3145ce9a...7259 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 93/100
Dynamic Analysis Report
Classification: Riskware, Wiper, Ransomware

3145ce9af8f1e44e2c0f0a9123f8201a3aab013c7bfaf1f120fa4d7e50a67259 (SHA256)

pdasib.exe

Windows Exe (x86-32)

Created at 2019-02-22 13:29:00

...

Notifications (2/5)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Code overwrite was observed during this analysis. Note that the analysis results may be affected by this modification by the sample.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x8ec Analysis Target High (Elevated) pdasib.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe" -
#2 0xb30 Child Process High (Elevated) pdasib.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe" #1
#3 0xb3c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" #2
#4 0xb90 Child Process High (Elevated) mode.com mode con cp select=1251 #3
#5 0xba0 Child Process High (Elevated) vssadmin.exe vssadmin delete shadows /all /quiet #3

Behavior Information - Grouped by Category

Process #1: pdasib.exe
344 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:54, Reason: Analysis Target
Unmonitor End Time: 00:04:08, Reason: Self Terminated
Monitor Duration 00:03:14
OS Process Information
»
Information Value
PID 0x8ec
Parent PID 0x460 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8F0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory rw True False False -
private_0x0000000000090000 0x00090000 0x0018ffff Private Memory rw True False False -
pagefile_0x0000000000190000 0x00190000 0x00193fff Pagefile Backed Memory r True False False -
locale.nls 0x001a0000 0x00206fff Memory Mapped File r False False False -
private_0x0000000000210000 0x00210000 0x002fffff Private Memory rw True False False -
imm32.dll 0x00210000 0x0022dfff Memory Mapped File r False False False -
private_0x0000000000210000 0x00210000 0x00210fff Private Memory rw True False False -
private_0x0000000000220000 0x00220000 0x00220fff Private Memory rw True False False -
private_0x0000000000230000 0x00230000 0x00230fff Private Memory rw True False False -
private_0x0000000000240000 0x00240000 0x0024ffff Private Memory rw True False False -
pagefile_0x0000000000240000 0x00240000 0x0024dfff Pagefile Backed Memory rw True False False -
private_0x0000000000240000 0x00240000 0x00240fff Private Memory rw True False False -
pagefile_0x0000000000250000 0x00250000 0x0025dfff Pagefile Backed Memory rw True False False -
private_0x0000000000250000 0x00250000 0x00280fff Private Memory rw True False False -
private_0x0000000000250000 0x00250000 0x00250fff Private Memory rwx True False False -
pagefile_0x0000000000260000 0x00260000 0x00266fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000270000 0x00270000 0x00271fff Pagefile Backed Memory rw True False False -
private_0x0000000000280000 0x00280000 0x00280fff Private Memory rw True False False -
private_0x0000000000290000 0x00290000 0x00290fff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002affff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002c2fff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x002d0fff Private Memory rwx True False False -
private_0x00000000002e0000 0x002e0000 0x002e0fff Private Memory rwx True False False -
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x002fffff Private Memory rw True False False -
private_0x0000000000300000 0x00300000 0x00301fff Private Memory rwx True False False -
private_0x0000000000300000 0x00300000 0x00310fff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x0031ffff Private Memory rwx True False False -
private_0x0000000000320000 0x00320000 0x00321fff Private Memory rwx True False False -
private_0x0000000000320000 0x00320000 0x00320fff Private Memory rwx True False False -
private_0x0000000000330000 0x00330000 0x00330fff Private Memory rwx True False False -
private_0x0000000000340000 0x00340000 0x003bffff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x003c0fff Private Memory rwx True False False -
private_0x00000000003d0000 0x003d0000 0x003d1fff Private Memory rwx True False False -
private_0x00000000003e0000 0x003e0000 0x003e0fff Private Memory rwx True False False -
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory rwx True False False -
pdasib.exe 0x00400000 0x00939fff Memory Mapped File rwx True True False
...
pagefile_0x0000000000940000 0x00940000 0x00ac7fff Pagefile Backed Memory r True False False -
private_0x0000000000ad0000 0x00ad0000 0x00ad0fff Private Memory rwx True False False -
private_0x0000000000ae0000 0x00ae0000 0x00bdffff Private Memory rw True False False -
pagefile_0x0000000000be0000 0x00be0000 0x00d60fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000d70000 0x00d70000 0x0216ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x02170000 0x0243efff Memory Mapped File r False False False -
pagefile_0x0000000002440000 0x02440000 0x0284ffff Pagefile Backed Memory rw True False False -
private_0x0000000002440000 0x02440000 0x0252ffff Private Memory rw True False False -
private_0x0000000002440000 0x02440000 0x024c3fff Private Memory rw True False False -
private_0x0000000002440000 0x02440000 0x02440fff Private Memory rwx True False False -
private_0x0000000002450000 0x02450000 0x02450fff Private Memory rwx True False False -
private_0x0000000002460000 0x02460000 0x02460fff Private Memory rwx True False False -
private_0x0000000002470000 0x02470000 0x02470fff Private Memory rwx True False False -
private_0x0000000002480000 0x02480000 0x02480fff Private Memory rwx True False False -
private_0x0000000002490000 0x02490000 0x02490fff Private Memory rwx True False False -
private_0x00000000024a0000 0x024a0000 0x024a0fff Private Memory rwx True False False -
private_0x00000000024b0000 0x024b0000 0x024b0fff Private Memory rwx True False False -
private_0x00000000024c0000 0x024c0000 0x024c0fff Private Memory rwx True False False -
private_0x00000000024d0000 0x024d0000 0x024d0fff Private Memory rwx True False False -
private_0x00000000024e0000 0x024e0000 0x024e0fff Private Memory rwx True False False -
private_0x00000000024f0000 0x024f0000 0x024f0fff Private Memory rwx True False False -
private_0x0000000002500000 0x02500000 0x02500fff Private Memory rwx True False False -
private_0x0000000002510000 0x02510000 0x02510fff Private Memory rwx True False False -
private_0x0000000002520000 0x02520000 0x0252ffff Private Memory rw True False False -
pagefile_0x0000000002530000 0x02530000 0x0273afff Pagefile Backed Memory r True False False -
private_0x0000000002530000 0x02530000 0x02530fff Private Memory rwx True False False -
private_0x0000000002540000 0x02540000 0x02540fff Private Memory rwx True False False -
private_0x0000000002550000 0x02550000 0x02550fff Private Memory rwx True False False -
private_0x0000000002560000 0x02560000 0x02560fff Private Memory rwx True False False -
private_0x0000000002570000 0x02570000 0x02570fff Private Memory rwx True False False -
private_0x0000000002580000 0x02580000 0x02580fff Private Memory rwx True False False -
private_0x0000000002590000 0x02590000 0x02590fff Private Memory rwx True False False -
private_0x00000000025a0000 0x025a0000 0x025a0fff Private Memory rwx True False False -
private_0x00000000025b0000 0x025b0000 0x025b0fff Private Memory rwx True False False -
private_0x00000000025c0000 0x025c0000 0x025c0fff Private Memory rwx True False False -
private_0x00000000025d0000 0x025d0000 0x025d0fff Private Memory rwx True False False -
private_0x00000000025e0000 0x025e0000 0x025e0fff Private Memory rwx True False False -
private_0x00000000025f0000 0x025f0000 0x025f0fff Private Memory rwx True False False -
private_0x0000000002600000 0x02600000 0x02600fff Private Memory rwx True False False -
private_0x0000000002610000 0x02610000 0x02610fff Private Memory rwx True False False -
private_0x0000000002620000 0x02620000 0x02620fff Private Memory rwx True False False -
private_0x0000000002630000 0x02630000 0x02630fff Private Memory rwx True False False -
private_0x0000000002640000 0x02640000 0x02640fff Private Memory rwx True False False -
private_0x0000000002650000 0x02650000 0x02650fff Private Memory rwx True False False -
private_0x0000000002660000 0x02660000 0x02660fff Private Memory rwx True False False -
private_0x0000000002670000 0x02670000 0x02670fff Private Memory rwx True False False -
private_0x0000000002680000 0x02680000 0x02680fff Private Memory rwx True False False -
private_0x0000000002690000 0x02690000 0x02690fff Private Memory rwx True False False -
private_0x00000000026a0000 0x026a0000 0x026a0fff Private Memory rwx True False False -
private_0x00000000026b0000 0x026b0000 0x026b0fff Private Memory rwx True False False -
private_0x00000000026c0000 0x026c0000 0x026c0fff Private Memory rwx True False False -
private_0x00000000026d0000 0x026d0000 0x026d0fff Private Memory rwx True False False -
private_0x00000000026e0000 0x026e0000 0x026e0fff Private Memory rwx True False False -
private_0x00000000026f0000 0x026f0000 0x026f1fff Private Memory rwx True False False -
private_0x0000000002700000 0x02700000 0x02700fff Private Memory rwx True False False -
private_0x0000000002710000 0x02710000 0x02710fff Private Memory rwx True False False -
private_0x0000000002720000 0x02720000 0x02720fff Private Memory rwx True False False -
private_0x0000000002730000 0x02730000 0x02730fff Private Memory rwx True False False -
private_0x0000000002740000 0x02740000 0x02947fff Private Memory rw True False False -
private_0x0000000002740000 0x02740000 0x0283ffff Private Memory - True False False -
private_0x0000000002840000 0x02840000 0x028cffff Private Memory rw True False False -
pagefile_0x0000000002850000 0x02850000 0x02c5ffff Pagefile Backed Memory rw True False False -
pagefile_0x00000000028d0000 0x028d0000 0x029aefff Pagefile Backed Memory r True False False -
private_0x00000000029b0000 0x029b0000 0x02a4ffff Private Memory rw True False False -
staticcache.dat 0x02a50000 0x0337ffff Memory Mapped File r False False False -
pagefile_0x0000000003380000 0x03380000 0x03772fff Pagefile Backed Memory r True False False -
private_0x0000000003780000 0x03780000 0x0b780fff Private Memory rw True False False -
dwmapi.dll 0x74ed0000 0x74ee2fff Memory Mapped File rwx False False False -
uxtheme.dll 0x74ef0000 0x74f6ffff Memory Mapped File rwx False False False -
wow64cpu.dll 0x74f80000 0x74f87fff Memory Mapped File rwx False False False -
wow64win.dll 0x74f90000 0x74febfff Memory Mapped File rwx False False False -
wow64.dll 0x74ff0000 0x7502efff Memory Mapped File rwx False False False -
comctl32.dll 0x753b0000 0x75433fff Memory Mapped File rwx False False False -
version.dll 0x75440000 0x75448fff Memory Mapped File rwx False False False -
winmm.dll 0x75450000 0x75481fff Memory Mapped File rwx False False False -
cryptbase.dll 0x75590000 0x7559bfff Memory Mapped File rwx False False False -
sspicli.dll 0x755a0000 0x755fffff Memory Mapped File rwx False False False -
msvcrt.dll 0x75660000 0x7570bfff Memory Mapped File rwx False False False -
lpk.dll 0x75710000 0x75719fff Memory Mapped File rwx False False False -
comdlg32.dll 0x759e0000 0x75a5afff Memory Mapped File rwx False False False -
sechost.dll 0x75a60000 0x75a78fff Memory Mapped File rwx False False False -
gdi32.dll 0x75a80000 0x75b0ffff Memory Mapped File rwx False False False -
rpcrt4.dll 0x75b10000 0x75bfffff Memory Mapped File rwx False False False -
shell32.dll 0x75cc0000 0x76909fff Memory Mapped File rwx False False False -
msctf.dll 0x76b30000 0x76bfbfff Memory Mapped File rwx False False False -
imm32.dll 0x76c00000 0x76c5ffff Memory Mapped File rwx False False False -
ole32.dll 0x76e30000 0x76f8bfff Memory Mapped File rwx False False False -
advapi32.dll 0x76f90000 0x7702ffff Memory Mapped File rwx False False False -
user32.dll 0x771d0000 0x772cffff Memory Mapped File rwx False False False -
shlwapi.dll 0x77350000 0x773a6fff Memory Mapped File rwx False False False -
kernel32.dll 0x773b0000 0x774bffff Memory Mapped File rwx False False False -
oleaut32.dll 0x774c0000 0x7754efff Memory Mapped File rwx False False False -
usp10.dll 0x77550000 0x775ecfff Memory Mapped File rwx False False False -
kernelbase.dll 0x775f0000 0x77635fff Memory Mapped File rwx False False False -
private_0x0000000077640000 0x77640000 0x77739fff Private Memory rwx True False False -
private_0x0000000077740000 0x77740000 0x7785efff Private Memory rwx True False False -
ntdll.dll 0x77860000 0x77a08fff Memory Mapped File rwx False False False -
ntdll.dll 0x77a40000 0x77bbffff Memory Mapped File rwx False False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
For performance reasons, the remaining 7 entries are omitted.
