYhtCTt0wyx3OfIV0LrFX0Ul7Auk:e0+Ow6c5gNuh3jqYyS/OfGiJXnl7M	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.59 KB	MD5: 809fcaa4efece69da6aa75fdcb5fde14 SHA1: ebd59e819eb576335c792004478187fe430a6c26 SHA256: 167323da2cbbf2459b50a5f40e4a9922b9244287daa2a2d527da4f5b00fd9449 SSDeep: 384:r9Z5edFBRbLhEIrE1bb19H2wGFY6wOuhewmxmM04DJlQVurJMXeSW:P5chr6NVOuhew406TeIuO5	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	75.46 KB	MD5: 18205abe725556b1be7840b4cdcf752a SHA1: 92ad861019d824b8b53fc4a2de912e9d4fb0dcca SHA256: d26fabc93a3cc75a6785767d91010bc4c330bdf670bd3d54ebab241ab02cde54 SSDeep: 1536:isc4LLLZANVRdVKEe4T7OvrgPBRpRiNancdlFwfs3xhVjG3xQAZ49dDL9Jc:isTjKxKEe4XOcRpRuEcPFwfQgL4zXc	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: 37dfee61637ec6698be77326160003e7 SHA1: c5b3cfc55190c08e6d665aff5b1a9e23c816f961 SHA256: 998c923f1e57446526fdb2e6f81f8ce566f5a305fded6b1fbc0f346162aff3e4 SSDeep: 24:pX4Blf6PtcNPbpjaG9hNRsBZFAJy9ufks54k/N0/nqRGfDUsG:pIDutcNPVam0BDOfRp0/qRL	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	78.43 KB	MD5: 21df5730dde53aff49c44a7e2dbb34e2 SHA1: db7fdcb48b37cfa816d4be421e9a18e991e0425f SHA256: 27e98bfff60a78fa2e7de912739af1a1ce9bac5433d49f04488a31dfaa97b5f1 SSDeep: 1536:8pRyxBVRKlkZJb7MPNmVsCq/pzRKy7WwGJ2Oo0Wc:8nyxBLKlaMP0O/pzRlywGJ2OMc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.69 KB	MD5: a793443b5b8b7d0b775da5d27267d5ff SHA1: 561f0e0e7bf73407bdb354ab44d17ddeff428b8c SHA256: c661a233f567cb06ef1ec779ae63c59e30ea7acccc5a37673b64b9e56dfc9397 SSDeep: 96:IHRZ5JgWW7tMg7kogiM84zm1J5bxubr19bSSxjJmd:mRZUWWZdM8mObxuHvbzJ2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.18 KB	MD5: e9334d8a0a4ec3c6e6277e89dc8ba239 SHA1: e55303ca89223ccde4474d7f8f5360938ce12b69 SHA256: 553028d0738edcd0234398b9ae1ab16df31c1f532b28ea2a4b92f4493b2ce150 SSDeep: 96:9lMStwHPxsyYm+XL/DAxRqHraenCMtgU1uwpmd:9lHtCI7/DI2/1uq2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	53.41 KB	MD5: 8f6f26d554092ca59cda23c8eed0694f SHA1: 3b49c7374a6e8755e99db2d05bba4c86df679c7e SHA256: b09f1b6c7dd70c10993942d3c9e8fbc82b7f50291684ce8b0e1dabef32b79dc9 SSDeep: 1536:H6ujhwO0Jsh+J0dFgvVAWw4tl66Jip+zxS2A2:H6utwO0Jso45Ww4t09+zo2	... File Actions Show Properties Download
C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	141.27 KB	MD5: db366b8bb04b33d7a14fad143391b411 SHA1: a560b35c4a04207a4951bf7cc85a5dd6a71b717e SHA256: 686feb73bb3e825572865543e30c904ba59e4d4f91786e70be8d5cbee08ed1fb SSDeep: 3072:6eHE0uSgCsWMJsxQNtFZuOlzaA14m7A5Y8enLfVQ6WgdplTF:6eHUVCVLQfFZT91zA5YxnLfVQbgd3TF	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 830a89283e0c021069a4492a58799442 SHA1: 2302c14dd267057ad093e9e736224f4c8369033b SHA256: 9e4da7e169dd96e26e95fec22d91e0f9ede928515a9cfe3f18d141128f0306e0 SSDeep: 1536:Qh/ZUrQicVJz8O3546LV6595Ti7BiHa9G2TFRcC/bL5zBTJb:QhqvcVFf3546h6595cBiHN2TFRcC/bL1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: b6a1451d354696305052650311e0d16d SHA1: 22ba57d02f4d10a32a530b517b899c951bc9955f SHA256: f7e3ec9ea4187cd5e49ba8e805e8980a95288333892bd7fb7b5749d9330ae0aa SSDeep: 24:t39HL6SdL9AQvk8NdyErvrrLK6aAe1xdUSlaEQDX3SmbTtWjEaRmQ:TuWLSQvkC/rLK6atNfQDHZtmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	515.90 KB	MD5: 1ca1ac95c340c11c23a84427247da390 SHA1: c399cea71b98435879924c68fc138147ada8f236 SHA256: c8b023f4fe9af34b2e7ab1b02c75bd371a7dfb53a62354a4fb8cba7956114e16 SSDeep: 12288:gfoDZiOmDy0agmV3vOvF71z5/R6mk2WGPDtXIuosW:gADoOmm0ZmV3WvFJ1/Rfk2WGL14	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.18 KB	MD5: 24700846e903dfd8dc64add558de1760 SHA1: c0ef047c53c68935b6b82ded1363bc526a344572 SHA256: 362141e5ed6938e7e574265216ddfcb3f7aa990d9d0f4365e473e9c2749f1c70 SSDeep: 384:TDUJHWB1vXsRVl25LatA03dyCU8sjbeCEvuRB7gzkBtWqlO:XUE1vXEzi2dyC+HehvuRkUtlO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.03 KB	MD5: 752905058b6f60fb5b77ac51eb4b7b88 SHA1: 275f8a15b1e395378f3af1a1abf2cd444b927505 SHA256: e66bf5460b593a094f9f32d97538a00fd97695098db71e0fd37dea0571dda1ba SSDeep: 48:6QpzQhZZtdRJ6qbQS5FZHJLiK8CrIWI+CKdM19KahZ5XIm1:66QViqbzLzrIWJPC+Tm1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 1717d91b91821d8d8d1cae4efb7a41e2 SHA1: 9db7db869f71af0a2f303dac29b99e76a6b567bb SHA256: de3444d9f73435d6857880dd4fdd3797ca63b7fc49eab5af22ffdc012f0a2dda SSDeep: 1536:Eszesy0RRs37k1c3b5bGtI4zPmni3uy1h3V2ww+Avqhm:EEzE7QQbGtI4LmnPy52/v4m	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.37 KB	MD5: cfe2045b1dce3d1ca26c9b0999f3736e SHA1: 4bf00981b3e007548d3b9191a3bb52ff09cd31f7 SHA256: 514ffe0e4252f554573511e40106c7d1b1fa3838241d201dbea787351f86bb0d SSDeep: 1536:T2UBeFmvpdzZMdUvmHkuQC6W4Ltez+NDvE/DbL9Br/p8rW7/p+m:7BcSydcEkbMSTUzl17/4m	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.47 KB	MD5: 481e39ed78ef9afdc120b379a271d9b8 SHA1: 406c7ace89940530abb2de2ed9728c734d643556 SHA256: 90b34595e3f7b02b47f101b84bf1f23a99495e9aece7fe4d53875a79cc61df69 SSDeep: 384:vtcHR59PzN7sWu4O64wmpM3U+uXZC57jGxgVp1H/1+Gfe5GnDQiQ:vtcxVG64wmpguXg17dQGfe5Is1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.37 KB	MD5: 61a62a19b5507e9005678a8fe2ededfe SHA1: b00e91cc497980e43b4e3430d7f57f7226885352 SHA256: 3ef487c9476ca99a2d12e5b0cf92ba0c444aaa8e952227db1a633d7a6e151237 SSDeep: 96:DR4BcJ/nQeE7mXunfoLtqLX+NG7fkHvikBnw9JF0mR+/el/5GJm1:DRFOmenQLtqS6MHvsJymQWcO	... File Actions Show Properties Download
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE	41.97 KB	MD5: 138861ac32800b918f28708da8f86c13 SHA1: fae69caaf8b94e32b490af3ddc855f6c8d18f180 SHA256: 4a1f5a61f0e8e84db9c09558608db87e1847aec5d4c4780367d1b1f16e721326 SSDeep: 768:SM6o6sgmPC4dRcEmtj3Dxkafm3hp9yZwQFcUyzwDxsffZOGn1Cu1IdmJzy7mBome:CoAYczzxkojSwDuffZOGx1IdW7JU	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.41 KB	MD5: d479b1591e4d739c39a1c7aa7e032395 SHA1: 31378e60c6c3004f6937b4c36c512a28ca632af9 SHA256: c10da949d737f9efbddb91945fc00c9d46e4601ca2084f57ad853fd26cb780ad SSDeep: 12:2SHx4mmzgWuuvDcAeFd/laqV1MobWjEp0Rl8N8:GmmcW/cAeFd/laqzMaWjEaRmm	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.37 KB	MD5: fa879085e4c3f1bf820acfc83c2f21e7 SHA1: bd94f88e8040badaade07ff819b8700d1d3de88c SHA256: 21d842fbe2ac2201aa440a55f877d2366181d0e5481ffb62ff7022cf88d1e380 SSDeep: 6:C7xXEZSwX2igRxbrJGapen076WChpjijQ5mbUdjE28PBR0l2q/l8Nc8m39V:iEZ9Mok4b1NwbWjEp0Rl8NW	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.37 KB	MD5: 7b78599ae2e7f9747adce6b67b533c9d SHA1: 236c8d3be37b48667b48ef9355334f1c3eec6015 SHA256: e2864defd975bbf1e889b24debc4cb64c6ffe544ddb82bc34c05b9cb0f7c99e3 SSDeep: 6:MvMRgOUaQ4v/yMIfRQL2SoHc6WChpj66N/obUdjE28PBR0l2q/l8Nc8m39V:CMRgODQHJRT3b1PobWjEp0Rl8NW	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.61 KB	MD5: 7d7588a1c845680c8a46bcb3e2996205 SHA1: 942e2a9d3c0ca865715f89b9b21e1d93bacfbf39 SHA256: aceffed73e8f0ae2d329bd06b2a70320a4f7b568b6c3da506cf692d2d7735cd0 SSDeep: 192:8jIbJyQ6piReR1H5mWiA+4mtC2Vxd54LSSDnvliQ2:WOylpPIAOtCWxdeSS7L2	... File Actions Show Properties Download
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.31 KB	MD5: a72065ca3cc58e8e94b5c6b9522c0ffa SHA1: 4706cfce780df6ed5a6fa52edfe4a641d53b27fc SHA256: ecf1d1e63d364d8fca068d6a7c772ac58ea1c28588efbaa3e59f849232034aeb SSDeep: 6:5F8461lcel1DmRH8lD7gCSpjkonnl/8E2bUdjE28PBR0l2q/l8Nc8m39z:IZ1UH8lI31konntibWjEp0Rl8NM	... File Actions Show Properties Download
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.14 KB	MD5: b385b505c06052faa41186baddfb3d10 SHA1: f34f8fc6fd69abcbeb846ec3937093ee12721b8c SHA256: 5f22f3cf87db3890cf068e6a2ffe3e6bc77a5035086e473effb32ffc509eb387 SSDeep: 192:eEi35atu8nkJthQ2qSDluxfQLbxfYUE+yxUTNHhm:eDEvkJU2BifelpExUJhm	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	140.95 KB	MD5: f3dff21bb876abccfb74a1ebc023e20f SHA1: 340f92012f142385037c6a3d1164ca7d98f671ea SHA256: 30cf789d29b79b10901d85643ac2d2d2966c90d44fefc6e6d52f5f90d1191738 SSDeep: 3072:C1u9/rn52PiwU2PJpW6+QME7OQb5cpf2l5o:9xn5KHJykyQtui5o	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.55 KB	MD5: d944c20566f08860ff52d655f7778dc1 SHA1: 989de0868548bca04ea9c81c10b24121dfd7f558 SHA256: 3cd417b8204f4f5e3bafa6ee6777e955fed162ab1e59232a241e34849ffc7cfd SSDeep: 12:GrQdxp03vVGd3j2Y8x0iFH8lF12IuO446fDhQ0soVFutn:AOp03NGdiY8x0iFH8lj2IF6fDUsut	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	17.09 KB	MD5: 03296ff3dbef750de29ff701f9535d82 SHA1: b50b0074de6da0e17a1220cf1663f4e3611a8564 SHA256: 78cec6199aa2454d27c6fb6e1b6805baf3b1797eb7f9d0eda3c56c317d86bc35 SSDeep: 384:YOH+n6StLssLB5+cmh7eVs+4svCPDymn3wsy9X2QflRV0bMv:YxZsswB+fg/yHT6q	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.39 KB	MD5: ef2882b80a5cf42ff21819901ef3a6bc SHA1: 762ca20f611e4c14230abbe83e95e53cb5c67105 SHA256: 85b079867bb9f7fa6738121326db0d9d08f5df9220d1d67b815d14501f231798 SSDeep: 96:gP7PHhuCOtpnj5T11Z7nv+G6OPcgZSR7SZerAajLGHlYsNdu0PcPzN64yRmd:gjPHhufdToGFcZR7SZtuGHT+0yJNyR2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	79.32 KB	MD5: 63951ac0e2d8052c3ef3bfdaf70b372a SHA1: c1dc96b51d648bcb2cc6cc5622918f3d25e8bc73 SHA256: c96cd66511dd3e29a37940d1801b8e86121db9bcd863ae1b95c36ea5dafb71c3 SSDeep: 1536:p81J3pA2LFg2L85uUdKmKExDblwvVSk19UXR/+NZ+C1+e8jc:pSZA2p9L85uUdFKExXlwv3UXJ+Nsg+5c	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	59.65 KB	MD5: 957e55b1b3a79e5c3f8c3ae993213a7c SHA1: eee69fdfac3ba297ebd34c48ed62f658018da842 SHA256: cfc61640e2bb971d2431224beba68d2337ae920cf6d77e968228dd440b8699bf SSDeep: 1536:vX4xdctGYsFE/ThED9NATtXgWEHo3mo891BflJeVSROANc:vIv8GY5/9ERNATCW93mhlgQOGc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.09 KB	MD5: 014366e9c24785d7c444bc51c611f567 SHA1: 0b1f3a8a869b72c177ea8e2febffeb00954225d3 SHA256: eeac1023c84008510b8ffa3993540d38e0a2dacab4b8c8818956461833aed09a SSDeep: 384:iF1384I1bxZ1n5meSPddwkFmOvxHELYpBs3oc:G1sNXieSFdwOtv/pUJ	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: d0b759a4ab639503fad01bf87f1bf2c9 SHA1: b8c10099e6006d84304b52a23254fdef74895578 SHA256: fcd186bb9798f59816743348d9d2f748c4e66907aa7edf2e06655d816cef5923 SSDeep: 384:rhbjhL2gWSi6Il4WcqkJ08/s329tTlbVY5aTla/dfPx6UyxtByWv:rJjAgTiX4fa8036t1k6mHx6UyhD	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	76.18 KB	MD5: eaca885d9e1869bf225522fcefaed2c1 SHA1: 7acc820df376ac4ab7728ca7ff26fcee840c1e44 SHA256: 81b6a41bec1529ad27da893c6dd050f228b4147d3946b3f52212f7ec9f4d3b61 SSDeep: 1536:wge6ZEx1M9pnGAq/6XK4dl+DOsK+hix19qbQ85WF405w/Rs/YDjEc:wpAEw9G4Kq+asK+s9qCRqRsojEc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	72.72 KB	MD5: a2e8785ec9cabf2e2a119580708e461d SHA1: b8121d8df428b4036c264980606a7f9cf9dfeab3 SHA256: f131c56d9387d543a2539778cd32895b3af34e9578750a1dc762581d7289edf1 SSDeep: 1536:pH4hgzNBaxprmqMUx8pTU6gi7Fa7dohbVeJDqxOtDy9hPKronzu2c:Khg5BMprKLw6J7EZL7tkG2c	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.83 KB	MD5: d02c5888f0d14b88bfc35c43efde77c3 SHA1: 450d809e5f6103ff6c57d281ce380b3dc3dec3d8 SHA256: 95e8c591285f580361f440c4efe181ad8c8afa80f598c9c50b8355b836782e05 SSDeep: 24:2gv4N1oTL3nCMyVB7m8OdNQS+uFU3HeH8ljvDfDUso:2gv4Do33nC1jOEaK3M8lTY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.47 KB	MD5: 9c17080757db555676f8cc086e3ab8a1 SHA1: b13197e3f0e5b3cd852d258d3c8721e025787d75 SHA256: 515c69d2294b46a9fda3bf05b85d20e233e53fc0f298cdbb34991423846bf1ef SSDeep: 96:f0cS9ESrS5VLWdy4OzpUcd+Ffs6VMCtKYPQvjmd:f0BEEoWepUrFfRtKES2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: ecbe75539ed6360622c9653f91fe6190 SHA1: 8915f8406da929e85b3a8c85c45e3fefc92e32ac SHA256: d980e2d77f18251478c646bf1cec225ac6d6e0c0ab0abdc623588efbdafcb7fa SSDeep: 384:Jme6BvQHloLeaUofiWU4PQ4xnWZxZ1b/CFGxrExo3rALm:Ye1HSzbP9NiX5YuYxOrAK	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: e09871c02bb245f0aa353e086e74b85b SHA1: 115eaac269ac0a2b65fb0f71fed8899c84fb0049 SHA256: 8169418455c78bca238df57678c8d905f48e3bccea95e2d8919aba72195cb5e8 SSDeep: 384:1HrlyfRECOy772zxVBoGZGwcI3Wl5KV6f0FuSoRA9YLYOknfgbl:1HrKEY2zzBanMWle68PoKOgfm	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	17.09 KB	MD5: 868ec83f74376de438605f4c99518beb SHA1: b94b9cdcf94d10cee708599b8a6caf1db331d63a SHA256: e7bec6184a8d39d520164285be4c6ae953e9746f3ee11ea36991e0335b076114 SSDeep: 384:jMGL9VN9tzR0evgaIyC9WVd44xNhDv5NlajJCBW8XkmfvKnjV7VT:RTI1yLd/r15NUjJhyhfvKnN9	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.59 KB	MD5: 7812bc5263e04b7824366fad9fbe8e24 SHA1: 9b33164010c6d467ec1d7e50a9695fbfc2cf95ea SHA256: 16c28cee1c6da9682234c5f3b5e11a9b97bc55b409fed0a0014eb30301d16874 SSDeep: 384:ptF69+0ESTgA/ckU9P7RIYL9H4D/dKI+h8vjIs7LOTTZdy7eE5C:vF69+rS7/NlbILIjXLsZdyaEw	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.59 KB	MD5: 6f4dc3e1546f445fe3e2f8d546ad64fd SHA1: 3564f1e271369d944d63959e58bc2f53b8e360ab SHA256: 5ed531c92e6e69e4f10083fd0a57c454d68566dd5fbb8c80cab21725c68fa89b SSDeep: 384:MrqAwQJGf8gDFVa6Wkpdu2XnLaumQJWF5BOvqV1+T8yNE/WeSG:MrqAwEsnaNkpdhX8QkEA+YWE	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	16.59 KB	MD5: 915b51e692261f872c7d39663833234d SHA1: 5fc9a0c2bb09a70a7082dfab21195a855d90472e SHA256: 92e799e6ad4893e344e794922360f230f12dfa21938e4914c16351c110d1676e SSDeep: 384:KZu3PIFqytoWhE8DCdwFc0ZT4QRWQOyM0X01U9Xjclr:K83PNRO7CqFHVYQOS04k	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.57 KB	MD5: ad224b7e2310ec1b42fc76e47aa009f1 SHA1: 035081d4150e8da3159315b4e55059f0eed4aa27 SHA256: b0b6656a79f2a4d355b23583bbe03899a1e85112f284a706c808c9be59286b40 SSDeep: 96:wYph/H3g7Qsd+JoJdyj5xDjErYD7OG7QoBlHmd:/7/X5gYRvQrYDd7QAlH2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	80.66 KB	MD5: 3294b24f195e8cd844b1f68a71d6d214 SHA1: 188ae00528369e75bdb0c3d89eb00f58b42db248 SHA256: 4a4ea8a49c55818fda322e8134e236370eb5d247de015dbc27e7e34d5a5378bd SSDeep: 1536:WqHXUATsCkxToXNsdarUVCKa1nTbvd9uwabM/mdiI7r+xX1TwWfOXhJAucsAnc:WuEosCkxTo9Pjl9xaoediI7r+R9wWUhD	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: 920c9cbc007ac4d8034c87c45d5b4074 SHA1: 715b5c4a5f5aae8eefa3f3c569d624ba182b6bb6 SHA256: eb439f1b15bb193458a936e46f1d2c6f649b6a287f909bd2da189e5b3698e0f9 SSDeep: 384:v+jtIjiDj75ioz4wCWjfXn0Hbigzk5vnx2Xh+3dBcCjiglDG3Q:vUIg4i4wCWL07ihkg3dBdjHz	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.59 KB	MD5: 8ae4337dee33d72b39f204ce65f37e69 SHA1: dd2800b60f2050913805ecc96c5f7759f82aa834 SHA256: cf7d0b6a8f65310805f9e4ab3b7d91f7434b3b056a7c7118ebaa76f39a54a61c SSDeep: 192:yRhA+xq8Z17WPC0R88LztDzYWTA7g5lVoZis/FhARr+/0KFJGLi69ucz0tdvR9SZ:BuTdEC01nugA7g5zwATwJD69fz0f4R	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	84.51 KB	MD5: 5e81fd95c2e796421025d6f7e42a15cf SHA1: c0f7af1ee0dd1fbe5283baf08340fede889076c3 SHA256: 8c0abab4b04b34be8f18dd32914a87f0c83013d3e2742fa219b44ba3a001158c SSDeep: 1536:+/79WOjfCNg49RaPucwGaHa5rABilhZnNJZDC3uIMD5MOzVDZ/c:iluZ9DvorDlhZnNJZEuPJzFZ/c	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.35 KB	MD5: 306c0284f1d7166e8c7913d5f98da50d SHA1: 7abff886a62b2526c983af78561531380bf2468d SHA256: 8479ab8ca61bd5c69c228cbdbf1651ed0ddb33f406fcb6e6f6fa391d0de74b7d SSDeep: 96:y0XLomUGV49Tjm856LXUhV94Fm5FFTjpwPtgl1qqmdUAmd:7aC4o85FncOFFTjWtgfgUA2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.09 KB	MD5: 32adcc0029d401e38e301847e985acf5 SHA1: cc8c6b2e2bcaced21d96f1d562cd79bfeda5453f SHA256: e113493d3ac85d99895a1273e906045525145487b0cb589ede5e769979f8f568 SSDeep: 384:VeDsBb/yKl3WRGe5JnvUVwMSxZ9nTDpeaITPT+DF:0DsBb/flTUcsZFBITr+B	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	17.59 KB	MD5: 0156b1ee77404aaa95274daa9e441258 SHA1: 9b1d185445ce8395ede1db614921b50044a9c7af SHA256: ee5a9e5cbc7a0765d595621fa2d07bf0bd617980826920add08c2a4a7079a9b1 SSDeep: 384:asr2/6z+U12pMe+hDrW8V0ujsxswNvKM+PlawB0eMNqacN78:asr2/6z+U12cDrVjsywNyawWeM8acN4	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.09 KB	MD5: adfc3dc79a2630809ae8388cbe2692ed SHA1: caf92fea0c9515670bf32cc082f86538b684890b SHA256: 90c1db096a7d82a8c80ef096b3e1b920bea33c39c397b5a85ac76cd7aab2d587 SSDeep: 384:mIzA9/jatl10+0FU/18K0Ai+0mFW+rVP3hpnmA3S3u:muA92z1fMUWK0AomF/P3nnrN	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	75.68 KB	MD5: b6dcf01c379c7b8df5337696920a99f3 SHA1: b3d0ec9c2dc045618b78b7a35d6a90ef623b8c2f SHA256: 965edcffafd307029777311b1e064645a941d62f72e0cacb5aa8eb2794a6e3c7 SSDeep: 1536:TdoSk0W36ApMR4wE07yRnOwyYQ6vt5yYA+gWlYlwIy1yXxrHyVpc:pXk0W32R7x7yJOcNvtMYA+gHlpy1OrWG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: 81a7e0252aeef26529271d88a9657c3e SHA1: 5adf594b821af1389a11859ca8ece5c657f5eb63 SHA256: 275cdabea06d202f4e75882d391d5f2e5f1bc3dec8e75605aa89624a3408c32f SSDeep: 384:dj7jYPdV79WxBb8suPdJk1xuolaiRmvmz51+WMyUWwS03ygctfwb/NYbkh:djQj79WwPgxiikvqQDrI03lc6jN	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: 899700bb87c3eda950d8725b4e1aa5e9 SHA1: 51337492d3defe7922378dfb74b4eed1009792f4 SHA256: f6d6be4e7059959ee0549ca46c82af5122c1f2a4ca1dfe41745836ca935997af SSDeep: 384:WFYsA8K+JGUy+YWcArzg4zkplL5s5p9dB0u7YcCVIdOZSK34ri/iBdiyc0sk6:yYP8J+1Wcu0TJ5Kp9d1CVOz+1B0s7	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.85 KB	MD5: 62a2974bc688ed3fbada7e275c9d3017 SHA1: 92e180b990d9cb14fa1bc4c405e5b4e8f82e3e20 SHA256: 3141aaf1b92ea47c4af122a2bf1d6202ca07b1791d8dac5a5c12c5b3e0d6fbd1 SSDeep: 96:aW7FXhtlUMn68oUg3Sx4btaoi04sHWsPg1tCP2/WJitfmd:dBXht2u6tURx45ni0VHvPg3LeJuf2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.09 KB	MD5: c9066e2b27fa5937c723e2047fffcb7c SHA1: 631c5617fb310b32d8e5be1f8ff3aa8dc091bedc SHA256: 0502f431791ef2a7e4c51ca84106bae09b2abc46636b9585363e8dbb769458e3 SSDeep: 384:TewjCr6DdMVaMMQZO/bqv/SP6C++tZ5BtvG0402jdt:y1+D/KgDMS/BZDHAjf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	17.59 KB	MD5: 51a3079da2062eab5039e532eec97c2a SHA1: 6aad88f16c7b146474e14e5b43266d4450e0a44e SHA256: 9d17086074a0f57fb758e964504c8caacaf15519be350758030c801b5b5c39d3 SSDeep: 384:oMGBhSVzGYoJka5H24Tvu23XvRtSzpzdHLQKm8sz0LDnp0Z1m+:oMGBhgz0J5Tv1fS9d0KmnuDeZX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	17.59 KB	MD5: 0f9f84958992fb6e5601bc6117a6e641 SHA1: c859430d47a98dadfa6eb8297e8aa63baea14f85 SHA256: f532f0c604384daf08ff9ac5cecbe7ec9a61709d81292e1e925f499e986910f0 SSDeep: 384:Ff2G7YgCXXjI8ZxGA/BqvcOoeGA6Aj2ceTtlwAwix5K:WgUzJl/QNFiJkAwL	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.68 KB	MD5: 1b7b9612dd377939ce5315e2e8e139c0 SHA1: d39dae58a464d638b3c721e420d240bd2ca836da SHA256: 013c4de995457ed29866f19d45414db272961fa17ec3907faf2e135f69a9c512 SSDeep: 96:i6TvvvBlut+XfGbCtjinyrwRWBSnST/nlDssmffad5lpB5md:BTuQX1In7RWB7rnBsJidZB52	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.09 KB	MD5: 6e40cd850d261d6e6ee7bcecac41e260 SHA1: 004d88c9d1f314a9761494d637524d0f95485d3b SHA256: f236a31b4a233a1529a823689c41275bab0d6f81f395e7baaafe55ae625d623f SSDeep: 192:gcxdcV5dJvrX+ZqX8RMjD7k0n2/OwwwJFU7/Nxzh2zEpIPZBLEzclpj798X2m4OR:n6dJSZBagUtr7IgbQlhGXh4OjYIyNkZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.09 KB	MD5: 0634340dbb69363308504d5308c4d970 SHA1: 6ca8b7bb82e5befa5c1c7bfe1d1b83e1f7ff0a2d SHA256: 3f04d51e401cc3982fb8a9b9e3ba3fd591d2975283109fc0296a894297f7db86 SSDeep: 384:dgUisxNGOO4i8ImxQFPS0bcgrNrEUuhezZ3BcnLmqTOz3uVpt:dXNNGJ3TFT2hKZmFq+VX	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.59 KB	MD5: fc72e7add655541970e5a8c531200cb8 SHA1: cb64767ee981064037539df778d42f33ccc84f50 SHA256: 5e44dc48ff38cdd06b6a88338697fe41d4e0adea4971ae44b36110ce65f0a178 SSDeep: 384:catBgIreFuk9iMxJoQMnxq/FwDGrnn5T/V4dBB4RVniIM:j8vrRqCN/aDSRU	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.59 KB	MD5: 1868053473d384d09b459a93890269e1 SHA1: 778f697694a28ebf655877a2faa7980299452d0d SHA256: b91421cab20b3b02248cff10109de40c148cafb0cd68c0a0c08b7cd468ecd6ec SSDeep: 384:hcfrob/U/lZpw5kbOpIle06IRHcGy3ihnomzbNY7moy5Ch:hcDoLU/hw5kbvle0tHcRihLdY7O5C	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.35 KB	MD5: c0e06460d380909ee35c07944723e038 SHA1: 2c4f9dbb84cafa810944420128b9f9703f2ab369 SHA256: 97ec8ac6e4667a4b5676746216d55779bb960259202d8f97e62f3f7effe2a21f SSDeep: 24:A3w2TeLPq6ieI8yQIQzHO7x8KdFREg/OY9A37lSDCj18eG+BRP8igI7wWwfDUsK:v27Kn/zS8KREwLSrg87GPI73	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	86.71 KB	MD5: dae5d93ece6123985ea99310f004c354 SHA1: 60b3904d7fedaf51866460bcbf1c9a005e6d48fd SHA256: 0a54f999cf6868fb3e4aa994384ad2010fba70a20f06c28e2d9fb0857795ee27 SSDeep: 1536:v2W/dxffJ4rz/ff8zXOpkMtlqAPqnaiounuAnWy3VF0Tv:+W1xfR4X/ffWu1GcioMuRy3sTv	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: 863fdb5eada5b9bce63aebfed7d979d3 SHA1: 2f4b3a894797bee5dff94e1da60d8dd3a4781831 SHA256: ddf62bd18ff2939622199839faeaebf6f290b2c4faaf0fde6af2f8a68be3ebd4 SSDeep: 24:si7bkuMAxMr0HaEEkCxUooxm+XQJb13gwMLDofdIHBFfDUsG:Lk1AjatRWo7QwMHofdq4	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: c4e5de990656c1c5bd32a9929959d1b4 SHA1: 3aa5482290fc2e2bf058a810ff1ed9c77f749141 SHA256: 09ce3143f90ddecc16c0e367810e37398e31c2ec99fc7bc5627182e754f73040 SSDeep: 24:2hgEpSNMWPlojrcVbLtPHqpctL5Xmzk+DAxnuWvfDUsG:2t1WEMLtKGnXmzfD	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: d11ea4bd6d9e85ed2f2d904fe7d3f27a SHA1: 86af9d8f96bee53832674705ebe5bba65d686725 SHA256: 8db99b47ee51dc34838478c7ad6f0fd2a77c0c9ebb9785c50aa4828264a5b262 SSDeep: 24:Tq/syN6cdMuyP0Lt10TMUIjjmnKsDzVfDUsG:Tq/F6cdM30LzyM5mnNDc	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: 12934e5f050aa020e6364735c0ac74f7 SHA1: ef2529dfc2c177024e837986443e0dfb5c47b7eb SHA256: 63e6455969a8cff1b308fc8906981a63cbc4d12ac42061ee820c040c72114d19 SSDeep: 24:txOkWoZe2bWNlWZ02tw7/2cpIUceou1qveJlLjz4zfDUsG:tAC5WDKlu2UmjIqviDl	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: e17f7d12ddc1e0710b3392248b5a40cb SHA1: a587f368444ce4e5591e7b2b3983431e3adc024b SHA256: 681d2029cd55b3a941fead1ac5758efa1db24bc013b1815898efe07347b92610 SSDeep: 24:Uuj63m9IL+6MZjGb1XRrxPnzuSGElwiXJbqIMGJfDUsG:U46SjurxPzuBElwi1q28	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.35 KB	MD5: 2f69bcf0079df5fa9fe991d4d8ca2f06 SHA1: 3bb71b12b03e3e25b851faf1c0c7bdcfa2c028d2 SHA256: b296b5ce3a768d7ccc996b3680b5a48de73ba1695c3a9ecf4e26ccc307924e85 SSDeep: 24:EqG3+O5k+kiQ7oxLmjY44m3gUkAltj8ebnO9HLWl9dJk7BrdF7+N0sq9lSc7uxHc:ETuOOF04MA36A3j8eKlQVO1qq9gRa	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: d28040819c1d0aa41498861231ae823c SHA1: dbd17f9cd918aaef5b91bf06dc7de2fcba02ed7b SHA256: 8cf50902ca06cd2a790e5322bc06917a8e70864628fd00a7f458f097b4daf04a SSDeep: 24:0c3VzynbIN0ykGPiggVBt1xS/Zhleuf2Xi4vHHfDGUufDUsG:flzgbINlKbnxK12hvnfh	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	36.08 KB	MD5: d6081d34480ea588f4cddde75524bb90 SHA1: b87a8b3f3e7382d32f066ae21710f3ae80c842b1 SHA256: e601aaeb328949c568b632f4e278e4d5603dd9432c59b9dec753e5cc12ce8547 SSDeep: 768:qu2pLy3N+ROWyo/iNPjqHrSnFYGw+Q7Tm8ZJdHDaT8Wb:3Sl/itOLSnaGp3m+T9b	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	81.27 KB	MD5: ad4bfc858f83c92907fca9a0e969f1fe SHA1: 1a4f551e9edb5f1ccdb3c0d189a12e24b8e92cc5 SHA256: 85096d6d279892cfca37884a8d25a356c790202bfe246e09227f2f70368eac01 SSDeep: 1536:2XyZZqRmdql3H4VYeGkXCYCNQlkfid4KpgVCZIzdAXGqWuBYUmWg0hfZzMXvJj82:2CZUia3q/lAHCaxAWqHfg0boXvS5c	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.86 KB	MD5: 66531bc1114f034a5745e5b0dab820d2 SHA1: a76500a813396c39d70280fa89d33df3babfdfb4 SHA256: 0fad28d189b421545d49b5729e1361915b5862766c0269f906622ffe379592fa SSDeep: 96:bGG0cVwPAnr4q2YqfPDDnJyR686rofWgwuAyuIn3A8W3Wmd:bh48MlYqfajACWDnyTnxWm2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.93 