1f0a6c92...919f | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Worm

1f0a6c92c237cbf344dedc841259f1da6b2d8742fcafb6926f746a48bbe0919f (SHA256)

%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe

Windows Exe (x86-32)

Created at 2019-01-04 14:38:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xaac Analysis Target High (Elevated) %appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe" -
#2 0xac8 Child Process High (Elevated) yfekw5dmgyvjgc.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe" #1
#3 0xad0 Child Process High (Elevated) cmd.exe /c "C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat" #1
#4 0xae4 Child Process High (Elevated) vssadmin.exe delete shadows /all /quiet #2

Behavior Information - Sequential View

Process #1: %appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe
10 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:55, Reason: Analysis Target
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:13
OS Process Information
»
Information Value
PID 0xaac
Parent PID 0x458 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AB0
0x 0
0x ABC
0x AC0
0x AC4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00071fff Pagefile Backed Memory r True False False -
private_0x0000000000080000 0x00080000 0x000fffff Private Memory rw True False False -
rsaenh.dll 0x00100000 0x0013bfff Memory Mapped File r False False False -
windowsshell.manifest 0x00100000 0x00100fff Memory Mapped File r False False False -
pagefile_0x0000000000100000 0x00100000 0x00100fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000110000 0x00110000 0x00111fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory r True False False -
cversions.1.db 0x00130000 0x00133fff Memory Mapped File r True False False -
cversions.2.db 0x00130000 0x00133fff Memory Mapped File r True False False -
pagefile_0x0000000000140000 0x00140000 0x00140fff Pagefile Backed Memory rw True False False -
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory rw True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db 0x00190000 0x001aefff Memory Mapped File r True False False -
private_0x00000000001b0000 0x001b0000 0x002affff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db 0x002b0000 0x002dffff Memory Mapped File r True False False -
cversions.2.db 0x002e0000 0x002e3fff Memory Mapped File r True False False -
%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe 0x002f0000 0x002f8fff Memory Mapped File rwx True True True
...
pagefile_0x0000000000300000 0x00300000 0x00306fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000310000 0x00310000 0x00311fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000320000 0x00320000 0x00320fff Pagefile Backed Memory rw True False False -
private_0x0000000000360000 0x00360000 0x0045ffff Private Memory rw True False False -
locale.nls 0x00460000 0x004c6fff Memory Mapped File r False False False -
private_0x00000000004f0000 0x004f0000 0x0052ffff Private Memory rw True False False -
private_0x0000000000530000 0x00530000 0x0053ffff Private Memory rw True False False -
pagefile_0x0000000000540000 0x00540000 0x006c7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000006d0000 0x006d0000 0x00850fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000860000 0x00860000 0x01c5ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01c60000 0x01f2efff Memory Mapped File r False False False -
private_0x0000000001f30000 0x01f30000 0x0200ffff Private Memory rw True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01f30000 0x01f95fff Memory Mapped File r True False False -
private_0x0000000001fd0000 0x01fd0000 0x0200ffff Private Memory rw True False False -
pagefile_0x0000000002010000 0x02010000 0x020eefff Pagefile Backed Memory r True False False -
private_0x00000000020f0000 0x020f0000 0x021f0fff Private Memory rw True False False -
private_0x0000000002190000 0x02190000 0x021cffff Private Memory rw True False False -
private_0x00000000021f0000 0x021f0000 0x022effff Private Memory rw True False False -
private_0x00000000022f0000 0x022f0000 0x023f0fff Private Memory rw True False False -
pagefile_0x00000000022f0000 0x022f0000 0x026e2fff Pagefile Backed Memory r True False False -
private_0x00000000026f0000 0x026f0000 0x027f0fff Private Memory rw True False False -
private_0x00000000027a0000 0x027a0000 0x027dffff Private Memory rw True False False -
private_0x00000000028c0000 0x028c0000 0x029bffff Private Memory rw True False False -