The remaining entries can be found in flog.txt.
Hook Information
»
Type Installer Target Size Information Actions
Code pdasib.exe:+0xdbe43 ntdll.dll:DbgBreakPoint+0x0 1 bytes -
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Create \\.\SICE desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \\.\SIWVID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \\.\NTICE desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Windows\system32\ntdll.dll desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_SYSTEM, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Read C:\Windows\system32\ntdll.dll size = 32, size_out = 32 True 1
Fn
Data
Registry (8)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Wine - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Hardware\description\System - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 value_name = DriverDesc, data = 83 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Hardware\description\System value_name = SystemBiosVersion, data = 80 True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Hardware\description\System value_name = VideoBiosVersion, data = 80 False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe" os_pid = 0xb30, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE True 1
Fn
Thread (3)
»
Operation Process Additional Information Success Count Logfile
Get Context c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe os_tid = 0x8f0 True 1
Fn
Set Context c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe os_tid = 0x8f0 True 1
Fn
Resume c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe os_tid = 0x8f0 True 1
Fn
Module (281)
»
Operation Module Additional Information Success Count Logfile
Load USER32.dll base_address = 0x771d0000 True 1
Fn
Load ADVAPI32.dll base_address = 0x76f90000 True 1
Fn
Load NTDLL.dll base_address = 0x77a40000 True 1
Fn
Load winmm.dll base_address = 0x75450000 True 2
Fn
Load NTDLL base_address = 0x77a40000 True 1
Fn
Load kernel32.dll base_address = 0x773b0000 True 4
Fn
Load user32.dll base_address = 0x771d0000 True 2
Fn
Load advapi32.dll base_address = 0x76f90000 True 2
Fn
Load oleaut32.dll base_address = 0x774c0000 True 3
Fn
Load version.dll base_address = 0x75440000 True 1
Fn
Load gdi32.dll base_address = 0x75a80000 True 1
Fn
Load ole32.dll base_address = 0x76e30000 True 1
Fn
Load comctl32.dll base_address = 0x753b0000 True 1
Fn
Load comdlg32.dll base_address = 0x759e0000 True 1
Fn
Load shell32 base_address = 0x75cc0000 True 1
Fn
Load user32 base_address = 0x771d0000 True 1
Fn
Load advapi32 base_address = 0x76f90000 True 1
Fn
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x77a40000 True 13
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe base_address = 0x400000 True 225
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe, size = 256 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe, size = 512 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetNativeSystemInfo, address_out = 0x773d10b5 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x754526e0 True 2
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtOpenThread, address_out = 0x77a61128 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77a5fda0 True 4
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlAllocateHeap, address_out = 0x77a6e026 True 2
Fn
Create Mapping C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe, protection = PAGE_READONLY, maximum_size = 0 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 1634560 True 1
Fn
Map C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, desired_access = FILE_MAP_READ True 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x29d0000 True 1
Fn
Map - process_name = "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe" , protection = PAGE_EXECUTE_READWRITE, address_out = 0x400000 True 1
Fn
Window (14)
»
Operation Window Name Additional Information Success Count Logfile
Find - class_name = OLLYDBG False 1
Fn
Find - class_name = GBDYLLO False 1
Fn
Find - class_name = pediy06 False 1
Fn
Find - class_name = FilemonClass False 2
Fn
Find File Monitor - Sysinternals: www.sysinternals.com - False 2
Fn
Find - class_name = PROCMON_WINDOW_CLASS False 2
Fn
Find Process Monitor - Sysinternals: www.sysinternals.com - False 2
Fn
Find - class_name = RegmonClass False 1
Fn
Find Registry Monitor - Sysinternals: www.sysinternals.com - False 1
Fn
Find - class_name = 18467-41 False 1
Fn
System (18)
»
Operation Additional Information Success Count Logfile
Sleep duration = 50 milliseconds (0.050 seconds) True 1
Fn
Get Time type = Local Time, time = 2019-02-23 00:29:58 (Local Time) True 1
Fn
Get Time type = Local Time, time = 2019-02-23 00:29:59 (Local Time) True 1
Fn
Get Info type = Operating System True 3
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Operating System True 5
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 2
Fn
Get Info type = SYSTEM_MODULE_INFORMATION True 4
Fn
Debug (8)
»
Operation Process Additional Information Success Count Logfile
Check for Presence c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe - True 3
Fn
Check for Presence c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe - True 1
Fn
Check for Presence c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe - True 1
Fn
Check for Presence c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe - False 1
Fn
Hide c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe - True 1
Fn
Print c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe type = DEBUG_STRING, text = %s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------ True 1
Fn
Process #2: pdasib.exe
8821 0
»
Information Value
ID #2
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:04:07, Reason: Child Process
Unmonitor End Time: 00:04:33, Reason: Self Terminated
Monitor Duration 00:00:26
OS Process Information
»
Information Value
PID 0xb30
Parent PID 0x8ec (c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B34
0x B38
0x B44
0x B48
0x B4C
0x B50
0x B54
0x B68
0x B6C
0x B70
0x B74
0x B78
0x B7C
0x B80
0x B84
0x B88
0x B8C
0x B9C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
imm32.dll 0x00020000 0x0003dfff Memory Mapped File r False False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File rwx False False False -
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory rw True False False -
private_0x0000000000090000 0x00090000 0x0018ffff Private Memory rw True False False -
pagefile_0x0000000000190000 0x00190000 0x00193fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory rwx True False False -
locale.nls 0x001b0000 0x00216fff Memory Mapped File r False False False -
private_0x0000000000220000 0x00220000 0x0025ffff Private Memory rw True False False -
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory rw True False False -
pagefile_0x0000000000260000 0x00260000 0x00266fff Pagefile Backed Memory rw True False False -
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory rw True False False -
pagefile_0x0000000000270000 0x00270000 0x00276fff Pagefile Backed Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory rw True False False -
pagefile_0x00000000002a0000 0x002a0000 0x002a6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000002b0000 0x002b0000 0x002b1fff Pagefile Backed Memory rw True False False -
private_0x00000000002c0000 0x002c0000 0x002cffff Private Memory rw True False False -
pagefile_0x00000000002c0000 0x002c0000 0x002c6fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000002c0000 0x002c0000 0x002c7fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000002d0000 0x002d0000 0x002d6fff Pagefile Backed Memory rw True False False -
pagefile_0x00000000002d0000 0x002d0000 0x002d7fff Pagefile Backed Memory rw True False False -
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e6fff Pagefile Backed Memory rw True False False -
private_0x00000000002f0000 0x002f0000 0x0036ffff Private Memory rw True False False -
private_0x0000000000370000 0x00370000 0x003affff Private Memory rw True False False -
private_0x00000000003b0000 0x003b0000 0x003effff Private Memory rw True False False -
pagefile_0x00000000003f0000 0x003f0000 0x003f6fff Pagefile Backed Memory rw True False False -
pdasib.exe 0x00400000 0x00939fff Memory Mapped File rwx True True False
...