KB	MD5: 74654b950e50ed83eef607e297624f75 SHA1: e1de59d4a6b599e71aa2bd6946939749f714464a SHA256: b2bdbcf0db75670b7b83bb07e2fdd00e86684298b8fb6ba18fee888c3e60bf2d SSDeep: 192:+Ghk+4F7owlUHgUm16RK+x/xhvE8B8d3JB6Eyg3J8ZFPO2:w7ow+HgUm1W5xSzag3JYO2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.89 KB	MD5: 06675cbc9a20aa9d610ed9f57798cd70 SHA1: 067b012945a6a54760bb2da8eaaaeeb429e68307 SHA256: 6ed4983ce52ace2289870aedc9fa59af299c82fdbb12a5328e6f208a3018a1fe SSDeep: 192:pj7sJzJgx79PRDWRuY9uMTL17fncvZluQnIzy+dS6r2u/A42:OJzJgxNwcM9DnEluEIzy+xr2eh2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.38 KB	MD5: 308233a3a333a64f8dc9399e102e9aff SHA1: ebe70847202f2bf64e250e8d4ddff6c993aaf2d9 SHA256: 6d2b4879afb0d1a2c1443c595a9647f727e1bc527cb8d9fd6fa0d250817e4b84 SSDeep: 96:fL9myYKU1S5D/Aodi3+17EYkRZmBdtffTqeG8XTb6md:JmyYp1S5D/AoM3QEJKntffOepC2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	70.63 KB	MD5: 769b9905e2a0943bd64b446f1d5a2325 SHA1: e7ed34e00feccea27593b122f3141eb692df5562 SHA256: 6a0ccabbb20c5918a08eefbe418d9a68d235fe2316ed9a8f954852b6525c71fa SSDeep: 1536:ZPFb//dWhSdkL+9VIRNqqi/9SGCkFxFP/66zc:pFb5CUQg91FxFPC6zc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	84.66 KB	MD5: 3e49b1f968b2b09038aed64048f4933e SHA1: 91337f7faf7ddb7d76df467993f9a5e806c41d98 SHA256: db3e3355961931833e8f9d1dae72a269ddc4d487fcfdbb8c1b8cfb6615a36aba SSDeep: 1536:K5nxTvZ0Hu5CXa3O8OEyjQ9R1p6GoAMjZTpu3Al+pehVH2PG+vLUnDgkOVQJLQv2:WFCSO8D6Q9RmGoAzk1VWPGUBK05c	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.36 KB	MD5: c7b6c0cf6c36e2d02c2ac653e231af03 SHA1: a4c86633795dc40f11ed0d2a6a96e19f41393ee3 SHA256: c60163f3b7aa1cad81fa4201e73166e3de18207186a124c35d354294e291458e SSDeep: 24:yQ4vNxF5SoTTjTiQKLdY6DSB2kD7NC8p4+t1Yw9jYxO2/h38fDUsy:Kvp5Son3iQYdY6oC8Pt1J0xXhF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	10.11 KB	MD5: e71d4890e969fb2ea9aa38edc4e037a9 SHA1: 53a83f70a435a99d0cd6734886ae02db07853660 SHA256: 608dc78fc18c9ed9365c3f3ea5b7d63966c2426216f81f959b5108e3c6dfa78e SSDeep: 192:Rm64fDV4UHHOSCVB0En0NQQFkdmpvXo5Fdv+PRMiNIhTbmFWr2:cxZHHO9ZALFkApQ5FdgMeYuFWr2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	66.88 KB	MD5: 8dd609e64755d3a044f5d442006c1cc2 SHA1: 048c7e2e1082e67ff8ee1cdbcb3c1faa3ae5d978 SHA256: bdb2b829f412bdc467c811e1b54ab9a7453be331a0794c113f0af90b9e520113 SSDeep: 1536:txYE7dPSU2CarSUwG0LpmvMpf74+IH1E2ZdaiaYscZuEqgzZvAemc:/Fz2CvLpGMBcd1Dna9yZuEqKmc	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.36 KB	MD5: 75949874aafd1e667937e41172939803 SHA1: 20df0464947dc84a6779f9a9dd48a17f7ad1f283 SHA256: 24841ac27882b1fb09c4998e5a8fd412ba472cc9608110adf0531476bb22723a SSDeep: 24:JUUJ4M/oIjfuwXNcJMyo1QbHClPy/MDeQ4AyunxXfDUs4:vqw3mKcJMyoObHePy/MmAVK	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	12.61 KB	MD5: 785004a18ed2bcc0e65d4d45fa1252eb SHA1: b1a47da97a443e7b7e3d1ceb7a04186ade5f49a7 SHA256: 0d3680733d245251e8d5c4e58124ed53ead4c07fc175a52feed92fbbc3d96f19 SSDeep: 384:9b+2zRteR2nU87Rte5DzlsQjFfJg/+HhAv42:9b+2zSR2X7RteZlsQjBJg/+H2v42	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.79 KB	MD5: cbf4ef9fe3bc9a23165356ec493aee0c SHA1: 730be41504028d612daa72ea6e18263f54aed2e4 SHA256: eb5c552531c6cbb558dc756bb9a282e332ba0f3a4990fdac66b2e36625d362e1 SSDeep: 96:ZcX+kaEUVJPXMgs+p+C4FYnzq5/Rof0WW3md:ZY+knm1ila4pofY32	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	63.96 KB	MD5: e782ec95fb18b76b95467a58da3c6502 SHA1: f47cc3175b2f023542d51c0063cd83ed62d1870f SHA256: 888a8c6800f6c7032645c418e62eb150c65c8672602e9bc8f28526a14e414a96 SSDeep: 1536:HIGxb4CyA4GmjEP9L2ctv5YdskMEQxPreCFAohdq2U4qhkklwHc:HIG/yA4BjEPLYqYieCqohy4kkkGHc	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	10.13 KB	MD5: 7ec0aef46dfb46d276614489b25117e2 SHA1: c1faaae61607ad0830d65b0b71bf007bda9d8882 SHA256: 4e4af9741911e01ad82667cb74bbb7ee4c2c82fc1c00d0417ee1b28b3af90b7b SSDeep: 192:JLTg/ajWoCwTNXKauJYrRCJRvdfGnNgqwbuZrEeyOroT1kzIEE723Vxla:Vgv8CvvFXxv1OpE72Pla	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.21 KB	MD5: d4cafd3aab3e5411505a2a42749e1d87 SHA1: 48045cf539b42eaf3264cddc46e349f7d1e1fae5 SHA256: 811e2c8a95c9b26b0a563c9d2a4663009237ef20dc57edcfb18203d930d433a0 SSDeep: 96:iYVCsKnVTWTztg7sBBngN0goPA6XtoIQYHtLzU2Imd:HKVQJBBggPAG9Lgd2	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	10.13 KB	MD5: 48be77c16d0b55bb607bc3229e8a7a44 SHA1: ae1e3eb403726bd2729eeb6b3f7ee11344f2e5f9 SHA256: be0d57f744401491d64bcc6fd2196428ed7613cdcc4763138a14a60d38a78383 SSDeep: 192:6jlf9gBEBwhaE/Xk8Aw38oEZm7I0qRVBDejojM4V5XKkXtqSu:If6BZxs8AWEqmBijOMc5XKkX85	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	77.69 KB	MD5: d820b3bb46ac51458543fb58eee4643c SHA1: 855f2c00fad0914009ee40d32b037490fec3cb34 SHA256: 58ede109f538b25ed35b6fa64a046ef92f7195f1874755c9cfaa9b8316c9c52d SSDeep: 1536:PYZ3nLFDby19Eb01FdaQI2odU7y7PN+gEPr0HecaHyOcESIdd3nzMAc:PYZXFW82zI2qUW7PNa+cytS3lc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	80.69 KB	MD5: 30a6742dc0ef57e4b10ba165aa0baf7a SHA1: 2542f09592ba63cfbaef4497c792bbcadad79094 SHA256: 07f3dd8d3a5bb12540c1e70e1d7f24096e50c49cdc83d537f3073f0b977f4f71 SSDeep: 1536:YEZcLHBEa0byYJ5SMsPQps4o4JBt/KYcFK8xq8+dqr/IiwLS8mXsMmP1C1c:sL9qhiM1NzcfxPr/YS8zMeyc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.83 KB	MD5: c49ad233f359685a63b162b1931974ef SHA1: 54bd74f9e42c27eb0adc5ad1eda8cdcd9ab33119 SHA256: 2854c729183fcf1567f1dc72ebbf4c632e681cb46a0d5f7c9837c739813b2030 SSDeep: 96:HaPZFuiSsGGBLQiSfQIol6dnjoE5Hqic8/feZPdzCamd:H4EsthSflRx5Hh7+1oa2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	79.10 KB	MD5: cc8bbcf92f2c1cb014573c5f72610c6a SHA1: 8e8576ae7caced0a4a69b77b0915cf0dc6a36074 SHA256: 4e0200e1b76dd5bee94c6f20a723a6908eab644753dc03af2def666d5facc411 SSDeep: 1536:HDy9qb7Y0OSHwYwHpEZBAu9CbkIofJWS7pbVzwcEBcMXDBIc:e9wM02YYGAu8ofJFbKcEa8tIc	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.10 KB	MD5: 2d23aad6957cc864f6b16004d9eb4dc3 SHA1: cdae87fd95ced3badf782f5400dec6f9f8255c34 SHA256: c3c554507bf043eef59e121a239b0d1fa8e9de92c6f2e9e5a7f344d63fad0ab0 SSDeep: 24:ZT0VkBZUZayXXvkn36tU4o9FhUjp+HBrTT67voz/JBWSg+iFOopfDUsG:lAkBZGX87Ot+h767vCBWZ0	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE	173.83 MB	MD5: cc75e7bda8993fedfe1a6badcf08dce7 SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.00 KB	MD5: 0610717725e4af8858a8be56f411d26c SHA1: 2a0b1e0c29e6e4e834a4822c151fadc35b2b26a1 SHA256: 76d72f957e47ddbfda346db886eeb5526437d02f25527e1958af9733314f3f6b SSDeep: 96:Pf5JlTjg0tgImzJ/Dm81oAYSpuljnpM+KrAViwtijcoNmd:ZDgtvN/afF8MjZ3VeN2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	76.12 KB	MD5: 8fded26279d55057197af3e40fc9d7fd SHA1: ac883d794ba50d53c119dfd54a216cf18ddaef20 SHA256: 9fde83640c8eba30f3e064f8f3435b119651edb9cdafc84deaa55e8436e69739 SSDeep: 1536:Uwjg0L/HWNbLseapxG3Z2o/TJYPIwHCWlkM8gp751sVOTc:Uw80TAWjGJ2eaIuCWW/zsTc	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.00 KB	MD5: 4ad06e53d7d3d82ee8e29b2c30e654b5 SHA1: feb9125947005c5004aae3d2dcfd5fa3bf495fcb SHA256: bf4803b748273edd8113e3a9171d3ae77075cd14977b489b00e4ac9b9330b701 SSDeep: 96:9ijt1EaI1irJPrZ0NMvWUSWe+B5KjEnE2M2juKZbUci2NAVqmd:Grk1itOeuweaPiKZbCMYq2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	75.27 KB	MD5: 691290f605b4fd1e130aa1c21ce5a043 SHA1: 106a5dd45fd400f2521ed312c875ebf37d975900 SHA256: db9fcddc5988317bc222f8a82a3e741547af76d3b1ec7f44801d6e5c41cb1413 SSDeep: 1536:U/qGKuNwIk2Gl/jfFZ1Lx5SPnJt2vyeQoC+Ae/c:U/Ug22Glpvxk/6VTZAe/c	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.11 MB	MD5: 4e05adb8a15ed2ee58b6e70ffda86f79 SHA1: 66d98802a449c6ca9f8e69e39783b8672ffb2cb8 SHA256: 54cba6556ea65bbd4c6245fa1b3fef0c07a3b5dd261de1eb0ffd6e171489bb37 SSDeep: 24576:kDNXkUxpn/+jGZy0Wa10HELKC9db8NQ8r+AyUevjR4cq:vUx8jGZyu2C/MQ6hCVq	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.56 MB	MD5: f4bb7f1a43bde78e7889ad8bbbf00184 SHA1: 1a701919fa7b8ac066fe8e8b002ca846f4ad3659 SHA256: 29a0ac6422b5938305d2227e7ff7ff3b9141ae6812b0b5dc5dc8d47b2cc260e0 SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGxoNaZko6g2YwcScNkUx3o8MeQS4JlVWKj25X7pX:ncxisfQxoMLkNoFJ2Y532U6yQR7ov5yI	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	78.02 KB	MD5: c2e95cb1af5cbe885e73a86d45e0d38a SHA1: c60abf143abbe5949f1114d4951bca3990c4b953 SHA256: 094e1a612c6842ca7de1345a3777f65c7eea66d6f71c93c59abfb13e288d2910 SSDeep: 1536:FDrKjUHV9fuN2Gqv64UiGNV2tNn12i+SdpVVMxrcOwpsl94fy5uDc:OMON2GqvLUDNVAn1qxrM+lNcc	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.93 KB	MD5: 92fa998236e44a9f15d2303da8cddedc SHA1: 3d9bd5b31aef89f70200aea9149f00d586801d83 SHA256: feb90d627518702a92344e2376b44f4b5d26c6543d692a8ff347a4f67fac8ee9 SSDeep: 96:K2LRBvIWff5kAgj4Cz+r8K2uSdfV/GKDaJOx00m//tOLM1WfoeZTrL8uJUb6PlSi:K2lWWff5klnz6SVZL++/m/1OY1K5RrL9	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	852.27 KB	MD5: 206504cd57f4ed8a7914519a25337edf SHA1: f9adbd9bf042bb194f1bc627e5449ec51d4a6a84 SHA256: b9b5ec9386b52874041d1a4d3ffea7bad095daa27c2e9c5a6e87415cb6957d89 SSDeep: 24576:z/+ZxexoRD1nNB1JgvEWZr05Yarbrn6dq9bg:D+uaNN7QyYafrn6dqRg	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	79.82 KB	MD5: 03064302b8645d9aef006da12508dcdf SHA1: 5711d86378ba84fdf80a3d89790477593f814799 SHA256: e72945cd402c3a03ded7ea88f5ad77c4c422f2b187fbe01b5c019b3cc420420d SSDeep: 1536:toDqIeOKd/kftHqB61RAJTI2A0DDqInS0sEiucb9UjO4c:XIbK/tBgAJM2A0DDqCcb9b4c	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	59.51 KB	MD5: 57db99cb40e4b4c075adfb817769d346 SHA1: 2d8ee98694884fd910a4bd7978b8c34300d66d39 SHA256: 219c7a180e19b91aa73ecdca06792926f30e9b2575f768872739bf687f930a99 SSDeep: 1536:+YjtFQg262P1aC0oGxCd2017GpZe8IGBnYc:+YvQg+lyCYogx1BYc	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.39 KB	MD5: cb1b7b4694862c887528da9ae7fffbf7 SHA1: dc3edd2b0946eeef5434bd9bce984265d4bdd79d SHA256: e4c3a87b6cb3da333a57b7a70a85e2da32e6df7d80944844a4cee088756ffaa6 SSDeep: 192:kSCEYiWLpvKJzyNXFwZGTYEf6YvIKG0zPHr+09y2:kSCE9KpvoaXFWEzIhuHr+qy2	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	59.65 KB	MD5: caf03e093571f15e5e2e0eceb85ed005 SHA1: 4b0cba93456db478a08b7987d03f34c6b6571510 SHA256: f9b3829391944dd5d755ffc0b041aac7eb12efd79069f81d670d7c64277265ab SSDeep: 1536:xcGeWmB3ITHvSsUJdl8QB8GAUPLlbCpvJlg7TnmMML7yTH8c:DBDTqsUJdl8qtj5Cjm7TnmMKyT8c	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	78.62 KB	MD5: ec0388f7c46e608052ab2c205cd64f37 SHA1: d2d7f9cdf0bfc3d4c8d1be4e888b4d38013c36de SHA256: 8a691a332099012d4326e38129a684d2c83b34c4e121934014f343b623af7e34 SSDeep: 1536:C9n3714Rm/YRZyNaBnfY3eG7zhpbF5A6Sx9YP+SfCSJWBH7sj4jQ7c:ClJl/shfqX7pO9rFOUH7sPc	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.22 KB	MD5: fc8df7f0d1d4e3f7aa959dcfb0690585 SHA1: 51edd39dcb84fa8b8ac11b9293db885f1078905e SHA256: 60480d588521f997efc73d886240aeac1d5e62c3239bda208dc4c175810ce38f SSDeep: 48:CgEEBuMo5LT9twmCZjTY+GappWz28cK9oW53lp3P9vd+KtT6X1U7XHVHJkXE/jcQ:CB2cLlOJpMrc4rIKd6X18BiU/jcFmd	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.14 KB	MD5: ccc2e8a94056ccaf78da91d7120ffec1 SHA1: 5c684be9ea1f24337072f303b5cfd2cd48d85e19 SHA256: d222a1c81cb53b341d89d82f705ddaa1b3f665915478cae550794637127802b1 SSDeep: 96:H7OohDXCbHfgkix9zsuWKvDpPfKgV+kKU4umd:H7OohzCMkixpW+pPfMU4u2	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	38.37 KB	MD5: edda059f4fc9add4889e356bbaa22c07 SHA1: 393a4296be7ebca3623c7b810e990d538a97e549 SHA256: f054aaf51a08e3d7b6f955d8e84cccedadcd87d5ef020e997e26ff1c1d387aef SSDeep: 768:Mrez05BIP051Hpg7Rs5RG1ZlwJ8pF/wcTPLSw25xW2W0Fcm/xQMEoagf2fs+Xxmi:r0tHG7RsiGJ8p2St2qqZ5EoagfL+Bmi	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.99 KB	MD5: 1a1c08c8b5e73e69004fa8531b2b1b45 SHA1: 8a0d671352043e499d5e30f8fe1c24370f15e51a SHA256: 8fa616536ce6c06b092d487d753cfaea058221c1434ad2f97c5b6ba43d3daa3b SSDeep: 384:bV49Qij4jLdQ9VB/ycbEPvB5pr3jVdvjPt4xH5GqQWG66izJshF3KaOWSFgfG:bVwQkY69VQQE/prTTbPtOhG66SCK7WjO	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	78.37 KB	MD5: acfff1d4a386e052768cb4ddbcca19d7 SHA1: 498482301a07944b9403801a70b02b4e73ba3b18 SHA256: 84a36370470b857ce2c9f9432e225262b02e77e041556a0772b87112d758a6c9 SSDeep: 1536:Sg3Dr8W5CSjNJ3dhpxu2ZvOuexF9NgBomcrALO5EpoWpV9c:Sg3DrbDFBfObu3crALOepoWr9c	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	91.38 KB	MD5: 462fe07fb7d933dfae499c5b610b5ce7 SHA1: f711df920a794f7296c893b1039d9e2cf4121901 SHA256: 354f9e4e986e61919cd535465388534fd7acae34795d9675acc0e503164a72a0 SSDeep: 1536:3fFb2uI4hgNPh9QRP0l4FnbY5EFIE2Xp8FUCjWhv/yXzaPOBuoc/rc:3hqZph9iPYUnbY5Et2XKqSWhv6WP8ulc	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.77 KB	MD5: 424822b7dbfbddc8d84f61e8f41b473c SHA1: 20d2061728f61e6844dd7c85a9e2c6bd91c928a5 SHA256: d9430e135da4b626981a90e7a688b16bbff99ba2544ba6ce912f0884c6cc9f2e SSDeep: 96:XlwyzPcNHyertpK5i6FSlMZHiJDrGW3jVT5qmx:61uI6FSlMZ85TVT5qi	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	38.37 KB	MD5: aab02c0849b097be7812acec35e4be39 SHA1: 7a39050fe5c9571c0b52184f0dcd9cdb618a303c SHA256: 87d874d5a535c310f634bd63367b464ff58489dc5ab9b6fcd78b53bdf4f48aa3 SSDeep: 768:wA8pD2svejc7q2NWoz7OLTu1LU7d/7PnkjMcsQYIM1otqvrRSDlGmi:T8MqejSlWo/661oJ/LkwcTYvytqvr4GP	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	197.32 KB	MD5: 8a1e46cb4c9d38177d1201504d774b6d SHA1: fe4c02a637d61e34b92e0881ccb0a0cc10459c0b SHA256: b9b96502feee1484fe0da74a82f695fa14e4d0b5f2ce6058fb27be05a3b8d1a0 SSDeep: 6144:T0YQsJ8to3/N37VjuF0sar3SyE++j/iz68c:Qn213mArj+j/g6r	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	13.99 KB	MD5: d3effd1122f9405534e44aa679f101ff SHA1: 0fa6e2f5d6e87e198ebe3b712cae9279d30e5f06 SHA256: a6e15fc9eea295e5171c6f2b4fc5566c7c2acc93a591b964a5691f3e176189e0 SSDeep: 384:v9fyA55etF9CH4VmBwP1RXRyUF2iveW3SX44:vMsesYoBwDRLYiveWx4	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE	40.36 KB	MD5: 647637f1cbe45b6352eed560cba32301 SHA1: 4478d30f8c2415afbc156a2f92e920dbc3bccaaf SHA256: 15fc52017c14c4e4f07313d7cda5544065ed148b6783c6827e43438d7d8ccab1 SSDeep: 768:lyaNzXTkFIE7QOhhOYhNLyKG0TElTEAfJzC4I87PO8lglC6M5LBN5oG:EaNzXTkV7QOhsYrLN5Y51C4BO8f6M5LT	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE	29.65 KB	MD5: a241207ab7434615256dcc08b6dc3076 SHA1: 1b8cc1fb4fd0578696ea41640968aecf41a5e5b2 SHA256: a17799787d35f0b0ab7c271f622aa7125a170edd3ed74b6a2e06b8374bd6974e SSDeep: 384:vbVjzE+01AnMHlqQ3vYXZg8gDsXs52zwfpJE6Xp4QAsGCRBfikpFcO45wr3bq/Gp:jVz2wMF7/Yr26wD6Q3BhcjyC/q2X4	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	265.91 KB	MD5: 5957c650c91f201bb192808000b7bfa4 SHA1: 84705352247abc102649ac3be7c65ab3315dfafe SHA256: bf8a9d557f42bf6135f31d419126bdd1d032583d6518fc3b7b67684bddecaeea SSDeep: 6144:GmXcqawa2BrNKQoRzW4JwcP5gmfuPsj4ASc:GmXcUTK3ZJwcPVf2sDh	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	38.23 KB	MD5: 694a54cf04729083bf288dbd6118d1a2 SHA1: bee9ddd274b51c8d9ece7f208933b047299fbd1a SHA256: 1333a95ade9b505c9ee0eed2d79690f84f9e4058c3ada270b419003bfe0864c7 SSDeep: 768:wjEhhY5/4TGu2Oq6vkkyJ3Wk21Fdt6c/sSSprO6KHJhQezrBUqRAJKKc+M8utirZ:wYhWp1u2y8Ik2n/sS6KYenRerIi	... File Actions Show Properties Download
C:\Boot\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE	64.25 KB	MD5: 763cfb5626bdb7a9f86ea17f8ccc0748 SHA1: 58e9475ad3461ef16788232ea224423e0e8c9351 SHA256: ae6e53a214bb48f87af6f68312f446e22a22ebdf1f99df675a1ff067996cf4a3 SSDeep: 1536:X+iid51jcWLeZpxoGmE/dX9ZbB0BiC+NiUlcvNAPd1M3QlZAWKO:ViBwWa1DmE/50WSNe1M3QlZLKO	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE	101.87 KB	MD5: f4ab8343da415c9ae3f6e39e71aed02b SHA1: a3dd05b747f83729d87cac451443fcf23b5d1a3d SHA256: f8e0ab78ee9a7c93a1cde661939b2fa0d581b0ac93eff16dae5f2c6d1f61e028 SSDeep: 1536:eho1SCe4Rfii6YeiW6ujmw2SfFrBMNAnh8i/xmOpkPZNJhPDte0r1Od3lAJLk:ehPCj1rVWb72w5B3j/xmOOFttOd30Lk	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	484.27 KB	MD5: 3fc8f72046ccb4e5d2f531a17e28fe31 SHA1: 82d8cfa3cc35a9079ea0e448d2c3eea79961047b SHA256: 2aaa2c62018f5c23e47a8123ce990c034cbeb455917d9d1ecc133ec60492e343 SSDeep: 12288:/ocKWDxUXohU/UHGKCjWZy8cbGJYO/pDi0xlooMK:/oBY+jYHyH0xlooMK	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.30 KB	MD5: f806a883abeb618b4c8ba45885de7120 SHA1: df40408c50e76aeb3b2c9f8b54c9e17a5a8ae62b SHA256: 9827b7dd67bfbd01f0a4b98ba06f0865de97e934152e422550d9598609ad8e5d SSDeep: 96:5hFWGdqCwLpyiffAQPNkORXQsK6lFKNDLZdHXOumigwrZKm5:xWGdRwLM+CORgo+lddpmJ9K	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.93 KB	MD5: 8de81639195203795112f2247d7cb78a SHA1: 121503ab644acc8bc988b2b914c3ad3c478ae8de SHA256: 2c2554f252bafd0b9b8ff5882bc7eaf2fc6fe01d3e10269a3abeae12d1f88363 SSDeep: 96:5htXDK7NVhAk2SO3kRawXH3ydzY/cpoxuxd6MBCczaRetjK3uHDWuJKm9:7tXoEk1OAa20z+goET6d8jKcDnJKW	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.62 KB	MD5: eea9c06531d22b0eaccf23cdd6692a96 SHA1: fe381a24c8ca777db067a66aed516b4a2f93182b SHA256: 71eb5b7ed603a96b266dcee6ff12203251daaa5da707aeebc2361627fb7d9d1a SSDeep: 96:DUJGmNAqU8XbbmNwJPr6QpFU1VMyUFZWBS7zKscdjxmR:DhnYX9Zr6+F8BG4w7zKbdjxC	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	92.75 KB	MD5: afb48211174d5b0b7504d9ffa544736b SHA1: d446ae87192c542729bc58838719987616c0970c SHA256: 55fb993f6986715434d243b38fa0f4a0980d0c2eec7d7da0cb69338b395df517 SSDeep: 1536:PjBd7YEESmku+PAo+Uq8Xh0kEmt2K6UGVX5teZN0D8tWy6I:DEnx9N8R0u4dUGVX5t9gtEI	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	180.75 KB	MD5: b9ee823dc7f493dbc4aab97043113065 SHA1: 0eafa4a197905d669203354f11802afc7ca142c9 SHA256: ac089f01311177e50dd2d3481cbfc3b5d3bbf0127d6e4d8b0024d201681b29a5 SSDeep: 3072:FJGrTcLFpWX8LuTW6yYu0mMK7214ds8+1+jOt1Dj9NkQxUS9sQzDWE67QHs92V+r:CHEpGxW69mMK72O+Uj+39NLT/zK7ImZ5	... File Actions Show Properties Download
C:\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.25 KB	MD5: 1ac184bcf965e18f6d0ae3c5d8a56048 SHA1: d6645cfc6c46d0aeb7390cd4327b2072f064ead2 SHA256: 97a1d719dfa5927454293e04922b1883c2c2f8c7e4c368fb3cd6663abb857a69 SSDeep: 192:8GDJYvWcmnuJBen/dKlLokx2yYxX/sjHxhUQXhW1tcfXHO:t0tmuben18LokEyYN/sjHb7hotcf3O	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	788.58 KB	MD5: 2a63238a0e23ae9f4197b5774ba88950 SHA1: 75a8c23653d9b832301e382167fd11edb70d23d6 SHA256: 7a3c944b964410f938f593e88fb4ebf3400b3ff1ef943f5e586592096106eb52 SSDeep: 24576:98RFB1PpwAelKL4jEMCsnmwB3zkwmikBVd0SG:CFnBolKLKb1BDkwmdd0SG	... File Actions Show Properties Download
C:\588bce7c90097ed212\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	76.55 KB	MD5: 7e9acbe30f04ca836c49f2a8f8bedfdc SHA1: 209a8fbebd1cf2e56d9e2a8a18cf6ab438fa9fdd SHA256: 30a7202c5e9548e89199bbd815b6273ce7f4c0deeb2e997a80262d3d59b37e4c SSDeep: 1536:BkcmP44fMTsfL5OcLyxOH6nt/D4ogo9vbOjoD31c7VpAPtZKGFybQtPS:BkTPjoD+6nGogGHL1c7VpAVZKGcp	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	94.08 KB	MD5: bc542454ce1f90e131b58eea8bef4096 SHA1: 3ee530c60a321e90c173edeacd5a7ae3043a55b6 SHA256: 9b601a4120ecb50be042462f3776c5b698e687212904e5b9494d8b38b2388701 SSDeep: 1536:79nE1ah3KexJdtXFGX/ipsOfvvOL0KVKKiNiw2QeEVwwBBzqCR1fKoI+mu:RaMKexxXFGPipsO/OL0KViNCbEVwQBOu	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	288.57 KB	MD5: 8715042225a4edbacd8d075d2cb2944f SHA1: 868cc6455326e332b88fd8f607aa75835c31b153 SHA256: 0a8a74c2f57c8d20645bf2d3e787e6f1fffa376eb62855c9276168b4b9c44226 SSDeep: 6144:LHCzPT6J1gRIc1I/eF7mtPoTyBcC2lXLYlVsht/fNyB2FYF426E/:LiTT61cW/eRBMcCESahN1lA4hE/	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.61 MB	MD5: 8698c490ee1d6226d94ff39a0ce1bdca SHA1: 0488a612867702eabf9b8997208a546b41bbd92e SHA256: d7a3e6c193acad1a81b1066836d2c5e8b25bac65453b8b437a326cfdf7b25090 SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6BV3548tpyKhdCr:27GBHTK8KXZ4UuY1kB1iKFKAV3icwr	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.71 MB	MD5: 65a2b63d7f9f71f09230f0fe435688b7 SHA1: ac9d6ecf5a2cff00c6a071cb48b3243f47bd5567 SHA256: 76d78a2d14d4664f037ee4fc4e7cf790bdf3a89578facee0178603e3ade4e5be SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKWcnGFZ0kn:e3PBkOK2Knq45mY4H5OMKkKW2GF+kn	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.84 MB	MD5: bf40003224c33a4b1d19a6f9afafbb01 SHA1: d88491a86cf24bb60d6c843a321482297e1ddc17 SHA256: ba4c08b8c6b2d193cdbdcf40867b2581422df897980b4849f1354a18084a1b5d SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIK6wHwczkVs3EU0:WV4Yab1PAdXZzKUYxs3pKZnK6w+VTV	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.79 MB	MD5: 14cbb40594ca929bc3e5b417dd04d39c SHA1: 1c308d5d79dfc4305560d21ad38f49437c7ec0c5 SHA256: 4e11387165e95b283d74d72f6d6bfd3d3d69ebf36e3ba749ad81e00bac49b5ff SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhK62KLHCbwcETm6:oJbGnRau84KUYcs31KfFK6Vib+b	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.62 KB	MD5: 08d2efb84bf537e708d9edd2a641ba55 SHA1: 8c818bc145accf4410ce9debc43b8ecf97c1d1e1 SHA256: 6144a76334a1bd4bff63745ef3d337302b68708d64bc6cced615b99883a82084 SSDeep: 192:Tb1zqUOSW6zylqu7dmomixdhKuyiUEcDfmnn6I0i:3Jpy770qVNUTDfmn6I0i	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.15 KB	MD5: 368c4c236f143950ccf3417c13a4551f SHA1: 867ec7142c6c75387fbb7a337935a2f82f5f9085 SHA256: 9a01d3df2186b7629d58c4eb03e0ef861d7ce832372fb603bb99efa2353048ab SSDeep: 384:LH0FYh5yK9ksH2NAD5Axzo95U2LqDjyjo6GPj8ZnxTit8ByAjsa1k:LUF25pJBdAxzg55Am0jPj8Zx1pjssk	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.87 KB	MD5: b1b443514c4d96f7c1eb2568a027f9e1 SHA1: 2c31aac963f97f4f5ec10a59e2de6902c4ab3541 SHA256: 7c12b92fe51a0b0f19ec2bc76548b41f0812e9063ccb0433bd29b38abe000ab9 SSDeep: 192:nzAKAmRYZg1cpAStcyA+zldBlCvOeIuy41HTpq+vrIgTTkDsz9Q4c:nzJABg1qAStc4ldzCvOe3zweIc9Q4c	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.62 KB	MD5: b941b28eab4a794b057a8ed8b1040969 SHA1: ff27451f51afff2af82614de70e4dd6d10969873 SHA256: 653d45d0de99d25df6175b30164d341c92ae1be07cad23f76811394718cc4c2c SSDeep: 24:f8S/KFhapqi/0Trx8aUMNDUpVlkeBJekYqxR/WjEaRmu:x/4hapUTN/UMNDUpgen4CFmx	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	12.21 KB	MD5: eeafa76da76779699c6093c1aab1a0c7 SHA1: 36a02762ad849a076577baebaa3ba57ae89d3f90 SHA256: 65785fa789a3bf94a7c73921cef0476f4427de56f9dc3c86a56744b6f75a06d6 SSDeep: 192:GrvA1WslN86zu77x2WcfDAqa0nqKcIQsvzgLrW05Q7o1O484VxK+YC9Tx9e:GTxslXzu77EfO0nqpB8zkeo13/lV9TXe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.41 KB	MD5: a2d7578a4a509ad4ec275b7c55dc2145 SHA1: 82a0dc1a8c481069876fda0b9f02362210c837cc SHA256: 0137af084cdead8d353e2fd92edd3bd0a7e4f005395ebdedcdb31b0408b76291 SSDeep: 12:i+ZrjYWhF9CjMM4030b5f1QUibWjEp0Rl8N6:3j7hSjMZfaWjEaRm4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.41 KB	MD5: c38af795a1b0939701965394f5753fe2 SHA1: 227a0621eb594f5cd8463bfc9e937f5607fea295 SHA256: 6c2f90e0544b7a53607672477efc56068b798a895407b4245b8509a855ba79dd SSDeep: 6:GIW3PAyeDe+IrhDJkDKhnJIjixlKp3SnOClPpjS0mbUdjE28PBR0l2q/l8Nc8m3H:GbXVrhDIitns3qf1SbWjEp0Rl8NO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.41 KB	MD5: 96dc4992a3c87e08507afcba503ada2d SHA1: b5f5fa3ece4ecc0ee4fdddef02a54a656ab27a19 SHA256: c620f7e60db6729da8dde7688b3476c0e70cb9e17ec463cb54a6d1f37c61c485 SSDeep: 12:h6axyxQG8vqChx83vT5f1XobWjEp0Rl8N6:hFy+vq9fKWjEaRm4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.41 KB	MD5: 009624ecbc0f6f3348b576aafece9a79 SHA1: 572208917373d28292faa2d1aca6d9117f07db34 SHA256: 8d09cba369fc1e0dd98d247d6879ff57bb3ffb70147a197e68877d90990d68e2 SSDeep: 12:ciws3rsisSX5/S6oTVs3H5f158xbWjEp0Rl8N6:Nws3rsisSXVJRf2RWjEaRm4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.42 KB	MD5: b087b8398bc3267273ae08e228a8d52c SHA1: 3649727bea957c087e8bc9b16901801948cef7a4 SHA256: ba3bab424fc759d01e9dabbfe4d50304ecd2faf2ac3f0fa03e96d6a44d25e12d SSDeep: 12:sg7exLxKu5KHQ8mWVuuWirvoWS30af1IocbWjEp0Rl8NO:sgir6MYuuxLmmWjEaRmk	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.42 KB	MD5: d1629232ab6373023530c741694433d1 SHA1: 3393ed50156ee741fc4f3f3b0671a98e8de1424e SHA256: a9f4d4d24e2955e70f6bd0afc57bc2981f5f834ff2cb7dc20b4431cc9be467e8 SSDeep: 12:Ynm5520SbB2NQohs3Of1AxJll12bWjEp0Rl8NO:Ym5520SbAGo3AD/18WjEaRmk	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE	103.25 KB	MD5: 537f3f1024b3d917858b9617c83b7d40 SHA1: dd1381c2087fabe7783609c695213c951fa92f50 SHA256: 293a45709daadd4396e9d9d73e17bcb073003f4a0bee53ef0403f49f8db25575 SSDeep: 3072:/hjGDa9ndNQBtq39z+nCbKLZ9mab1yhgK2ltjNbl2:/H9AtiV+nQKLZ9m/X2lthl2	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.27 KB	MD5: 73d7cdccf515de65443fd6e853f799ae SHA1: 8ec431c35829aed56aa60ee95766720941123d55 SHA256: 6a96d56bda6e720d8e68070ac79a06bedc64eb22cba0c70fe8545f607a5c4bae SSDeep: 6:cT5/BSP9vUUprSpjQnK3ElabUdjE28PBR0l2q/l8Nc8m397:cFcvLe1yK0QbWjEp0Rl8NE	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE	62.71 KB	MD5: f4fe5b019c7b38d5595c9e1ccba673ce SHA1: 7aa0ad66e306a1ec71763cdbf3cdbd5493630bdb SHA256: d5ab50d209fa70e4a2561042c1fec27c2aec55d747d48cecb1ceb1278c9a9c16 SSDeep: 1536:RbcPRlademj9oWRWHHQTwL5+miPALpsPg+lelVpcCDsGlK0oS:6PCPj9oWoQmoBPAVT+QBbDsGlKJS	... File Actions Show Properties Download