private_0x0000000002a80000 0x02a80000 0x02b7ffff Private Memory rw True False False -
uxtheme.dll 0x74d00000 0x74d7ffff Memory Mapped File rwx False False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
shdocvw.dll 0x74ec0000 0x74eedfff Memory Mapped File rwx False False False -
apphelp.dll 0x74ef0000 0x74f3bfff Memory Mapped File rwx False False False -
profapi.dll 0x74f40000 0x74f4afff Memory Mapped File rwx False False False -
ntmarta.dll 0x74f50000 0x74f70fff Memory Mapped File rwx False False False -
comctl32.dll 0x74f80000 0x7511dfff Memory Mapped File rwx False False False -
propsys.dll 0x75120000 0x75214fff Memory Mapped File rwx False False False -
rsaenh.dll 0x75220000 0x7525afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75260000 0x75275fff Memory Mapped File rwx False False False -
mpr.dll 0x75280000 0x75291fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
clbcatq.dll 0x754b0000 0x75532fff Memory Mapped File rwx False False False -
ole32.dll 0x75540000 0x7569bfff Memory Mapped File rwx False False False -
wldap32.dll 0x756a0000 0x756e4fff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
iertutil.dll 0x757f0000 0x759eafff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
wininet.dll 0x75be0000 0x75cd4fff Memory Mapped File rwx False False False -
shlwapi.dll 0x75ce0000 0x75d36fff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
devobj.dll 0x75e10000 0x75e21fff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
oleaut32.dll 0x75f60000 0x75feefff Memory Mapped File rwx False False False -
setupapi.dll 0x75ff0000 0x7618cfff Memory Mapped File rwx False False False -
crypt32.dll 0x76190000 0x762acfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
urlmon.dll 0x762e0000 0x76415fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x76640000 0x76666fff Memory Mapped File rwx False False False -
shell32.dll 0x76670000 0x772b9fff Memory Mapped File rwx False False False -
msasn1.dll 0x772c0000 0x772cbfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory rw True False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory rw True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory rw True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe 18.00 KB MD5: 5a054e4b94c144afdf259c0ba19d0693
SHA1: 42449f01ac3e9b0676a75d6053ec3a566d6f14a3
SHA256: 1f0a6c92c237cbf344dedc841259f1da6b2d8742fcafb6926f746a48bbe0919f
SSDeep: 384:95/Gu5S5C2js70eOeF5eawczDyhoZhKrbr:9BGX42jsNzNXzDyhoZUrb 		True
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat 0.30 KB MD5: 2e83fd14e6b70b3b3b3a7b1c47b2fc1f
SHA1: a60113e1e6be64da73695c5ec56ba9fef1409392
SHA256: 244fe82fa86db3766b8df452f52ecd1c3daf7db51ff8c12315d5477a35aa1a56
SSDeep: 6:hHUTk4FA8y40MhiXoKKWOrIvMD2UUTk4FA8y40MhiXoKKWOrY0/Hm1gfbci23fSD:eT6x40MkXXNOqT6x40MkXXNOM0/Hm+zn 		False
...
Threads
Thread 0xab0
10 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, base_address = 0x2f0000 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender False 1
Fn
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, size = 260 True 1
Fn
File Copy source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe True 1
Fn
Process Create process_name = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe, show_window = SW_SHOW True 1
Fn
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\%APPDATA%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, size = 260 True 1
Fn
File Create Temp File filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp, path = C:\Users\5P5NRG~1\AppData\Local\Temp True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, size = 309 True 1
Fn
Data
Process Create process_name = C:\Windows\system32\cmd.exe, os_pid = 0xad0, creation_flags = CREATE_DEFAULT_ERROR_MODE, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Process #2: yfekw5dmgyvjgc.exe
2477 0
»
Information Value
ID #2
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:31, Reason: Self Terminated
Monitor Duration 00:00:25
OS Process Information
»
Information Value
PID 0xac8
Parent PID 0xaac (c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x ACC
0x AF8
0x AFC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0006ffff Private Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00067fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00077fff Pagefile Backed Memory rw True False False -
yfekw5dmgyvjgc.exe 0x00080000 0x00088fff Memory Mapped File rwx True True True
...