pagefile_0x0000000000400000 0x00400000 0x00418fff Pagefile Backed Memory rwx True False False -
private_0x0000000000420000 0x00420000 0x0051ffff Private Memory rw True False False -
private_0x0000000000520000 0x00520000 0x0055ffff Private Memory rw True False False -
private_0x0000000000560000 0x00560000 0x0065ffff Private Memory rw True False False -
private_0x0000000000660000 0x00660000 0x007cffff Private Memory rw True False False -
private_0x0000000000660000 0x00660000 0x00760fff Private Memory rw True False False -
private_0x0000000000660000 0x00660000 0x0075ffff Private Memory rw True False False -
private_0x0000000000760000 0x00760000 0x0079ffff Private Memory rw True False False -
private_0x00000000007c0000 0x007c0000 0x007cffff Private Memory rw True False False -
pagefile_0x00000000007d0000 0x007d0000 0x00957fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000960000 0x00960000 0x00ae0fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000af0000 0x00af0000 0x01eeffff Pagefile Backed Memory r True False False -
private_0x0000000001ef0000 0x01ef0000 0x020fffff Private Memory rw True False False -
private_0x0000000001ef0000 0x01ef0000 0x01feffff Private Memory rw True False False -
private_0x0000000001ff0000 0x01ff0000 0x0202ffff Private Memory rw True False False -
private_0x0000000002030000 0x02030000 0x0206ffff Private Memory rw True False False -
private_0x0000000002070000 0x02070000 0x020affff Private Memory rw True False False -
private_0x00000000020c0000 0x020c0000 0x020fffff Private Memory rw True False False -
sortdefault.nls 0x02100000 0x023cefff Memory Mapped File r False False False -
private_0x00000000023d0000 0x023d0000 0x024cffff Private Memory rw True False False -
private_0x00000000024d0000 0x024d0000 0x025cffff Private Memory rw True False False -
private_0x00000000025d0000 0x025d0000 0x026cffff Private Memory rw True False False -
pagefile_0x00000000026d0000 0x026d0000 0x02ac2fff Pagefile Backed Memory r True False False -
private_0x0000000002ad0000 0x02ad0000 0x02bcffff Private Memory rw True False False -
private_0x0000000002bd0000 0x02bd0000 0x02ccffff Private Memory rw True False False -
private_0x0000000002cd0000 0x02cd0000 0x02dcffff Private Memory rw True False False -
private_0x0000000002dd0000 0x02dd0000 0x02e0ffff Private Memory rw True False False -
private_0x0000000002e10000 0x02e10000 0x02f0ffff Private Memory rw True False False -
private_0x0000000002f10000 0x02f10000 0x02f4ffff Private Memory rw True False False -
private_0x0000000002f50000 0x02f50000 0x0304ffff Private Memory rw True False False -
private_0x0000000003050000 0x03050000 0x0308ffff Private Memory rw True False False -
private_0x0000000003090000 0x03090000 0x0318ffff Private Memory rw True False False -
private_0x0000000003190000 0x03190000 0x031cffff Private Memory rw True False False -
private_0x00000000031d0000 0x031d0000 0x032cffff Private Memory rw True False False -
private_0x00000000032d0000 0x032d0000 0x0330ffff Private Memory rw True False False -
private_0x0000000003310000 0x03310000 0x0340ffff Private Memory rw True False False -
private_0x0000000003410000 0x03410000 0x0344ffff Private Memory rw True False False -
private_0x0000000003450000 0x03450000 0x0354ffff Private Memory rw True False False -
private_0x0000000003550000 0x03550000 0x03650fff Private Memory rw True False False -
private_0x0000000003660000 0x03660000 0x03760fff Private Memory rw True False False -
private_0x0000000003770000 0x03770000 0x03870fff Private Memory rw True False False -
private_0x0000000003880000 0x03880000 0x0397ffff Private Memory rw True False False -
private_0x0000000003980000 0x03980000 0x03a80fff Private Memory rw True False False -
private_0x0000000003a90000 0x03a90000 0x03b90fff Private Memory rw True False False -
private_0x0000000003ba0000 0x03ba0000 0x03ca0fff Private Memory rw True False False -
private_0x0000000003cb0000 0x03cb0000 0x03db0fff Private Memory rw True False False -
private_0x0000000003dc0000 0x03dc0000 0x03ec0fff Private Memory rw True False False -
private_0x0000000003ed0000 0x03ed0000 0x040cffff Private Memory rw True False False -
private_0x00000000040d0000 0x040d0000 0x0410ffff Private Memory rw True False False -
private_0x0000000004110000 0x04110000 0x0420ffff Private Memory rw True False False -
private_0x0000000004210000 0x04210000 0x04290fff Private Memory rw True False False -
private_0x00000000042a0000 0x042a0000 0x043a0fff Private Memory rw True False False -
kernelbase.dll.mui 0x043b0000 0x0446ffff Memory Mapped File rw False False False -
wow64cpu.dll 0x74f80000 0x74f87fff Memory Mapped File rwx False False False -
wow64win.dll 0x74f90000 0x74febfff Memory Mapped File rwx False False False -
wow64.dll 0x74ff0000 0x7502efff Memory Mapped File rwx False False False -
browcli.dll 0x753a0000 0x753acfff Memory Mapped File rwx False False False -
netutils.dll 0x753b0000 0x753b8fff Memory Mapped File rwx False False False -
cscapi.dll 0x753c0000 0x753cafff Memory Mapped File rwx False False False -
wkscli.dll 0x753d0000 0x753defff Memory Mapped File rwx False False False -
davhlpr.dll 0x753e0000 0x753e7fff Memory Mapped File rwx False False False -
davclnt.dll 0x753f0000 0x75406fff Memory Mapped File rwx False False False -
ntlanman.dll 0x75410000 0x75423fff Memory Mapped File rwx False False False -
winsta.dll 0x75430000 0x75458fff Memory Mapped File rwx False False False -
drprov.dll 0x75460000 0x75467fff Memory Mapped File rwx False False False -
mpr.dll 0x75470000 0x75481fff Memory Mapped File rwx False False False -
cryptbase.dll 0x75590000 0x7559bfff Memory Mapped File rwx False False False -
sspicli.dll 0x755a0000 0x755fffff Memory Mapped File rwx False False False -
msvcrt.dll 0x75660000 0x7570bfff Memory Mapped File rwx False False False -
lpk.dll 0x75710000 0x75719fff Memory Mapped File rwx False False False -
sechost.dll 0x75a60000 0x75a78fff Memory Mapped File rwx False False False -
gdi32.dll 0x75a80000 0x75b0ffff Memory Mapped File rwx False False False -
rpcrt4.dll 0x75b10000 0x75bfffff Memory Mapped File rwx False False False -
shell32.dll 0x75cc0000 0x76909fff Memory Mapped File rwx False False False -
msctf.dll 0x76b30000 0x76bfbfff Memory Mapped File rwx False False False -
imm32.dll 0x76c00000 0x76c5ffff Memory Mapped File rwx False False False -
advapi32.dll 0x76f90000 0x7702ffff Memory Mapped File rwx False False False -
nsi.dll 0x77030000 0x77035fff Memory Mapped File rwx False False False -
user32.dll 0x771d0000 0x772cffff Memory Mapped File rwx False False False -
ws2_32.dll 0x77300000 0x77334fff Memory Mapped File rwx False False False -
shlwapi.dll 0x77350000 0x773a6fff Memory Mapped File rwx False False False -
kernel32.dll 0x773b0000 0x774bffff Memory Mapped File rwx False False False -
usp10.dll 0x77550000 0x775ecfff Memory Mapped File rwx False False False -
kernelbase.dll 0x775f0000 0x77635fff Memory Mapped File rwx False False False -
private_0x0000000077640000 0x77640000 0x77739fff Private Memory rwx True False False -
private_0x0000000077740000 0x77740000 0x7785efff Private Memory rwx True False False -
ntdll.dll 0x77860000 0x77a08fff Memory Mapped File rwx False False False -
ntdll.dll 0x77a40000 0x77bbffff Memory Mapped File rwx False False False -
private_0x000000007ef86000 0x7ef86000 0x7ef88fff Private Memory rw True False False -
private_0x000000007ef89000 0x7ef89000 0x7ef8bfff Private Memory rw True False False -
private_0x000000007ef8c000 0x7ef8c000 0x7ef8efff Private Memory rw True False False -
private_0x000000007ef8f000 0x7ef8f000 0x7ef91fff Private Memory rw True False False -
private_0x000000007ef92000 0x7ef92000 0x7ef94fff Private Memory rw True False False -
private_0x000000007ef95000 0x7ef95000 0x7ef97fff Private Memory rw True False False -
private_0x000000007ef98000 0x7ef98000 0x7ef9afff Private Memory rw True False False -
private_0x000000007ef9b000 0x7ef9b000 0x7ef9dfff Private Memory rw True False False -
private_0x000000007ef9e000 0x7ef9e000 0x7efa0fff Private Memory rw True False False -
private_0x000000007efa1000 0x7efa1000 0x7efa3fff Private Memory rw True False False -