C:\Logs\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.25 KB	MD5: 5a52894d8eb4ba890773708c2bd8f39f SHA1: 5b73fd1bd7b1aae9e1fb19d2a0e9d36282b297c1 SHA256: ce1a8a3073c615c430b7bd14d7b0c746ab21896cd09e829e0c1c4e013bfed9cf SSDeep: 1536:VZbnOKooPLFgXrpXPSZPUEQHcnCRo83ym3zGhMuBiyJg5CUNwLJdFQ:VNOfoPLKXF/SZPUhHRi8NjSVgo/ldG	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.26 KB	MD5: 825b82dd0e906e9b3b5ad37d34011879 SHA1: f59c06138600cd5e7edce2d7846814be31a1cbe1 SHA256: 7b970835bfb5ffaeec0d9a3d197f5dd07f77174100fc6d69f52bcb819668d516 SSDeep: 1536:ECxXorTc76JcIX7a0BDKcLXNo0xd7A3lmzBKHAe6FmTX0:EC6UulHbJo0xd7A3fHA3Fs0	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.28 KB	MD5: 1f93d1f52a1eba04fc2a58623353d6b2 SHA1: 9261cfe4c41c3aab334823828be1e4605d68b9d3 SHA256: a3bd6856bcfa6540e5baab0a287a48ebe13cb77f2099b9b8338a8f0e3f24f1a8 SSDeep: 1536:4UkxHCMN9/SpK0fWBRJpPYzQN3hP6MCzqkqm+x:4XHRNEpvWBRJEYp2s	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.37 KB	MD5: 0bdc530a0093dda4a221b56faccca0e0 SHA1: f17793a2b8bb7e19a87069b852c218bb649efce5 SHA256: db6d44f913b298066fdbcae4832dcfbc36fa22b16eeb642ed2ae1e673476756a SSDeep: 96:R7PYfHneKa5ibyeU6D2yVmPcNmRtGqNSsJI739Wumz:R7PsHa5BeUg2aL0tqiIL9Wuk	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.27 KB	MD5: 9d42545d581ad1032cded911a029ea75 SHA1: 76d6c73f45178a453fead73720bd382c9e6fef50 SHA256: 80418889dff61269ae3fac802d272ac2ef6c3f077f4c0b418c3207103a0a562c SSDeep: 1536:JVfztkW5lX+8QQJGaKeV7IoLJkQmTDR4U8C0K666djDBpvNNOJhoY1ZnnV:JVfzVlJJJGanHLJkxTDRMK6Rdj3GSYLV	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: af60c36be3c4fc45149c3a276c3ebed3 SHA1: 36f621c59cefabd2dafe839c72226039fc62ee66 SHA256: fc1a142e65aaf9b733b9a3b3adf40ccf8de551367cd93c72138d3a94ca96be9b SSDeep: 1536:8o5iJwfsC6U4Ixhmi249Y+gFt94bfpXZNjGb7U1:8oKwfsC4Ihmj49AFtubdfQ74	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.17 KB	MD5: b1ba4c3309ae6b430470ddcb48bbc89d SHA1: e2d8980d734deef2bb6e3c3a293bfb9dfacb87c1 SHA256: 07035a1e6ed6322779c63a01b5ba9b521c993fb7e33c1809dcfc22177571ee17 SSDeep: 24:zYYLR618AvIdYUdYhCdMk87ij8zSpq2/i3s5/WjEaRmC:n3kzhC657teqam1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.38 KB	MD5: 01830b0de1d8fd51b02477a843d0d872 SHA1: 997a01f46dc82994c24c9ca0e9bd2c66365ffaa8 SHA256: 65f8e7636a5a8f94726e8be1f46db04b4056ee54eb97f56a579e5784fed73443 SSDeep: 1536:CWQ0OsVmSvjwYQCfjh5Ep8wBt+CszZeWcRO74FL6/GY:CWQ0ng6wYhY7tiHc9SZ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 1a151bc11f536a0074c39639c7e2d31e SHA1: f0f1a13cde1711965512378b4ddc9e31403fe7ae SHA256: 1a76b7dcabeeb34da4aa74d9cbbcdbbc3cbf6bc3b91ddc48e5d0b810e619fef1 SSDeep: 1536:tzfKBY+0mdXLndJ0dSs81b4tml+pjAc0y9s6kXs:tDKBJ0m5ZJ04P8i80ymQ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.53 KB	MD5: a3825644bbaf68f702f7bd2815cfb117 SHA1: 6baec887201af329c25eb72519a7337844648bf2 SHA256: bce72ce9edcaba28727c443a3104b60c5f86ee042f87f287877203c395435188 SSDeep: 12:0owU2spifza6BuJlKEfv0GlETCcaAdjc1jIRW1JiAbWjEp0Rl8N8:0Lv9f5BMJ3WTJDKkWHWjEaRmm	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE	142.04 KB	MD5: 91bc3c7129f4464d2f01f9dab222c947 SHA1: 2edfbebb1f82d1a74585edca38f9c04f5b59b546 SHA256: 5adfdbc04f8ff2635569759af10cec32098b163bbcf3c932d76b02e6f12c3f1c SSDeep: 3072:wXmeYY98JHpSJwRmb1IDST+99SD0RJ/g4eGnMEReooZZgV34tRY:wXmq9mRmhIDM29X1pMERepZgVKY	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: c4fea7f3bc0d83572f38c9df9cf8e420 SHA1: 2173ae4fdebc3243743f6557cf4767c836fa84f4 SHA256: 145e9223aa3e1d65879b956ac9f35b41ce917cecb285d8507af14e34e802ae74 SSDeep: 1536:yfxAtYMe+b1sibq9nqCph0X33d/qYRg9gTXcwCBKFwUWywzh:IG5eYhqnh0X33I9KXcwFWyI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE	92.49 KB	MD5: 69603bc105c9882f2cf2ccd572c5c619 SHA1: 73a563a38477b05dec9658485a274e07111c5fb1 SHA256: 5c3a541f64f7b320e72eabb59e4e1af7afed9dde6200847d3521bf0d432f5f5a SSDeep: 1536:NS8lEEsgmZQkew39GCe2wi6GKV0MKHfdyDAkqvM3FdC6yoddCNUiGV2k1SeD70Jb:c6d2avT5AQ0fHfrMNy2Yin2CN3H2	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: f1b38bcb7a5b2feedebf0da9876e1ed6 SHA1: 7f5ec22b1a392e7ee181f3ebd5cb5a9661d0858e SHA256: 607a0a11fcc7f487e88fdec8f53aef961382a2acc57d5a228c400d2a7773c34b SSDeep: 1536:cDzeQsXOySNWSqebPLRJ3z7MOqAKTMapPSvh9izx:0yQdD80nRqAOHKvfizx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE	170.68 KB	MD5: 00f4bbb5e528ffc52e849d9af04f46f4 SHA1: d1f7760f11237250c228cd6a9cb2a42d77d01557 SHA256: 4d39b310bc93661ebecea542728bb0c36a063546094cd81d3312a64f66f98574 SSDeep: 3072:5ASS1yhBi9vR3+1mhXovDDXEDcz5GzJFwy54a4xOKcNh3DZjmlF4QzI+U+pih7Jl:589v0hIcCwy54ahbhz9AFlI+UZJQfWxR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE	35.73 KB	MD5: 73eb515fdcb737cfa72741b227c2d35d SHA1: dfe7e7951960dd8f0c5f8af7169b41eb8fc7dee1 SHA256: 89e4d2d4d1e89a1a4b461365731cfe6e0a3207a13c333711d18111bfb0d4d892 SSDeep: 768:UmGN+RiUIOgTbyjJR5qQ1UAPaL9b8KyKMFjlsA8n4:XviUcTb0JR5jUTLtyKMFK4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.81 KB	MD5: c4d41803116046e4309987ae8172d3f0 SHA1: 7b9fb5f2ce889b3d0b84772031a6efb610b689cb SHA256: 1779630128f08f93c045c519c836d7b064e4a395e281f5ccd799c4bb25d72e76 SSDeep: 48:CIojz87OFfnlrg9L7lx4d6+sP5Jx4WMYEzX4W4Bmj:CIVqvZgxH4d6+sXffEzdcmj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: af6bbbce2e3c9a691b46be1865a95fe4 SHA1: ff229f93c6344828ed14752c5b5a4381ff529119 SHA256: 65eaa5a6d4654f256bda0bb8fbf8ff09e78566f23b3842e35680e20b96dd036e SSDeep: 1536:p5/lWTB2SEeHy4ynrewi/cBOjIFJK3auDRInco7wldaZ9MZ:p1MBNgrbYcYjI63auDqncgwdumZ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	378.59 KB	MD5: 64853f977a8cf89f5141a30b3cbca473 SHA1: e55cdd726ac6ea478751fdbb681542cb251c31cf SHA256: e3ad7dd508fda319b6d7ece784ab783b085070ea9a3babfe72e450cbda410af5 SSDeep: 6144:KwOMM2Y/WhqYE1HIid6fxNw2VyGrojRVchDLqg8e512clAjXtCgU8D1ziPvcrBCT:7Ot/pYE1H1d6fnwupojRUvL5wd9TU8p2	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: dcec0945c3ab051841f8dd04a026fc61 SHA1: f048243cb43d1dfe0b927cdd2cb0410e84d035dd SHA256: 7893855284e96d4bda422b8cd2b7b89a56a43cb8ffe34e2ebb91a5096fe41851 SSDeep: 1536:POF0GmG3aWixmO618M2hzTTjtzTxcEimyx+gp8tot/9u2oWbEX8+y:PWx3IW8M2FTTjtze5m459uWEX8+y	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 74c1cb3f11d58cb02a282a671e9a9b58 SHA1: 62a4d3b8a71597f506efb0fd6434304815159d49 SHA256: f63c84fcc5ffeabc90d4af4e5115d81c11d197f33fae70b8d34de888819114f7 SSDeep: 768:yAJwAv+JI+JO+Qn2fGz9ad9mGMGmxcpz4rO62eBuCi1Ov/kvIz7v/h/rJiYjJZXN:upJlfGzGVR0z75BuCT/DDdvK37Sx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	782.42 KB	MD5: 6af17034ca24ac5e971af54c71ef8e05 SHA1: 98cfb631dd734b64528554094b9ed599baba62c3 SHA256: 64589537af5640bf829f527943b83166400d9c83f98099a92c00e8a284dfad11 SSDeep: 24576:ZiP0yfUysrId4qbApRAmMGNtfKo+nN9SUM8sF3:ZiMEBbmLV2xvM8sF3	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: bacb887baaf2f68f3c3a5712bbcc556b SHA1: d9bb5f9e46df6b1f784e9e922dbc3f5a84e65a4a SHA256: defd57696c61bb14d02db36c58dd62d622fa5122cde6706f63f054d48bf90d07 SSDeep: 48:JIy0ag7kQ6lB0Gq1HBPDQ5ZVc7EQ9FC7SMmj:CragYQ6leGq1Hx05U7E4tMmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	485.20 KB	MD5: a57959b79df534e74843e9a929b4b164 SHA1: a16ac96f56b0463653aa6d86f503afeb1ba56202 SHA256: 7cdc92bf499caa6d47c50c8202460dcb935bf0beb6bbeed46e1da4251c70293e SSDeep: 12288:FNb5J4RsLCfSofJDey293zA6I35YHOMiYnUK:rzGfR0389OH6xK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: a71ce97d1bce3de65388a5ee31e7df37 SHA1: a604e56760c81dbf2682634167f01ba23169ba1e SHA256: 7e10a17011d736f815789ebfbabf3ab892caf2212486cec9f9054cb3fa510394 SSDeep: 24:j5wD02I1ksAQdnJiscIeYLugR50JWCiOgOUurd1IIxCmzGNtLrCadpAMCAWjEaR1:j5zkRQuscIeYL/yiDOxd1TCbvGadpRmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.42 MB	MD5: 92f64dc4e39f363fa0e81b865439b827 SHA1: 5da4a4fa0f1903ce174969566502ea954033facf SHA256: ea0b5b27039dec060146f3bb2f6dcaf4a8225b721c78b7ab1c68d0ea5690d6a8 SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNSl:5qk3NIX3NIIa9O8k0myBLJf03NqJIeW	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: 601114a6580a5f4940904770ef06a288 SHA1: 510f4e8674de2202bbbe1dadd8e091a75d50e9c9 SHA256: 720209714bbf82767ff9df936e4fd464eeb2bd86223c81be51b0097549a0bf15 SSDeep: 24576:bRODWR0Ca0ORmP4Jc/VXy90zp74/ZMbOzqXDSN9v:gWR0Ca0O8P0c/VC9LMbOzIS3v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.07 MB	MD5: 747cfe6b3891a6bbfb2e758f3bbeb4bf SHA1: 7116e10b8e23b1251afca3699b11499f14c0e64a SHA256: ba42fc664765e6e9df86e54f285e259c6fc3eff5cc9bba147259953e5f8f6122 SSDeep: 24576:zKKpqF+I+2Dztp5h2ktQJIT2N2EUzodXvR:Dp++ApKWT2N2ABR	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: ade4c91e9c7c1b03692573bfdbed87ef SHA1: ec8819cf12b145215e485c7eb4fd3bb6cb583283 SHA256: 612bbb2cbb3024c8aad664e2dc46e2fa2c4cd5c52fac0784bb0bf6ebde0d9ef3 SSDeep: 1536:QYGRsJ2+2TpcQAeZUSv5qLkYMAen8FwHWo6H6sWou:QYGRsl2TxZUSv5qLkZAen6w2TxBu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.82 MB	MD5: 2a5cf5120ecf4ae3da74b914980e173b SHA1: eeb176d5ae9d3f6a13b6be1c4d3fe3a4611c6f7b SHA256: a785c3ed31df1739c10f8b3f271ebfe96468f3689b9c0b2881c016e7103fad72 SSDeep: 12288:2KdlDRq4y0WsT19/Onm4/GpK9sWh9HhYeSLZFcLfGJMdGnMpn3Zzl3edAZG90:PA4y0WaX4EKfThbwZFSGM8MRdlEyGm	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 3c48e9f3660d1928b30b2edda3d32a11 SHA1: 67a77d35ed4383ac997ab0db8528f2e9bc67349e SHA256: 7a84002c73c174de4c23f2e5d4106ddba515b5ae558cec3bbf25b9c07b27e926 SSDeep: 1536:m2Lhzdr4+SXZDWPCzDzjXH8Aa4miHcNL7GYU/EGoBT6p8vj5Z:zld8+SFWPuzjXcAP/cNL7VUcGo0CFZ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.35 KB	MD5: a2b85c591adaf36e3342c24daea10eec SHA1: 656023bbc1ad71c59828ca6d79d0cf1ad6a2c25a SHA256: 48987d9b2653d650c5827a0dde6754da69f067afe67be43950279bfd6f8779a0 SSDeep: 1536:MXiM9ZwWyYvg5SMtkd3TkeoqxRF09miIKG:uyYvgPk1k0RK9jI1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: e13092f8aaf8284c14465f3d55551fba SHA1: 0ae28479d7ace8d3575be57416a6b6450de0061f SHA256: 826382770e3cedd2d6e6cb81943786d0741acd72e4298cf959a78c4aaef39541 SSDeep: 1536:IIgVMBy49JDn2QGBM8mlR0TAmhgrTKztU1l:r4mWPokGrvD	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.35 KB	MD5: 541f64e6cb300c182ca56404963b01a1 SHA1: b0a42ea383630705bdc5b2c20ad26ed25a7e4288 SHA256: 197ce4587bd39f1a0a13e9b130c26c941d46d4ee0714e5635ad0b3efb76d7c6c SSDeep: 1536:RfLLzQnscKgzR/GFGtLYIM/E2JyShhQM4Ts7GFNVm:RPzQigzR/OeHM/pJzzZkNw	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: f6653d392afc1ca61e0df10f359944b5 SHA1: aa3d99aad5209a35c03d23b1dd95a45b50ce7969 SHA256: c885b4c215bc3705dd75d8937927c138adfca5327d0647b2272d06781b2b973b SSDeep: 1536:JF/9iCa8yqETUtRLJ4jpyr6lIVTTJY6VUE0GejaWv4ZWti6elj:USEwUyrXTTJheGehi	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 18149ae91fa4e92ac4bd450ba73d16eb SHA1: 5fa71f81bdcc24ede41940598505abc61a2918c4 SHA256: 6cc4a5298d1fef9c961e4953123ee9f4a4983aec7c0f95f8d7e741cd43b71889 SSDeep: 1536:cQnJgMpyhtOOWv93FU9cUPGUH7109o5S2Ww2aBCkULZjnVk:pgMwOOII9cUPGW7xU232sCkYk	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: d8ccb957970f5976487278d4fa4eba29 SHA1: 771867478d5d3238b99a7eedfe26db4c48028390 SHA256: 0756fd519f71229764142f8b84169f0632d3aa3a7903d27aae9b97a907b83007 SSDeep: 1536:tbhLs6DlAslHngbaHvOU9sgncM/T00aT4a+c6lgbZhU4l:DLvas9g2ZsgncM40a+nChU4l	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: d74288833d8b9359a5b3817d25a76269 SHA1: 59793234fa7ebb68c558a5fef5d0c01d02b18845 SHA256: 74a4ac0a4949982070026f50bee1e6ab1d6ee1c6377c90f296fab7c830497bbf SSDeep: 1536:SR61v08lEsdB089sH3LhpXkqkX3gmdANZyrwTRSeWEIlYnDt:Sa08lEqB3sXLfwHgmdw82sdReZ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 83ff72b87b912a23ab357eb4b4a19b93 SHA1: 905487dce5dd959ed17fcadc61db28aa2c57c601 SHA256: df0890d759554583a214a8a352727d9d7aecdedc56475cb324a32a9cdd8f5ec7 SSDeep: 1536:7tuyprDgQXMRbnJX/RoDyvyEnj+OLj1nlATRWHsjuBAc:Uyrchnbznj+mj1nlk/uyc	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 7a8451701a137faab1999bebc7af47cb SHA1: 5879a18a5d6e0e8ae5ee1cd1a83018882475a53a SHA256: 4983437b8c75985a401636b4a0c5b4971c0e960a2184c83dc4c522fe578d264c SSDeep: 1536:K0lRxK6tjpGxUtAEVwtHm3gA11nuqLLrUXqv:HBtlwtHPsnRL/U6v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.07 MB	MD5: ab7cc5dba80a62864a6bd9bce190c678 SHA1: 6c372bfb0a238ab36c8459374fbebf1d5faa9706 SHA256: 7cecdae97348fba84d509a507aea481242b64dc434dd3526f5c1697cb43aee02 SSDeep: 24576:Qrs/nwP+6LuosCJ1pKIcuydwVxBktkooVf8knCDrOLtX4kLz1:H/nwP+6Lufk/KIpy+z/o2nnCDmtDLz1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	248.09 KB	MD5: c108f967e7a2a19dd6ffdc2ae904bfeb SHA1: 0911a7796c2a51adcbf08cf624e501496719ed7c SHA256: 3165e6cee376f8cbeb44c237cd0b6113c1f9300fd0ee71b65105928011a411f5 SSDeep: 6144:ICs0zX1qhtxvllGLEe9rjpVlY1C0BUBEQf1WCZkHY+Xg0:ZnFq3pMEe7n4lEEQfHkd	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.31 KB	MD5: cec3c8c9fb4cd8325636662b3221bcde SHA1: 9a5b5e6285d10b5119c5cbadaf590dbdf8bd6eef SHA256: f4eb6a47fae479deb02d32ee0e92d2ed650ff21405c8354ab18fde6511e432ad SSDeep: 384:1bTCuTKy0TluvW3jpCbKScrAkilNcK2lLpC0tK0rqGnpR/2rLDyVnJWy0:xC8Z0Tugjpk9lN1kLg0s0GqRsDyt0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 46e1f4fbbd4a3d3e60b1aa029e3e2925 SHA1: ed693d07979acace79f1655d468793f6675843f3 SHA256: d5690ca0b6ec611fd41c5a48fdd885d15fce77944a2d26b4404b6fb6d5ccf302 SSDeep: 48:xSCA5VdgIcgUvV8jsoePFJlf2J1l7zK2QRmj:xSN4wePFCJ1l7zYmj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: a58ed5c9c73918ce12d2c6a2bc336b2e SHA1: f4cdc0ca42189f817f9673beb434ae4812577c56 SHA256: fd31a6ab519fe5e1870b6423115e479115bd239bd74d30fb68fdbed9a8ceffe7 SSDeep: 1536:GvwzZNZ4Cj0hXlr+kx0St5ZVmI9xQTlXuBIKDKfPAJzg0p:Goz/0nVSSt5ZVmKxdJ6uRp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: f9c7cd125244de786d7a440f9979d37e SHA1: 3e2a56564784bd39ffa49cb72bf6e1fd2fc0170d SHA256: 575d6d1c7af7b9b9ac5c73a4895c3f421b956d6788184e890f1f9936ebb035a7 SSDeep: 24:MDxq8kRMQBtWg0ZO6rK84G4a0/DaX/S0j+b3WNV8qaG6K6yv8vfWjEaRmQ:kxq7TTuOcFPEDaPS0jO3K8qaG6JTfmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 247dd8f5e634b286aefa664dbf3eb64e SHA1: d25685e693aec0b2fa0d75ff7367ae55c4d39a44 SHA256: e0e99c3a67d4ba225965d020092bb110eaa1db8254c22bf958f1f14178fa55b5 SSDeep: 24:p+B6BV8PfGrlS1hVl5gNkflk/xBvEGgJPiFgpUjyiwJ86i2zvme0foQWjEaRmQ:pc6T4H1l5akfloMG6iFgriwJ8QvPymj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.42 KB	MD5: f7bef812b9e0ac78ac268a10c5421535 SHA1: 29a40752971ce209d72e8ff965d68584563689a4 SHA256: 13a898125ba18199292516e37bd3f461fb9c4df70249ac885cf1a7950afffa36 SSDeep: 48:pBE/qgR+AX2M7aYqqe5sisf5J03+6PHdBAt3+tl66Zfcmj:kBRKQaYqpsi82u8HMJMlgmj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 0525fb2dfd9a5c5e63b8676aa9be3fc4 SHA1: 6c70447ebd2f30a8f749f77dfc5e01820bcb792d SHA256: 8e06581b8badec69ee677da258e076ce6ada4212f8a40501322c0f51d6dd9320 SSDeep: 1536:RO+11UPjXfMNTMsIqy4tI+sJuWfeQ+D8NBnbi4Stbz0KNgYA:wu1UPjGM0I+6uWfv9bijbz0ygh	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: a6d74fc4c360c86d08b5922f49b692e7 SHA1: 25f08463e45ec5ec5a4220076de10e22b29078c9 SHA256: 55c2e602b3a20b448c12b704082fa1d8da368b74a4e4c1339d9b425c1753bd75 SSDeep: 24:9cJGy58xJmog65R9cQa1Z0km+Xi2Vc9u0hwOljiWb8x7Pi9XelI2qcdWjEaRmQ:9cOmog65R9PyZ0kmMy9luCNuFIydmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	211.14 KB	MD5: 2bcc482ed84efad27744b6ce9a989d23 SHA1: 2aff82573f825511fb80ce30c367621e5a22d116 SHA256: d2317657574fe5b7382d5fa006a09bb09387ee7534614af9c6cc0d1069178848 SSDeep: 3072:9pF/BbLEso9wAaZAJ/sdVtgdAobjybEYSQXyEdwwjj46YRiHoJJKYgdaDJozh00/:YkAak9d1abELRawO4lKYythWT0290	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 8df45d3c6ed1400fec251c11c6dab4b9 SHA1: 29cb4d28f387526f770df6c99c8be8f3c5f5ba69 SHA256: 55d849511dfbc387b18870c471582da3611c78c0df95c9bb94935228817ea968 SSDeep: 1536:JEAO0r7q7fYjKm1d2Z2f+3Av+FK2QRVr7:JEMqnm1ds6nXj7	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 062b29fd7f4260bfbabfbb75107f8f17 SHA1: e06984c9c041dd9a7c4134de7235533a934b4e93 SHA256: 06eb8931930ff2234fd6313307739666e41d2c0622e7d4d1ff5024b697b3bcc9 SSDeep: 48:mLhqIIuca9UNw9cI/LSMI7hkx8oXDn0WCb4Rmj:mLh2Q/LTICyoX1Cbymj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	335.61 KB	MD5: 6e6f59b4f26408c902c0f8261636515b SHA1: a11402b538196df87394f0a507a83f6389d4a1f1 SHA256: 5f0540eadfb92076bb3fe87d02bb68c8736683d246b770c27876cc8ba78e2f6d SSDeep: 6144:LqA5ypSoeNp8wJ7uVvDK1LZX+5BsMQ73/0IxuRVWrMlr0rhLyVtCtlJp+2O0:UmX16Vv21p/02u/WBkVctlqg	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE	41.88 MB	MD5: b790da90d0c6c3db2d470430d72b0adf SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166 SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578 SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.89 KB	MD5: bfff253345225c020b69dbe2da6fe53a SHA1: 4461d5ec91126b3f365c5a512e932eb5b1c568e6 SHA256: d51fd9f517ea3d74426277d32e6cd472eddcd46bd92e844d01ef3e557d42da0b SSDeep: 384:7SUYM63n9mM16hLZECXZ1fPOwAMwkCnVnBqV0:7Z41a1fmw03VBk0	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 5d5c40adb3973a76ac2bd78af92a6580 SHA1: 62479193711c430ee7e0ab3e00d8302a653457bf SHA256: 662c410710074899d90abe4d5812b893a1da2427758226f02938ad2bdc1df298 SSDeep: 1536:VGCuUsfH1fWMm9DJzctYXgCA19nNJq/BvbvFbQzF/coEJa2nKVzKHdcGEQM:VGCuUsNfI9lgtgTq9nNJq/BrJCFkVao0	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 30f80661423d0543db46a9c7ee8201a8 SHA1: cf544c3eed445944057ef5de223bbc231f83d943 SHA256: 958cc4ca420a6db30aaebc90e4052461f9be97d0c01e5085371e26c1f112efbd SSDeep: 1536:+Ok8T7fwGtBtg1T4cn57IHaW5dsivTwLmJMrQuOkzBc:+O7nHtgBJIPvTwLMAxfi	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 64df59d40ee4a35b7b0f6289fbe2473f SHA1: db97b55b3135200f86a21de6c2f7955b2932bc29 SHA256: 435598023f53bf114c0498c66091902bb6c29c060e743b79df55d6f1f4a81c81 SSDeep: 48:ZRNb+7rQbfaZcjZdlXLlTDlCe9Zmkk1GtOCilfmj:hifGFdj3EwgJ1umlfmj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	63.79 KB	MD5: 793b10d9eff98a198db50b91d8a1a617 SHA1: acd12fff489efa7fb1c0c1355cca92d1e6655a1c SHA256: 8c428e22dea03e92b1a6f5b677de689d1d714cfcf126d016d2a7ff0739a2da27 SSDeep: 1536:2IIcDxJPnNFjTI3A9QUuCX/p+qL92oKyxcj6QZ7XB0:2RqJPnNFoAqaX/sjoKy2FZ7XB0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	349.29 KB	MD5: 341d06b170863bb0dd2592eb59684001 SHA1: 5819c8ed49e79a68e53b647126f63a989626c9fc SHA256: 1c0dee470580bbf558b029a9f9f99ea7e0bcb25914e157f402c3d1146cd2b155 SSDeep: 6144:sEJay/SIVDQVFAqFJqFmVMydXXOAk9RkrvOAemtiJA8k4Y1wwkVcSEWxRu80:sEJay/SigD/+rvHZK8j5Po4RuD	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.34 KB	MD5: 614a8d8e30ea401ba07122d8dd9b9563 SHA1: e8836cf681963b879cf75f7fbb013dc6b26e1d0d SHA256: 813688c8c3055347b0eda655a80da376f0ae8baccdfc51f186381f1b046aeac6 SSDeep: 768:TlgTxGw4grSqxnGfAd4egdcXOy9bbcttezy9a+i/ibwPBop4NXL7haoyJZ706a0w:Tlb+GfY4ex0ezy9tsm+Xh4a0+aLA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	390.48 KB	MD5: 81ca94deff3d118bc5af14e6cfc85ab3 SHA1: b3fce3dbbfa0da5fa00d4463c11ce51d72016fe8 SHA256: ed5cadc02edb9038b88faec51988cce7f303c9fb8bdd6d5c7957332936f501d6 SSDeep: 6144:y51iAFqhWyuxsFKer7buLigsrpwsbS1WNpYo9bMg+FfaBHk76/YxTQeAVGtkwR0:21x0Eyw0Hr/CIvNGg+FyJYaekGCr	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: a1489f019a3ae61c89ec84209f7aefe8 SHA1: 5a26137bae03f30612de11793b8acd806588b8b5 SHA256: d87cb5eb8c1c791d795a907a3bee322449e18151654d2377feaa4c34a8643e5b SSDeep: 24:MMegLkCcMqfng5gTdBBbkBkM2paUuymppfMBpQLREC1mT+evfw+WjEaRmQ:MDZCcH8gyBkMKzbQ9bYT+49mj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 23875b5ca8bbeee4b0cb25f40de28ce6 SHA1: 202a46fe418b2b1ebabea469f16ae6cf5a3775f9 SHA256: b7ea516b28072a7df304c00dc7c84050408c4a1ca4e1398997d7b0cc0cc27374 SSDeep: 48:0hLa4bFLlD49iheEH3TSB/EdN4XXmCUw2Rxmj:Ya4RRE9iEUjShEdN4XXBAxmj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: 051f19876032f94956dc7ea050accd45 SHA1: 073fdd6d43391f3ef5385e2e2c8450cb5bede181 SHA256: d7c24efb0e61d72aad24af547a5550f763318f0abc03340fd93a69ba1f573c3f SSDeep: 24576:U5awJ8KHIXRWYr6BEa9EnqsqmC+qiOgykQ:U8XBZr6yIEn9qwq6RQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: a64649d0cd833d200fdee73445c9118d SHA1: 29fa70feedc72e95b062726758d84a010c956d01 SHA256: 3e1876cb3ccdf96859e775b167ecf71999746652c42933c6ae743b5cfaab9416 SSDeep: 1536:QCDokXjO3pQQZ5YwmxOyk5uvoWZjZnp2FdiPRRgsZZkL:DnXIyu5jEjFp2FUP7gyZkL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: 9965504592ef124174e15c24dbc9a737 SHA1: a17f47336c249f1cd72465d7844f1075ee7cc243 SHA256: 8d26d1c030ccb5dd54a81732575d06df5620e801a3dfbc344f1e02f14c92a928 SSDeep: 1536:GzOJ/tnoi1Brlq3eY5f9TMml31upNRTEvjNh4FJuPrKGQqMM4jxc:ppvIeSf3+pNROjNh4FJ6x1Mdxc	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: fd0aa730a35b41a250efc476485cf2ed SHA1: 0fd1549ebb943fbb72ec0eaa09b536ab84f15118 SHA256: 33db302ead6c77df3720086500679da745f6c9238b088e2d7dd0e1b375789a10 SSDeep: 24:QB4S/fWOkHFYX/n4Fp050gHsF3H5KHNp4kn6gQaZ232tf0TuWlWjEaRmQ:QuRewE0g23H5Kcpotamj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 360b3d50c8485c782b5977a26c4e4505 SHA1: 993ce11b9efb1aea44805de88dfb434070c3e78c SHA256: 90ffadb2fe3bc66abb91951d1df74a651eb7ad84fecac8db52c0acbba7bf5cd6 SSDeep: 1536:fPmTqxkr8YKmSgYrPQVF+GwVQSYcLqEF9JKqM:fP+z8YK2Y2F+1V6E9K9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 3401e73ae55029c953ddd5a84fba431f SHA1: c3813fcea4f88f1c1d8994287ff816929f126196 SHA256: 0f0bb6e1ddbd9a4af8ed79f1203a5a58576227d3fe8fdaa6c842e8b711653872 SSDeep: 1536:48sVbQ6I2RZb6IoCNV6438JtlRJ5VIzebc/i5BD3OR:fSQwZPoCNwA8DbVIzebWi5m	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.98 KB	MD5: 2dae79ffdb8110b4f881f9aabe1ec921 SHA1: 4967d03cc8982c3604d097fcbfaecc2884bf6b7f SHA256: b91bcac212383ca35f4efc4f88e1a08d47a10dc8ff0b5aa0cd3610ba8bb420ce SSDeep: 