private_0x00000000000b0000 0x000b0000 0x000effff Private Memory rw True False False -
locale.nls 0x000f0000 0x00156fff Memory Mapped File r False False False -
rsaenh.dll 0x00160000 0x0019bfff Memory Mapped File r False False False -
private_0x00000000001f0000 0x001f0000 0x0026ffff Private Memory rw True False False -
private_0x0000000000270000 0x00270000 0x002affff Private Memory rw True False False -
private_0x00000000002b0000 0x002b0000 0x003affff Private Memory rw True False False -
private_0x00000000004b0000 0x004b0000 0x005affff Private Memory rw True False False -
pagefile_0x00000000005b0000 0x005b0000 0x00737fff Pagefile Backed Memory r True False False -
private_0x00000000007a0000 0x007a0000 0x007affff Private Memory rw True False False -
pagefile_0x00000000007b0000 0x007b0000 0x00930fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000940000 0x00940000 0x01d3ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x01d40000 0x0200efff Memory Mapped File r False False False -
private_0x0000000002080000 0x02080000 0x020bffff Private Memory rw True False False -
private_0x0000000002110000 0x02110000 0x0220ffff Private Memory rw True False False -
private_0x00000000023c0000 0x023c0000 0x024bffff Private Memory rw True False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
rsaenh.dll 0x75200000 0x7523afff Memory Mapped File rwx False False False -
cryptsp.dll 0x75240000 0x75255fff Memory Mapped File rwx False False False -
mpr.dll 0x75280000 0x75291fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
ole32.dll 0x75540000 0x7569bfff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
shlwapi.dll 0x75ce0000 0x75d36fff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
shell32.dll 0x76670000 0x772b9fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory rw True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory rw True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml 2.49 KB MD5: aa24cf4316545a6d76559617d9de4e81
SHA1: 84a8f9ddd37b0b64589418122e3c5af4dc664d33
SHA256: 0b92f62ee86a7acad8e983dfce98bff8297daec0405efdf1942993fe0df0fbd6
SSDeep: 48:uILJqxjAXXwT/n3+rK5ZB7Xr3lGoNBiliZqzKPCsFtV2tM7m:LLwRrXBN73iliUzKZteM6 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi 2.39 MB MD5: 86c67c9ce448a0a992cdcd8fd37a227a
SHA1: 34da7b9e555263fabdef2e7388855e6a43d4ef04
SHA256: 674e94ed7e8e1f6381843dd39157b93eab518615362aaf89668caeabbee69d60
SSDeep: 49152:LNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXcmH:2xihRZ2dfJmOhzDixJLjs5oz8PExAf2U 		False
...
debug.log 7.76 KB MD5: a67db75a1f2f813da54317a661354887
SHA1: b37f2701fc414201a0af34820e6b896c27ef9a75
SHA256: cc4a7f6af53cea59dffde21082d2c7cc3f20c29f98228b43f8c9a4aa1e929355
SSDeep: 96:bGsQaziuw6fc6dZeDmhZKv/MyJ20XUKCr70zZgp7A21aII:1hzLfBvgf 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml 1.78 KB MD5: 221c89a6864b87a80374fa2750031774
SHA1: 8bd11313381e0f6d79fe640c4cf80f2b7c6dd48b
SHA256: 737192827b0ccfcc11cbebe88972f10e3263ef68e360cb7d34ce894634945102
SSDeep: 24:gXQB0Be6MwjtbToCFMt3/Us0mwnkcPWOes5RcU5LZz9ETnyewUgamQJSx6ixRty/:mM6Rjtb0C21HTwnkWRFlhejy+LU6Es 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi 2.39 MB MD5: dfa631eca19d2049def0813c67795367
SHA1: 8d42b115432d3c9d631cb292651b8b94648a5c7f
SHA256: d914b03d007d082875ca7a6c79dace819a099d8785666cb07f122a3a895cf50c
SSDeep: 49152:vNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXc/Ks/gA:KxihRZ2dfJmOhzDixJLjs5oz8PExAf2X 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml 1.67 KB MD5: 33aba5bec1006aaa6e9aa1bee448c5bd
SHA1: a8aa8df1a51297cdabeefb808b9d40501d7cb7ab
SHA256: 11e3ae780ea27b71c9c24130bfbf17718f541e02a7e3245bfbfb03143281fac3
SSDeep: 48:lVF2xoYUc/hZA+Dqssv50zDY8VuHm7Eoa:XAqYUi7U5OY8VuHm4x 		False
...
\\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html 3.80 KB MD5: 2de785d1c95cbccdfa87db48edcb7cae
SHA1: 72b977a464cc16fbe2a2be391b276752353cf009
SHA256: 4f3ace85ad315ccae5a828098d493b65e2ab0b0f9c13d0b0746f1056e7358be1
SSDeep: 48:CF5bDvFKFkDGAyORAeUcnyvUFkUMUW8feeyWe9fZhi3Lhhxmyk4r+yf6HD3MQC:qxDtxyK1Uc/MUW8feiYfZhehG4Jfga 		False
...