private_0x000000007efa4000 0x7efa4000 0x7efa6fff Private Memory rw True False False -
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory rw True False False -
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory rw True False False -
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory rw True False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory r True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory rw True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory rw True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory rw True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory rw True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory rw True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory r True False False -
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #1: c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe 0x8f0 address = 0x400000, size = 102400 True 1
Fn
Modify Control Flow #1: c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe 0x8f0 os_tid = 0xb34, address = 0x77a501c4 True 1
Fn
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe 2.04 MB MD5: 3dd37c6c7e82add7dc670f915e434fde
SHA1: d3809eaa76ad95a50b114c2b56c528655ae4fd5b
SHA256: 3145ce9af8f1e44e2c0f0a9123f8201a3aab013c7bfaf1f120fa4d7e50a67259
SSDeep: 49152:d69mkNHDmPsKlYtiO5ssBVlZBtLuqV5Rcl5a8w:Omkt6kKyt9seVlPtLl76nw 		False
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 16.70 KB MD5: 7804eb8669ab3b505462d7e9e97eb612
SHA1: b56e2aec46636b76f4e7350a058caee1691f2e4e
SHA256: f0a22a32496d31d3606a73ed85edc7da34aaa19d4bd4e8d76c56f6982c71cd2a
SSDeep: 384:Rbf9J7QL/+es4E3tYt4LR4+/gwfvK2FkywXPpF6+5rd4U2/hhYlxh:VfLIhkZTgwfvVW/x5+UQYB 		False
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 6.33 KB MD5: 38784cc357bc6881ae0c39814a677c22
SHA1: 8105183cc433a0b4604ec9af36b744bda5764346
SHA256: 10d3121545cf9d3aa40dc053dd8bbab6c66cdd4e3bf083d21f5d1c370264cfe2
SSDeep: 96:+QlXDdGTFoUGQjAr/VMhP1mFaSGbTc5M99hl5ZnLNaLxf7Z9F8WWcUlhNRDl4OjY:/ldHqAmh9fbTcKxsF7HF8WWcUPxFha 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 26.79 KB MD5: 57849186c8f21900576ab96c1da3d1cf
SHA1: 95f667843cd630a733f567b82d6bfbdf0ef53d02
SHA256: 6cf68bae97ffd86e6e5a6bf0470d6ccd6c45239e2923ac848baaf6cece277fd1
SSDeep: 768:lzNBSQc38+8jKGdYFCZdJKCtwStJyZcng+k:lqQe8+8jKA4yJKsJyZcnu 		False
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.80 KB MD5: bf8c1b670da38960413660e543180326
SHA1: a5ef10b37b046ca13d2ce39e70b98ce4796aa854
SHA256: 7b372b8847a2ecae8332fc21b17d855164b08c19a59288f73cb28fd2399e66df
SSDeep: 48:eSdkz2q3yYKNpFfgKoCfo/emOns/IAjSbEVH0cqueNJYYfx22em7q8Vp:HphloTfrIEVH0cquBYZgUL 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 6.51 KB MD5: 0f85b86c2a1a755e6048dbc93079368d
SHA1: d87cbef87fb388eab35192394eaf342900aa6994
SHA256: 1ec6658cfda7ed377f8d5f6b6b38b7d1a7ee7ebfff747467cc83b0d92c803b65
SSDeep: 192:cjzOx9CBIQ/wb7M3eImfmZ4pqGIm2FZ7dknb9R:WS3/Qn3eIReEXHddknbr 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 860.74 KB MD5: e93c398a02463a7d8ca56f865dda61ca
SHA1: 5efe474baf6b81705ffd1cbedb9f75957eba9e6c
SHA256: 708d884b409e0b434ef92ac178d037874c90dae101be919208606162c2423c2f
SSDeep: 12288:eWxptxygZJHKlCkH5mLsoNWfa7pFaeEbFtUOFiC8NB33ZI3t93uiT4Ri:e4p2gPKCkH4Lsoea9ceEhtUYiC8iPvYi 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.15 MB MD5: 527054301364b5f159fdcdf3af6936bd
SHA1: 5ad719eff1d0d7c471ff361bc63a69d4f0f59cb7
SHA256: fe420a35f5427f7b17a1da9b03f9f32d7aab3ed3e13d7581dcc5360f5c2f75f0
SSDeep: 49152:zDxL8QBonTex4S120ytJySg4W5u368YdQN/tJgQb:zR89K134WQq8YK/tFb 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.03 KB MD5: 0b7ffc655b759a15fd9ac3f6d0ecc010
SHA1: fa31ad1ecc0fb879ecc7c0620317a3e5fc50cd41
SHA256: 4ce40932475642c9c5b6ad77d3ae315f8d304debadf7578e5ca534ae9afb5009
SSDeep: 24:5aPeEW31Nmu1t6sfv9zo9ejtVB7Ma2IOA+MIpyDJ:5aGEW31NmQ6sfvO9ejtn7T23Az7 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.13 KB MD5: 09a5a82ea66daaad427d46cbc4a1f288
SHA1: 6cf55b0ba4fa00fdf340bb6f5c19dd667e833eb6
SHA256: a64d5aa149929c525d735d6b940bbf5239336d06b9e4e68346ba0cde299858d2
SSDeep: 48:6FX9j1sQoiqgDRLn9gNz8UZBqaUBIjgXGnge/b:6B9+0lc828BIj5ngeT 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 26.54 KB MD5: ee83b709ee128cf52733cb2b008a0aaa
SHA1: d3ac898c6146fdd5c96442816f5b0a9a12565c90
SHA256: e8c33fa6c3b8c9cdf6a10039f6fa668d6cf1c3a7fdf37ca41c58fa79f94cce71
SSDeep: 384:+ajRnLQxE95OLxrrlgjK8zf4fjBSnZDNtCacYpCN33bNpftoJs3rn1DbLpVbj:Dj5oE9I94caP5E3rL+kj 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.99 KB MD5: bd5a56d917dee61b5284372b7a8afe02
SHA1: cd7f3aaf13675b95fe29469181308a17dc8e35fe
SHA256: 206259d67c61abbac8633756e2631963f893bafddd72d4d1c8eb0914163b33bb
SSDeep: 48:kwNmtQOCKnGWU4tZtaObMfFCwAK+uyby+wrn:kwNmiYGD4H0FZAK+HGD 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: ff63eedb4c79023110eabb6218cd8166
SHA1: 66d7b7bca2716004acd763a5d4a695c03204b977
SHA256: be23ade517584cc95fbf3d593f00d2239dbf6d1369739197655d4b2e13918dc3
SSDeep: 24:0qHl2R7ISNQyg7o91BwPAl+1SrdPhkArAnFZKxFGfXGKev7K0Ux4CFfrRJWpuBJ9:P07e61FdPyGAaxF4IDfjCFfrzWsrVL 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.47 KB MD5: e5f6187203fa51e6de1320b11b07797c
SHA1: 1317a8c17b2ab3c27c08ee8b5d10619878d16457
SHA256: c1332e93abaf5a44568cb8ceeb961c6a7299d92e80537d0e6de48eff2fb9f3fb
SSDeep: 48:BqCwjAYsirnHnyjrCATkqC8S9z0auBQ+P568s5bcWtZM5hwwJdQO2Kbm:BqTcwnwG+C8Iz0agHB615cWtZghTsKbm 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163
SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455
SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ 		False
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.81 KB MD5: a2677f19e07fc4d2413d80321896636e
SHA1: 246bd857cff70c9591d79b5554c79628f6243132
SHA256: 98a82a12d128cbd07ae9912fda2fc95916c0950a4b68344fda5711094f8eee66
SSDeep: 24:dQMkYH54zM7wA4P1jm3HwPEKX/uAV3Vx2Ocq+pi0fdGgl5I0wbG+b6XyGSoPFjUx:cWYHVm3HkVRcqiVxOGxXyIy+WUYeef 		False
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 4af8fe567cf72cf90cbbad22275ef86c
SHA1: e173401fc1c0644510c211575d4c2cb2bac4168c
SHA256: 496e9acff6dff99d6aacc345ab9c087b6314b22d1450d2b616a55ead444b3dc3
SSDeep: 48:KzOEdJqlOl3qX0wB5ZEqtikFFHjPE2AnwD+pRpcLKLf7eZ0/f:GqYlkZAqtL5PEV2IvT 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 6148fb6dfcf40651deac0e9cb9ccea81
SHA1: 75dc2062a20f102e4e2ae021e7fab59032793006
SHA256: 0df6e7e2b139fdd66c23b00dfc51d543009ae475ac8bdb5028fd7bdd2cb6afae
SSDeep: 48:PJnHvIw9vTf9tGpDdp7e1tHe52DVd2lihDoW16137n:hwwJD9tGp7cC2DTZDp1mrn 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 16.52 KB MD5: bb4dca89ba1e2e295d22aa33f381d3b3
SHA1: 11ffe946a8d48da4c72a7ee1ebc1f1407146803d
SHA256: d6b07b59715d7d6ba7d3a1717edda83a6ba6ac541cfd620be9c6ceda93d3d1ef
SSDeep: 384:vg1+iR+rif90zp7IuWXymXtCsjUdlyc6SRSJJMHCdfARl0Por4eMIAGG:4IOV0zp0TXy2Cbacj+yDRlFRMIY 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.14 KB MD5: ac6a669039ac8e8ba992afcc2694141c
SHA1: 00f83fcc6c0209d7704479599a62cfb5979da799
SHA256: 363af84bc4990f31bb6d363c782240acb5c838ff0d06af2b9a4e19e27f4c5278
SSDeep: 24:9bkBs/wj480I2XSEDxbPhs9K8CNJMmV7tQ+bqg200Bk12wpyDFl:9bkey0IE1hsCTfVmBxV 		False
...
C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE 0.87 KB MD5: 39c82d1bdb5b2573d9e46b725ef8f401
SHA1: 8ce680582fca67257721891a5a440d0ca383682e
SHA256: 8bb245d2fc2bb172ed337a039034cbb534c00495ae0e0e8cdb3776fa38424cd8
SSDeep: 24:GCFCZujZnZnek112J7oMy4t4pfELZMf9fR9FAigMKwpyDz:GGCQPnwJEAJLZMp/Re 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.18 KB MD5: ac33d5ccb38315c1874c5a8052c6b120
SHA1: 408237fcb2ccc8a420542d922c0b31bae9869a14
SHA256: 0c6c9fb0d483cda2886016e356d8e9d489580aeb098bc3a12f9872594763fdb2
SSDeep: 48:1hGIfBLzmFtZJ2xy02Zx6mERZ+l9DSOOm/2o7HyJWDtN7TEQMH:1hGYBLzmFbJWyLUD+l9DSOOXgyJivA 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[sebekgrime@tutanota.com].AYE 65.85 KB MD5: f759a8dc294df228556b02025b548129
SHA1: 316049e0cac4865233a56323f49f76b3a8a1407a
SHA256: 8082c5d49d48832653d16be43da4778bfc48a1c79716aa603407feb6d6b3c859
SSDeep: 1536:UklxlArTYL91ZMFQ37E8EdZmFTMkqqO+rG5lJL1AcLbfs4Mvi6VmNa:U8xnLmFQ37E88kY+roxAqbfKp+a 		False
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.27 KB MD5: 4d0a8d4d47506400d16111115609c6c4
SHA1: 3f693ab1b40078cff479d7f6febe9f369e64d330