96:MmXKYyXh16DK56TiE3pzptOX2koBDIpInsmj:MmXKYy55fE3PtOXWipIs0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: b7299cabfd8e5d8d3a39b6f663ec8027 SHA1: 7685a5ab4ea5f1f79937b2171195a18c508621c7 SHA256: bef93ac683a59bd7f3db278924ff6a4cc30540dc2edd1e16ea9bc9d1d8064576 SSDeep: 24:1Rq+z9oFMU/xr17IkRivh35cT4h89hRHmUJgUtTu7ZWpRvovwhos3IWjEaRmQ:1R5i5HXoJAkA/HmniUcpRvovmHImj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: bf6b93aa0f117bbf326fc48981c40fd8 SHA1: 9e639e25d63641e5aecadc22e8fed9e886f21af0 SHA256: 1640e14aa425f4125a76fd9b157c828aa31d337f531b96a747709e84ebe48652 SSDeep: 24:5qavvsVK2Vx6BatSuO2I4hVIeXJC6E9I/l88KPSOCAwjhIJLT56SCT3WjEaRmQ:59vvr81O2I6V5C6E9It8iLA805Q3mj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.61 KB	MD5: 80213d304409ddcdb2ca9729512a86cb SHA1: 3b15e5299d208188224980724f2ecb5aaaf1b76f SHA256: 7580d1348edf8f2438c64a0e3c5aaea3baea658ff04c27542878f527fca33494 SSDeep: 96:K0agbLxb3gT4YpodOyKlBiICBG1KsWWLUmj:zTgEP4tlBrCk4sWWI0	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: ac3fe043eafeba01540dfbce3099dd61 SHA1: 5932cf266693f42ca241eadc8b4a5e02da684fce SHA256: ccb0b48cfd21fe553024270983cf352d9add8b06a920cf662bd8b02c4df73561 SSDeep: 24576:t0Ii7sMJz9A7vlgRZK3ADNBK0V4N5PoC/s0ChCPxPt:tJi7sq27vq8A5BKs4ztxPt	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: a436ddcb894c31a56c9f1b1e853926d2 SHA1: d8c4c195cf86987532e1ab4a25fa42f752dfb2be SHA256: b18eaf1dc271fe001fc360503ed2aba206946701b805ed71405bca9ab67a02c3 SSDeep: 1536:A+Aw/UEKSVxHIxq08BK4SJm9F3oLffqbaebCJNbCsC4z:1AyUIrkqdI4S09loLXqbaebCJNes1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: cc0c968f048267a26e7f0dd7e32be604 SHA1: bd0a4e4a8b676aa54653a70ef3cf07fb6d1e4159 SHA256: 989068858a08119ba5fb5f7fbf66f48f8a7738497510b3dacb50919f99541416 SSDeep: 48:amqpb68zN2UmzRdX3g5Roh014VQGTubvx1mj:amqxzNyzMfUKljx1mj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	9.87 KB	MD5: 50a7d3ea747cf6ef1cdda8e1d35b9f85 SHA1: d0f46203f92143f12f6078f236a882d137fbcb37 SHA256: ef24fa9377e51f9e481be8503905a996a78961343b9d575af3338be414116857 SSDeep: 192:bnlslU5XW1AyjEKopnUUXRE7nSz6uHNWVpj9W20432HCimTU/8NdEfTs:balU5XCAEEKop7x6uHipkrwiQdEfTs	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.62 KB	MD5: 610f161c6b08b1edff4d91ae55159086 SHA1: 7d5e9032d3f7de9f8d2c6491a261baff4fb79e4b SHA256: ae80556477e576fa3bd6789687f3ce8ddf5c5ae186c439740d2e487b8dd0d72f SSDeep: 12:JGYDk7exzrQo4diRo0O2Kru11L+4K0xjLq6MW1Q89b2bWjEp0Rl8N8:gOk7sQKO0l1wgq6Qmb8WjEaRmm	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: a1cacd732662a8b920dc925b94697b44 SHA1: 6ca4366211016b941694813f0fa12fdd4aa6063f SHA256: 638cbdec4339d205db61a209f28533de81ba3e4a3adeae5ec088290b20ed184d SSDeep: 1536:n9umNnP4/wq8+RcNKppA9iRf6jCCS+bFBuamcZuZyCirAgg0rSj:UIPGz8+Ruo7RfkjS+xgcAZyTAurSj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.54 KB	MD5: 292ede62b6f03dc9bf65c7d90fbcf4f6 SHA1: 34ad73e92f99bfd6608a81a8602f05f423026b88 SHA256: 38c4f91bafa582e044d82ac4d412070858bf9b09cc65769ea9237603c874f3ea SSDeep: 24:XIg08pNdDt1iVJiDIDRSmw/xOPVENIK6g9KbdSU53y+Thht7E048DuWjEaRmQ:9nprt1iGkDoF5dNf6g9qw+Temj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	9.06 KB	MD5: f6920447073440c51f3520e90a79f38a SHA1: 0f07bea476ed787f6a6e56bd6fe03f4cd2c0f265 SHA256: a67a450398f61f0b917d7104d7b39c87d954c13803064f47d9843766d90a8c57 SSDeep: 192:kqfA963cXEBfelftRqjC4iHAiDsTInQVgMvqQlUxSBJ+oLdkeee/O:3IGIfnqjQA0sTuSqQlUIFeyO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.29 KB	MD5: 1bd01dd156c417b4269a64d910549ead SHA1: ff3c31c0c7a6f2451bf621ece9b4f30ff91b0834 SHA256: 829eb3e7b00747ec74da7a54c33dffcf198fe01f76e4f3f53f154cbe24347d1f SSDeep: 192:yzNL0Y3vqaV/Nk6XHuxz5zhPN3hDI0SwTBx0c6FkO:SNLDTnFHuxNzvhEwccwkO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.76 KB	MD5: 49fbc481c295a653a241b6a63ffd548f SHA1: 770ba0fb165883f9f7d553707f55348dba7158f6 SHA256: aa4f60f62c25cfec441a4cf91dbde8eec6afa856f1ee772204b1f65bbfd2e812 SSDeep: 384:jxzZ0qfVbaeYK7U7bA+LALD7fMyNKZFAsYODXYsEDO:lZb+K7Wbk70Ffz/WO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.82 MB	MD5: 7595d9196ce857c1289b3b792d60aac9 SHA1: b7d4cebe87db898f7f52942a340f7a3ab041d0b7 SHA256: 8402f53b7058934d12e70ea2f6a0434f86948ece5a04f5ec12b90177ee4d55a3 SSDeep: 12288:CmImXMdKvKl9oouk7zw7uC5yD3dSgvzg8sZV+zg3lR1OsDyiqprkWKQ4r4c0e:CcbKm+zw7uoyDtLs/ogn1OriqpszR	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 19c37314e0a6671d14c6fed0bffe524e SHA1: 54990b96fea8b1e129e31b001556fca17c4bbfa9 SHA256: dde54aac0733f67d6b4f3dc995ceca3e23b9c637707b99db10a9078c6688cdf8 SSDeep: 1536:Bh3ZfE/ntJwf0057BLp1jq0lTX+RCF2+iuqfBlE:74tJaTu0ZX+Ydqfo	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.42 KB	MD5: d0e116dda2db25dfcbdd41b7249accb4 SHA1: bf4894b75426e257a3bcb0b1f3da614177e225ca SHA256: 015c84fc984799a528354dc6f26ba50359509aca5bd7c1e137887c59802169ac SSDeep: 96:1qaj0T664K6FSjAvKcQJU3teztCACeNwA6B8Kwm1:DU6tPFfvKczM72hZwO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.15 KB	MD5: f5e69cd884e2f3422d014a39d1c37218 SHA1: b9300164f84e2e95761e9ff4a5c25b2c1d849de6 SHA256: a8d0949dc0c0bfcdf44916a4bfba67b2c9d5a90a18039ed55ab43e7b2caf5b55 SSDeep: 192:jskg0ypBqhpFssQNKEs5yVSL71vYyQeorrviEO:K2pqKEqys72y8fzO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: a6b9218211549f97797bf4e0ffc8dcc1 SHA1: 9ed4fb83bbeb00c1ff7e4eb14ab1be031590ef89 SHA256: 0a28b955405cfc9292b5ccf5730aecd815b0278a535905344235bc70b4b4df1b SSDeep: 1536:jApxPwCaCe15pVOIMsT5GY0MjknCrNXnUwBOZl6N/j6jft0S1R:w1wBznpVOIMI5eEg2XUwBSARj6rjR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.76 KB	MD5: e0659d4fd2ecf52e476531242129868d SHA1: b6708c19787b9b17cd7f785c4d3c391e77c3b276 SHA256: a4c4bf415ebb84f7f28acb3fdd96a0e99c2ce28354588e19471a5f9756d60dae SSDeep: 192:N84T9JTFeO4+/qVHVwWKPUX5cVWyn7ehwAZyIYq/kO:N84F8h9rgUldhwAZuO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.75 KB	MD5: e4e4a8165a726beae3ddc2fe3db6210a SHA1: 842b2d5a518d2f92cd975abb5a380c2eda181b5c SHA256: 0ee490f58e0a7d579ea2cfc4be7d9a03c64f8d2dd65d9b63e169dcb729eafa30 SSDeep: 192:GGqwtdV2D++bQE2AYRKaTAPdj+F15usiKB0KYPCO:owt25ZKwaTA1jQusVKKYaO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	11.86 KB	MD5: bf7fefb1ead71d75db0d0cf338ea758d SHA1: 175594558c2bdb81a4b42762e3b3833c2b03871d SHA256: e1c2c4ad86f27948fe6654d5f1bf9db2a6a2ede2a80c5ee7518c8596dd829e14 SSDeep: 192:+7xNp+AaQ5UO5m0yc7XzGLVDbFVc3c86VGSK9ItZNIIH9i0b66TbPpI2Tba1v9VO:sNVJ6O577XqZVc3c8L9KZNIIH9t6WbP3	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.75 KB	MD5: ef470df33e0f52690d62caebb7661d5d SHA1: 13b425440c327d1254ec0cd410c7c5178b05d1e0 SHA256: f35b3ee46a928e79ea7684088452546433bd193dbdac35b87051a88ff3233c0e SSDeep: 12:TvQ4L96NNiIInOwt1gjfJoeZfos0sAbT4KbLM2O65k3Nl1cRjc2bWjEp0Rl8NA:jQE6NsVLqJoUws0rbT4ALMD65uNDuc8O	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.73 KB	MD5: 3e1631cf4f57ce3b94c5075a453fa361 SHA1: cc992bd1b928da1698c304a62097e2f8fe8cd00f SHA256: fef2c63c0b7e9e4164a7898b53b3455f48037f87d7a0695ae298cb727d625507 SSDeep: 12:8Iz5NC0OHxH0v6W790RS9pgo520FhpkJbCpt7G15SRGQir42E5G+l1xfibWjEp01:fa0omv6ZSngi201Ua6Nk2EUM2WjEaRmC	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: f7245b62eda581e12f55c8fb6e246345 SHA1: 49acf904a7dfb17b077a9bf9b34191344a186c52 SHA256: b40447530f2a0a661c4172ae904d64d3f5ecea7cff775fc37c0fa86d3f04837a SSDeep: 1536:QLy4F22wS1h0rE44zVDsH3CaMfopEaybzEs4t3qw79mA:Qe2X1O44EVDsHSdfWybzEs4Rqw9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	12.64 KB	MD5: a612cd3146c08a822ab5196072abb32b SHA1: bd13c49d176f433fe580de244aded0cd5105d38f SHA256: 061d736fa5f9fa65d1f5caee9ede3aa197eba496712e46c93d348f86367808ff SSDeep: 384:xOAlwPhU3I6pL6oLLbxhjFwZfQquHPuEr6QO:LwK46pxzjFwZJuvuErFO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.29 KB	MD5: bc7be0acda995f35713d0d9a55800df7 SHA1: 3d71d6e2ea83e9ca17a51e7f21619ec1c24f8ac3 SHA256: 7fb2afdaf46613a060fccb7b91454b7aa81df0c3243d198d6ea2de32e5beb18e SSDeep: 1536:jqtcggoUDjfiXl4Mkior7nwhi6H+bbWrafCKtb0Yl9oms2gB:jqtc4UDOiMk5r7w49bbWKCKtb0Yrod2q	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	12.43 KB	MD5: 996cf56c66e4253142831fbdac238ea2 SHA1: 730a45fa85eed887c75e84802fc7b3b169620576 SHA256: e938000631dd39d454637de0302fcbee0eb2207f54668a3693857691d2684084 SSDeep: 192:wqPAVfDqjimkjOsU4jqmoRVNkFfYsodVTnadfe8kEiV6NkHnV8TIuYxB/5hO:RUbqjimQYl3If9kTgG8kjQK8o5hO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.64 KB	MD5: 55136b19b8a6aab51ed86c83d8f59d6a SHA1: eb92de2b7c511b1aa13b1e285dd7f25afca962b2 SHA256: 8ae1d450f740938f58b4ea8a6159422798b4a02697f33c03fa566a99f751985f SSDeep: 96:/2udLB/IgVwzgyxUIDlk2APkUTGkGjdfY2m1:uiLa63Ihkj3rGjdrO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.31 KB	MD5: 45f6840c8a06a78eb9d65a7c255d06b6 SHA1: 89f5ffa52d8bd86d538c321bba07be39a8e8f1fa SHA256: 953b4bf6a8d0b70aa4bd6671fe156ab322f1289cba352d61d4249e9a0c6ec5f5 SSDeep: 96:Sz+Bv5SKYBwsj4wjNJi0JtCCOQzBBNT8Hm1:S+t5SisLNtt5zB3YHO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	10.59 KB	MD5: 6bb5798ea78529696c4dd6c07f11821a SHA1: 2936f4be07eba2cdded222cdaecb27c94773620e SHA256: 5fda8cc541a18792319018a89a5e65a17c12de39e115fc98f7cf34a2684bedc7 SSDeep: 192:PTDRr9LRMWPL6yuier2utrLZS9JhLiDtYCNN/LY3JOHZJ1IZOuMTAO:PTDrLoNNsLiHpLYZO5JGqMO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.78 KB	MD5: fe9d3044dc0a25bc04a6b30632259bfc SHA1: db46859645bb03602dadb0d3666a049fbeea5f09 SHA256: 230a6e23ac2ecc86b1d468c5594b8a2d6efaefdc6eb9b1a9083b9a92ba4a61d2 SSDeep: 48:8TtOUKAtEG9yBidhSHNMtDrAGzC61sKR+YGcxIR7QD+kqdFHRNVZiekZsEn859eF:YtO0tEhgffpEGz51sKgYGN7QDGdFHRju	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 51b1eda77dde6b0bb48f798591804384 SHA1: 75d9d6e5e5f817d8dc8ad1e64f7f5e3e8f626ff1 SHA256: 985788bf31ca026d65eb70d1531a0074d581b043dac9e0e4076e8bc03994df8a SSDeep: 1536:ohK00G3KTccI/Vvn55z4Xsc6VVNJ19ed6TNe:ohK00uCcd55e65gcM	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: fb4b7c73606160501fedf215d2942aa5 SHA1: d9bc1bcc550800b82398c4656a8bfd5761890c8a SHA256: cc5f6c008ec2c032e8612e0e9001e7719daa7d31fb942ad64d24b5169e53b75f SSDeep: 1536:xgC9RLfRU7eQK3Dene/Ymfa+Y9AiczBPisxeRUFMhO5Aa:x59V7V3x/fy+c1czxtxd75x	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.37 KB	MD5: e64464e6ba650e382b2be5c5ed2d0d58 SHA1: 6ea63c1824045c9c4f3ec4e1f5a6da8eb4828911 SHA256: 651ecc9348a4b4c96f90b0b7af9a49c2270f85108a87a094f332bd20ffaf9ebd SSDeep: 96:AKW09KwpFhLqgZpA9Yph99W210qBkQ5zCyjrQKumVk3VpAC0aH/NRp+RipKqkjcO:ApShdpAephHR5fQKumM3L0aVRpX2jLOO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 9d78407d077ba0ba26c2741e929a9a07 SHA1: 10203ef8d3e5a8c883cd36992aafbb667f328fc5 SHA256: 36bd991741cfb8eeaf6097161d3b9f31e6029cd3a5d5e357dba7c1148ebace7b SSDeep: 1536:wmzBBwPUt144uRHg/pHGRBmvVrjqI3Jb3PMuNhZDRptx:wmlePUb5utg/RW4GI1E8xx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.43 KB	MD5: 7645d4e276fe40c46597776d4dd87a0b SHA1: b4c5c77f538d3cef061c17a0978c59a834a02e17 SHA256: c03e6cd26445e5f20e7b1102a57224573eb072994f74d648208b01eb3912c569 SSDeep: 96:sENCTz3Qf+m/9rtmK0k6PIn/unjrR1cfSAZSOYLB9qrJAz+98+ZP6Mm1:pCPs7/2/kiG/unjrjcU7qrJek8TMO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: e44a02b11108a7db52c38fac034faba5 SHA1: 983a46de81301232e9e69d9298bd38183ac78447 SHA256: ef80309a3598175345964dba01e56dcc876d1c45e234c5d6dd8aaee71554639c SSDeep: 1536:hEINMwk9n0Xkww9Puf5GkuiuQ1HjNCeWnPpoVrNU0LUye/6V:hEINMwkJkw9P4OnQmrRoZNUqUB/+	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.07 KB	MD5: d150b8067027d568a05e47f384a2412b SHA1: e4a354f19afa0a0bf77a861dd51e20a1792db47c SHA256: 0bc21dc6ac304f7443161d46233b5d1e1c1ecb7c14fe01a2e3a6e222db468a8f SSDeep: 96:bEd5Ap0cH9BTgniX1ZiqJypeFFK70/4SdUq8IIKhvwcg2puq9Zw0BbxA12G/RVuJ:Ad55cdtfzJae7emdTRlgLq9Zw0de12gW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.15 KB	MD5: edcd1670fbcd604571ff35a9227bf825 SHA1: e6798074f971905541a0741c7ff1ad3d610a900e SHA256: 17246cf7cbfba3f7f2c355667e80c0ccfb9ef7fb64221cdb945c09e1838afa08 SSDeep: 96:vGeCsyMOQXnx9S/2jBxSeV1VPViB6x6cp5EjMskhyN0Qriygm1:e+yPe2uj/PkBC685EBkh20QrkO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.37 KB	MD5: 7e6231ef440c468031556a596766ed6d SHA1: 279bf20a6147e786e98ddc1acf7ee62483bcf713 SHA256: 3e0dd4284d357f66cbffd8f36032fb018e32f154dcf435d8bdb06d14092d6020 SSDeep: 1536:qAzuddWzxpOXAgLMTqKGJgzRD/OrvcHo6RV9FOOvfCk3zy1mmIdONwc54LsgG:39dppUsqKGizRDov4XVZvagyLDKc54L2	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: de8c4c903892eadaf7ed16cd848192c9 SHA1: faa6cc0d01781c9bc5b73af215e840b57a498835 SHA256: d0ad3179fce8db36fd384e68fac5b787dcf5479c6238f67b96452edf3e18d5b2 SSDeep: 1536:mIFThPptjrkyvgu4m8Tb4pDOJ+vUGx+0yGp9y6u8Hb0WNd:mIF1PptbvP4NTb+OUMGxXyuu8Hzn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.36 KB	MD5: 27206c1487ae60c642febfdcc5eeb93b SHA1: 23122f428f4187b90e6648422afb3cc6e21eba1c SHA256: 909041cdb0a7e67a4a6bc1866460e4c7842a671301046b8d2e6c0c66825a16ad SSDeep: 24:DTQZQnO81GKemUWv7AFvH3rsw2lybmJg0eViPa5Fw4QyFGTrWAabUF80tIJFDymO:/mEO1KedWvkv7TCyiReVi0LtcP9GEeDO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.06 KB	MD5: dda34e543cd209a3a531762e55352f89 SHA1: db41ebef0beb76d8ca274145c7f0a5951cff35d3 SHA256: 67decf05fccef01de4426b921cee709be60a7bd32ef9738c4d0f8172382e7a1b SSDeep: 192:6FuCFAOvnr+ynfwa/Y1F55EX4UJlne9ywuO:iuCFAOz+Sb6O949ywuO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.64 KB	MD5: a7c0f9f8912c8d680b49129ff4c78742 SHA1: 12b1378c8be623034df5cb8114ba46294bc4bb7f SHA256: 2b98a1b2a364321f8cdbaeb3bfd7b57fd41cbb102bba6a7c1153b997e56f0709 SSDeep: 192:VLTjSuIsO3Lbq/UUsJdJ5rxH0ghwashllNO:VLPlIsObyKpxH0owasXO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.62 KB	MD5: 1a1f6043f3be548a7c4a5bdb15addb31 SHA1: 6406083a6f73c4e5aed1bbfedd100ac44616fabf SHA256: 286337e5b59f7d3ae449cb81f57040ff9216755f8d6977366101f90524794c7f SSDeep: 192:gOyMK2ftD25Gfm3PUf6qcUPO0kBuUWwF4h7prcNtq9/PlU1O:mCiofm/USqm0kBuv/Fga9q1O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: eaf0c7760f3707d7d050e3c13d8ef035 SHA1: d7115b874e5737d3ca057546f3d843e2e2bc3cdb SHA256: 947415e9f6287a17326490f007f669b60244bdbdf0fd0317a00145eca0c4dbd2 SSDeep: 1536:p1pw15UvktnFk4nA5xdFaSzMt5CcEWik9GX2GVmcsuUYRb1lE:5emkh1nA/FyDEWiWGX5mcs0K	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.01 KB	MD5: 83634be436d2710cebf1d4f7179e5ea3 SHA1: 81bf32cd7094e5e1233e2eae6b4a9ec03cf1d891 SHA256: a57ebfd5dd1c13e440f1809e9b66492cde4996c36b045f29cfd23798357ea28a SSDeep: 96:tKmewBYP7LKRJR93MHNr1pjndNQJdIQgOYVx/RSNVLVKmm1:0BwBYqJR936r1pLQMTOYV6NymO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.14 KB	MD5: 1fff873e0ab8a7739f254dd497a70d49 SHA1: 6152a9afc6f5099767fd6dfb37529ce5d056568a SHA256: 0e5effb6220d35b9ca6df4576afc5acaa9eda0616fcb16518e8407daf18cc182 SSDeep: 96:NjW9JiJE6ZAhibPOMFTPv3XWXzrvCwF4BfdzcYhqCo7Igl2vSpPWnyy5j/IOzepQ:Nje0ZAsbLzWXzr2V+Yhp2IUASZWnrqpQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.35 KB	MD5: 533a4cfa40addc13760a91b2d202e8ee SHA1: 168ebeca4c017d4e95278edbb3af915fdc4184dd SHA256: ad254764005362ce6a811a54e846671e17cb920ca78d8ec5d04af45c3f0f8446 SSDeep: 1536:4jfVyFecM+fXscM6Kkt8MayYAfH+hqMAijykFbn0NNBV+:4jfV8N5fH738MKUeDnmBo	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.48 KB	MD5: 3f17d1d3234cf3587c3d591be34d241d SHA1: ecbda7b086c5eaee17363ca04cf6bea5b39678a9 SHA256: ad881ddf8c2a91c80a3ca342690ebd8a8880447efff4a4dd156deb495b82b6f5 SSDeep: 96:WmrJWbZMDAPEw4wph1r0q/Zr9n84wyo7kvEWIfW+8yh3fPlfbwmlY0RsnhI1Mh1c:hJIMDAcw4w1rHwy66EWIu+8yh3Xlfbpf	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.53 KB	MD5: 93b826b2cd9c19b6cf59e4949a715f93 SHA1: 75deb82f5a231d03bbaea45555962aea9adfc0d8 SHA256: 05eee15d13d90a5556c8901201563cf8d5ad5243e9b46920c7ce9f5b999299e5 SSDeep: 96:mH69NF/nYfIv6xpLWVsc9HhnbmivEyYqV5ZtX1TPul16B/+8m1:ma9NN4oTnSivEyYADl1DuD6B/jO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.29 KB	MD5: 1e2d76bece8f7a69bc7a5879ce4ebc99 SHA1: 9cbef951a576f0df670ea985add71aa51cee6786 SHA256: 442cb5001dc814907f3f4a00c625db8777340a46e2d36b45961a735679556c88 SSDeep: 1536:IwHpxTQZtvKBnfFaBSSpNgldVuqoCYpe/CP3KPtPM2XgvFd3BW:IUHQZ6t7wNQlZYpe/CP3QtE2Xo34	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.29 KB	MD5: df8982c7973b0539796612bd377a9b13 SHA1: f4c935f21d063385fd02c229e522be2dbd0d226c SHA256: 8f83bc541a127712e1a319c320ddc5e26464dca154c4f3271139b31c709490ea SSDeep: 96:LRJg3dcmX0CEs51J9kDEB7Rs/Z2XqoqYfbm1:0NcmENs5uDw7RsBwcYfbO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.11 KB	MD5: 797dcbf9304e697ae6a784be9a886fb2 SHA1: 1b4cbf47a05f8a774717b07045314343eed74b2d SHA256: 34111f7675a1f0018ce84b171673337da7d36012ee206efdffcdbbac22b70d38 SSDeep: 96:iwvLbhT0zUXaS7rfJn21rSWACYy8OVdBjOvWjxE++mr5m1:iwvJ0y3B2RoCgOVdBjOvWjxE5OO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.20 KB	MD5: db38739bc3a6417907201e1d21876865 SHA1: 3b6f7f8a2590fb87dcba69e2c55fbdf5a214af52 SHA256: bed8a4a8a2c869e7def6e71b074bc3e190352d48e1828f7c3634e11e00764e1b SSDeep: 96:auAmSSI3EqvMbZDVbO65AeTfUlcFMyc+gtdFCGrRNXgHXym1:gmxuQl9fTMXhtd4cpWXyO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.79 KB	MD5: 828d7b5c0ec89e2912f348da7626ab81 SHA1: fb243400db6ee8d72a47f45962d97028d9178660 SHA256: fe3678ef4f161fb52040cd410d808f053621ee2d9caeb7725601310ed3d08242 SSDeep: 96:L+IIRdnYyOmoC0h6+GtaYBQlLA00CFEuesiOXazD7nl16Om52dBisvC4NLw8YxAy:LV09YyOt9YBQVAzgh/irzD7C2dBiGXNg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.86 KB	MD5: f5b273af8e3eaef3079b903fa7938935 SHA1: 032376c958c619fcb376189105c6310a1cc8d673 SHA256: 84fac1e45e378db9cfa28cb2e766e67effc979a87ea6b59334ac91fcd94f61cc SSDeep: 96:kufcCOg1Sgb2zoRtRBSqnENVyzBafTGgvDC0qg+mCGI9TPQVTOdm1:rECJ8gb2zoRrBSqkUFa7G8qbmZwTCT2O	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	20.34 KB	MD5: 3985a6df6bea3cf0d5a9c0c35cf89205 SHA1: cce546a504900d09dde0befc773e688915d060b7 SHA256: c27b5cfefc9e18964732821084f63f7e3232d58c07a5b15b508ce3cc1355ee11 SSDeep: 384:UL87BQeEvxxbqL9e9Eyi7CjpmkoUp6PycpzpRZHHxMLdEOO:o87BBEvveyi+wkoUTcpzpRZHHWLdEOO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.32 KB	MD5: 8049847ed716b3129b13e072642bc0c2 SHA1: 84957a81bbc13a3c0f3c48462db0827b439dba33 SHA256: fce1ea5479655431fc775cbecbdaa7cc4c6661c21530c78f54e1d05c75b918cf SSDeep: 384:SYbU86Sac5P3PdbKZxTddVqGcTxVrunvGq6Yoh6NO:SsoSTp3PdmLRmZVKKYoINO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: cfdcaa517ca50d084494c0eb80feee0d SHA1: 416aa565c9d3b5d48079f81210fbe7f112af88e5 SHA256: e303b5ce30dd964a6ddd6201c6c24e81349dd7f2d879f66ebe018001233eebfc SSDeep: 1536:k/L6Cqx2MzbTWej3kOuDuZQuez+hDpTv5i6IzWY+7G4fAwj1SKtk:k/Ll5MznW03nFI+h1o7p+y44wUKu	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.15 KB	MD5: bb060a60591ca1320a90edc4bac07448 SHA1: af6785092253416cabd85ed6421714ab1ed6d838 SHA256: d6d3dfe4fb81d446ecad5454a6e545ec98e3313a20b429fe897c995758f01ab9 SSDeep: 192:r3KTiUlOuvUU5NmFtckP22TsPGcRp6b6J62xCt/UNoO:r3gth5lqSGcj6NRRO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	3.51 KB	MD5: daa454d821afdc4375bb0122d0fcc6a1 SHA1: f01c2e9ff46a921d136553fa61f6b2cd84b556d3 SHA256: 9272dbf1702625bea763686390a1d7c3f27ab766a0e7d83f4b1d93d3d49370bd SSDeep: 96:i+gKhWJU5vQIJBTHpT6JmNisIMzT2t1k1s66dCB2m1:4WvQyJ16cT2tu14dCB2O	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.03 KB	MD5: c8dada406941bdf630d4e87cc457b606 SHA1: 4baa230891a323bb431615294a79243c0e457313 SHA256: 8dd4f8df1cb2c53d86e89e77ff5d9de7b2f4524bd988bbc5ac7388cccf3ee7fa SSDeep: 192:726bSbNLUWCriNJMREGaa+90QS36SlHEsSTpHkinqURnA88Owce4v0O:8bS9ICraYQS36SlHjS9HkXVvcfv0O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: 77aead05e82a78d035d427d957b5e273 SHA1: 14378313d7e7ff576fdd16b7b28f379571e2c81c SHA256: 0a2f617a66d752023e8a81ca92b0d2592bfd38bd5511dda6390b1e9530dc7ee0 SSDeep: 24576:PqHbpzMMVuYjd/7u2OEN6XLIl79vnJirqB3t442kXtP:CIYjd/7NOEN6M79vJiu4kXtP	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: cdeae21b8b4e134912cf5bf7127b862b SHA1: 52f5d86031c0de5a487cf350685a99993aa9d598 SHA256: 2cfba15e29b2e703b991edfe14fb1c6121c0df8dc8e29c1bd3fac6c005fdbedf SSDeep: 1536:4ou+cIcMvvsKgSJcDWsmMZex57/73QTlXCtBkNHA:UpIcMvvs4YWMe73cQBB	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: e5ad6b3f7222c1ef4d2ee252204fa8b5 SHA1: 70d1eba11ef273dde545c22679ec3ac08d80e58f SHA256: e469dc696bb06e8abc955a29fabfd9e4b1cb7b15eb87976ce5842e2c61bffee0 SSDeep: 1536:kkwIYOOMyZ0AZ+3n0d9z2C/3z9D1poA2OfLKfu61Dtgm5rzG:LwdVje6Bz9zTcuQMm5PG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 827ece4aebeeb1d172c8f0a4fc84176e SHA1: e080e97b0b9406ddd4497722a34abe0a7e4a2526 SHA256: ca5c47d3c8fc5f4a04b0860187c9ba2bfda75bee8dc3ce1f650156ef22548896 SSDeep: 1536:y93ztnWy/wv8kzxmmXBr3+TLQXA//g1O9f2K/wUO/+L9tHPwfmyeG76PnM:ypztnWNv8qlpuTLQQ/IA9z/wU/3Ab60	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 4817e5d2117a8e02dfa9a55067273a1b SHA1: 5391053849d8cb2d9da89f0ea88fef3b28090810 SHA256: 046e8dcb3afb30a629db4b05e52e4e928eaefcc097829efbf283330e9770d630 SSDeep: 1536:wyoUBtQMpNyvdIDoeVMhHxBig2DAgU+/mZF7ZHOKgsOrWq:wyom7SqoeVMvBnBgU+OpOKg1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 01dcf21ff3e53b82c47b226b83d99405 SHA1: 4ea4b7788506a08bef11270f4752478bdb14971d SHA256: 4ba3a6591a03f72108f5f0bd48547480451702e494bffaae2a8a9c25de016202 SSDeep: 1536:ACYXGGcGd3CQBQ+aEnCXsunATzg20Sk6Slr+0y2Rt5/B/jn6E0xKo+uMK:ACYp3CQQREMsOAPF0SkvVrVpBbnIbPMK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 8f915f210068df42cce4205f95f1c5c4 SHA1: 0442641598118d748dd62e3de6d317784543b100 SHA256: f66571d1d7c97d33dadccb7e54e135058cd0fe36acddb42e0183f037a0d18813 SSDeep: 1536:5gMVuwsnECBZjmhHBItnN+80oBttLxDbBC6NRJ7:9owsEC3jmhW90o7DN/x	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 6b1076987c76965fb7494e29afb70916 SHA1: 90726d89648fd4b106272ad46bd54491b3e4762e SHA256: 258f075538737a173436b26a358ab977f647b086b909ff8798b5280197274d24 SSDeep: 1536:V0bpZkcs5lu+qUJUZ2KQ33w5IMIjsMObwJJns+h9TA+88nxvo:V0b1s3udAw5IM+HsuX8uxA	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: 30b9e6f5c718bc86a4e3ac5ffd30a4c1 SHA1: dd88fea19e271173477df121b820055df3b0b9c9 SHA256: 8a3443900bc7fc002d023e37705ffc57efd849e2a1d00ced13a0dd653792fa20 SSDeep: 768:OFiWeLL8rFFICqxM0GyrpbO2G4CxqtdKWazVMoL8MKSjniU0L9/Mj5EDB725ASyl:+r8L83IduMr/cqn+B06i0515AU9GOtCJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: e0f1e2c1e45db5716900179d681ff10f SHA1: 436d7a0e615a9f71a0c058c7c516c06936bb536a SHA256: c46a2b1d29c0ef2fbbf3de6f130af0ee40d3c5626499c9a7082eb2f60d0a71c9 SSDeep: 1536:5wqH2Fv7K9atseyT8aZ4rRQG6XU9GiivAqC3U7mWAdBt9gs+:fHWK9atbw8eGQXXqGiiLov9gs+	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: cb9625b960e043b7d9bf0dc23f2f0d87 SHA1: 686bf3dde9c8a1aa77f5694c1ffc07afcb5f6ab9 SHA256: 9179e748e3ebb6f5978c46f1dfc194a57904a2db3ffa78af2648b6e4caba6dd9 SSDeep: 1536:IdZFIfWdOJW6YQ/0fRNv+VlPi0WlIBiNHtr9x28QO5vBQD/QkEVcRtb35q8:IdPIfKXP3+VlPRHqtRI8r5vSQdVcZJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.36 KB	MD5: 2fb02797719e9545fcce38cc5c91155e SHA1: 83a5704886b0b8b1c7e1d1d9ef398cdec010717b SHA256: 894445e5837c49b6854c6499e767e1033783b07836d46fe5d84f71d2a22cf758 SSDeep: 1536:X0F1Kcl9zcmjA4/Y06QFRYwTVSLKKfze09auBgGU0t4eZZ:X0F1KclRw4/Y0hF4zeSBq0Zn	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.36 KB	MD5: e973a07e7f9e72ded339304407e6538a SHA1: cad240d066ceaeab504d3ab4bf9f454a173193d2 SHA256: 51985ed744a4e77d43ab9778333caa6b28d1a7e3170c3812e089d59b07a12e10 