\\?\C:\Boot\BCD.LOG1 0.25 KB MD5: 03f18ffb87691417b20dd7ed3c8ff321
SHA1: 2e092399add9b15462b36281860c84f621d9fd16
SHA256: 0fd66a6aa358db1fbc1f659e62fc64ea19ca3e3b5b2983b85cf6c208b9f23c45
SSDeep: 6:xv7ShRLN3HQ7GT6Q+Tfpz+SaXJAMApPCNtFdzGcW+l:xkNAy21LpQ6sN3d6cll 		False
...
\\?\C:\Boot\BOOTSTAT.DAT 64.25 KB MD5: f80b8d8edf9ab436b266c3d91821c102
SHA1: 70075093913574e5ddcaa5671d3a46e85d90013b
SHA256: 49f0fd5d8691008879a85ca4e86d70fe367ece1ce65140eb4e9e552b6c116fe2
SSDeep: 1536:cUhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhI:cUhPOcFUhPOcFUhPOcFUhPOcFUhPOcF+ 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP 10.00 MB MD5: 15a0fef8a1ade304c039f05a7912fe24
SHA1: 5c75410864654578995e6403198e337ce1eb47fc
SHA256: cf531fd661768bb410cc89b2600c42873ee27fcac66c9e29c717eefd69788299
SSDeep: 196608:kkI0ShKgPbqrX+O+TtdjBU8PMIXiIJ5towFXg2j95eCp:knTK4WrtgBUwUq5mwFg2H7 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab 10.00 MB MD5: f9a8a5aeaa1312e63b4ee59a8d53f748
SHA1: 877e3e73c306afef2bfd8e89ea30ed6de648e710
SHA256: b270b3b867f9fd7ce1dcedd10847f34b06cef027f88790bb56eea61cad0e9db3
SSDeep: 196608:uBT+FUVOwJ4WerdbzDDPMX81eg3hPol9y8mjlnzl7Z7yPpWfQbXa4Fxt5M:V66WuFz/w81nhsFmx5NyxbXDc 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml 2.49 KB MD5: aa24cf4316545a6d76559617d9de4e81
SHA1: 84a8f9ddd37b0b64589418122e3c5af4dc664d33
SHA256: 0b92f62ee86a7acad8e983dfce98bff8297daec0405efdf1942993fe0df0fbd6
SSDeep: 48:uILJqxjAXXwT/n3+rK5ZB7Xr3lGoNBiliZqzKPCsFtV2tM7m:LLwRrXBN73iliUzKZteM6 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi 2.39 MB MD5: 86c67c9ce448a0a992cdcd8fd37a227a
SHA1: 34da7b9e555263fabdef2e7388855e6a43d4ef04
SHA256: 674e94ed7e8e1f6381843dd39157b93eab518615362aaf89668caeabbee69d60
SSDeep: 49152:LNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXcmH:2xihRZ2dfJmOhzDixJLjs5oz8PExAf2U 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml 1.78 KB MD5: 221c89a6864b87a80374fa2750031774
SHA1: 8bd11313381e0f6d79fe640c4cf80f2b7c6dd48b
SHA256: 737192827b0ccfcc11cbebe88972f10e3263ef68e360cb7d34ce894634945102
SSDeep: 24:gXQB0Be6MwjtbToCFMt3/Us0mwnkcPWOes5RcU5LZz9ETnyewUgamQJSx6ixRty/:mM6Rjtb0C21HTwnkWRFlhejy+LU6Es 		False
...
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi 2.39 MB MD5: dfa631eca19d2049def0813c67795367
SHA1: 8d42b115432d3c9d631cb292651b8b94648a5c7f
SHA256: d914b03d007d082875ca7a6c79dace819a099d8785666cb07f122a3a895cf50c
SSDeep: 49152:vNIDxihRZ2dfi18m90hzj3ixoUKgjs5oz8+YnFqKyxghZf2rXy9SB44qXc/Ks/gA:KxihRZ2dfJmOhzDixJLjs5oz8PExAf2X 		False
...