SHA256: 1d8ed2ada3de31b774980ff73fe4e9e4dba08455dd9ffd8413f33fec26c0854a
SSDeep: 24:J0Yh26wZKQqEM5Mdc3WO1XH9XS4LQ3PAFJb+5Na8Pj0tzEnGvP9spyDF:7jbuOtY3PKJbPiOz1vZ 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 22eb96af02b3f36235bd1a95b5236a43
SHA1: 2c8def42f67a9f4b3c53bb0fdea9f1e6b70f1b73
SHA256: f9d7499c5d32bd8470545613f9ed3130a8e6e18ef2f104397c9ead1046bf6e76
SSDeep: 24:NJoL+ty8QmriN7Uyvi6/AYB8sKAG9dnDkas35rrx3ZQqVk3BQCOeH0lT5gQjxm5A:NmLMRe4YB8spe4asprEqGiCOeiT5h4K 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.36 KB MD5: 58e0635f8182c42d7d5333fead19f1f8
SHA1: 2c9ee4b17894a48759781dcb8708e83371a7c73b
SHA256: 46f29c6c65ad2de6c2ba2002889de84bd0b22ba4e645e1382897061ad8dacd62
SSDeep: 96:EbowSPWDIchy+JdHjdwOTKskxY0oFkAUgr:EswSPQhy+JdJwKaxYFok 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.55 KB MD5: 4724ac7c4035951dde6a4802ed12b9d4
SHA1: 7ffd734202c3dfcf5e43e994cf0d4f3b47343f6f
SHA256: 4cfc7cf73272aa4f4310d7a4dae907c212a4f8cd4e042ec0bb1bd686ed8c442a
SSDeep: 24:Q4GBrttJAcMGxe96Z/GNIdUatzNLJKYbL1iCKjL4usc08enzPTpyDH:Q40xtmcbxe9iGaO6NLJK0BiCq4jm 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: ed0d1731b114f3b9db909889b47a167d
SHA1: e9df605c62dbccdb27f9d47a18e80dfdfd78e997
SHA256: c7dc5c3c46f7824cd1c75a50e48833c43aa60fec9ec972fe11e81e2aea6dca25
SSDeep: 48:dl5bYLCGh5n0z+ketfi7N4KrAzQSZwphRttD:dl5ELzh5n/kSg40gQSwpD 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.60 KB MD5: 624861b6ddbadd0056d8c03ef75ade95
SHA1: 8999b623b479b7d006c3cb807c1689b70e46ebec
SHA256: 0bf55199b2d15ffc084c5820667f37b21f61f399bde1bd6a14b461b576316367
SSDeep: 24:HBVxFH5i/aYEYCnkvSdIT8HX3z3zn8ssrpE172zPV+ZEpkI7yBobSYk2lk9fVjp2:pJbHIT8H85W72zAkkOQoOY1+Yl 		False
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.56 KB MD5: 812bb3920b1803a6c6093812cb8fad49
SHA1: 16df42fdebb91efbefe54d0b4b6160a8f67e3ef0
SHA256: b55aa628dbd30cc731d074ae55b9f801b2093848aa0c84888d412abe2ee7023a
SSDeep: 24:ZnCTdcLDv0SajTQb8DMFPrjT1XdwXXOHBnK1ThMgpu2tj2DBCPsWSebHBRpyDFl:ZnChQHajTQb8OhNwnOhnK1vgDBMiebBa 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.07 KB MD5: e19bb2af5ab9a0d08730a1dae7001904
SHA1: 53eb34256d7defb9dec5c07fa319529c8e4817c2
SHA256: 62b0172a7b3c90ba39d006d454cd6f7b8c1430c55979d28f119942c994356bd2
SSDeep: 48:x60zFuZLdU8zpWjnQ+NS30vF8H07IAM20xoKQqR:x60zFuZJynQsSkvF8HLAMjlbR 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.14 MB MD5: 9e75607e8a66b8ea9750795c6c5b363c
SHA1: 36c2c54386c866d02b5e1939895a10bd3df581a1
SHA256: f49ebfc512b3767a817c90aa8760951cbad3702da5633fbd36190229b6bf1806
SSDeep: 49152:zDxL8QBo6Tex4S120ytJypnLnAI/BmkVhi:zR89j1Fnnrvi 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 5.97 KB MD5: 7d9af231c5dff18a41f718d5c45f22b5
SHA1: a96b71355f2875dfa4880fe50a2deb8e813bf65e
SHA256: 8dd87288aba399c44e1a879dfe7289a10ed7fafb5d8e2192d3f015fd91e4b940
SSDeep: 96:OZvRedLBee2BB1GUPkLrHl7N44QZRDKT1W5/VknpfKjgJfS9c88mh7VKFXY2sWXr:OSKBgUPCdN45ZgT1PfVJfyc88W7V+DxF 		False
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.05 KB MD5: b4215e0ffcc5435ea77dc746bbe507c0
SHA1: 75d47834de044d784e732a3dbf72d9ca2557902c
SHA256: 4c0ba35749b583ffb937ef8aeb1b63bb436545a5299bb702b645775b783e83e4
SSDeep: 24:m/KU7Sf4Je+BQD7slanQo2VhagQKA1co3IO2WS25NTpyDh:IKUOfwQj36haLKMzA2+ 		False
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 16.52 KB MD5: 278b248e26d452492aa2ec6083768a87
SHA1: f16e0676b0f9450c32eeb4336292188e66cdd8b5
SHA256: 641ff441d5f36a49009078c76a69a85c97348da64e9944a84b3dc11138d82796
SSDeep: 384:fqItFmZsRlYTx4Bp03d8CC/e1k1Z7HgQ2KtvnHFkmJ/8zOG:nn4UW3fkYYZMNwHFnkzt 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 582.61 KB MD5: 215cd4eb59861ff4db5b28c01df573f9
SHA1: 93b6a8f9baa23354297f6725f32fb5de19e3dadb
SHA256: 3f3eb2a002b85bfaa8eaf90b8836f5107e5071e65145a9478e3f0c45f2feeafb
SSDeep: 12288:zAu7dsxuJVz82SxCeb2QpiTgf8ahC09m6/zPg6Lq2CPULx9xfpCvjokl2A:ztbJVo2ObHpMgf80COf/D42qULNfEvcA 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.05 KB MD5: ec28e5f9f2dd3d0e5b06c5165e749733
SHA1: 4720bdfba7ae4d44a99fd4147ca7051717eb9ae0
SHA256: 61315f0e6637a595935cfbe98db4382387f3a3fdff711af837774b669a630090
SSDeep: 24:q1rcBt4LImaAvIPwKjMcvx6yR7fHYkm3WS2Z9TpyDh:q1rcBt8WPXIc1FfQt2q 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.55 KB MD5: 80843964c37f4843b6278b5e649a7cf8
SHA1: f30822dd5174d8067fbb29d77c848da370244351
SHA256: 712953327a5924ab04b502f158ad8c8852bf8e6694fc6ba7810f6d432225fb11
SSDeep: 48:5TmGo563ZHNrg5KZP8NOARb74TteoR3JsGPaCkx:5TI0JHW5E8Eeo0oRGGP3y 		False
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.18 KB MD5: e0fd47b5e482638d3fd5c8d750d2da1e
SHA1: f8bb657f02c8c72ef96e0b7824704f0a63d9dc4c
SHA256: 06656576b77858277f696bc60400ff83fe0c04ea10c82d13cffa76dc5d3b3671
SSDeep: 48:A+dnnSYS9earv36mVFT1egIf6+xJYFzo2Yslw4owbRX/:A+dnSxVvqS5dO8k+PVX/ 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.44 KB MD5: 852150212108f835be345f4b43c8c1cb
SHA1: 67f2744106778a8cd316559bea0fe980a1e270e0
SHA256: a88852cb32682832975a563a35973b467e581e0549c025cea437e8a2e4fe67b6
SSDeep: 24:CH3YjemXfOlF9C51PRWsoWnLHJFI1LAq6v05OVYleVJkeTpyDpl:CH3KXEY1PRWsoaJExY40Y4vjIl 		False
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 853.75 KB MD5: 9d50edf2ec92592408bdf51d81450553
SHA1: fc18d52f9638443ee8f15ca6bf5359ad863fe506
SHA256: 8c25ed774c6bbbdf1924e18279a972889f688b46e242596ec09880261f3aaff5
SSDeep: 24576:sgCvThwRaZ/DWoKFMYgBR7iCZEsRculW/cFZxkTX3C6ZAtT:DC7hJ/DE/2hlZ5WeACttT 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 848.75 KB MD5: 3eff857e6c56713bdf4947895830b441
SHA1: fb272b1bb49e84dabc1f1165baf8beafe8f2d34d
SHA256: def269f1abd45ab7c26f8b52210b3442e2ee68f3406facf323f888a2e5cba25c
SSDeep: 24576:T6yjGo5XLosH7hq05btZL04UaH8WHGPTL:uyqm7osHdV5p104UaH8WmPf 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.04 KB MD5: 3ea5f9f745124410da1da0f6ab520299
SHA1: 52475171e78596bf82c5c1e284c8ad310e3e7000
SHA256: 6d9d8caf6ae150050907913a9e6474ac99e794115e1a14070c72169a3918918f
SSDeep: 48:AepVStXdL4Cowd2tB972KKGqHmCsw6CfxtYMAcgBto4g9dRm1R:AeTYXdXJkz972jGqHmCzXYMAcgfs9nmj 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 8.60 KB MD5: bc6d6dd0f261f7dc7cc177ef47293926
SHA1: a1ec510c213fd52af517b120d3c4db6d68a21964
SHA256: ce6b0e6460a90f2fa7f61e48166ca188a67650e15a9d6bedcc590d79a56f9557
SSDeep: 192:xBmA3Jm/x7R0m/0K+ltHSWOcUGdcTZvs+ZyRCN2HJW0:nL0xR0f1lxTOcP6TZvFZHo 		False
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.07 KB MD5: 6ef433a8879a653323974d3cd4da4f1d
SHA1: 12c5853f02ac8d423e5df4c83e7c665f99d0e1f9
SHA256: 5e231e5324a8537f535b4529bc2b41172422273f1f514a79cb995109fcbf56b9
SSDeep: 48:DmlEfgCFKFQa4qsewNjQp4Z1gg04zxj282ziDPTxn:DmyFK6Jd0OEc1qiDrxn 		False
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.88 KB MD5: 7cfbe5ed1ade260f37c5e55fa893eb99
SHA1: d8f23d0bbb2a5339ccc8f82c54265c70ded6032c
SHA256: 3f954c3eb8a6b75d62cc483fcd2244108cbc1d71a29a92d52eea240138ebb255
SSDeep: 48:xkR/eim+kD/zbMFKAHDhFiDGS0/anhFX9euakVr:xAeim+UYFKAHDhHTytlr 		False
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 8.76 KB MD5: dfff3cd0ee8d159c99339b9453e4136d
SHA1: 300a5d92220329aa62bf7d329b51b6636c1f5c76
SHA256: 53c14a4a6a8421e72a2acdc778dce7e6f8673c0a4761bb5022a88a27d7e60414
SSDeep: 192:rDuhD4c9fZGXANghlqUY1XW0rC1b83NUi8kOcCz3snNSc:rDODvfUwN+ljiW1+Ui8+Ceb 		False
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 9.51 KB MD5: adefa8a7f13de46de1c21e384db628ab
SHA1: c0222f00e877702efa20a0ab2740aa0c60d6fa90
SHA256: 8b25b4ecd8844c7c93be64ac0f42cc00c53492ad10e67c03041b473b990bc199
SSDeep: 192:M1qg73+8NTZOie2o11LCp7G0ciWXFJ3yuNao8HSO7Em1SbKJmMeRhC5:aq+xe2oynW+uNHgX7E8SbXC 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 69.80 KB MD5: d456864d9c06c495d6a7fb9c568c86ef
SHA1: 26998e2e4215017614803ef7879d3df4f160041d
SHA256: ab64f116e4299f019e3682a6723218ae1cb1b29f45d9abeda362667fd709f4d4
SSDeep: 1536:yrSf4c8CRX6bbOV0QdoMmI2AN1UcpdvyzshlxSCQbs/Q3Yd+tw:Vf4c1wbO/5mI2ALozsh2CQB3sd 		False
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.60 KB MD5: d2c16d9974588acb9e0c699d6b223bf3
SHA1: 36eb2d52ce4651f147c80ac3e37f6a7070eb076e
SHA256: f1cd178a7e45c0824f5ee0a9410d2a7b0c75edf21a6ddd48a2af5b26f0dd1d0a
SSDeep: 24:HDAIVbWzg2mppocfofCGkl20S++0EPRlKEV9JEX6kzxrw06cGD7Uk2lebFpyDpl:0IVyRmp+n++0Epl9rJEDxN6VDQ1e6l 		False
...