SSDeep: 1536:9aKbFzW6YQhieoPUTKfG+j9iAVdcXw6ExBLYprbHRXTFqOp9d/t3vZaM:9aKhSNQGch+jrVIEvYLcOp5vZd	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: e596dd7d10928f50bff09ae9acfc227b SHA1: 0ea482b71a96c3b9a8e79285048119dd7e795b4c SHA256: e4bccb18ba2e37b466aec5b00b0452f9b29c3d181d6721baacf5a820fbd2ac8e SSDeep: 1536:j5F1wW1oyIhEUDWqjchq1BA2z3W+eUexcTzw0+9PgCh1DOb:HqyIhfDWqQhevz9excTsJ9Pn1DOb	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 04c36146bb3ce7d42bdd5ba09db92b6b SHA1: 977c98d05091866b2dead893fde44b807f179c7d SHA256: 5bfe38ce52298cf0628d6f9e1eda32daa3cf7b69a3f57e362973e1720b65865d SSDeep: 1536:/qA9rmTpWUJmb4Ep9tYJgfVHDGNrUUKX+VKiFCALvpuCjMNXZczPQB56:/99iTpWLvVHDgrUUKXc/vg1NYYB0	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: a54667b49e8b9dc6a43388e9724b59b6 SHA1: 9fa716852b5e56b2e0b7660ea2583b08ce2e2128 SHA256: 1f6b70282eda33fd29afc78801c5dbf9a6ee0d6942411e112e354390299b8c29 SSDeep: 1536:7oNeNXdYbbPsAKq7GllgX4LmTGbCH/DSaM6InVj3IX:59OjsdmR7M6InpIX	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 30e82cd36a267df1da5c0f19080b01a9 SHA1: 35de5d2753aac689a8722bafa96715a5ddcdf4aa SHA256: 3653175ec99e7bc4b49029439f320603454956582bf720506124b47f871fbb16 SSDeep: 1536:sOLwX8yKjminugR6tTLHE+4XnIxqKkAJ00diobglLIOA1oE4:sCwXyjPvR65k+tIKvwo21	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 2a1c865c5af55394f9043a23f72eb9ce SHA1: 295974bf65bc3abc2d1d256432f9ba672f2a0b2c SHA256: 1a2bc7ac3053663853eb99768cf16d12a5cdf5f12d92a49a7746caeb737c60f1 SSDeep: 1536:STjAhV14s0l0a8Jn7eqzk5lb1n2B014ESfRaj1rroigZewGRRWbgYI6:S3AhosRPn6qWSW3lgZWqVN	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.30 KB	MD5: c1d45f46df52f729364b9156a59a716f SHA1: a2f712c03cc365eb85154af6d0f6c6941efa1944 SHA256: e7e76a8b07775e2b46ca6f8e46916928b7e44b068bb44f111897f4a4bf61c89b SSDeep: 1536:4ZQFiUZRGM+Oz94c3d+qtIJNqvI3WfoQ8izg3zOYPNgoozTSscWTPleRQMZ0:MarGMpeZe47xSYlgNGsJZMZ0	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.32 KB	MD5: d89559d7be84eacb2a41debff8d7220e SHA1: 71775a61f092b34ddaf353a1aaf7b077ccd81626 SHA256: 51ff012ebc25188b52fefdf0f0d55bbd9d8bd4cabc1621109246451390d685b3 SSDeep: 1536:tPiC3R2jXx1KZsDNjtNd19CrPAPgI46guu1k9ojMrm+6kHUYq2J1Wx+O36JblCru:AC361KZshPlGYrIX1wojMauUYqM3Ca	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	8.01 KB	MD5: 066d5003ba3c31cab8466a7895ad7727 SHA1: 2de23c898f4cac87ee831b3801ff390db327873c SHA256: 057d7b164de869d77f742816b0e0a17069b35024d0ddc302b3d254e3ff656504 SSDeep: 192:2fJNp6Vhq4SAknn3bwa77PKHLlT8pOGFbUd+aIkF1JTNMXukO:2rp6uF3bz7yhgpOW/aIk/zMXukO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	13.43 KB	MD5: 4594298d03fd63aa31d267fae627f824 SHA1: 7300e9f34d84a1a4dde8a379d2219e1d03f3b223 SHA256: 14275c4674dba3eb0e4046d7fb74ef9672d5cb949a9c78a0eec0991504267c22 SSDeep: 384:t8FzwJTx5U7w5epAyeO+bMsSdfhxbq3ykA/XWO:qFzN7OA9eOQcdpx4ykBO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.38 KB	MD5: 6da1f52c0038a975b478454d244dcf75 SHA1: e91512cf7a7bf9205ca47a7ff67d38cc8f9f97bb SHA256: b2dad4459f0b36ffc05573434f1c761050c892aa0b25871575e1753d3ad7c396 SSDeep: 1536:c7nZpygKnVeiXGnxfo78F52Tp1r/FMRv0yeH7cNUR7TkW:wnig0Vb2PATpdFPyeHIeR	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.35 KB	MD5: a0ccb00882a0f27ea663539c75e7c15e SHA1: ae2a357accdc48f369281e951e13c7981249b85b SHA256: d203c43249967b0214d32b873079173d009ccf87e8c6dc9cd28d816eb5469f07 SSDeep: 1536:mOn7cas3YD9+vnajOz/4VA9TCFAMlZ2IKxDF//GpcFGQE:mOn7caKYDQfajOT4VgqZ2IUF//UcFGQE	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE	20.21 KB	MD5: 7e39f6bc7a58005ce2c7c37637decf78 SHA1: e0c3e2c0cd13b5bd6e036cb16668e21e3d70626d SHA256: d53b15abddbaf43956e07e95e63ab2dcc0025cd3763cb20839aec7149dae726e SSDeep: 384:lHwdAxfadUKunQhNvW56zz4zB6pcyR83tUUaEQmrkJileguP0Z46AtO:lR21Rh03acVUU9QmuiogkCUO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	14.39 KB	MD5: e64263ddf5d038e743899f8734e5d72b SHA1: 166e28ba4dded7acb4198309954fa12335b24636 SHA256: 92f8288ba1a2516adf182586296c4ee9b85c41a65605dce365b28380540703ac SSDeep: 384:4LdCFDvCJaS+pB717iEKXk6yus828nAdrEjmlO:CwFDqgSgB71iE3NuK8nenO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: 9323ed67323c2a73cf33a5f0c52b6897 SHA1: 82fa337171877f63eed2c3298863597c04654058 SHA256: 480975178817127a4de83b88c01d861c71b008d99cfbd10836274c3b55d77184 SSDeep: 24576:0jpodPNNU8+h70jbhSNRojnRPApAvSPl/ebUzhrN:GUEWWojRYk3bAB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	7.92 KB	MD5: 7fd116513293575794467173c7aa6e42 SHA1: a655f62d624e44aec7457399b83cee15af06522a SHA256: 3f46bfd621492092320099f13abcfd37e5e62024e0fd7bdde2549fc4795c9cb3 SSDeep: 192:OFSjdPVnY6E80xr2zWjPqN7Twu+JLrNcScxo5Rgl6I/rO:e+B26E16z2CN7D0WsO6I/rO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.90 KB	MD5: ef606fc2542d1e59bf0ce22dc608e401 SHA1: 54ec58c8122698386a705c7cc5fc0754bd43850e SHA256: 490a101bdca5aa8b13abf562a0ca9b9a9151fa6ecaf9f2fe9a8293106651ef56 SSDeep: 48:ek7fFrvbVTwTtuoyY83mjbluIcWD46DM4OkFbkCw4m1:ekp3VTwTaYokbluhWs23FbY4m1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	9.32 KB	MD5: 4d4b627d06bf952ba84199bfdb1c5898 SHA1: 580c760d8e906b1c1c771822cd5769b22a66a1ff SHA256: a224dc44f22a5a0ff486dc61574980fe7483af17f5cd207b708c63e6e31983c1 SSDeep: 192:RVNI90ziQquvCm+c8phg7f2WGIgCpWWk3y+GyJowyvbdMllKCEj6CiTwO:zNE8bqCMc8phSf/GhMajtaw6bdb6CikO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.33 KB	MD5: 4b48b275c76aa306c10a04dfb980d73f SHA1: 2bc7282130b14a7d251bf3d1d48bf34c4b2b7bff SHA256: 4c06d1225858453b652a110ad2627c99fa8e8203cf5a82b07d5641d6923651c1 SSDeep: 1536:ifDr3FvdcZTMuLWcOeVHnWbReexe/PMATdqdJGN4GFvko+Bh:sxyM6jOnbReKe/Pbgdo4yvXEh	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.75 KB	MD5: 27d2fa26ca5069ef715ffca0c3cb6beb SHA1: 0709559f0dce9874742850f731fa78673f99b503 SHA256: 6addcef9946b5dba8b0cf5dd7359914ae687dddc14f4788defc8d0efff13130b SSDeep: 48:/n14fY1WCbJfOacZ2zPVLdPytbtmzAVOkI4IpIAsIm1:/nWYsCbJfOcPL0btlS4KPm1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 3f1f5487ae9875e4971329f00f18a66b SHA1: 8148cad15ec7fd36a9a2eaf95b05832c30c1a9db SHA256: 677e1009e61aa04514eb90ba3bf1f3608a03ff06d2dd075d8d2536e2bfc7da55 SSDeep: 1536:2MJ41x3lmiw/GVHReTypmkW6jbuEgcTaLChQ1QUeF1yj7P6nGE28Rj:y7NSTmvSEkLCi1Q3sj7SrNRj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.73 KB	MD5: 0b7ef3fb3c8a1364f38ef849cb189a4a SHA1: c64bdc57f390f02c0120f8bb6bfc75bb87515b2f SHA256: a9e4e77aa7b86e4a49d2c7cc9b6ad3c8219c393e3a53720b5c3cb275f753481e SSDeep: 48:P29kGib61fCw8PeOl6LcV8ILvz2kplB2J2b59Jx/FMXpZmwhqJjm1:P29kGiVw8GOlT1L6kbIa5TxSXpCjm1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.39 KB	MD5: 8665c80851a64c639cd96e20d353af1d SHA1: 4a22f7efef58fff1dedf349c4c3e66f50f889da6 SHA256: dd790d9e040baaab37d5e7e30be4499c773114b05db153a8231ea3e20e9c1f06 SSDeep: 96:JBVGD3426il/VZYDV1UA4hCcuOf8SvQSqVhYzsio10mnKHwQBl4KCVc8Dbm1:K4UfeiBfCLhcg3OLBuKebO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.31 KB	MD5: 26f76662b8df6d011b6e156d1d21f891 SHA1: f2a442cd1653175f286b4e332d727061a60411ab SHA256: 3e69fbcdb3903812e229fac8b5082fcfdb718e205b9a2bf6b05c31fc7f173f2c SSDeep: 1536:2ryuHgzZvs4X8eVgOXpSUsKru3W9VRmuIu3NcAjI66+JJHuV:2lHgzFseVgOXpLZK3iauLOV	... File Actions Show Properties Download
C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.24 KB	MD5: c3c191e70fc15912d4765d30fa4708a0 SHA1: 67f3c942a9a4bda61a68a4d2f8b8a714e173a0c6 SHA256: 00891bf78145e43d8e53b13f2a5348053c9993146ce6ab8712267caabb75ff11 SSDeep: 1536:ECrOPcVe5nS3JEXiMAtY/oF4gXgD4juaqg5nY7Ej:EC1g5S5brrXgDiqUY7Ej	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.00 MB	MD5: 33fcb3da735ec37c72f726ee8ce7e311 SHA1: 984d6d2b86dff7cc8c3e17ad95ae05c1747ffc04 SHA256: 2d91196af303bd0909105e96f6a4e8455290f97a2585371753f4cae934eec5cf SSDeep: 12288:9vzI9uDGmlVWZRJndFCMKuFPdUA8MCCQsv3PJ+PoWDHgJbo9MkVoJiSOdTGnXzPF:FzDNWTJnyMMB1qdJNkVoc3CgBmHhg4yO	... File Actions Show Properties Download
C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.07 MB	MD5: 646fa9da34dda09b99334c937015a348 SHA1: 0ea6294991c8a9d3c154bd717d14ab2038febb27 SHA256: 7393046a91f08ac13f42847540a6587384bcae27242eb866049db6ef12e1be81 SSDeep: 24576:G/DcSVeSuuaZCP+8uK7Kw/zPeZv8zXCYTJg4r29dDtpIfz:wgSnuFZCOYbPeZUzXNlg4rKnpQ	... File Actions Show Properties Download
C:\Logs\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	68.27 KB	MD5: 2a1643eec0bc82464a194a90c3ba6037 SHA1: 4e61ceeb9de1de0cafe2beb7673120ef6ccee304 SHA256: e6e29f4116184711498c014ea1e30622aa980e46e0350e001b7f0cf7d52dc7b4 SSDeep: 1536:8WGV4E+FgoMPixwmBH01YY5QWYP2Kq0OfH+0EtKc0ZhmgARXvi3co:8ZWNFatmBH01Y6YOv0K+0Et90Zhm23B	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	4.31 KB	MD5: e2ed741fd329cfb098acc864f327aa19 SHA1: 39d53aac2f942c41430b7a93ab52735563369c18 SHA256: 8527a92b244c67a47a04bce8b6daad8f7587a47fe15a9dbee9fd8e2c4e3b4ddd SSDeep: 96:8DHabLjDZrs4ad5EPCywlxyD6cTGH217dsj6s7J4OTShkQbm1:8D4BrK8PY6mHHssj6Z2ShkSO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.79 KB	MD5: c56955ed08b8af5ba98588a154eb5836 SHA1: 987c5369323b191484dc4be74ba7ca0e5d956417 SHA256: 0758f26a87af8fddd046ebcb1e72e90d10fae9f84369e366da7409f3813c4b07 SSDeep: 48:leXGMn4sgii29iUDo1HJsxMNhpHFG9gm1:en+i5SsxQFFjm1	... File Actions Show Properties Download
C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE	15.86 KB	MD5: 75ad31f7125f5071525c4b666f86bdf1 SHA1: 3969a41809795d81591e149b1d8072020a9184ed SHA256: 505afbf52b7711f8413a7cd53e6db47c6a9b5be26814fd41d698917cbf283161 SSDeep: 384:AFfSjIqxqeY+eXOREYPwgs0Ae//DFVRkw3TlSL5ABb:AEjIOVAORp1B/xUwpSLY	... File Actions Show Properties Download
C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.07 MB	MD5: 842b3215121f7dbe1135616f55ea1033 SHA1: d1c7870b1cdd2476acf4f5459c3546d2165b1667 SHA256: de5af69dd5e5867106944e8ee8ec50bf942051062206a4253393e0bb6f350446 SSDeep: 24576:Uh5IGpBlAjCbIqYbrxW2LOZwORjbmXwfmg7n2cuHqUjJH0l:s5IG5A+bIpbrxEwyXjd71qqCJUl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.42 KB	MD5: 27a73f43f44fd04de616afcd16f0ccd8 SHA1: 7ba92eb7ffe53e93c20f9ebe2f879091d87884a8 SHA256: 45bd39bbff65f283b79c24c9114b8fa2930e8eade741ef00371847758a497607 SSDeep: 24:zfK4F2EUPI9MeVZmSom1MaLmIVxBIn5BNL/TYaxJ2SSscWjEaRmC:DyqLmSNLmIY5BNL7Y+J2Hm1	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.47 KB	MD5: 25d66d185d94593f27b04080ff9ae2c4 SHA1: a2ca53f67af3612663d3336ac11cc9abebac0b1d SHA256: cf9dc9822e753099d0421cf0e8fb5a00c090c196534c284496e7a615fd44c3ff SSDeep: 384:V3QL8ob3NyYiwO+PNNRA+fT0XvkCUmYl7dflULLialo7KItPv7Sa9OTe4cvv6nc:pQ4ob8pw/g+fTavYXflUP/o7Kkv7Sasa	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	20.99 KB	MD5: 663fa2495de6ae63343c74ef37d20163 SHA1: 0fdafb22e68f4840c95eb980c43857a667a9d8b4 SHA256: 470d49ef6262a88b8f844cbd11db9b0be26eba9e90d45a4ce1cbe9dc57defd16 SSDeep: 384:wxm+f02DIijcDEMc8qjwImIkYTfyzy/kIoP1DIMalVw3Yyzn:wx77DpqEMc8uhnTezgkIoP1DGw3Yyzn	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.48 KB	MD5: cafe1da7aba42d4a6577079e7e4b6cf7 SHA1: a69a2a866a553c9ecdeb37ebf53323c2d20bb9a1 SHA256: 2333663c93adc28c2cb34bdd5afff3eb77463e1b9cb911f4d8f5c1ed29cf4fa0 SSDeep: 384:EIS4jBAs43zu5qB65vGIq8sjVP2EQAZi6CXbf91WT7r7QIMUgP:E/gBA13zNiOIq3VuEQbXHGfQ7P	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	11.63 KB	MD5: 04cf91a14f33cc1b83d915d708ada0d6 SHA1: 0c4f2ecc953f9bee700dcbbbae3a912ce4c36c88 SHA256: f686b6128b5fe47be227bcd91b0a25c927a9f65ccd30172c9d3e42da8e1d6c17 SSDeep: 192:XNOrxg0Tx9KTzKUCVRt9lfcGJ/Zw3LPl/CjLefOagvA5UkXJQVCt1fRp9w:d+x5V0CVRXlEGo5/C/7adB5Qot1fq	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.97 KB	MD5: 25dbd64ba8bd9bce9c8177a382a53599 SHA1: bed5e092a6755a26375770062ee4a643d6169cee SHA256: 28b30ec8e208893a17ba45ba6c3145570816c7f1d1310886066e1629ce95a6de SSDeep: 384:gAHCUM9uvKBoD6dOCPubKBijudbAHqlR45O6NLM+UrhVKoPmrs6alDnQUY/P:gMnMWwK6tPubcd65O+A/lG3qzjY/P	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.47 KB	MD5: 42fdfb5cf80c0f82cd6051e34ad86c27 SHA1: cbadb47d37103630498fd58457388d2f587e4835 SHA256: 1a807fc750d0e0f58488837dbceda53ce9080c6649b51ff0f2cd4033ee21eeb7 SSDeep: 384:plTtcsUMMPBP9TtUnCuZU5Bi/DCBZUhs1vV0XqwMNgZQ1nCnv+Z2:vtq9TtgCFi3sNSXqWET2	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.99 KB	MD5: e4bcb38a0164ef4cc0f4c62747c5399f SHA1: ab531d243436129cb1455d01c4adc792be2f9f62 SHA256: ab067159b074347345004ed5582d35da57d3c7ea26ac0724976990a1136dac82 SSDeep: 384:iaywMseyFdlj5JVVL2+TMtbuE/LNsrdnAbXxfun/kNp1aH:AaFbj5XVaWMRu6LWnMXxfuUY	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	22.47 KB	MD5: dbfb468a8c1c31a3b3f74f3500179d03 SHA1: 8369f9919da72b6839290e710c7ac6e7c7cbe7cf SHA256: 25f2f8f1243705d0bac444a6dd26aefbf7fdb7b6d1e8dda403071244ddce9a42 SSDeep: 384:AB86Cbi0g6mcnn+MWBfULqUevfH9UDwg95olTbrckJ5NXNGV86E2kqmoaNHDsMHb:AB8c0g6mcnn+MIf0GP9UDF95olvrvhGK	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.47 KB	MD5: e3fe9157b5dfd0dbb4f26804e73a9bdc SHA1: 618466deae2bf30f2df2f1fe62870ccacb4d844d SHA256: 4eb7cdf7a15057d7f85bc0ae726e8b23adbf766ff1630daf32390c4df9c148c2 SSDeep: 384:kRVRTjSk9zHl5yzeddIL49VL2NdYEPbfNlhEp4FXukt9Y3:GLjDfyzGdIs9ANdbPhlOp4th3Y3	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.98 KB	MD5: 095aff232dbfe87a39158e6c0905a388 SHA1: d26413d7d5a5d613b7185f99aa0f6b6395d15c2e SHA256: 4283928b1066bb11bbeabfcf9536733da1ef9a6ca65ce4291a82ca9b34a9a042 SSDeep: 384:Pht6EHIg5U5GgLzJf6Zq2GjlyzxSDr/wHEMsu78jaFIk691e:OEHM9L56gTjCxwj678jr1e	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	20.48 KB	MD5: b366f9b33cb0aaba5d54cfdb7ff8da53 SHA1: 56e48e7b2eebbed6b2bec635253013c3c5d7615b SHA256: 51cf88eceaca52cee7139af80841eaf526b7d56cd97ba0995fc8a51480bed9e3 SSDeep: 384:G1DNjeLrdZWn8snBr4Ms433jkkRESlu8gI6JD6cRZS2GAxOCJIpo:GJjeXsnBrM4Dkn8ofPS2RDz	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	27.47 KB	MD5: 87c45cabf3086ee9eda59cf05f0a6943 SHA1: 3e438a968240e7b825c6fe35430f4c6c0495acbe SHA256: ca390d2a896cd5c868c88a69a41cb8949e7a7e067c463472870d482c4e6235b6 SSDeep: 768:ouO+NoT9jPVT+HjVg97JuCwEyApNVYdF+oEN9yiaR:oJdKj4dZwE5i+lWiw	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.97 KB	MD5: ac582703da3e89add73cf81ab296dc8b SHA1: 40ea14d93f7e20567121b483716842d11b0b7e82 SHA256: cac7e57f7b68b75d96a5934baa1de06d7e9eb8affaaf88a0064a471360680afb SSDeep: 384:5pRS6mu4uwbXORtjeZPMSBG9LzaHDWr2SvH/xvlKJ9+fnXz3Qbb7LYEJN:5p8Ru4H+RtKtBGvaHw5//zEQEj	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	69.47 KB	MD5: 311d8b3fec2c5f37afd95219c0a968e8 SHA1: f8e246c44ffa613b2ce8dd0f77c97bbd2ffabe02 SHA256: d46f4968e86ba76e74533dd462591e30b551f181b5ff87cfea03578e1d702f5c SSDeep: 1536:MOFKBnV9Ekc+vuZG4n5fIf23cWb2I/kAaIP9bRjcf:fKHEkc+vkG45dQI/cI1m	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	26.48 KB	MD5: 6a4a342b992a6d494e5f627a43d0aade SHA1: 645be3fdddcc6203f3da157c87ae45f73488dff9 SHA256: fd06d3f78f50fdc7899f5575a2e787f01b0f0f7699cbda297e6b95af1604600d SSDeep: 768:o/w8pDu5w+iOljl48TOPmnglyPGjHJ8ZZYyhrk:uw8pKaBCl42OOngzzJP	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	19.47 KB	MD5: 8a4f88f511b43b5d320b02492a895b32 SHA1: 52ea4901bfc50f71f8d14000121c900014a12c0b SHA256: 6efb0d48f1df8e8c51610b7fd7860eb3ff8176be70e8ef23a62ee341550c40d8 SSDeep: 384:RU0vLnszauAof5kzV5Iy8P6LBMbUKPSi1WXQIMVsbm3MHNqHuHq:RU8IMoOAy8P6LmpSiMQibXwD	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	24.47 KB	MD5: 12c65bf17d43527292e579da7886fefc SHA1: 5c40cc57da0033c776483cfae540d7140aa2e743 SHA256: ced0493758d2abfbc014c7a01f22f9e2f0519bf11ef1750c6a789f85fd5ee92b SSDeep: 768:YtRQaT36dILMPT2wjbzsismKBn0gGyJuFQQYc:YtRv6aw4ixKVCsuFEc	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	18.97 KB	MD5: d93326fff4404baa3f0d5196df5c857c SHA1: e05de04783cb400bbfce5b0d4a2294dad6a83926 SHA256: f6aa96b69463ff61f900796396b9a2f325a28d33a39e3d875a782d9a899c1bcf SSDeep: 384:C/Toz9l+VigKat7mdg4V3NxyZve6ha/n9BNKxJZGd2CbY:3RgK3gc3fy5haNKP	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	20.97 KB	MD5: 4c210aa897e2aa66fafc6fcab932cf6c SHA1: 20b0055546812ccdfd7673194485f778244c7951 SHA256: bca2d4b8a6156107201e8fe9cd711ea06b8399bd67836cb31006a3a58448296c SSDeep: 384:KsWRiW1YFnDEocHnU8z1Vm7KKJVK5ZdiTmuYKGk8EtLPNfsBncTFuDjLnOuPP:Krb1YFnDEyM1VmJadLKGkLtL1fs9K6j1	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	22.97 KB	MD5: 3eb3c93c359957eb88140b40e122bafd SHA1: 46eb96ac3404d0ad3f08a791279b197c76ae134c SHA256: af083b4577b43ae87b7b412e2af3710579b46e802eb23f6fd7ee30314aa493f9 SSDeep: 384:A26p/gUTTNADExPxc9bT14DYrT3Fj3RjwBX2fWO1N3DJ34172rMNqsxHTnpd3HV:f61gUTZA4561hrxG6WO1FlK/znfF	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	24.47 KB	MD5: 06c4787bbee55e2e4e5af4c3582505fe SHA1: 1c83c10764ae62269a4e4c4d174fc6e6368a4862 SHA256: 18a52fdc67c393c80d4eda13d004e3aaf8bcdbbc95b0973559e450bf2fa04e4b SSDeep: 768:Hp6oCVv4IhjQf4gS6ALFKMCAyci7zB4Yj3PyPwOE:J6RB4IVYS1FK77ciV36oj	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	462.92 KB	MD5: 57b41f923bf359d535f178d847c4a33b SHA1: 839c38d2e569c9d6ada2fcd1a54a528ca73cce3c SHA256: ec3a504f66fdb577d015ddb2363104aced3857c68a8bde9dde05136b9ae19450 SSDeep: 12288:WnFi3h/BcALvOWql+0uDi29vUT086SnglHU38P3Ihj:WnF8h/BjP0WhnMgl03a4hj	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	387.92 KB	MD5: 27be09be2afb5a05056e6433efcb76af SHA1: 5ad38baabfcceeed5612ecac24ab12108977b6f6 SHA256: 56a4bce50f28e577a6eee5cbe039d5ffce189fb2521da82e9701f7d872ef616a SSDeep: 6144:mKRKBHT4kpE9UAsX60gHCj8d1Qv6xe8uwcqNndo8T1zQjTHsTZzVJmwNJDxKd:mKR6vk26cBquwcqPBzQnwr+	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.43 MB	MD5: 7182e15b4afc1ed68044042a4f3b9fbb SHA1: 978bbc7f5f6f48e8c34803d523dc3592760ce4ac SHA256: 80e79d6f6c10f27e45a37019df93be681f107de7b5f7a54f1692bc007b6fd457 SSDeep: 24576:d+iCZUPGCkqQ9gkHzxBTEWxek5PYWzcP++BAvkpd/IpKW+jRzi:aU0NzxBTEWxeKwWCBBAvk7IYvi	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.93 MB	MD5: 8b4c97c0a4910e044cdc212fc4582905 SHA1: 008c458e4cbb10c2d97af19ec79b4b749da713cf SHA256: 66c834ff049557014f6163f2306a2b913f5760108608834406ceb2b22b1d9405 SSDeep: 49152:ZNl0YWr5XbaUlTl5uquRBxvuSTnOdjIG/BUN:X6BHuRB5lOd9/KN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.07 KB	MD5: 67579aba83f89088174cbba5b6be9a8e SHA1: 59be0e30417a33f9685e668627ff269971b57633 SHA256: d8f3193b03bc6d26f4bb177ab38548a8953cf4b42f6610528afe0936983df5ea SSDeep: 48:4N5F3X6aCPq2soBpy3/JImS04bPRmSm3YNR7TukBm1:4N5F3qanw4CJbPvpfLBm1	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	500.46 KB	MD5: 3f6acfc96b711584891b59d0dd2800c9 SHA1: af06f0c9c6c7e3b4faf069c8334fcdecea0478ee SHA256: dfb636a33bb5b65ab27d6263c9299ac8d2cb580824920f243cde3452899123f3 SSDeep: 12288:GJD0NUaGOLX6TyOLIbOkQDzUR++nAq3eGCiXpM4Wm:blGOLOcWSnX3Jn59	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.71 MB	MD5: 1d4769c9dbd1fc47de4b6f4ddfd453bb SHA1: fb2abee041ef253bee3257c3819205a2923d76eb SHA256: 11534cccc367f3543097508c5aec360f7bf63b382635d2e6fc14a8bbd11a3026 SSDeep: 24576:J4uRh4AF7vfjQyiuBBa/MDexVQiAVPmabrqEM9mDa1RMLLYBuWYnl81k:nOAFjtiia/fxVQiue8mrmO3hJYj	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1.15 MB	MD5: 1fe157b88328f53179b8b5bf1d662899 SHA1: 67b59287a351f43c507ec82224d10b8b64bf187e SHA256: d95d9a2cb592826b78b9bd3f7ae295fbd0e296e7fd938eae71608d7eac4a9211 SSDeep: 24576:+OfAxDaZ9wn54ugpbYM40P7oO0oUrQ8+yaZw0nVR8D22XsCeIJ4:HyZ54uAYM4t/QGOTVFEsCb4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	881.42 KB	MD5: 01dc1ca006648c767f0eaa0ce38b990a SHA1: fce4c7da540b442c0d56a3e62895f1a25e7b6a46 SHA256: 53f34f6c23f1c686ef63820f5129b529ba4e6c0d8cc14667176fa6c073811632 SSDeep: 24576:5gRYZ52e1jSzEOZLU38FUuJLsdn1ogCy4rB:5gOmeIZ23aJodnujy4rB	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	257.96 KB	MD5: 0de1fdc94cc6143f251de609812afe00 SHA1: 655ff48885b96f554d9551507957ca3896ad69b5 SHA256: d0cb0ec42435b0129d41806813d32c501e63b198ca8813367359ecbdc04f7140 SSDeep: 6144:qNwGD/wodIFGPli3wDNIJ75NsLNxHUT/KS:qN1V+FiiAm40L9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	5.38 KB	MD5: 40eec0ef7b1246f3d25d1f29fb0b7408 SHA1: 55b651a156cf3fb734cac8bd561526d4d8a1cdf9 SHA256: d969bf43659624a7974cb791489019db4bd2228fc8a02444f66e7cb09d43ee1b SSDeep: 96:I/9dE6RcM2XLJwyxBVKkfQo4kq8HMgu2LbDcIiQZ80X0I5hOZaFAEJO/6mb:eE6RcMT2PKkukq8fu4DcMZpEI5hxPK6M	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	325.40 KB	MD5: 87a695248fb045ddf637235d6244b6ee SHA1: 9adf3412e5c0f193741b1ef65dcfe3c3d62d3e5c SHA256: 0ee9266f14067ee2cc57d269dd151ced5dc12511bdaf3a4866874eca2c2395fe SSDeep: 6144:UZpzCFCX/yV6Cx3S0GWqCoswOP7sCx4HByEhVBnYI+g:UjrX+l3S0bZWIFx4Hjnf+g	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	30.64 KB	MD5: feb11b39bbdf6eac10b74a1059da7207 SHA1: 73596b74678674eba6aedc62cc3e68e7bf526e76 SHA256: 5a5dfd6151f56d034cf68d52cd8619ce01c96973979b2bc66a6a6574ddac29ad SSDeep: 768:7eokeOd3LvZq0m22fJPt99GcWVhSc24NATvWfSTsFmKeWj9O:6onaLhq22fXGcWHSFLv8STsmEj9O	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	801.43 KB	MD5: 9c59d138ff7532ca2a3b563bac4e9b83 SHA1: aa41c02aace9c898947e74cc5f6829f5ac4ebe4b SHA256: ee12d06ed667d77b7ce7d65adadf85e8857c6d57cdbb0e534abd1eb553326cd2 SSDeep: 24576:g2VbUY77Onio9uzbKdOsyzClXIOlG5wEFGIgc9WV:1VgBSwq5wEFacQV	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.33 KB	MD5: bba94811b26893761aa03b820367789b SHA1: 0f24aa69411be9b69ba144176b2af70c51469552 SHA256: ea35a6cbfe79b712f47bb78cbc517dc952aa1a78ce5bc587204d260d741dbda8 SSDeep: 6:wP5o388r9CZAovDYmDdcSdpOD9pjU/kVfDxTJHS0Z+JqVF47l:wP5os4UAob1dcSdpOh1U8fDhQ0soVFK	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	350.46 KB	MD5: 6e4f806de510aabb6b8b3fa90cecb553 SHA1: ad2d2cf9c09fcf848e499bede0cd5db76d2f4799 SHA256: d099f020aab24cb3b0f7cccfe09ac215c3d071fca29c7e5ca570e0bfc25d91f7 SSDeep: 6144:RJrPPHOeG99eZgpTIYwiaCI3gdork7RQ8tbATN8tFbzIl3sa/TyelJ9hP1viiRwQ:LPHFo0Zgu8jI3AWU8iPgl3sKTplDh9q2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	37.32 KB	MD5: 05054307557a75537d0ea1edff94f8cd SHA1: 582814316336f11f08ce1b8e0623fb496269520c SHA256: 7002264d230912eef078b9b21f1849ac2775d7bdf6cabf6707c32cadea0a5537 SSDeep: 768:YNWaMECG9LgH3/kgo3xVragn3lYKiY4udWRRWpYsU4+SaXkC3NYb1+0+bO:muYxgoCgn3lFuudWPlPbPYh+nbO	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	6.44 MB	MD5: 03256600a987ed04a422ad3e423978d3 SHA1: 0ca5af0c1bdbd0e866a8f7661d56415843c8a3f0 SHA256: bbe8a383172f7d26030db52006186bd38e0ac4abd2ce5dd0b84ce2fe28c7c09c SSDeep: 12288:/LBc9bGV+uPxI8KqyAskPcgsg0M3R18bqXo/6w3ZMxNDi:zBc9b6xjOkUgs8Rvi6w3	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	973.46 KB	MD5: 28f9e596ab3031fc94d7382b03914800 SHA1: 9d70ed88ccb90279310f4f413b26849dcdc5a52b SHA256: dab84763c8be9554146a5b2169a81b363026b4dfcd21eda399686487fb1ddeff SSDeep: 24576:eELHIfsfZPk+OyWm+B+h3DPJcgAss2U1A1XP0FxdjosQNI:9oEPk+OFhB03DPJcgAss2UG50FHJQNI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	0.93 KB	MD5: 718b8bd96558b4d287326a83ef3ae955 SHA1: 809d04b919acb733f3d62f3062944b82e122f5dd SHA256: 9e14eedfe3bedc2ac396f9cc53ea5c71ee073579c88f2af263b75e6647811664 SSDeep: 24:gPLRQOKD4QJgpVrVVGdIzlVnfhIAzLa+BFWjEaRmC:YJZ8AlVZIAzLm1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE	2.12 KB	MD5: 6761c66920f05e86d2c679ccd9d77bdb SHA1: a24e1c5adb1acad61a8221bfeda0253e2b3fcbd1 SHA256: 6fe0ffd26e46e6d7d75b58de9d9b8d5bb75cb405b9bacb24fd7f09fc4bdc1b49 SSDeep: 48:JnDVvnJfJ5bYw9VIFOcfuc5MzQrx0mhzJIPCsG8etqOm1:zfJfcoU15Mkrx1aPCr82m1	... File Actions Show Properties Download