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml 1.67 KB MD5: 33aba5bec1006aaa6e9aa1bee448c5bd
SHA1: a8aa8df1a51297cdabeefb808b9d40501d7cb7ab
SHA256: 11e3ae780ea27b71c9c24130bfbf17718f541e02a7e3245bfbfb03143281fac3
SSDeep: 48:lVF2xoYUc/hZA+Dqssv50zDY8VuHm7Eoa:XAqYUi7U5OY8VuHm4x 		False
...
\\?\C:\Boot\BCD.LOG1 0.25 KB MD5: 03f18ffb87691417b20dd7ed3c8ff321
SHA1: 2e092399add9b15462b36281860c84f621d9fd16
SHA256: 0fd66a6aa358db1fbc1f659e62fc64ea19ca3e3b5b2983b85cf6c208b9f23c45
SSDeep: 6:xv7ShRLN3HQ7GT6Q+Tfpz+SaXJAMApPCNtFdzGcW+l:xkNAy21LpQ6sN3d6cll 		False
...
\\?\C:\Boot\BOOTSTAT.DAT 64.25 KB MD5: f80b8d8edf9ab436b266c3d91821c102
SHA1: 70075093913574e5ddcaa5671d3a46e85d90013b
SHA256: 49f0fd5d8691008879a85ca4e86d70fe367ece1ce65140eb4e9e552b6c116fe2
SSDeep: 1536:cUhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhPOcd7UhI:cUhPOcFUhPOcFUhPOcFUhPOcFUhPOcF+ 		False
...
Threads
Thread 0xacc
65 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe, base_address = 0x80000 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender False 1
Fn
Module Get Filename process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YFeKw5dmGYVjgc.exe, size = 260 True 1
Fn
Process Create process_name = C:\Windows\sysnative\vssadmin.exe, os_pid = 0xae4, creation_flags = CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Service Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Service Control service_name = WinDefend True 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Service Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
File Create filename = debug.log, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
System Sleep duration = -1 (infinite) False 1
Fn
Thread 0xafc
2412 0
»
Category Operation Information Success Count Logfile
File Write filename = debug.log, size = 39 True 1
Fn
Data
File Create filename = \\?\C:\Boot\., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Write filename = debug.log, size = 40 True 1
Fn
Data
File Create filename = \\?\C:\Boot\.., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 46 True 1
Fn
Data
File Write filename = debug.log, size = 41 True 1
Fn
Data
File Create filename = \\?\C:\Boot\BCD, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 46 True 1
Fn
Data
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Create filename = \\?\C:\Boot\BCD.LOG, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 50 True 1
Fn
Data
File Write filename = debug.log, size = 46 True 1
Fn
Data
File Create filename = \\?\C:\Boot\BCD.LOG1, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = \\?\C:\Boot\BCD.LOG1, size = 10240, size_out = 0 True 1
Fn
File Write filename = \\?\C:\Boot\BCD.LOG1, size = 0 True 1
Fn
File Write filename = \\?\C:\Boot\BCD.LOG1, size = 256 True 1
Fn
Data
File Write filename = debug.log, size = 38 True 1
Fn
Data
File Move source_filename = \\?\C:\Boot\BCD.LOG1, destination_filename = \\?\C:\Boot\BCD.LOG1_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP True 1
Fn
File Write filename = debug.log, size = 41 True 1
Fn
Data
File Write filename = debug.log, size = 46 True 1
Fn
Data
File Create filename = \\?\C:\Boot\BCD.LOG2, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = \\?\C:\Boot\BCD.LOG2, size = 10240, size_out = 0 True 1
Fn
File Write filename = \\?\C:\Boot\BCD.LOG2, size = 0 True 1
Fn
File Write filename = \\?\C:\Boot\BCD.LOG2, size = 256 True 1
Fn
Data
File Write filename = debug.log, size = 38 True 1
Fn
Data
File Move source_filename = \\?\C:\Boot\BCD.LOG2, destination_filename = \\?\C:\Boot\BCD.LOG2_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP True 1
Fn
File Write filename = debug.log, size = 41 True 1
Fn
Data
File Write filename = debug.log, size = 50 True 1
Fn
Data
File Create filename = \\?\C:\Boot\BOOTSTAT.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 10240, size_out = 4096 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 4096 True 1
Fn
Data
File Write filename = \\?\C:\Boot\BOOTSTAT.DAT, size = 256 True 1
Fn
Data
File Write filename = debug.log, size = 42 True 1
Fn
Data
File Move source_filename = \\?\C:\Boot\BOOTSTAT.DAT, destination_filename = \\?\C:\Boot\BOOTSTAT.DAT_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP True 1
Fn
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\cs-CZ\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\cs-CZ\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\da-DK\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\da-DK\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\de-DE\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\de-DE\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\el-GR\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\el-GR\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\en-US\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\en-US\memtest.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\en-US\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\es-ES\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\es-ES\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\fi-FI\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fi-FI\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 56 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\chs_boot.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 60 True 1
Fn
Data
File Write filename = debug.log, size = 56 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\cht_boot.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 60 True 1
Fn
Data
File Write filename = debug.log, size = 56 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\jpn_boot.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 60 True 1
Fn
Data