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE 64.25 KB MD5: 37e60417467011e5de9956a150dd7e75
SHA1: 328285c0b057d6800a5d4869272600c91b909c10
SHA256: 6f3456e62fc8345726fc44fc3d5b6b45421e1adcc46d28102863e3422b13ed28
SSDeep: 1536:6el46N2jJQ6TGTwzaA6LAP4g1AEo3WLRrLEDhWql:nhN29Q6T2MR6LAP4g1Ro30HEFWql 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 003514c153909056c23955eb7338d43a
SHA1: 9810e1c97e6482626dac7b513d52d8cdf5fdc964
SHA256: 4f789be3c848bc1767bfe8945405764b65e1ff08be45227fcfcef37012848d7e
SSDeep: 48:m0PxC9OAUjnqShCKT3TC/+UMrHJ6ZzCmCj:m0PxEOAUjqQCKT3TAJMzJ6Yt 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 9.51 KB MD5: 4f592c0ec24de20f2ff45c830cf0337e
SHA1: 4874ec98a04347e8fd82304b561c6620a1f614d0
SHA256: 23fcfc23959ed6f8124cb756ac474276bd747b7f6b5ff5cb9f17bc055cfa1fb6
SSDeep: 192:Lyx5Mmd2NqGctjztir4pWqHiGl1emhfR9winkBJnM3:G6md9iRmvZhJuik7ns 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.99 KB MD5: dce03aa5b00cfa03fdb5647979b6c509
SHA1: f9e9c9d01a62e7c4319f7f42e026056f80dba649
SHA256: 8656c7986eef2b2caf9f636aec554e4358c753107fc3307ca774aa185646e169
SSDeep: 48:9gVbHERoec7Jrap5C6lSdgc6q7+FenkW8B5GeSLHb7EUCMF5IwGVeQ:9pqHYp5C6sdgmFBjEeIwGx 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 5.67 KB MD5: c8b02675b58c136d29474c748ed99dda
SHA1: 3b647298a4d5104837730000671c33903dfadc9d
SHA256: 9282a98e76bbaefa459b8a462c3d110ae26c6fe79c82339ddfd8bc7d311d6e9b
SSDeep: 96:r8y4eWQxank6BG9j1knRir+4Gh5dA0+izedBXrVbXWqk4Wi396Piq:Yy4BQLX9hDCr5WHkOhrQU1Nc/ 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 582.61 KB MD5: 12e9ddc08cae7d9c68457d021b1fccc0
SHA1: 7d1076ec1f5f2a2740b4996cb448316c7fcf17f1
SHA256: b3533ce9d3b06849a7475dd67477cf21268281b4d2e8cdfc50bb54e26031bdcc
SSDeep: 12288:ef0k7deT3AwaIp77izxRkRqQALuKKJyOiLF5nd4T1v/QvRilpt4U0Te:w0k7qAwTgR5+iLvdK0epCUQe 		False
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[sebekgrime@tutanota.com].AYE 14.94 KB MD5: 8e359e2babd06df699aa19403e6fd51e
SHA1: b514247383daab2ae809f6850acc117f850808fd
SHA256: 7e70b3ae664356d0859ce6b3f29bcc7f8c2c9fa4b459f0571e3f5f75523a3435
SSDeep: 384:1wLkJhj0R+v68dwmIqWTpGBtAb7BTQI1Tau:1jJ90+hIfcAhTQIgu 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.54 KB MD5: 4a561ae2a8e184bd7ebbcbe1f8df44ae
SHA1: 52812488e9db33c336c145d453036e1990a6c9a0
SHA256: c773eae9c20de46efc71c3c1f4adf5f8a86cc88d5dac53c3baa7b6a8f8dc2401
SSDeep: 48:bAwg4Y2HENLoRBtWzMnH1KfhMJq4AK8FVJBgcx:b7gS4SjWzMnH1KZMJq4AKqgcx 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d
SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021
SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h 		False
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.04 KB MD5: b8c6003d98fdaadabec08509b4f9b577
SHA1: efe9678f8667e581ac80032afed463e3db1adcd5
SHA256: c5f2b75aa5643799180e3b0a34d7042a361ffff93965aa5c9787c8d3f76db832
SSDeep: 48:DAC1ud4AUf0SxKT72lVCPbFSJ8GA1VjWp+PBXKg1mDHlj:DNFAUfbnlMPxSqJ1Jo+X0pj 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.05 KB MD5: b044f135536e8c52cf48d347798335ba
SHA1: 7e1de0dce1a8be1ea1ba9b06b8f7c6960bcbf752
SHA256: 27a34b4adf23e75c36d4516faec37045d5bb086db45f8720c47c733c35d1e4ca
SSDeep: 24:fMepHRqwD6PfwOgc0CM/qs4UZNW6OKJU4S2ZATpyDh:fMe6wDcfIc0CM/qs4uNWp0U4S2h 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 5.67 KB MD5: 3e0927f1d509392f8f963dc341caa0c6
SHA1: 818a29d2f92cc48d94d356a85fa1813db0a87af5
SHA256: 4b9b6c4cf1323345a9908543b3c835eb182b0760c4e372a3e88aac54cff1ec04
SSDeep: 96:N9ThYPCB8G89lDjQjdVmCzZPwVad5wzD+VXWYZpfsXpg21qd97mR6djzKlizpfcm:N9TaKuG89lDjxkZPVrwzaQYfUZgWqn7b 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 30.60 KB MD5: fc31d1df492e06667ddc422e238f6525
SHA1: 4c74c07e603fe571cb9f173682960d016911b02c
SHA256: 8457728a3eedd357f09083b21fcd44f8d403a739af99474e7d8ffdecf8ee410b
SSDeep: 768:ddXl37yaR+CgpJoXNVooQ6wWXYMQajJk+oC791fpx:HZDAQzoHKQKk+o0bfX 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.07 KB MD5: 2d9e0a43e62a543a395cbdb456d00f6b
SHA1: 2e1bb8e8c1a1a94dcce3b840925b002fdea46bc6
SHA256: 366853fca57f9e0b1d6a5d0a2a949e4da099938c80e89072de4e0c846fb640da
SSDeep: 48:aNFgpY4PLLdKqTPN/aOleyeVW6ZPd+XDzSwNWAbxVIkM:aNFgmoLBJ1/aoeg6ZPd+S5gDIkM 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.80 KB MD5: bf7c8ed23a797023e826c3fb5bcde9d2
SHA1: eb148922d599c5983aedb8140cd1ab130dbadf22
SHA256: 6d682c262fe80514e3ab6d65515ccc6e6d36f75b6757cc2878374f9fe594a83e
SSDeep: 48:hlicZenVezDTaYNRwZSs9BKLS4B0C2aDyiBFzOw9X7Q1Bt2X/K:h6nVez/zYKG4B0StB1z9LQ1Bt2X/K 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE 38.34 KB MD5: d3a455d86a9acb6216408205ed52e4f6
SHA1: b9415e4e5cabeb49b5ef4a6a5da254aba48d9837
SHA256: 231b4c833c3643db268e42ed0553f75ac0dce9d4c024ebecb80b6f3c86bc24ca
SSDeep: 768:/Iyofs6s7iSab1WvPfZNKwpZqSN9XCdm82f7ycmiVdP2pBOPG/:SUpEWjKwpZqSNoIl7KodOXOPG/ 		False
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.42 KB MD5: 5bc9e6351789e7d60b588a1a4146451f
SHA1: bfe73dbda5a57809754396bd2bfaa4b137b78701
SHA256: 2efb13a0e826414e57a6a015c82f3cd8fe5c5abc960329d3c1c0b146169c7f5c
SSDeep: 96:6wyN1GKehK2BWHG67lP3Szp0YDxamXQjJAVlt7:XuGKe5mXN3NY1JQ2Pt7 		False
...
C:\BOOTSECT.BAK.id-9C354B42.[sebekgrime@tutanota.com].AYE 8.25 KB MD5: ea945a7583fed65e0c191a44d18da352
SHA1: 50cd153eb67901a2a00cc34ba705d9e43fc9e579
SHA256: 068f2f4765d1162bcfb216f9a6c873b5729f23595102eabafc3c4a524a6ce715
SSDeep: 192:hq1wBM8m+DUxdOa+uJGM5uZ+BigarW0wNYpK5+s3i:hG+e0UHOrucZSohY6 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.05 KB MD5: c911dd5c4e61f119c20376c6acd14767
SHA1: 510bd8a4beee720a33a1bfc86fe56d862960d574
SHA256: 92c6554157929a299e4a8af0156f1c12e6e2c7adb06ab14c27a897eb583f4da0
SSDeep: 24:Fa6zzfSe0jwxT9ac0iG5kjs0N0VCtol6ujwS25vTpyDh:Fagzf2SZac0wjsSqhl64wS2A 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.47 KB MD5: e68dadbba448e63c0c63763c1327cbf4
SHA1: adcd12f12af3d12d63fc14296f7a5aa27d05c4c8
SHA256: d8e9aa9a960520278aa2bb0ff731ad7de97110016af7516b61f4d0787be61fa9
SSDeep: 48:Q7VXpLp7DwCKXpxqMevAgGN7TNB8tbrgRKy0gUOhTBsHXTuoDjQyaIn:Q7Vvvi5xXevoh0brgQyT6HXT5jnaIn 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0
SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f
SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 1a8d35ca14255ba087feefd84e827acc
SHA1: 4d7bd66c6a57e8cecdac4069d27be639a627ce2d
SHA256: 10582b4fffe184144a896ce7ca49dd8c521aad435a63cd7f039dbb57170f19c3
SSDeep: 48:zdzJVA376woBet6xudBxFDbC57q5lY/KaWXBUqLJtX:jVAL6woBWeSFDbK2mU5 		False
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 30.60 KB MD5: 006e6976a4bc616c079633a7989fe250
SHA1: 30f022a5649e7ffb4317ff88506bfc93e0b2655a
SHA256: d94f881b55098e4d2691be8ccdbfaf8ebb7437ee64912ae313dfcc8d4f5c6609
SSDeep: 384:yK7BCQeWLtaZEFRDtQ8kt1lXx1eObF6jCmN9M3hlNKQbgycA0gokj6wb1eeINBrz:55Lt5Fbd8Lu2f4e3hKUdpFj6w5KNAZ+ 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.60 KB MD5: aa23c3096976d292d0e219e95e9df6f7
SHA1: c130482a4be6a0dff902ee87b3ff92310d2a932a
SHA256: 017eb31d737decf67586584f2cde627d23e12bd321199dea5519d9671d20188e
SSDeep: 48:hx2HVHy0Hugh/30YwOH2NIgufFZ0Kp1WpUpvqnfE+5jrwI7M:hQH1ykugp04HfFZIu+fE+5jMmM 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.85 KB MD5: c3bc848e79fc1b5cc6f94392e27899f1
SHA1: 5d8a53406912423b999631abeb28ac186d231efc
SHA256: a73cefe454a4d28bc8433f67f5e5a07b40057466cfb33baeb71e17ecd3a184a0
SSDeep: 48:ABgonCaHJ/GUbnHJtl2JT9jJKUttMEOKoW3EEOpqTvq54Bkqs1kqpkk73abse9hT:ABNnCaH7bHHYJtJP6EtB+qmOjM+Ds7rU 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.03 KB MD5: f1839f715537d6883c7f59273de522d2
SHA1: 29c618863d0f663eb39b93aba32e527357c5cef8
SHA256: f3820903e987d60ec4a4f6ca9f777d761d5e9a735b1fd82af15057a439395e03
SSDeep: 24:bFWPe/7WfwZ2m0VEkrOTvf+/fSnB+aIg7J6JMeJGpyDJ:APoyfwZfsz6TvgKnDIg7J6Kyt 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 4256d68cd3ee4acd651ae8db77931993
SHA1: d87c390310d7b0e02754171f7b69cd82cc664e4b
SHA256: 6901cf6564f2e5af01303ac4c35059523968c1d75f40e99caf1ba28f98c8216c
SSDeep: 24:AsG4a+zP17sTx9D1Iqsh7BMDnV3LYWjWNJcXd3e9ryKorip95JQUbOBkPdOs9aBA:E4aA7sXD1Iq0B2nVt0et3G+VmhJ3LsrA 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.60 KB MD5: 255739f64b607e4194f5930515eb3408