Threads

Thread 0xf08

424

Category	Operation	Information	Count	Logfile
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindNextFileW, address_out = 0x75efee40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindClose, address_out = 0x75efed70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MoveFileW, address_out = 0x75ede500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileSizeEx, address_out = 0x75efef40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileAttributesW, address_out = 0x75efef10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetComputerNameW, address_out = 0x75ed32c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetComputerNameA, address_out = 0x75ed3780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateMutexW, address_out = 0x75efeb70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = lstrlenW, address_out = 0x75ea6c70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = lstrlenA, address_out = 0x75ea6c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalDrives, address_out = 0x75ea0d20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount, address_out = 0x75efdd50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenMutexW, address_out = 0x75efebf0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForMultipleObjects, address_out = 0x75efec80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiW, address_out = 0x75ea6bf0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = lstrcmpiA, address_out = 0x75ea6bd0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReleaseMutex, address_out = 0x75efec20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceFrequency, address_out = 0x75ea5dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileAttributesW, address_out = 0x75eff100	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVolumeInformationW, address_out = 0x75eff020	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindFirstFileW, address_out = 0x75efedf0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreatePipe, address_out = 0x75ea4590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetHandleInformation, address_out = 0x75efeae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringW, address_out = 0x75ea4430	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringA, address_out = 0x75ea4410	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTime, address_out = 0x75ea54e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SystemTimeToFileTime, address_out = 0x75ea67a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateToolhelp32Snapshot, address_out = 0x75ededc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Process32NextW, address_out = 0x75edf8f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Process32FirstW, address_out = 0x75edf750	1	Fn
Module	Load	module_name = advapi32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenSCManagerW, address_out = 0x761d0540	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenServiceW, address_out = 0x761cfa20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = CloseServiceHandle, address_out = 0x761cfc00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = ControlService, address_out = 0x761e26d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = QueryServiceStatus, address_out = 0x761d2380	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = EnumDependentServicesW, address_out = 0x761e2f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = EnumServicesStatusExW, address_out = 0x761cfc80	1	Fn
Module	Load	module_name = user32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SystemParametersInfoW, address_out = 0x74b9f210	1	Fn
Module	Load	module_name = Shell32.dll, base_address = 0x76480000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\shell32.dll, function = ShellExecuteExW, address_out = 0x765e4730	1	Fn
Module	Load	module_name = ntdll.dll, base_address = 0x77bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
Module	Load	module_name = mpr.dll, base_address = 0x74500000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\mpr.dll, function = WNetCloseEnum, address_out = 0x74502640	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\mpr.dll, function = WNetOpenEnumW, address_out = 0x74502790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\mpr.dll, function = WNetEnumResourceW, address_out = 0x74502410	1	Fn
Module	Load	module_name = ws2_32.dll, base_address = 0x746a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAStartup, address_out = 0x746a5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = socket, address_out = 0x746b4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = send, address_out = 0x746a5030	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = recv, address_out = 0x746b0c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = connect, address_out = 0x746a5410	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = closesocket, address_out = 0x746b0910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyname, address_out = 0x746d6cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_addr, address_out = 0x746b9160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htonl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htons, address_out = 0x746b8ff0	1	Fn
System	Get Time	type = Performance Ctr, time = 27905287057	1	Fn
System	Get Time	type = Ticks, time = 279015	3	Fn
System	Get Info	type = Operating System	1	Fn
Mutex	Open	mutex_name = Global\syncronize_P4AHB8A, desired_access = SYNCHRONIZE	1	Fn
Mutex	Create	mutex_name = Global\syncronize_P4AHB8A	1	Fn
Mutex	Open	mutex_name = Global\syncronize_P4AHB8U, desired_access = SYNCHRONIZE	1	Fn
Mutex	Create	mutex_name = Global\syncronize_P4AHB8U	1	Fn
System	Get Info	type = Operating System	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 32767	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\11.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\WINDOWS\System32\11.exe, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1048576	1	Fn Data
File	Write	filename = C:\WINDOWS\System32\11.exe, size = 1048576	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1045504	1	Fn Data
File	Write	filename = C:\WINDOWS\System32\11.exe, size = 1045504	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 0	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	1	Fn
Registry	Write Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, value_name = 11.exe, data = C:\WINDOWS\System32\11.exe, size = 52, type = REG_SZ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, value_name = Startup, data = 83, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\11.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1048576	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, size = 1048576	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1045504	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, size = 1045504	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 0	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\11.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1048576	1	Fn Data
File	Write	filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, size = 1048576	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 1045504	1	Fn Data
File	Write	filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\11.exe, size = 1045504	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Desktop\11.exe, size = 1048576, size_out = 0	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cmd.exe, os_pid = 0xb10, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
File	Write	size = 65	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 32767	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\11.exe, file_name_orig = C:\Users\FD1HVy\Desktop\11.exe, size = 32767	1	Fn
System	Sleep	duration = -1 (infinite)	1	Fn

Thread 0xf8c

5239

Category	Operation	Information	Count	Logfile
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
Service	Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Service	Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Process	Enumerate Processes	-	2	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
Process	Enumerate Processes	-	1	Fn
For performance reasons, the remaining 987 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x7b8

Category	Operation	Information	Success	Count	Logfile
System	Get Computer Name	result_out = NQDPDE		1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)		22	Fn