File Write filename = debug.log, size = 56 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\kor_boot.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 60 True 1
Fn
Data
File Write filename = debug.log, size = 57 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\wgl4_boot.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 61 True 1
Fn
Data
File Create filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\Fonts\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\fr-FR\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\fr-FR\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\hu-HU\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\hu-HU\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\it-IT\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\it-IT\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ja-JP\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ja-JP\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ko-KR\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ko-KR\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 49 True 1
Fn
Data
File Create filename = \\?\C:\Boot\memtest.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 53 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\nb-NO\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nb-NO\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\nl-NL\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\nl-NL\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pl-PL\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pl-PL\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pt-BR\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-BR\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pt-PT\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\pt-PT\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ru-RU\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\ru-RU\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\sv-SE\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\sv-SE\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\tr-TR\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\tr-TR\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-CN\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-CN\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-HK\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-HK\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-TW\bootmgr.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 63 True 1
Fn
Data
File Create filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\zh-TW\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Create filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Boot\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 40 True 1
Fn
Data
File Create filename = \\?\C:\bootmgr, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 44 True 1
Fn
Data
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Create filename = \\?\C:\BOOTSECT.BAK, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 49 True 1
Fn
Data
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Create filename = \\?\C:\Config.Msi\., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 51 True 1
Fn
Data
File Write filename = debug.log, size = 46 True 1
Fn
Data
File Create filename = \\?\C:\Config.Msi\.., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 52 True 1
Fn
Data
File Create filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 1607 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 16 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 1452 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 98 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 17 True 1
Fn
Data
File Write filename = \\?\C:\Config.Msi\$%%! NOTE ABOUT FILES -=!-.html, size = 687 True 1
Fn
Data
File Write filename = debug.log, size = 45 True 1
Fn
Data
File Create filename = \\?\C:\hiberfil.sys, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 50 True 1
Fn
Data
File Write filename = debug.log, size = 43 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 49 True 1
Fn
Data
File Write filename = debug.log, size = 44 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\.., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 50 True 1
Fn
Data
File Write filename = debug.log, size = 53 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 59 True 1
Fn
Data
File Write filename = debug.log, size = 54 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\.., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 60 True 1
Fn
Data
File Write filename = debug.log, size = 94 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 100 True 1
Fn
Data
File Write filename = debug.log, size = 95 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.., desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
File Write filename = debug.log, size = 101 True 1
Fn
Data
File Write filename = debug.log, size = 104 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, size = 10240 True 1
Fn
Data
File Write filename = debug.log, size = 96 True 1
Fn
Data
File Move source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab, destination_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab_9c4rmT6TdKfuH9Ft_{alexbanan@tuta.io}.CORP True 1
Fn
File Write filename = debug.log, size = 99 True 1
Fn
Data
File Write filename = debug.log, size = 105 True 1
Fn
Data
File Create filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
File Read filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240, size_out = 10240 True 1
Fn
Data
File Write filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi, size = 10240 True 1
Fn
Data
For performance reasons, the remaining 1412 entries are omitted.
The remaining entries can be found in glog.xml.