SHA1: 6a04b8d8a763d2afdaf912b9c4739b5e72caadbc
SHA256: 1dd9f2751ebcb4a48123bc6a5aa720722b4409aa3d9367aac9f76630c5b01a06
SSDeep: 48:n0Z3qywaTwA3b2MSNG/nPx1GR282eFTA8UBz+JGwNnczkCv4eRmY:0Z355Dr2ZQ/nPx1CnNHudenczkCv4eRb 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[sebekgrime@tutanota.com].AYE 222.21 KB MD5: 817f2c5a2ef2be2163ffef992a889deb
SHA1: 08bfe6f2dd9c54e3f51a0908e1b09a7a0ee64dd9
SHA256: f37b4de3872bc0249d683e19274e5fd508ea44e34295e43e3fb13e692bff781f
SSDeep: 6144:wjq/MSMSkpcve7ENaGAc8DQ1xpKSZt4OXjRrIqCrgmYe:wjqUPS6cveQNaY8kpKCfh6gmYe 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.33 KB MD5: 9fac72bf72d81792e9c24604b44d69e6
SHA1: 2709c7212f14d385f7000b32632219d5bdb0574a
SHA256: 4423013a1d3195f94937e0b75eb960358f9510d2014b1d8fdd04c9fd8eb73f3c
SSDeep: 96:JEoGAZCtUiwKTT+T/elWh6I6RqqR1Qf7DZmKPezJuQ0wPKeZlBcy6OU:JEiCtxwt7w4dA5vKymy6z 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.14 MB MD5: 68bb400a8517f21f0d70d2b63ac6ccc2
SHA1: 9854f5824994c1c879985e6d445ef41b16ea0d36
SHA256: 8770146d27578b9f3855f3a66ee08bb3e2e6b6a8e99e3fd72285f854e49c0be2
SSDeep: 49152:zDxL8QBo0Tex4S120ytJylXHsQSPorTIf4+QOOxwQz:zR89t1N3DSIkfJQOOxwG 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.42 KB MD5: ba37a645848ada5cfdd0a18535cc082d
SHA1: 24a609c176458096b7ec7edb0eb709468a5b1afa
SHA256: 41e2ad615e0f91d103c2101ef8f242c2af8c4a8c4e21c8293020a0638e7f5acb
SSDeep: 96:fMZyH0Knm+3OXtW1srj4AybTnp9yo12+Ce1NCd3yeQ4wZw:fTUZvSbbp9yoDCy2 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 9.37 KB MD5: de75426ea88c557e7581151b5ed1698d
SHA1: b725f8494652f83b3549daf802b119f56a95a700
SHA256: 857a695795438385957194ce74baa6f6ed33c231b406a8a594c86cea84f6c07a
SSDeep: 192:MUAgHy6z7IYG4Pr6kSs47kvSIriBgVDK9lfaEXSAfP4C3t:MUAGHHIDJku7aiCRSQEXSAff3t 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.36 KB MD5: b056b22eb0ed0750f72f397c4f3738a5
SHA1: 98436e6e8f4ec36f818bd452c6e809dbb03ff490
SHA256: f44cdce97ae39b10e869d616044f135b2f2d9ebb78733b6fb500d8d14b551a48
SSDeep: 96:XXy+jmgNfXTubP8+KnjsBA8bbYnedxECDbHTfVW:XiENfXTOajsykbW2xHbHTfc 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 8.76 KB MD5: c23ffcc616f2312e7e3b044056c60284
SHA1: 962533f4366a73076e6549217acb41ca0657576c
SHA256: 03b7bda77b4e20dcf6cb4eb1a476355877f0536a526e100054c59bb12c025c0b
SSDeep: 192:ZS+RKIy90BAkG06HXX13Ep3J1a5olCUnvuNv3A6DxRlO/:ZS8W06HXX13EpZKYZnvuJA61Y 		False
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.57 MB MD5: ae136c9c06f66ebcfee4eba3ba753049
SHA1: a6917e4cbfd1337522269937d859dfe6b2353abf
SHA256: bfce043a449e2d92d27b81868ad91a9571a680582dd0fbb6b666c8feba3433de
SSDeep: 49152:Crh2TUGD0HEytsDd5D9kwfbF4diB/SC9GMzff7Nz7kk7oU0Ps:llyaDH9kcidg6C9NfjN0+is 		False
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.44 KB MD5: 2b37a67b15f501089ab53a31acdcc515
SHA1: 37a928c1773a0be633928e81206221f30eba69a9
SHA256: f44207be4dc502985db5c585f23d2b80053c8916938fc0efc15cd73feaba0bb7
SSDeep: 24:SNrGMI/McWHwmZ5gl0hHCXHSVxbjK5lsphH/NfEIofXe8JtWEnwkd+4eb4pcTpyX:YKB/MvwmZiaxEI9/NRo/eAnVeUyIl 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE 11.43 KB MD5: c86504fff28850c0d4a16054e8258d96
SHA1: 37c44c50df4990ffeb1fa514dc76d015faffb146
SHA256: 605fd024a2aeea3e45ef709a42f4d1e9e369839e06c68215b30db94509004b32
SSDeep: 192:y5clhH1lb65GcCBm40QgrYr+s+O/p8r77RsT58obQYcqxLKb:yU19mVyHsYqjkpg7RsV8oby 		False
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.65 KB MD5: bcfaac55c77403632040221bc5dc6ee9
SHA1: ad367b8dc7769748f431d84d568d8c93fd2458b3
SHA256: e1a91ddc57a1d32e10ac117a96af6be7431717a907cca6e55f05d5d3f2ff094a
SSDeep: 48:gVkTpn79nEYJH4sx2ZYGY/k7PesC6dzDi:UMF79EYesx2Z8k269i 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 20.33 KB MD5: 6e29c67ea29dbdf5cafb29dfb0d2f215
SHA1: b335de73fa6a06a6f734696a1908936c376bc077
SHA256: d8d5ee9a60572812a0fda60bee30b5f9c6462c6093dcadfcafa170b8ab37689e
SSDeep: 384:h4mF+Vj9SzzodIZ3tPK0MEGQzXwXEHmfBAT0HWKGnfhgckK:hS19S4dI+0Mvb0Hmf4MsaK 		False
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[sebekgrime@tutanota.com].AYE 26.79 KB MD5: 4b2f4d0253017a9e95bd9c6b1e15286d
SHA1: df299a93ea16917938236cb1d507aba790053a59
SHA256: a53478d578119c88ba2103b83bb79aa45683f7c9d8b7cfc3a7506c901ab23aeb
SSDeep: 768:WDdiUp+ZLjeQYv4txog36lKn7x7A25ZVezgl:+diXLjeQYv2xfKC7x7ve6 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.33 KB MD5: 5808a1e53c6b23397d066601723b9578
SHA1: 1911498b82e61531b3447358b832e173a70f14b9
SHA256: eaa08825694ba116bd6f9962d5e72d86b5998ed268ee63734d801f18d26300c7
SSDeep: 96:OrN1t4Tdz12UlXRSoIT3QxXVAzkD2wZhlr/l/hZsvKa7ZkU:yTt6dz12U+MQLwB/lJmj7n 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 8.94 KB MD5: 45e23306abb9f03cb19ea00fc3ee25e2
SHA1: e63f7415aad7084bd46eaff8f7ee4e374e10b616
SHA256: 020a7a15776123ef47d7a04212c4dd38e81d4c83e55234aab357a192ce53f24e
SSDeep: 192:0DNsiyi4iPxItTDOU1sq4D8/Lc/EIsKTumfAozxLb+0SwuGkAYao:QlyhOCE8/wNSm41pwmAVo 		False
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 582.61 KB MD5: 81212cb35139c4f7233710e6916ad197
SHA1: 1cdf6cff2a19c609cd58cfe3992125bd323dcee9
SHA256: 387c259384899eb006d4d343d4f0da5d93f32b310e5e45c77681fc44cf1db5c2
SSDeep: 12288:+5OjFGVZq7N5CmnMLen8e0JaIK3LgxrxHyP79097VwNip:eOjF1Tpnce8ekXxr127C96Ap 		False
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 6.51 KB MD5: c7251c4932ea97addb651e3ad42a4cb4
SHA1: 2f5ca3623073f3bf7e044ca7c4d394259f90978e
SHA256: b580bb6ccbadba16e5650c04682039a60173aafdeb3a979ad923a9a39df8760c
SSDeep: 192:gkhCRPL3NYNZYP5ul3t3ciTbgUVc7tqFj:gkARPONZYP5u9t3csvQ8Fj 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.80 KB MD5: 79a48d147690a2a8f6d50db51bfcf236
SHA1: d3cd38e81d8e4daf6cdfe3d6b8079bb176944670
SHA256: 39fb7f6d45c98d0dacd27c6415024dcd177c52e1276c8cc9da682b90a9660277
SSDeep: 48:mLdheCGPciGIUWM1FwAKemd2sXob2OR+ny1d:E0CGciGI3oadGyY+ny1d 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.04 KB MD5: 3a3de07bd332a651ef759fc16e08831e
SHA1: 85a1cf1e6eb094bf8a891324c5a79ff109007139
SHA256: 550bb53e5218e4539cddfabc974f20fd46ee4c797bca95852cc7547685722331
SSDeep: 48:dPOQUV0OLtSdkveok6EdvsMNYqjrNkSfbWX:dPVAgdIHk6cTNWX 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 865.24 KB MD5: c52c9a3854c34cd56958bc0b07b5b26f
SHA1: b4736e98b3a8e5894d436c1434580db93eeef594
SHA256: a0800971ca2e8508790c9e99f56a61ed3bd014b1ef72df1ad23eab757d9e3bac
SSDeep: 12288:zWZJOkm2emVkze9Mt2DyszmuR3ked3rXTweRmUWBzoKw4vQ8xNOVDA7IruFUpIb8:qjA2hMt2F73HBR0BNPsdAZFraZwBCl 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: e88ce60c4db6110d6447eb1e25086f81
SHA1: 793095f4c3ce4a75b25c0ac4d3cefa5f8393208c
SHA256: f51d7a3f0c35bc5aa8994b2da6bf546d859326dff6fdabaefc7ddfa89c96baa1
SSDeep: 24:/S8f0xurvtNnM2rKZfSaUCt3qaN+yRodrj+0t2PuDXYpart8hrzGebuFlUpyDh:OxYtN9K1TUCFYpj+3uDkasGe6D 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.76 KB MD5: 3d2dde9e8b288ada6f37363a0d33d94d
SHA1: eae5795107d6012e40b740e4c37b43cc8f65695e
SHA256: 116f09cf2da8dfaf710b37c22fdff47814f8f745e1d31e8009d0ed3f8598cb87
SSDeep: 48:Pc0po6hkUfjHRGCeEhtfZWWF3sGBFWLx4c17LY0kexep:k0pXkULxGitfws39e7M0keY 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.81 KB MD5: caaa5b123dcd2bb246af9984d2a54372
SHA1: 107ee230aaccb3a6ea2eb1649ff759ad0d62c0e3
SHA256: 80457131352884a447f824aa01f6010321ea54434ab6b899d23545d80b26a6d7
SSDeep: 48:hfU3i5U3DV2r7SN3Wbrzn9jbthp6NFNAVIRib5:hX5APKzn9nthp6bGVIK 		False
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.14 KB MD5: 991e5d53fb33466467039acaef6640ad
SHA1: d93cf25fcfb705da6b82b125427f06aeb3b834d7
SHA256: 6407649ccf60b3839bb66ba4e42185f576d475c79ec6d21ef7c42c31659115e6
SSDeep: 24:6sr1tGeMGyjstSkCmC4aM286TgIu4I0EqxVizKbU43oebt7pyDFl:6sZtvMHjiSYCXMYub2izKo43oem 		False
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.42 KB MD5: 0db41bd455516aa64bd0d3d45c91561f
SHA1: 6ceb409f1773fca50de500173968e76fe0d304ee
SHA256: fd4b58da2187e6aad1cb54cc0d65f2890092eefb5da6cb8f4a2891b79b3510db
SSDeep: 96:sySbRD+7rdxg3D25TEycgj0nTwpEOie4Xm+e+vPP+Z9vxAD:syWDIi3iTEycgj0sWAto6xg 		False
...