Thread 0x904

151

Category	Operation	Information	Count	Logfile
System	Get Time	type = Ticks, time = 280312	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Get Time	type = Ticks, time = 281906	2	Fn
System	Get Time	type = Ticks, time = 283156	2	Fn
System	Get Time	type = Ticks, time = 283421	1	Fn
System	Get Time	type = Ticks, time = 284812	2	Fn
System	Get Time	type = Ticks, time = 285015	1	Fn
System	Get Time	type = Ticks, time = 285343	1	Fn
System	Get Time	type = Ticks, time = 285656	1	Fn
System	Get Time	type = Ticks, time = 286687	2	Fn
System	Get Time	type = Ticks, time = 286890	1	Fn
System	Get Time	type = Ticks, time = 287546	1	Fn
System	Get Time	type = Ticks, time = 287671	1	Fn
System	Get Time	type = Ticks, time = 287765	2	Fn
System	Get Time	type = Ticks, time = 288437	1	Fn
System	Get Time	type = Ticks, time = 288796	2	Fn
System	Get Time	type = Ticks, time = 289000	1	Fn
System	Get Time	type = Ticks, time = 289109	1	Fn
System	Get Time	type = Ticks, time = 289203	1	Fn
System	Get Time	type = Ticks, time = 289437	1	Fn
System	Get Time	type = Ticks, time = 289781	1	Fn
System	Get Time	type = Ticks, time = 289890	2	Fn
System	Get Time	type = Ticks, time = 290156	1	Fn
System	Get Time	type = Ticks, time = 290265	1	Fn
System	Get Time	type = Ticks, time = 290375	1	Fn
System	Get Time	type = Ticks, time = 290484	1	Fn
System	Get Time	type = Ticks, time = 290593	1	Fn
System	Get Time	type = Ticks, time = 290812	1	Fn
System	Get Time	type = Ticks, time = 290953	2	Fn
System	Get Time	type = Ticks, time = 291062	1	Fn
System	Get Time	type = Ticks, time = 291171	1	Fn
System	Get Time	type = Ticks, time = 291281	1	Fn
System	Get Time	type = Ticks, time = 291390	1	Fn
System	Get Time	type = Ticks, time = 291531	1	Fn
System	Get Time	type = Ticks, time = 291640	1	Fn
System	Get Time	type = Ticks, time = 291781	1	Fn
System	Get Time	type = Ticks, time = 291921	1	Fn
System	Get Time	type = Ticks, time = 292015	2	Fn
System	Get Time	type = Ticks, time = 292359	1	Fn
System	Get Time	type = Ticks, time = 292765	1	Fn
System	Get Time	type = Ticks, time = 293406	2	Fn
System	Get Time	type = Ticks, time = 294203	1	Fn
System	Get Time	type = Ticks, time = 294593	2	Fn
System	Get Time	type = Ticks, time = 295140	1	Fn
System	Get Time	type = Ticks, time = 295578	1	Fn
System	Get Time	type = Ticks, time = 295890	2	Fn
System	Get Time	type = Ticks, time = 296000	1	Fn
System	Get Time	type = Ticks, time = 296140	1	Fn
System	Get Time	type = Ticks, time = 296625	1	Fn
System	Get Time	type = Ticks, time = 297296	2	Fn
System	Get Time	type = Ticks, time = 297906	1	Fn
System	Get Time	type = Ticks, time = 298593	2	Fn
System	Get Time	type = Ticks, time = 299218	1	Fn
System	Get Time	type = Ticks, time = 299656	2	Fn
System	Get Time	type = Ticks, time = 300296	1	Fn
System	Get Time	type = Ticks, time = 300578	1	Fn
System	Get Time	type = Ticks, time = 300906	2	Fn
System	Get Time	type = Ticks, time = 301250	1	Fn
System	Get Time	type = Ticks, time = 301375	1	Fn
System	Get Time	type = Ticks, time = 301484	1	Fn
System	Get Time	type = Ticks, time = 301671	1	Fn
System	Get Time	type = Ticks, time = 301781	1	Fn
System	Get Time	type = Ticks, time = 301890	1	Fn
System	Get Time	type = Ticks, time = 302046	2	Fn
System	Get Time	type = Ticks, time = 302156	1	Fn
System	Get Time	type = Ticks, time = 302265	1	Fn
System	Get Time	type = Ticks, time = 302375	1	Fn
System	Get Time	type = Ticks, time = 302515	1	Fn
System	Get Time	type = Ticks, time = 302656	1	Fn
System	Get Time	type = Ticks, time = 302765	1	Fn
System	Get Time	type = Ticks, time = 303328	2	Fn
System	Get Time	type = Ticks, time = 303453	1	Fn
System	Get Time	type = Ticks, time = 303625	1	Fn
System	Get Time	type = Ticks, time = 303734	1	Fn
System	Get Time	type = Ticks, time = 303843	1	Fn
System	Get Time	type = Ticks, time = 304000	1	Fn
System	Get Time	type = Ticks, time = 304109	1	Fn
System	Get Time	type = Ticks, time = 304218	1	Fn
System	Get Time	type = Ticks, time = 304328	1	Fn
System	Get Time	type = Ticks, time = 304437	2	Fn
System	Get Time	type = Ticks, time = 304562	1	Fn
System	Get Time	type = Ticks, time = 304703	1	Fn
System	Get Time	type = Ticks, time = 304812	1	Fn
System	Get Time	type = Ticks, time = 304921	1	Fn
System	Get Time	type = Ticks, time = 305031	1	Fn
System	Get Time	type = Ticks, time = 305140	1	Fn
System	Get Time	type = Ticks, time = 305250	1	Fn
System	Get Time	type = Ticks, time = 305375	1	Fn
System	Get Time	type = Ticks, time = 305484	2	Fn
System	Get Time	type = Ticks, time = 305578	1	Fn
System	Get Time	type = Ticks, time = 305687	1	Fn
System	Get Time	type = Ticks, time = 305859	1	Fn
System	Get Time	type = Ticks, time = 305984	1	Fn
System	Get Time	type = Ticks, time = 307890	2	Fn
System	Get Time	type = Ticks, time = 308125	1	Fn
System	Get Time	type = Ticks, time = 308296	1	Fn
System	Get Time	type = Ticks, time = 308406	1	Fn
System	Get Time	type = Ticks, time = 308515	1	Fn
System	Get Time	type = Ticks, time = 308625	1	Fn
System	Get Time	type = Ticks, time = 308765	1	Fn
System	Get Time	type = Ticks, time = 308984	2	Fn
System	Get Time	type = Ticks, time = 309156	1	Fn
System	Get Time	type = Ticks, time = 309562	1	Fn
System	Get Time	type = Ticks, time = 309968	1	Fn
System	Get Time	type = Ticks, time = 310078	2	Fn
System	Get Time	type = Ticks, time = 310265	1	Fn
System	Get Time	type = Ticks, time = 310359	1	Fn
System	Get Time	type = Ticks, time = 310609	1	Fn
System	Get Time	type = Ticks, time = 311140	2	Fn
System	Get Time	type = Ticks, time = 311312	1	Fn
System	Get Time	type = Ticks, time = 311875	1	Fn
System	Get Time	type = Ticks, time = 312218	2	Fn
System	Get Time	type = Ticks, time = 312421	1	Fn
System	Get Time	type = Ticks, time = 312625	1	Fn
System	Get Time	type = Ticks, time = 312734	1	Fn
System	Get Time	type = Ticks, time = 312843	1	Fn
System	Get Time	type = Ticks, time = 312968	1	Fn
System	Get Time	type = Ticks, time = 313109	1	Fn
System	Get Time	type = Ticks, time = 313250	2	Fn
System	Get Time	type = Ticks, time = 313359	1	Fn
System	Get Time	type = Ticks, time = 313468	1	Fn
System	Get Time	type = Ticks, time = 313578	1	Fn

Thread 0xda8

151

Category	Operation	Information	Count	Logfile
System	Get Time	type = Ticks, time = 280312	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Get Time	type = Ticks, time = 281937	2	Fn
System	Get Time	type = Ticks, time = 283171	2	Fn
System	Get Time	type = Ticks, time = 283421	1	Fn
System	Get Time	type = Ticks, time = 284796	1	Fn
System	Get Time	type = Ticks, time = 284812	1	Fn
System	Get Time	type = Ticks, time = 285015	1	Fn
System	Get Time	type = Ticks, time = 285343	1	Fn
System	Get Time	type = Ticks, time = 285656	1	Fn
System	Get Time	type = Ticks, time = 286687	2	Fn
System	Get Time	type = Ticks, time = 286890	1	Fn
System	Get Time	type = Ticks, time = 287546	1	Fn
System	Get Time	type = Ticks, time = 287671	1	Fn
System	Get Time	type = Ticks, time = 287765	2	Fn
System	Get Time	type = Ticks, time = 288437	1	Fn
System	Get Time	type = Ticks, time = 288796	2	Fn
System	Get Time	type = Ticks, time = 289000	1	Fn
System	Get Time	type = Ticks, time = 289109	1	Fn
System	Get Time	type = Ticks, time = 289203	1	Fn
System	Get Time	type = Ticks, time = 289437	1	Fn
System	Get Time	type = Ticks, time = 289781	1	Fn
System	Get Time	type = Ticks, time = 289890	2	Fn
System	Get Time	type = Ticks, time = 290156	1	Fn
System	Get Time	type = Ticks, time = 290265	1	Fn
System	Get Time	type = Ticks, time = 290375	1	Fn
System	Get Time	type = Ticks, time = 290484	1	Fn
System	Get Time	type = Ticks, time = 290593	1	Fn
System	Get Time	type = Ticks, time = 290812	1	Fn
System	Get Time	type = Ticks, time = 290953	2	Fn
System	Get Time	type = Ticks, time = 291062	1	Fn
System	Get Time	type = Ticks, time = 291171	1	Fn
System	Get Time	type = Ticks, time = 291281	1	Fn
System	Get Time	type = Ticks, time = 291390	1	Fn
System	Get Time	type = Ticks, time = 291531	1	Fn
System	Get Time	type = Ticks, time = 291640	1	Fn
System	Get Time	type = Ticks, time = 291781	1	Fn
System	Get Time	type = Ticks, time = 291921	1	Fn
System	Get Time	type = Ticks, time = 292015	2	Fn
System	Get Time	type = Ticks, time = 292359	1	Fn
System	Get Time	type = Ticks, time = 292765	1	Fn
System	Get Time	type = Ticks, time = 293406	2	Fn
System	Get Time	type = Ticks, time = 294203	1	Fn
System	Get Time	type = Ticks, time = 294593	2	Fn
System	Get Time	type = Ticks, time = 295140	1	Fn
System	Get Time	type = Ticks, time = 295578	1	Fn
System	Get Time	type = Ticks, time = 295890	2	Fn
System	Get Time	type = Ticks, time = 296000	1	Fn
System	Get Time	type = Ticks, time = 296140	1	Fn
System	Get Time	type = Ticks, time = 296625	1	Fn
System	Get Time	type = Ticks, time = 297296	2	Fn
System	Get Time	type = Ticks, time = 297906	1	Fn
System	Get Time	type = Ticks, time = 298593	2	Fn
System	Get Time	type = Ticks, time = 299218	1	Fn
System	Get Time	type = Ticks, time = 299656	2	Fn
System	Get Time	type = Ticks, time = 300296	1	Fn
System	Get Time	type = Ticks, time = 300578	1	Fn
System	Get Time	type = Ticks, time = 300906	2	Fn
System	Get Time	type = Ticks, time = 301250	1	Fn
System	Get Time	type = Ticks, time = 301375	1	Fn
System	Get Time	type = Ticks, time = 301484	1	Fn
System	Get Time	type = Ticks, time = 301671	1	Fn
System	Get Time	type = Ticks, time = 301781	1	Fn
System	Get Time	type = Ticks, time = 301890	1	Fn
System	Get Time	type = Ticks, time = 302046	2	Fn
System	Get Time	type = Ticks, time = 302156	1	Fn
System	Get Time	type = Ticks, time = 302265	1	Fn
System	Get Time	type = Ticks, time = 302375	1	Fn
System	Get Time	type = Ticks, time = 302515	1	Fn
System	Get Time	type = Ticks, time = 302656	1	Fn
System	Get Time	type = Ticks, time = 302765	1	Fn
System	Get Time	type = Ticks, time = 303328	2	Fn
System	Get Time	type = Ticks, time = 303453	1	Fn
System	Get Time	type = Ticks, time = 303625	1	Fn
System	Get Time	type = Ticks, time = 303734	1	Fn
System	Get Time	type = Ticks, time = 303843	1	Fn
System	Get Time	type = Ticks, time = 304000	1	Fn
System	Get Time	type = Ticks, time = 304109	1	Fn
System	Get Time	type = Ticks, time = 304218	1	Fn
System	Get Time	type = Ticks, time = 304328	1	Fn
System	Get Time	type = Ticks, time = 304437	2	Fn
System	Get Time	type = Ticks, time = 304562	1	Fn
System	Get Time	type = Ticks, time = 304703	1	Fn
System	Get Time	type = Ticks, time = 304812	1	Fn
System	Get Time	type = Ticks, time = 304921	1	Fn
System	Get Time	type = Ticks, time = 305031	1	Fn
System	Get Time	type = Ticks, time = 305140	1	Fn
System	Get Time	type = Ticks, time = 305250	1	Fn
System	Get Time	type = Ticks, time = 305375	1	Fn
System	Get Time	type = Ticks, time = 305484	2	Fn
System	Get Time	type = Ticks, time = 305578	1	Fn
System	Get Time	type = Ticks, time = 305687	1	Fn
System	Get Time	type = Ticks, time = 305859	1	Fn
System	Get Time	type = Ticks, time = 305984	1	Fn
System	Get Time	type = Ticks, time = 307906	2	Fn
System	Get Time	type = Ticks, time = 308140	1	Fn
System	Get Time	type = Ticks, time = 308296	1	Fn
System	Get Time	type = Ticks, time = 308406	1	Fn
System	Get Time	type = Ticks, time = 308515	1	Fn
System	Get Time	type = Ticks, time = 308625	1	Fn
System	Get Time	type = Ticks, time = 308765	1	Fn
System	Get Time	type = Ticks, time = 308984	2	Fn
System	Get Time	type = Ticks, time = 309156	1	Fn
System	Get Time	type = Ticks, time = 309562	1	Fn
System	Get Time	type = Ticks, time = 309968	1	Fn
System	Get Time	type = Ticks, time = 310078	2	Fn
System	Get Time	type = Ticks, time = 310265	1	Fn
System	Get Time	type = Ticks, time = 310359	1	Fn
System	Get Time	type = Ticks, time = 310609	1	Fn
System	Get Time	type = Ticks, time = 311140	2	Fn
System	Get Time	type = Ticks, time = 311312	1	Fn
System	Get Time	type = Ticks, time = 311875	1	Fn
System	Get Time	type = Ticks, time = 312218	2	Fn
System	Get Time	type = Ticks, time = 312421	1	Fn
System	Get Time	type = Ticks, time = 312625	1	Fn
System	Get Time	type = Ticks, time = 312734	1	Fn
System	Get Time	type = Ticks, time = 312843	1	Fn
System	Get Time	type = Ticks, time = 312968	1	Fn
System	Get Time	type = Ticks, time = 313109	1	Fn
System	Get Time	type = Ticks, time = 313250	2	Fn
System	Get Time	type = Ticks, time = 313359	1	Fn
System	Get Time	type = Ticks, time = 313468	1	Fn
System	Get Time	type = Ticks, time = 313578	1	Fn

Thread 0x8f0

5336

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\eula.rtf, type = size, size_out = 40	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log, size = 1048560, size_out = 40	1	Fn Data
File	Write	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 48	1	Fn Data
File	Read	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 272	1	Fn Data
File	Delete	filename = C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, type = size, size_out = 6309	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 1048560, size_out = 6309	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6320	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1028\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, type = size, size_out = 80970	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 1048560, size_out = 80970	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80976	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\eula.rtf, type = size, size_out = 3314	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 1048560, size_out = 3314	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 3328	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1030\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 8876	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1048560, size_out = 8876	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8880	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1032\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, type = size, size_out = 86442	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 1048560, size_out = 86442	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 86448	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\eula.rtf, type = size, size_out = 10125	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 1048560, size_out = 10125	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10128	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1041\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\eula.rtf, type = size, size_out = 12687	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 1048560, size_out = 12687	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12688	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1042\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\eula.rtf, type = size, size_out = 3546	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1048560, size_out = 3546	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3552	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1043\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\eula.rtf, type = size, size_out = 3046	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 1048560, size_out = 3046	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3056	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1044\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, type = size, size_out = 79296	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 1048560, size_out = 79296	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 79312	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\eula.rtf, type = size, size_out = 4040	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 1048560, size_out = 4040	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4048	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1045\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\eula.rtf, type = size, size_out = 3683	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 1048560, size_out = 3683	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3696	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1046\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, type = size, size_out = 60684	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 1048560, size_out = 60684	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 60688	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, type = size, size_out = 60816	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 1048560, size_out = 60816	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 60832	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, type = size, size_out = 79996	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, size = 1048560, size_out = 79996	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80000	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3082\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\header.bmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\header.bmp, type = size, size_out = 3628	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\header.bmp, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\header.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\header.bmp, size = 1048560, size_out = 3628	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3632	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\header.bmp, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\header.bmp	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.xsd, type = size, size_out = 30120	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.xsd, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 1048560, size_out = 30120	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 30128	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\SetupUi.xsd	1	Fn
File	Create	filename = C:\Boot\BCD.LOG, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Boot\BOOTSTAT.DAT, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\updaterevokesipolicy.p7b, type = size, size_out = 65536	1	Fn
File	Get Info	filename = C:\Boot\BOOTSTAT.DAT, type = file_attributes	1	Fn
File	Get Info	filename = C:\Boot\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Boot\BOOTSTAT.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Boot\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Boot\BOOTSTAT.DAT, size = 1048560, size_out = 65536	1	Fn Data
File	Write	filename = C:\Boot\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 65552	1	Fn Data
File	Read	filename = C:\Boot\BOOTSTAT.DAT, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Boot\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Boot\BOOTSTAT.DAT	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, type = size, size_out = 4782	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, size = 1048560, size_out = 4782	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4784	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 260	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, type = size, size_out = 111320	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, type = size, size_out = 46622	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, type = size, size_out = 181964	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml, type = size, size_out = 212	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml, type = size, size_out = 392	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml, type = size, size_out = 804	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, type = size, size_out = 488	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml, type = size, size_out = 617	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml, type = size, size_out = 16616	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml, type = size, size_out = 15097	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml, type = size, size_out = 9803	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml, type = size, size_out = 1853	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml, type = size, size_out = 924	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml, type = size, size_out = 215	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat, type = size, size_out = 805	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat, type = size, size_out = 498624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat, type = size, size_out = 1100592	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Read	size = 1048560, size_out = 174	1	Fn Data
File	Write	size = 176	1	Fn Data
File	Read	size = 1048560, size_out = 0	1	Fn
File	Write	size = 234	1	Fn Data
File	Delete	filename = C:\Program Files\desktop.ini	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, type = size, size_out = 1423	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, size = 1048560, size_out = 1423	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1424	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, type = size, size_out = 168	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 1048560, size_out = 168	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 176	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 258	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, type = size, size_out = 174528	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, size = 1048560, size_out = 174528	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 174544	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, type = size, size_out = 1533	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1533	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1536	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, type = size, size_out = 496513	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 496513	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 496528	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, type = size, size_out = 253712	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 253712	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 253728	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, type = size, size_out = 19451	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 19451	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19456	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, type = size, size_out = 763363	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 763363	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 763376	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml, type = size, size_out = 65002	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 65002	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 65008	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, type = size, size_out = 399528	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 399528	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 399536	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml, type = size, size_out = 527958	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 527958	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 527968	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, type = size, size_out = 9024	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, size = 1048560, size_out = 9024	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9040	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, type = size, size_out = 6684	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, size = 1048560, size_out = 6684	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6688	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, type = size, size_out = 517	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, size = 1048560, size_out = 517	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 528	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 3140	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF, size = 1048560, size_out = 3140	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3152	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, type = size, size_out = 10607	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, size = 1048560, size_out = 10607	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10608	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, type = size, size_out = 15308	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, size = 1048560, size_out = 15308	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15312	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, type = size, size_out = 1146	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 1146	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1152	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 13254	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 13264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 9248	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 3378	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3392	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 10832	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10848	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 1596	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1600	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 27858	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 27872	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 2108	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2112	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2344	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 2352	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3416	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 3424	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 3144	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3152	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 7668	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7680	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 7804	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 7808	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 3348	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 3360	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4996	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 5008	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5004	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 5008	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 11636	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 11648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 16112	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 16128	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 26748	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 26752	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4066	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 4080	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 24320	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 24336	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 40206	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 40208	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 14540	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14544	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 12982	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12992	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 18304	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18320	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 12520	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12528	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 1012	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1024	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1464	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1472	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 14444	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14448	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 4708	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4720	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 12482	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12496	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5752	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5760	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2644	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2656	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6996	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7008	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 9590	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9600	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4408	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4416	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 19476	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19488	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 29004	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 29008	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 1444	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1456	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 2378	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2384	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 2166	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2176	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 2488	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2496	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3896	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3904	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2436	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2448	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7176	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7184	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 10538	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10544	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 3564	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3568	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 2262	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2272	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 10326	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10336	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 40030	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 40032	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 792	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 800	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 17584	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17600	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7828	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 7840	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 9992	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 10000	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3692	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 3696	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3632	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 3648	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2796	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 2800	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2960	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 2976	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 2232	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2240	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 1804	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1808	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 2084	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2096	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 8564	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 8576	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 552	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 560	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 2300	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2304	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 2700	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2704	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 6938	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6944	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 6780	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6784	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 17308	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17312	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 29212	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 29216	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 15856	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 15872	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 4074	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 4080	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 4796	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4800	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 5260	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5264	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 752	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 768	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 4634	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4640	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 10316	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 10320	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 30414	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 30416	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 31180	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 31184	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2636	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 2640	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2472	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2480	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 1960	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1968	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 3298	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3312	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 14688	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14704	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 3718	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3728	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 1468	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1472	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2756	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2768	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5958	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 5968	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF	1	Fn
For performance reasons, the remaining 36 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0xfe0

5316

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, type = size, size_out = 6004	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, size = 1048560, size_out = 6004	1	Fn Data
File	Write	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6016	1	Fn Data
File	Read	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 276	1	Fn Data
File	Delete	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, type = size, size_out = 60816	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 1048560, size_out = 60816	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 60832	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, type = size, size_out = 77748	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1048560, size_out = 77748	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 77760	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\eula.rtf, type = size, size_out = 3419	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1048560, size_out = 3419	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3424	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1031\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, type = size, size_out = 86284	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 1048560, size_out = 86284	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 86288	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, type = size, size_out = 77232	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 1048560, size_out = 77232	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 77248	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\eula.rtf, type = size, size_out = 3702	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 1048560, size_out = 3702	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3712	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1035\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, type = size, size_out = 77022	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 1048560, size_out = 77022	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 77024	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\eula.rtf, type = size, size_out = 3526	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 1048560, size_out = 3526	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3536	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1036\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, type = size, size_out = 82962	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 1048560, size_out = 82962	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 82976	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, type = size, size_out = 68226	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 1048560, size_out = 68226	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 68240	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, type = size, size_out = 65238	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 1048560, size_out = 65238	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 65248	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 81482	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1048560, size_out = 81482	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 81488	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\eula.rtf, type = size, size_out = 6309	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 1048560, size_out = 6309	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6320	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3076\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\eula.rtf, type = size, size_out = 3069	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3082\eula.rtf, size = 1048560, size_out = 3069	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3072	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3082\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3082\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, type = size, size_out = 39042	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, size = 1048560, size_out = 39042	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 39056	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Client\UiInfo.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml, type = size, size_out = 93314	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml, size = 1048560, size_out = 93314	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 93328	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\header.bmp, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\ParameterInfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\ParameterInfo.xml, type = size, size_out = 272046	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\ParameterInfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\ParameterInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1048560, size_out = 272046	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 272048	1	Fn Data
File	Read	filename = C:\Boot\BOOTSTAT.DAT, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\ParameterInfo.xml	1	Fn
File	Create	filename = C:\Boot\updaterevokesipolicy.p7b, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\updaterevokesipolicy.p7b, type = size, size_out = 4662	1	Fn
File	Get Info	filename = C:\Boot\updaterevokesipolicy.p7b, type = file_attributes	1	Fn
File	Get Info	filename = C:\Boot\updaterevokesipolicy.p7b.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Boot\updaterevokesipolicy.p7b, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, type = size, size_out = 4136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, size = 1048560, size_out = 4136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4144	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml, type = size, size_out = 791421	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\Content.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, type = size, size_out = 27045	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\Content.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\Content.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\Content.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 180172	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi, type = size, size_out = 208408	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, type = size, size_out = 199994	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, type = size, size_out = 1600388	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 645	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 656	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, type = size, size_out = 8590	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, size = 1048560, size_out = 8590	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8592	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, type = size, size_out = 7805	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, size = 1048560, size_out = 7805	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7808	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, type = size, size_out = 153	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, size = 1048560, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, type = size, size_out = 281	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, size = 1048560, size_out = 281	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 288	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, type = size, size_out = 94467	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, size = 1048560, size_out = 94467	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 94480	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, type = size, size_out = 387356	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 387356	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, size = 387360	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, type = size, size_out = 2147	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, size = 1048560, size_out = 2147	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2160	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, type = size, size_out = 14913	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 14913	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14928	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, type = size, size_out = 9831	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, size = 1048560, size_out = 9831	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9840	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, type = size, size_out = 373	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, size = 1048560, size_out = 373	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 384	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, type = size, size_out = 7216	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, size = 1048560, size_out = 7216	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7232	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, type = size, size_out = 3251	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, size = 1048560, size_out = 3251	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, type = size, size_out = 7686	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, size = 1048560, size_out = 7686	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7696	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, type = size, size_out = 502	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, size = 1048560, size_out = 502	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 512	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF, type = size, size_out = 3484	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF, size = 1048560, size_out = 3484	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3488	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 2596	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF, size = 1048560, size_out = 2596	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2608	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, type = size, size_out = 4955	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, size = 1048560, size_out = 4955	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4960	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF, type = size, size_out = 7583	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF, size = 1048560, size_out = 7583	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7584	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, type = size, size_out = 4894	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, size = 1048560, size_out = 4894	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4896	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, type = size, size_out = 5016	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, size = 1048560, size_out = 5016	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5024	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, type = size, size_out = 4390	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 4390	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4400	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, type = size, size_out = 3120	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, size = 1048560, size_out = 3120	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3136	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, type = size, size_out = 3026	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, size = 1048560, size_out = 3026	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3040	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, type = size, size_out = 5684	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, size = 1048560, size_out = 5684	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5696	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, type = size, size_out = 20578	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, size = 1048560, size_out = 20578	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 20592	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, type = size, size_out = 7072	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, size = 1048560, size_out = 7072	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7088	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, type = size, size_out = 7968	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 7968	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7984	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 26332	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 26336	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7372	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 7376	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 6640	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 6060	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6064	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 2636	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2640	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7804	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 7808	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2492	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 2496	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3228	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 3232	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 4808	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 4816	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 26886	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 26896	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 22516	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 22528	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 16180	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 16192	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 17236	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17248	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 4924	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4928	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 47996	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 48000	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 47786	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 47792	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 15733	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15744	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 11058	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 11072	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 9818	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9824	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 880	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 3986	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4000	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 1048560, size_out = 8070	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 8080	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 1736	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 1744	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 3016	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 3024	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 27050	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 27056	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 11500	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 11504	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6256	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 6272	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3768	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 3776	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1330	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 1344	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7974	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 7984	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1712	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 1728	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 8366	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 8368	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5580	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5584	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3524	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3536	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1676	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1680	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3796	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3808	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2732	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2736	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3494	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3504	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 14996	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15008	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 2262	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2272	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 49546	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 49552	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 8256	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 8272	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2832	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 2848	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 42908	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 42912	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 20784	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 20800	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2226	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 2240	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3616	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 3632	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3588	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 3600	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 2300	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2304	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 2004	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2016	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 2024	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2032	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 2996	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3008	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 900	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 912	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 19068	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 19072	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 296	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 304	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 1382	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1392	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 13936	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 13952	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 17850	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17856	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 11994	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12000	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 30240	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 30256	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 18194	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18208	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 8552	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8560	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7878	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7888	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 8926	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 8928	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 11152	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 11168	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 13968	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 13984	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 2412	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 2416	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1160	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1168	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 12958	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12960	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 3696	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 3712	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 3988	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 4000	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1648	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1664	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 3764	1	Fn
For performance reasons, the remaining 85 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x200