Process #3: cmd.exe
121 0
»
Information Value
ID #3
File Name c:\windows\syswow64\cmd.exe
Command Line /c "C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:10, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0xad0
Parent PID 0xaac (c:\users\5p5nrgjn0js halpmcxz\desktop\%appdata%roamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AD4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00036fff Pagefile Backed Memory r True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory r True False False -
locale.nls 0x00070000 0x000d6fff Memory Mapped File r False False False -
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory rw True False False -
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory rw True False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
private_0x0000000000110000 0x00110000 0x0011ffff Private Memory rw True False False -
private_0x0000000000130000 0x00130000 0x001affff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory rw True False False -
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x003dffff Private Memory rw True False False -
kernelbase.dll.mui 0x003e0000 0x0049ffff Memory Mapped File rw False False False -
private_0x00000000004a0000 0x004a0000 0x0059ffff Private Memory rw True False False -
pagefile_0x00000000005a0000 0x005a0000 0x00727fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000730000 0x00730000 0x008b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000008c0000 0x008c0000 0x01cbffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001cc0000 0x01cc0000 0x02002fff Pagefile Backed Memory r True False False -
cmd.exe 0x49f80000 0x49fcbfff Memory Mapped File rwx True False False -
wow64cpu.dll 0x74d90000 0x74d97fff Memory Mapped File rwx False False False -
wow64win.dll 0x74da0000 0x74dfbfff Memory Mapped File rwx False False False -
wow64.dll 0x74e00000 0x74e3efff Memory Mapped File rwx False False False -
winbrand.dll 0x75270000 0x75276fff Memory Mapped File rwx False False False -
cryptbase.dll 0x753a0000 0x753abfff Memory Mapped File rwx False False False -
sspicli.dll 0x753b0000 0x7540ffff Memory Mapped File rwx False False False -
usp10.dll 0x75410000 0x754acfff Memory Mapped File rwx False False False -
user32.dll 0x756f0000 0x757effff Memory Mapped File rwx False False False -
kernel32.dll 0x75a20000 0x75b2ffff Memory Mapped File rwx False False False -
advapi32.dll 0x75b30000 0x75bcffff Memory Mapped File rwx False False False -
msctf.dll 0x75d40000 0x75e0bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x75e30000 0x75edbfff Memory Mapped File rwx False False False -
sechost.dll 0x762b0000 0x762c8fff Memory Mapped File rwx False False False -
lpk.dll 0x762d0000 0x762d9fff Memory Mapped File rwx False False False -
imm32.dll 0x76500000 0x7655ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x765f0000 0x76635fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772d0000 0x773bffff Memory Mapped File rwx False False False -
gdi32.dll 0x773c0000 0x7744ffff Memory Mapped File rwx False False False -
private_0x0000000077450000 0x77450000 0x77549fff Private Memory rwx True False False -
private_0x0000000077550000 0x77550000 0x7766efff Private Memory rwx True False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
ntdll.dll 0x77850000 0x779cffff Memory Mapped File rwx False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Threads
Thread 0xad4
121 0
»
Category Operation Information Success Count Logfile
System Get Time type = System Time, time = 2019-01-04 14:40:10 (UTC) True 1
Fn
System Get Time type = Ticks, time = 136454 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0x49f80000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75a20000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75a4a84f True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75a20000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75a53b92 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75a34a5d True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x75a4a79d True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Module Load module_name = ADVAPI32.dll, base_address = 0x75b30000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferIdentifyLevel, address_out = 0x75b52102 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferComputeTokenFromLevel, address_out = 0x75b53352 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\advapi32.dll, function = SaferCloseLevel, address_out = 0x75b53825 True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Read filename = STD_INPUT_HANDLE, size = 8191, size_out = 309 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Read filename = STD_INPUT_HANDLE, size = 8191, size_out = 298 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Read filename = STD_INPUT_HANDLE, size = 8191, size_out = 294 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming True 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roamingroamingmicrosoftwindowsstart menuprogramsstartup8gfg.exe, type = file_attributes False 1
Fn
File Get Info filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\C:\Users\5p5NrGJn0jS HALPmcxz\AppData, type = file_attributes False 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
File Get Info filename = STD_ERROR_HANDLE, type = file_type True 1
Fn
File Open filename = STD_ERROR_HANDLE True 2
Fn