5182

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log, type = size, size_out = 42674	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log, size = 1048560, size_out = 42674	1	Fn Data
File	Write	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 42688	1	Fn Data
File	Read	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 286	1	Fn Data
File	Delete	filename = C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, type = size, size_out = 156	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1048560, size_out = 156	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160	1	Fn Data
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, type = size, size_out = 129	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, type = file_attributes	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, size = 1048560, size_out = 129	1	Fn Data
File	Write	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 144	1	Fn Data
File	Read	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\$Recycle.Bin\S-1-5-18\desktop.ini	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, type = size, size_out = 129	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, type = file_attributes	1	Fn
File	Get Info	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, size = 1048560, size_out = 129	1	Fn Data
File	Write	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 144	1	Fn Data
File	Read	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\eula.rtf, type = size, size_out = 7567	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 1048560, size_out = 7567	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7568	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1025\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, type = size, size_out = 74214	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 1048560, size_out = 74214	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 74224	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, type = size, size_out = 82346	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 1048560, size_out = 82346	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 82352	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\eula.rtf, type = size, size_out = 3188	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 1048560, size_out = 3188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3200	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1033\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\eula.rtf, type = size, size_out = 6851	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 1048560, size_out = 6851	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6864	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1037\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\eula.rtf, type = size, size_out = 4254	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 1048560, size_out = 4254	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4256	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1038\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, type = size, size_out = 3643	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1048560, size_out = 3643	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3648	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1040\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, type = size, size_out = 79634	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 1048560, size_out = 79634	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 79648	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\eula.rtf, type = size, size_out = 4015	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 1048560, size_out = 4015	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4016	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Client\UiInfo.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2070\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DHtmlHeader.html, type = size, size_out = 16118	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DHtmlHeader.html, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 1048560, size_out = 16118	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 16128	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\DHtmlHeader.html	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, type = size, size_out = 39050	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, size = 1048560, size_out = 39050	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 39056	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Extended\UiInfo.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SplashScreen.bmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SplashScreen.bmp, type = size, size_out = 41080	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SplashScreen.bmp, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SplashScreen.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 1048560, size_out = 41080	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 41088	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\SplashScreen.bmp	1	Fn
File	Create	filename = C:\588bce7c90097ed212\watermark.bmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\watermark.bmp, type = size, size_out = 104072	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\watermark.bmp, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\watermark.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\watermark.bmp, size = 1048560, size_out = 104072	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, size = 104080	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml, size = 238	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\watermark.bmp	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, type = size, size_out = 4450	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, size = 1048560, size_out = 4450	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 4464	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 264	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, type = size, size_out = 48936	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, type = size, size_out = 84190	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml, type = size, size_out = 384	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, type = size, size_out = 3529	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml, type = size, size_out = 44506	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml, type = size, size_out = 737	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml, type = size, size_out = 221	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml, type = size, size_out = 471	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml, type = size, size_out = 1069	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml, type = size, size_out = 213	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml, type = size, size_out = 591	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat, type = size, size_out = 46624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Read	filename = C:\Boot\bootvhd.dll, size = 1048560, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 160	1	Fn Data
File	Read	filename = C:\Boot\bootvhd.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 244	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, type = size, size_out = 165	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, size = 1048560, size_out = 165	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 176	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 258	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, type = size, size_out = 105500	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 1048560, size_out = 105500	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 105504	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, type = size, size_out = 46	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, size = 1048560, size_out = 46	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 48	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\README.txt	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, type = size, size_out = 63933	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 1048560, size_out = 63933	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 63936	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 280	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, type = size, size_out = 145180	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, size = 1048560, size_out = 145180	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, size = 145184	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\Office16\OSPP.VBS, size = 266	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, type = size, size_out = 36336	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, size = 1048560, size_out = 36336	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 36352	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, type = size, size_out = 800867	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 800867	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 800880	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, type = size, size_out = 1124942	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 76382	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 76384	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, type = size, size_out = 2147	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, size = 1048560, size_out = 2147	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2160	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml, type = size, size_out = 215883	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 215883	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 215888	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, type = size, size_out = 343329	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 343329	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 343344	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, type = size, size_out = 357349	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 357349	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 357360	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 9216	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 9216	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9232	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, type = size, size_out = 1450	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 1450	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1456	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, type = size, size_out = 14873	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, size = 1048560, size_out = 14873	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14880	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF, type = size, size_out = 8097	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF, size = 1048560, size_out = 8097	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8112	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 11891	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF, size = 1048560, size_out = 11891	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 11904	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, type = size, size_out = 12702	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, size = 1048560, size_out = 12702	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12704	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, type = size, size_out = 12482	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, size = 1048560, size_out = 12482	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12496	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, type = size, size_out = 5253	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF, size = 1048560, size_out = 5253	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, type = size, size_out = 5315	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, size = 1048560, size_out = 5315	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5328	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF, type = size, size_out = 5030	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF, size = 1048560, size_out = 5030	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5040	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 6984	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF, size = 1048560, size_out = 6984	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6992	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, type = size, size_out = 8582	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, size = 1048560, size_out = 8582	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8592	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, type = size, size_out = 5375	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, size = 1048560, size_out = 5375	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5376	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, type = size, size_out = 3966	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, size = 1048560, size_out = 3966	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3968	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, type = size, size_out = 4734	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, size = 1048560, size_out = 4734	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4736	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, type = size, size_out = 14428	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, size = 1048560, size_out = 14428	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14432	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, type = size, size_out = 3344	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, size = 1048560, size_out = 3344	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3360	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, type = size, size_out = 1832	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 1832	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1840	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 3746	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3760	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 5836	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5840	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 3012	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3024	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 2756	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2768	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7540	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 7552	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 9240	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 9248	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6636	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 6640	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4612	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 4624	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 8492	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 8496	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2016	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2032	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4296	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4304	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 4870	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 4880	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 28948	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 28960	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 16676	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 16688	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 24778	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 24784	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 20554	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 20560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 20189	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 20192	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 9710	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9712	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 8772	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8784	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 10146	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 10160	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 1516	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 1520	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 4024	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4032	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 3780	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3792	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 812	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 816	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 13102	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 13104	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 27552	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 27568	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3350	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 3360	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 228	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1044	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 1056	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4976	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 4992	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 12788	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 12800	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3104	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 3120	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 2052	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2064	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 3948	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3952	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2422	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2432	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2966	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2976	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 226	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 29628	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 29632	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2690	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2704	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 42992	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 43008	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2952	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2960	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 14820	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 14832	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2140	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2144	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2960	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2976	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2228	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2240	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2080	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2096	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2020	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2032	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2404	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2416	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3796	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3808	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1448	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1456	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1768	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1776	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2324	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2336	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6958	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6960	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 12356	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12368	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 7944	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7952	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 14194	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14208	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 46814	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 46816	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 10816	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10832	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 16396	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 16400	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5098	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5104	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 17406	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17408	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1472	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1488	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 896	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 912	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 42704	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 42720	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4984	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4992	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3964	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3968	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2488	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2496	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2188	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2192	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4396	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4400	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 5392	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5408	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 3128	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3136	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2070	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 2080	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 228	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1026	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1040	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1528	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1536	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5798	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 5808	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1400	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1408	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7340	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 7344	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 15806	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 15808	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF	1	Fn
For performance reasons, the remaining 36 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x7fc

4043

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	2	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\eula.rtf, type = size, size_out = 3726	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 1048560, size_out = 3726	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3728	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1029\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, type = size, size_out = 72076	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 1048560, size_out = 72076	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 72080	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, type = size, size_out = 80060	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 1048560, size_out = 80060	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80064	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, type = size, size_out = 82374	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 1048560, size_out = 82374	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 82384	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, type = size, size_out = 80738	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 1048560, size_out = 80738	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80752	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\eula.rtf, type = size, size_out = 54456	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 1048560, size_out = 54456	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 54464	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1049\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\eula.rtf, type = size, size_out = 3865	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 1048560, size_out = 3865	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3872	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1053\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, type = size, size_out = 77680	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 1048560, size_out = 77680	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 77696	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\eula.rtf, type = size, size_out = 3859	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 1048560, size_out = 3859	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3872	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1055\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, type = size, size_out = 76818	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 1048560, size_out = 76818	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 76832	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\eula.rtf, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\eula.rtf, type = size, size_out = 5827	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\eula.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 1048560, size_out = 5827	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5840	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2052\eula.rtf	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, type = size, size_out = 80254	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 1048560, size_out = 80254	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80256	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, type = size, size_out = 201796	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, size = 1048560, size_out = 201796	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 201808	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Strings.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Strings.xml, type = size, size_out = 14084	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Strings.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Strings.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Strings.xml, size = 1048560, size_out = 14084	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14096	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Strings.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Strings.xml	1	Fn
File	Create	filename = C:\588bce7c90097ed212\UiInfo.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\UiInfo.xml, type = size, size_out = 38898	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\UiInfo.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\UiInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 1048560, size_out = 38898	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 38912	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\UiInfo.xml	1	Fn
File	Create	filename = C:\BOOTSECT.BAK, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\BOOTSECT.BAK, type = size, size_out = 8192	1	Fn
File	Get Info	filename = C:\BOOTSECT.BAK, type = file_attributes	1	Fn
File	Get Info	filename = C:\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\BOOTSECT.BAK, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\BOOTSECT.BAK, size = 1048560, size_out = 8192	1	Fn Data
File	Write	filename = C:\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8208	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\BOOTSECT.BAK	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, type = size, size_out = 1434	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml, type = size, size_out = 903	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml, type = size, size_out = 903	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml, type = size, size_out = 3333	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml, type = size, size_out = 247	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml, type = size, size_out = 10947	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat, type = size, size_out = 215	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat, type = size, size_out = 3380096	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml, type = size, size_out = 2514	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml, type = size, size_out = 2618	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml, type = size, size_out = 2578	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml, type = size, size_out = 3024	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 14156	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14160	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, type = size, size_out = 15276	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 1048560, size_out = 15276	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15280	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, type = size, size_out = 12250	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 1048560, size_out = 12250	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 12256	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 252	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, type = size, size_out = 153	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, size = 1048560, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, type = size, size_out = 147	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, size = 1048560, size_out = 147	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 258	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, type = size, size_out = 153	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, size = 1048560, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, type = size, size_out = 4226	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, size = 1048560, size_out = 4226	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4240	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, type = size, size_out = 955	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, size = 1048560, size_out = 955	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 960	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\AppXManifest.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\AppXManifest.xml, type = size, size_out = 5944055	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\AppXManifest.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Microsoft Office\AppXManifest.xml, destination_filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786700	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, type = size, size_out = 3754	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 3754	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3760	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, type = size, size_out = 1261	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 1261	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1264	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, type = size, size_out = 3375	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 3375	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3376	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml, type = size, size_out = 2173046	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml, destination_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786714	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, type = size, size_out = 7966	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, size = 1048560, size_out = 7966	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7968	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, type = size, size_out = 13515	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, size = 1048560, size_out = 13515	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 13520	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, type = size, size_out = 20454	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, size = 1048560, size_out = 20454	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 20464	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, type = size, size_out = 14486	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, size = 1048560, size_out = 14486	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14496	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, type = size, size_out = 7862	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 1048560, size_out = 7862	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 7872	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, type = size, size_out = 1696	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 1048560, size_out = 1696	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1712	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, type = size, size_out = 9304	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, size = 1048560, size_out = 9304	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9312	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, type = size, size_out = 1536	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, size = 1048560, size_out = 1536	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1552	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, type = size, size_out = 2556	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, size = 1048560, size_out = 2556	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2560	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, type = size, size_out = 5272	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, size = 1048560, size_out = 5272	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5280	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, type = size, size_out = 4164	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, size = 1048560, size_out = 4164	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4176	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, type = size, size_out = 1588	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 1588	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1600	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, type = size, size_out = 1212	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, size = 1048560, size_out = 1212	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1216	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, type = size, size_out = 1874	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, size = 1048560, size_out = 1874	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1888	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, type = size, size_out = 4236	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, size = 1048560, size_out = 4236	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4240	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, type = size, size_out = 5270	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, size = 1048560, size_out = 5270	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 5280	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, type = size, size_out = 31122	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, size = 1048560, size_out = 31122	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 31136	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, type = size, size_out = 37974	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 37974	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 37984	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, type = size, size_out = 712	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, size = 1048560, size_out = 712	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 720	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, type = size, size_out = 1932	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 1932	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1936	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 24588	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 24592	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 2780	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2784	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 2300	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2304	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 2080	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2096	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 2052	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 2064	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 1888	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1904	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 2296	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2304	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2524	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 2528	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 580	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 592	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 4148	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4160	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 3252	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 3264	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 13042	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 13056	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 2280	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 2288	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 736	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 752	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 37390	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 37392	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 6068	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 6080	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 8424	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 8432	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 11002	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 11008	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2108	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2112	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 9010	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 9024	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 15164	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15168	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 2332	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 2336	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 17924	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 17936	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 1564	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1568	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 4660	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4672	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 2232	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 2240	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3286	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 3296	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 3016	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 3024	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 818	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 832	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 13538	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 13552	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 10644	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 10656	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1568	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1584	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 9300	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 9312	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 4340	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 4352	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 7084	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 7088	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, size = 1048560, size_out = 2848	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 2864	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, size = 1048560, size_out = 5000	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 5008	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 5414	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 5424	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 23300	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 23312	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00005_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 68776	1	Fn
File	Write	filename = C:\Logs\Security.evtx, size = 68784	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Security.evtx, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00426_.WMF	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560	1	Fn

Thread 0xff4

498

Category	Operation	Information	Success	Count	Logfile

Thread 0xaf0

3264

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	2	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, type = size, size_out = 144072	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, size = 1048560, size_out = 144072	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 144080	1	Fn Data
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll	1	Fn
File	Create	filename = C:\$WINRE_BACKUP_PARTITION.MARKER, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$WINRE_BACKUP_PARTITION.MARKER, type = size, size_out = 0	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, type = size, size_out = 19288	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, size = 1048560, size_out = 19288	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19296	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1032\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1032\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\SetupResources.dll, type = size, size_out = 17240	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\SetupResources.dll, size = 1048560, size_out = 17240	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17248	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1033\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, type = size, size_out = 18776	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, size = 1048560, size_out = 18776	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18784	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1038\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1038\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, type = size, size_out = 19288	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, size = 1048560, size_out = 19288	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19296	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1043\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1046\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1046\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\stop.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\stop.ico, type = size, size_out = 10134	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\stop.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\stop.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\stop.ico, size = 1048560, size_out = 10134	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\stop.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\stop.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, type = size, size_out = 1901056	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, destination_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786704	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, type = size, size_out = 184832	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 1048560, size_out = 184832	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 184848	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.dll, type = size, size_out = 295248	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.dll, size = 1048560, size_out = 295248	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 295264	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUi.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\SetupUi.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, type = size, size_out = 2192672	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, destination_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786734	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Boot\BCD, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Boot\BCD.LOG1, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\BCD.LOG1, type = size, size_out = 0	1	Fn
File	Create	filename = C:\Boot\BCD.LOG2, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\BCD.LOG2, type = size, size_out = 0	1	Fn
File	Create	filename = C:\Boot\bg-BG\bootmgr.exe.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\bg-BG\bootmgr.exe.mui, type = size, size_out = 77664	1	Fn
File	Get Info	filename = C:\Boot\bg-BG\bootmgr.exe.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Boot\bg-BG\bootmgr.exe.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Boot\bg-BG\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Boot\bootspaces.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\bootspaces.dll, type = size, size_out = 95648	1	Fn
File	Get Info	filename = C:\Boot\bootspaces.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Boot\bootspaces.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Boot\bootspaces.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Boot\bootvhd.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Boot\bootvhd.dll, type = size, size_out = 99744	1	Fn
File	Get Info	filename = C:\Boot\bootvhd.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Boot\bootvhd.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Boot\bootvhd.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Move	source_filename = C:\Boot\Fonts\chs_boot.ttf, destination_filename = C:\Boot\Fonts\chs_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Move	source_filename = C:\Boot\Fonts\cht_boot.ttf, destination_filename = C:\Boot\Fonts\cht_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Move	source_filename = C:\Boot\Fonts\jpn_boot.ttf, destination_filename = C:\Boot\Fonts\jpn_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Move	source_filename = C:\Boot\Fonts\kor_boot.ttf, destination_filename = C:\Boot\Fonts\kor_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 1048560, size_out = 1	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 16	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 226	1	Fn Data
File	Delete	filename = C:\BOOTNXT	1	Fn
File	Create	filename = C:\hiberfil.sys, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Application.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Application.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Application.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Application.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Application.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Application.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\Logs\Application.evtx	1	Fn
File	Create	filename = C:\Logs\HardwareEvents.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\HardwareEvents.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\HardwareEvents.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\HardwareEvents.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\HardwareEvents.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\HardwareEvents.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 250	1	Fn Data
File	Delete	filename = C:\Logs\HardwareEvents.evtx	1	Fn
File	Create	filename = C:\Logs\Key Management Service.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Key Management Service.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Key Management Service.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Key Management Service.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Key Management Service.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Key Management Service.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 266	1	Fn Data
File	Delete	filename = C:\Logs\Key Management Service.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 354	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 322	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 340	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 368	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 324	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 318	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 314	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 312	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 304	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 340	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 294	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 290	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 352	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 364	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 376	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 356	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	1	Fn
File	Create	filename = C:\Logs\Windows PowerShell.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Windows PowerShell.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Windows PowerShell.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Windows PowerShell.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Windows PowerShell.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Windows PowerShell.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 258	1	Fn Data
File	Delete	filename = C:\Logs\Windows PowerShell.evtx	1	Fn
File	Create	filename = C:\pagefile.sys, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\counting_rankings_maternity.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\counting_rankings_maternity.exe, type = size, size_out = 75776	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\counting_rankings_maternity.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\counting_rankings_maternity.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\counting_rankings_maternity.exe, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, type = size, size_out = 15984	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, size = 1048560, size_out = 15984	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 16000	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, type = size, size_out = 18624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, size = 1048560, size_out = 18624	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18640	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 274	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, type = size, size_out = 19136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, size = 1048560, size_out = 19136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19152	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 276	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, type = size, size_out = 23232	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, size = 1048560, size_out = 23232	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, size = 23248	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, type = size, size_out = 473760	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, size = 1048560, size_out = 473760	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 473776	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 250	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll, type = size, size_out = 567512	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll, type = size, size_out = 1231576	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll, type = size, size_out = 947928	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll, type = size, size_out = 1295576	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, type = size, size_out = 512216	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, size = 1048560, size_out = 512216	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 512224	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, type = size, size_out = 820416	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 820416	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 820432	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 102	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 112	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 1048560	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 44688	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 44704	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 252	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 390320	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, size = 390336	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, size = 242	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\micaut.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 244296	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 244304	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 226	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 12448	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 12464	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 250	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 20608	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 20624	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 244	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 100488	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 100496	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 246	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	1	Fn

Thread 0xfe4

3374

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	2	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, type = size, size_out = 577	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, size = 1048560, size_out = 577	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 592	1	Fn Data
File	Read	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 260	1	Fn Data
File	Delete	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1035\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1035\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, type = size, size_out = 16728	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, size = 1048560, size_out = 16728	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 16736	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1037\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1037\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, type = size, size_out = 15704	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, size = 1048560, size_out = 15704	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15712	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1041\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1041\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1045\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1045\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, type = size, size_out = 17752	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, size = 1048560, size_out = 17752	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17760	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1055\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1055\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, type = size, size_out = 14168	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, size = 1048560, size_out = 14168	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14176	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3076\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3076\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, type = size, size_out = 18776	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, size = 1048560, size_out = 18776	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18784	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\3082\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\3082\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, type = size, size_out = 1150	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, size = 1048560, size_out = 1150	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1152	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, type = size, size_out = 1150	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, size = 1048560, size_out = 1150	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1152	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\warn.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\warn.ico, type = size, size_out = 10134	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\warn.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\warn.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\warn.ico, size = 1048560, size_out = 10134	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 10144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\warn.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\warn.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core.mzz, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 181483595	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core.mzz, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core.mzz, destination_filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786696	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\588bce7c90097ed212\SetupEngine.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupEngine.dll, type = size, size_out = 807256	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupEngine.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupEngine.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupEngine.dll, size = 1048560, size_out = 807256	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 807264	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupEngine.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 242	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\SetupEngine.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\sqmapi.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\sqmapi.dll, type = size, size_out = 144416	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\sqmapi.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\sqmapi.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\sqmapi.dll, size = 1048560, size_out = 144416	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 144432	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\sqmapi.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\sqmapi.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, type = size, size_out = 5091790	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, destination_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786734	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, type = size, size_out = 2141433	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, destination_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786734	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 302	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 326	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 304	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 312	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, type = size, size_out = 2166784	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, destination_filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786780	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 298	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml, size = 330	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 290	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 292	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 292	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 360	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 304	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 302	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 304	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 344	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 326	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 300	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, type = size, size_out = 19136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, size = 1048560, size_out = 19136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19152	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 294	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, type = size, size_out = 19136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, size = 1048560, size_out = 19136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19152	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 286	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, type = size, size_out = 27840	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, size = 1048560, size_out = 27840	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 27856	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 272	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, type = size, size_out = 19648	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, size = 1048560, size_out = 19648	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19664	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, type = size, size_out = 21184	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, size = 1048560, size_out = 21184	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 21200	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 272	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll, type = size, size_out = 307416	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll, type = size, size_out = 2118360	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll, type = size, size_out = 468696	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, type = size, size_out = 396960	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, size = 1048560, size_out = 396960	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 396976	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 250	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll, type = size, size_out = 2285736	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786714	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, type = size, size_out = 1208928	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, size = 1048560, size_out = 1048560	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, size = 1048560, size_out = 160368	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 160384	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, type = size, size_out = 902328	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, size = 1048560, size_out = 902328	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 902336	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 242	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, type = size, size_out = 332968	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, size = 1048560, size_out = 332968	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 332976	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, type = size, size_out = 3144288	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll, type = size, size_out = 4677216	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, type = size, size_out = 3177152	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 61024	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 61040	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 250	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, size = 1048560, size_out = 982720	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 982736	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\mraut.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 590523	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 590528	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml, size = 260	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 990032	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 990048	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 168064	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 168080	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 17048	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17056	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 22680	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 22688	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 236	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb	1	Fn

Thread 0xf34

3221

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	2	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, type = size, size_out = 74	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, size = 1048560, size_out = 74	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 80	1	Fn Data
File	Read	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\$GetCurrent\SafeOS\preoobe.cmd	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\SetupResources.dll, type = size, size_out = 14168	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\SetupResources.dll, size = 1048560, size_out = 14168	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14176	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1028\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1030\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1030\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\SetupResources.dll, type = size, size_out = 18776	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 18776	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18784	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1036\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1040\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1040\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, type = size, size_out = 17752	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, size = 1048560, size_out = 17752	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17760	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1044\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1044\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1049\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1049\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, type = size, size_out = 14168	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, size = 1048560, size_out = 14168	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 14176	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\2052\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2052\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DisplayIcon.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DisplayIcon.ico, type = size, size_out = 88533	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DisplayIcon.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DisplayIcon.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 1048560, size_out = 88533	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 88544	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 242	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\DisplayIcon.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Save.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 1150	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Save.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Save.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Save.ico, size = 1048560, size_out = 1150	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1152	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Save.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 228	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Save.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, type = size, size_out = 36710	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, size = 1048560, size_out = 36710	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 36720	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Setup.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Setup.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, type = size, size_out = 1163264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 114704	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 114720	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, type = size, size_out = 872448	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1048560, size_out = 872448	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 872464	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, type = size, size_out = 495616	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1048560, size_out = 495616	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 495632	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, type = size, size_out = 94720	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 1048560, size_out = 94720	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 94736	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Setup.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Setup.exe, type = size, size_out = 78152	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Setup.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Setup.exe, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Setup.exe, size = 1048560, size_out = 78152	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, size = 78160	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Setup.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi, size = 230	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Setup.exe	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUtility.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUtility.exe, type = size, size_out = 96088	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUtility.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUtility.exe, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 1048560, size_out = 96088	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 96096	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\SetupUtility.exe	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, type = size, size_out = 5198099	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, destination_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786734	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Logs\Internet Explorer.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Internet Explorer.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Internet Explorer.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Internet Explorer.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Internet Explorer.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Internet Explorer.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 256	1	Fn Data
File	Delete	filename = C:\Logs\Internet Explorer.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 368	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 324	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, type = size, size_out = 1118208	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 1048560, size_out = 69648	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69664	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 338	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 320	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 294	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 306	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 314	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 310	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, type = size, size_out = 1052672	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 1048560, size_out = 4112	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 4128	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 308	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 276	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 304	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 302	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 294	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 356	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 324	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 300	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 302	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 326	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 296	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 316	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 300	1	Fn Data
File	Delete	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx	1	Fn
File	Create	filename = C:\Logs\Security.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Security.evtx, type = size, size_out = 1118208	1	Fn
File	Get Info	filename = C:\Logs\Security.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Security.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\Security.evtx, size = 1048560, size_out = 69648	1	Fn Data
File	Write	filename = C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69664	1	Fn Data
File	Read	filename = C:\Logs\Security.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 238	1	Fn Data
File	Delete	filename = C:\Logs\Security.evtx	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll, type = size, size_out = 21184	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, size = 1048560, size_out = 21184	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 21200	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 290	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, type = size, size_out = 18624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, size = 1048560, size_out = 18624	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18640	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 282	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, type = size, size_out = 11616	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, size = 1048560, size_out = 11616	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 11632	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, type = size, size_out = 19648	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, size = 1048560, size_out = 19648	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19664	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 274	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, type = size, size_out = 19648	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, size = 1048560, size_out = 19648	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19664	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 272	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, type = size, size_out = 26816	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, size = 1048560, size_out = 26816	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, size = 26832	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll, size = 282	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, type = size, size_out = 24768	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, size = 1048560, size_out = 24768	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 24784	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 276	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, type = size, size_out = 19136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, size = 1048560, size_out = 19136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19152	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, type = size, size_out = 162880	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll, type = size, size_out = 656088	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe, type = size, size_out = 2054872	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786698	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, type = size, size_out = 102	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, size = 1048560, size_out = 102	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 112	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll, type = size, size_out = 660136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786706	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 1048560	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 1048560	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 426600	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 426608	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF, size = 234	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, size = 1048560, size_out = 367216	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 367232	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 240	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll	1	Fn

Thread 0xf88

2234

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	1	Fn
System	Sleep	duration = 100 milliseconds (0.100 seconds)	2	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, type = size, size_out = 307	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, type = file_attributes	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, size = 1048560, size_out = 307	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 320	1	Fn Data
File	Read	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 246	1	Fn Data
File	Delete	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 17240	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\SetupResources.dll, size = 1048560, size_out = 17240	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17248	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1025\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1025\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, type = size, size_out = 18264	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, size = 1048560, size_out = 18264	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18272	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1029\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1029\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\SetupResources.dll, type = size, size_out = 18776	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\SetupResources.dll, size = 1048560, size_out = 18776	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18784	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1031\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, type = size, size_out = 15192	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, size = 1048560, size_out = 15192	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 15200	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1042\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1042\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, type = size, size_out = 17752	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, size = 1048560, size_out = 17752	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 17760	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1053\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\1053\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, type = size, size_out = 18776	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, size = 1048560, size_out = 18776	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18784	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\2070\SetupResources.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 248	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\2070\SetupResources.dll	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Print.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Print.ico, type = size, size_out = 1150	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Print.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Print.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Print.ico, size = 1048560, size_out = 1150	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1152	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Print.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 230	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Print.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico, type = size, size_out = 894	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico, size = 1048560, size_out = 894	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 896	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 234	1	Fn Data
File	Delete	filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, type = size, size_out = 43131591	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Extended.mzz, destination_filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786704	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Logs\Setup.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\Setup.evtx, type = size, size_out = 69632	1	Fn
File	Get Info	filename = C:\Logs\Setup.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\Setup.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 69632	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69648	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn Data
File	Delete	filename = C:\Logs\Setup.evtx	1	Fn
File	Create	filename = C:\Logs\System.evtx, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Logs\System.evtx, type = size, size_out = 1118208	1	Fn
File	Get Info	filename = C:\Logs\System.evtx, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\System.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Logs\System.evtx, size = 1048560, size_out = 1048560	1	Fn Data
File	Write	filename = C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 1048560	1	Fn Data
File	Read	filename = C:\Logs\System.evtx, size = 1048560, size_out = 69648	1	Fn Data
File	Write	filename = C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 69664	1	Fn Data
File	Read	filename = C:\Logs\System.evtx, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Logs\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn Data
File	Delete	filename = C:\Logs\System.evtx	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, type = size, size_out = 18624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, size = 1048560, size_out = 18624	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18640	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 274	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, type = size, size_out = 19136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, size = 1048560, size_out = 19136	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 19152	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 276	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll, type = size, size_out = 22720	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll, size = 1048560, size_out = 22720	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 22736	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = size, size_out = 20672	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll, size = 1048560, size_out = 20672	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, size = 20688	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll, size = 284	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, type = size, size_out = 70848	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, size = 1048560, size_out = 70848	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 70864	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 278	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, type = size, size_out = 24768	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, size = 1048560, size_out = 24768	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 24784	1	Fn Data
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 274	1	Fn Data
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll, type = size, size_out = 210648	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll, type = size, size_out = 1402584	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll, type = size, size_out = 1761448	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144, size_out = 262144	3	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 786714	1	Fn Data
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 262144	3	Fn Data
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, type = size, size_out = 263896	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 263896	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 263904	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, type = size, size_out = 358616	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, size = 1048560, size_out = 358616	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 358624	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 242	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, type = size, size_out = 996568	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, size = 1048560, size_out = 996568	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 996576	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 244	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, type = size, size_out = 88752	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, type = size, size_out = 10752	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, type = size, size_out = 10752	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui, type = size, size_out = 9728	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui, type = size, size_out = 23040	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll, type = size, size_out = 2018304	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll, type = size, size_out = 41984	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui, type = size, size_out = 10240	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll, type = size, size_out = 4101632	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Move	source_filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll, destination_filename = C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, type = size, size_out = 363728	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, size = 1048560, size_out = 363728	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 363744	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 232	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, type = size, size_out = 18624	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 18624	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 18640	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 260	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, type = size, size_out = 855376	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 855376	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 855392	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 234	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, type = size, size_out = 987136	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, type = size, size_out = 48872	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, desired_access = GENERIC_WRITE	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, size = 1048560, size_out = 48872	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 48880	1	Fn
File	Read	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll, size = 1048560, size_out = 0	1	Fn
File	Write	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, size = 258	1	Fn
File	Delete	filename = C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui, type = size, size_out = 18432	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msdaps.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdaps.dll, type = size, size_out = 376320	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdaps.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdaps.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msdaps.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll, type = size, size_out = 54784	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msxactps.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msxactps.dll, type = size, size_out = 16384	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msxactps.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\msxactps.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\msxactps.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\oledb32r.dll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\oledb32r.dll, type = size, size_out = 77824	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\oledb32r.dll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\oledb32r.dll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\sqloledb.rll, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\sqloledb.rll, type = size, size_out = 4608	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\sqloledb.rll, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.id-B4197730.[seeyoubro@tutanota.com].LOVE, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Common Files\System\Ole DB\sqloledb.rll, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Create	filename = C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn

Thread 0xc14

498

Category	Operation	Information	Success	Count	Logfile

Process #3: cmd.exe

284

Information	Value
ID	#3
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:09, Reason: Child Process
Unmonitor	End Time: 00:03:43, Reason: Self Terminated
Monitor Duration	00:00:33

OS Process Information

Information	Value
PID	0xb10
Parent PID	0x4b0 (c:\users\fd1hvy\desktop\11.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D94 0x FF0

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	YARA	Actions
cmd.exe	0x7FF6A7520000	0x7FF6A7582FFF	Process Termination	-	64-bit	-		... Region Actions Download Dump

Threads

Thread 0xd94

284

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\system32\cmd.exe, base_address = 0x7ff6a7520000	1	Fn
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadUILanguage, address_out = 0x7ff92fdea990	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
System	Get Info	type = Operating System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 52	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CopyFileExW, address_out = 0x7ff92fdee830	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x7ff92fdee300	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\mode.com, os_pid = 0x4a8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Load	module_name = NTDLL.DLL, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0	1	Fn
Process	Get Info	type = PROCESS_BASIC_INFORMATION	1	Fn
Memory	Read	process_name = C:\WINDOWS\system32\mode.com, address = 1042624049152, size = 1952	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 36	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\vssadmin.exe, os_pid = 0x9f0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Process	Get Info	type = PROCESS_BASIC_INFORMATION	1	Fn
Memory	Read	process_name = C:\WINDOWS\system32\vssadmin.exe, address = 997312618496, size = 1952	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000002	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Read	filename = STD_INPUT_HANDLE, size = 1, size_out = 1	1	Fn Data
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data

Process #5: mode.com

Information	Value
ID	#5
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:19, Reason: Child Process
Unmonitor	End Time: 00:03:31, Reason: Self Terminated
Monitor Duration	00:00:12
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x4a8
Parent PID	0xb10 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 368 0x 798 0x 9FC

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	YARA	Actions
mode.com	0x7FF7F2420000	0x7FF7F242BFFF	Process Termination	-	64-bit	-		... Region Actions Download Dump

Process #6: vssadmin.exe

Information	Value
ID	#6
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:32, Reason: Child Process
Unmonitor	End Time: 00:03:40, Reason: Self Terminated
Monitor Duration	00:00:08
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x9f0
Parent PID	0xb10 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x CC0 0x ECC 0x D24 0x F4C 0x F60

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	YARA	Actions
vssadmin.exe	0x7FF7B2AC0000	0x7FF7B2AE6FFF	Process Termination	-	64-bit	-		... Region Actions Download Dump

Remarks (1/1)

Remarks

Monitored Processes

Behavior Information - Sequential View

Before

After