File Write filename = STD_ERROR_HANDLE, size = 68 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Read filename = STD_INPUT_HANDLE, size = 8191, size_out = 183 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Environment Get Environment String name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
File Read filename = STD_INPUT_HANDLE, size = 8191, size_out = 60 True 1
Fn
Data
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = STD_INPUT_HANDLE, type = file_type True 1
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Get Info filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\5P5NRG~1\AppData\Local\Temp, type = file_attributes True 1
Fn
File Get Info filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, type = file_attributes True 1
Fn
File Delete filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\Users\5P5NRG~1\AppData\Local\Temp\1296.tmp.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
File Open filename = STD_ERROR_HANDLE True 1
Fn
File Get Info filename = STD_ERROR_HANDLE, type = file_type True 1
Fn
File Open filename = STD_ERROR_HANDLE True 2
Fn
File Write filename = STD_ERROR_HANDLE, size = 33 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
Process #4: vssadmin.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\vssadmin.exe
Command Line delete shadows /all /quiet
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:31, Reason: Self Terminated
Monitor Duration 00:00:25
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xae4
Parent PID 0xac8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\yfekw5dmgyvjgc.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AE8
0x B24
0x B28
0x B2C
0x B30
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory rw True False False -
vssadmin.exe.mui 0x000e0000 0x000ecfff Memory Mapped File rw False False False -
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory rw True False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
pagefile_0x0000000000110000 0x00110000 0x00110fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000120000 0x00120000 0x00120fff Pagefile Backed Memory r True False False -
private_0x0000000000140000 0x00140000 0x0014ffff Private Memory rw True False False -
private_0x00000000001d0000 0x001d0000 0x0024ffff Private Memory rw True False False -
private_0x0000000000250000 0x00250000 0x0034ffff Private Memory rw True False False -
private_0x00000000003e0000 0x003e0000 0x004dffff Private Memory rw True False False -
pagefile_0x00000000004e0000 0x004e0000 0x00667fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000670000 0x00670000 0x007f0fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000800000 0x00800000 0x01bfffff Pagefile Backed Memory r True False False -
private_0x0000000001c30000 0x01c30000 0x01caffff Private Memory rw True False False -
private_0x0000000001cd0000 0x01cd0000 0x01d4ffff Private Memory rw True False False -
private_0x0000000001e40000 0x01e40000 0x01ebffff Private Memory rw True False False -
sortdefault.nls 0x01ec0000 0x0218efff Memory Mapped File r False False False -
private_0x00000000021e0000 0x021e0000 0x0225ffff Private Memory rw True False False -
user32.dll 0x77450000 0x77549fff Memory Mapped File rwx False False False -
kernel32.dll 0x77550000 0x7766efff Memory Mapped File rwx False False False -
ntdll.dll 0x77670000 0x77818fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff6000 0x7fff6000 0x7fff6fff Private Memory rw True False False -
vssadmin.exe 0xff940000 0xff96cfff Memory Mapped File rwx False False False -
vss_ps.dll 0x7fef3e60000 0x7fef3e73fff Memory Mapped File rwx False False False -
vsstrace.dll 0x7fef79b0000 0x7fef79c6fff Memory Mapped File rwx False False False -
vssapi.dll 0x7fef79d0000 0x7fef7b7ffff Memory Mapped File rwx False False False -
atl.dll 0x7fefb070000 0x7fefb088fff Memory Mapped File rwx False False False -
rsaenh.dll 0x7fefcbb0000 0x7fefcbf6fff Memory Mapped File rwx False False False -
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File rwx False False False -
cryptbase.dll 0x7fefd4b0000 0x7fefd4befff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x7fefd5a0000 0x7fefd5b3fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefd920000 0x7fefd98afff Memory Mapped File rwx False False False -
msvcrt.dll 0x7fefdb10000 0x7fefdbaefff Memory Mapped File rwx False False False -
oleaut32.dll 0x7fefdbb0000 0x7fefdc86fff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefdc90000 0x7fefdcf6fff Memory Mapped File rwx False False False -
usp10.dll 0x7fefdd00000 0x7fefddc8fff Memory Mapped File rwx False False False -
ole32.dll 0x7fefddf0000 0x7fefdff2fff Memory Mapped File rwx False False False -
clbcatq.dll 0x7fefe000000 0x7fefe098fff Memory Mapped File rwx False False False -
msctf.dll 0x7fefe0a0000 0x7fefe1a8fff Memory Mapped File rwx False False False -
sechost.dll 0x7fefe330000 0x7fefe34efff Memory Mapped File rwx False False False -
lpk.dll 0x7fefe350000 0x7fefe35dfff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff740000 0x7feff81afff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feff820000 0x7feff94cfff Memory Mapped File rwx False False False -
imm32.dll 0x7feff950000 0x7feff97dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x7feff990000 0x7feff990fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory rw True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory rw True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory rw True False False -
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdbfff Private Memory rw True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image