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE 0.37 KB MD5: c29f0674d5a5b256bfe0fbb8039ae3c2
SHA1: c86978088053c550704f53f662c2e85320e6af1f
SHA256: eac5789b020bebad416bfee237c3963c130cac60f0b691e0ed195544a4ee175d
SSDeep: 6:QfuUPxa8EexR9Nxf8sC7wKDFlji6WC2kUccNllpcTW17sO+D6Jbr0WGg/:QfuUppb9dC0KB1pw9N/pcTK+DeQWz 		False
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 20.33 KB MD5: cd659fd7d3fb9653ff07ae70ccb894b5
SHA1: ca07b7fb68f8fa63547476f2d58c009507567a13
SHA256: 921b074e0db3e02de566fbafb9e7876cc6fa8e6c36ca4e598d86f493b9e4ef77
SSDeep: 384:7632hH8dAwxi1rTGHnV8r5ZYZxkolOQQC7F9iYk1Sb3ciB8DY6d7XCCXC/0DcjRI:zH8dLSrTGHnEg5Ol+XiYlusM7X40gjRI 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 65.85 KB MD5: 411c000d46b80d7c23bce909945d563d
SHA1: c60b2a150a8002915bb105d4428cc206a9b3d0c8
SHA256: 82081d2c18ca11a87a5077d5cca94c5f388bfa6d06d9ab48911685a498860527
SSDeep: 1536:Rx9u9FrMI/5kww7wmlScXwD2c30VY5PMcj/81v4wc+hHnH:Rx9u9RMM5xSQewDb0S5Nj/EvTHH 		False
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.13 MB MD5: 3250afeb5a541402e1dcb4703f24e423
SHA1: 3f0a1d8791aad77720ec8c1c42db2451d55712f7
SHA256: e035d24756367f74598563a4ac818e9aad056b4666498c85cc70df7d988ead8b
SSDeep: 24576:si419loddluv7FSAip5MYsHGXv+S4kIedKmFXiWHuT8O/r4nTU:49loluvZ1y5MY5v+S4khdXF8UnTU 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 6.33 KB MD5: 4c66d65cd2ac79a4552925286f0853d7
SHA1: 0afb28e18446c58530f8d3b5f4d0cc1ce4d4b0b7
SHA256: 1bea36f9324cd4d6e622c2f1f32e2d4f200d0149ab1612f843774b44b5988908
SSDeep: 96:Mx95uRRf3ZSop8ApKWu37ffeOe5EbAdzQzp+0OMOP5dtZ8wE8m:MxPCRP5UWUKz6pFOMO3T8Z3 		False
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.27 KB MD5: 9effc0963164fb23ba8e171ebf1f55dc
SHA1: b73188c0366c1c942dc178b734d0cad103323042
SHA256: 5987c452fc146b7729704e8257d07862650d6654487f8a689458aad863da5c6f
SSDeep: 24:FX9oYmsNc4pV+togPwS8Skpwqxq+CbiJKNSfceapRpyDF:Ft2sNc4pctX4Xpwq4+CZYfk0 		False
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.54 KB MD5: 50c66666812087479a9d0d2f4f467694
SHA1: 9b44c8da604a53d23c2d47bc8bfc8e854de3fa06
SHA256: 93c5c28284c60f53abea1422f8dab66353b94b49434be3d53b1a23cdb1d83ea7
SSDeep: 48:RmRTpkyXuGh93WvrOYNFecNl3hHn7C0mUFbTF8:RmHJjUV33hH7UY8 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.48 MB MD5: 53e6cb6e300354c42a200d4a46ec0500
SHA1: 8de244fbf540759175efb70136eac25efa1db245
SHA256: 8156f617c26416a60f2262ef4e8dadcc775e36ab6acb86d650b2f281e464900b
SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6fR7GrKGuff9d:fqLVW6vrlgif9d 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 5.97 KB MD5: 71af6fcfa80e5893c44d50140e60fae9
SHA1: cc3a9e165fff7d8c4f0b78cc04c39f77797d8190
SHA256: 81bc838d59984fa1b63bc56fa77778933a60bb327521a5cea8d5a1000855acd4
SSDeep: 96:13cR8dQT64ISpXk1d/V1yNN4dGvEYXkhbeBtnxTnT9+RtcygX2iHif67y1A4EsnS:5ba6upXk7/ObUGvEvgtniCygX2i+MSjW 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.35 MB MD5: d8bd8a17f88323e43917ef262dbc584f
SHA1: 1622a01795d0d44d5363bc17324881a6b2484c3b
SHA256: f6ab024e5d9c0d97f4f5f66f1761bbd7b353bdd3a32239d03c7a78e6c633a52f
SSDeep: 49152:R0opH/cgHa3HRxz+4g5RkWq0HkFx1WudMI8p:R0op1Har+XRPHq4udv8p 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.07 KB MD5: 18c9e5d6d2fb354adf0f7f76b8eefb9d
SHA1: d9bce24b2afeec168822b8fcbbd59e2163005910
SHA256: 418c01e02cd53b715581abe90b5c78e2a16f18a692d867b8a5d21d0c4b37f5f9
SSDeep: 48:3poll26wCuLxhQmHI4CKImabiD6LggDrpluKCBugkMM4qBM:3pi3wZhbI4C2+FDuKCmPBM 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 3.16 MB MD5: 5f20d8079d328f8fe8b814925a2b4464
SHA1: 248034faa50659f5f6ab5cb43d852bbce47bfd93
SHA256: c2857c65650ff1d5956bce6365458321bd7d14ec0fe1cf99aeb1982833f6f657
SSDeep: 49152:zDxL8QBoSTex4S120ytJyY9hCHhPf5ZTlNKgGGF:zR89r1wDCBbSGF 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE 37.04 KB MD5: 20975c5ae8b9713e8c4e782a994808cb
SHA1: 78c8883f06d6b1b7b80cd1cc23883c7da9094b55
SHA256: 17596e922305216a68816c8934816de69f9a67f7df75dec6a267ef57cf4a3785
SSDeep: 768:4AnPQNLvHprvu12yvb7U3He1KI/kCtvaoadzq8wVNC8o5esBluzU:4CPSLvp02GU3eK6tpEdUCt44QzU 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.56 KB MD5: 29086c962bb374b8ac40dae520422054
SHA1: b86bc10bf7c8dd83fffccf69b3261958f55ef063
SHA256: c59bd4b8dc70eae0ff2dbb7bb29fa8fe457d5b4508fbc89edddfa15c462198a0
SSDeep: 24:K4Ija632vcWAI4TdQnNb+kJRfHHPoyG+cGK05a6cyOXrUgpWSkqBpyDFl:bIja632WHTdQnv3o6I6cQgzs 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE 855.24 KB MD5: d8ca103ea1811a8228cd5506f3b244e0
SHA1: 08bd030d60cd0633abb955b2f93e02f24fff7226
SHA256: 4d17cbd809edb90a3feab2fe6bfd18a16a13570032cfc19b72a7af71c06a1fc6
SSDeep: 12288:NcHR9bSR+Q9HhdNkzMDDF8LwMtEHHgTHNgh+xb2wXQofEjblcDb4wib/VDkEg48m:6jG9HhgwFdOtb2wA1jbt8iChRZdBJ2 		False
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 4.42 KB MD5: f8dcad00e14c394bb249e1d67dd11538
SHA1: d6b406d6e304ef9b54502231951851f805b19241
SHA256: 862fbeff2806cae4b7c62fd3a77da7abaf839040b5ef28218482dd4a5c74f66d
SSDeep: 96:cHFpP1EoDyhmjzpkJAjSK8F8xw1IDtFCes2FSh4jbSHh4qa7O8:cfFDyhmvOISKnw6tFvsKf2Gqav 		False
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 2.57 MB MD5: 8dfd7eb6c8f9a9ce76c7e5f2c272c29b
SHA1: bfd0ee9aca1d65b4cdebdb4d2897a4499572aabc
SHA256: f13a90d2abafc2c33ae272d32fedaf702f74a154928b8a8990d9e751341c77dd
SSDeep: 49152:AeFNMMFrwnbddIOxFOSOwPFhbYRjfIDPHLoBTv5oJBB47q5Fqci:zDMUwxyODPFhbY12HLodiF4+5ri 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.76 KB MD5: de183ea4bc450d2493d23342946a77af
SHA1: d26c342fcf133675bc368b19656eddea7c5a6e60
SHA256: ac867f9005835509edeacbf94fdb547e83ecef27edb548735a1d3ac1efd7e582
SSDeep: 48:ONZaU2D/BgyJJftc/CUH9S4ygwlG/oE+fTILX+9J2YU:gDDKd+aOS4yv+Nu9JRU 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: c200996e8f73a26e03176595dddae1d8
SHA1: 9ace623edc6c91b60d00d0fc54e956caa9cd85e5
SHA256: 1c0c4c92eeed1644f911b4813b3144c1c8648062f24b56e24c07ce47a3e83583
SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+XBRku:MUvTiNhU4L7tZiTnprP0txRsXYu 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 9.37 KB MD5: 20c524e751311e1edd80fbf765384f7c
SHA1: 351e48d5252c7908a5f387a45837698367821821
SHA256: e1823a2aef2f8a4436c61568439d3f45b3b339c1f456ea89aba98410b51c6fbf
SSDeep: 192:551a3ZTD/btfOu5M4/czA6tSgyiEB6p3uTBcib5c/ceop1VXJz:5QnTaAEN566I97c/O/FJz 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.80 KB MD5: a265e17e3e38e363645ebf9812664b61
SHA1: 9263a086e7c797e1fa81b8244872798c0bfa319b
SHA256: 990efed449d4b38e1dfe2fe2a19dd68c408dff167ea0c64d025cefec4c1b30c1
SSDeep: 24:wI734N1H1hDDMnBYTgkcy1SZa4ECBv5h1LXPsUDyCyVnISspGV8LaIGYwA4wrNB0:wIb4DwnDy1SAzCvDsXvV8mIG4TN2 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.66 KB MD5: 5162c60363203ac22f22c64f9d88d951
SHA1: 77f8de9a1d60e99b5db7503fc4ee420f0c1c2f26
SHA256: 0aed130f83378ec0b78b10e5e414bc59e11a623ad1e581bbc4a68065c889d01c
SSDeep: 48:6wqpIgKkcupNaG11JPXWH9uJpj+FuZ3Soxtejv:1sKXHG9PquKF+8v 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 16.70 KB MD5: dabf03f5884ca1e9c15859c90ae3b0ff
SHA1: f982f428e9fd2d9620b47fea74238714516bee75
SHA256: 382608fe0f904dc372518bf52445d3d7d59de23070ce0cd64480e77dc3012836
SSDeep: 384:Zd0iOPvYxYq301Uak+FBgaEVUTdn3+jRSGweWR7QJvvzc0MjQLS+:f0ZPQiMaX0FUTdYRSGweWOJY0MjyP 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE 10.00 MB MD5: 0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35
SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE 1.65 KB MD5: 6354e822b4fb176a72f3aa77bf63ef7d
SHA1: 89832282cefc84853c06f4eb12e136a518e976a8
SHA256: 62d8fb9fb7daab565815499db2e3bdeae583a0be8387e2a9112218f3f92e89a5
SSDeep: 24:lqYVco9p+ORYc4sLd14b8Ex9HAgoXl46dHtLoJHdeJ7/Y8I4PYU3aEqIB9C/zpy7:Tmo1YTsjI8Hgo1BZ5oopLqI6M 		False
...
Host Behavior
File (4985)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\pdasib.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdasib.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\pdasib.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\pagefile.sys desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Services\verisign.bmp desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\ado\adojavas.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\ado\adojavas.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\System\ado\adovbs.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\ado\adovbs.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcjavas.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcjavas.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveNoise.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Services\verisign.bmp desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveNoise.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE desired_access = GENERIC_WRITE True 1
Fn
Write C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 144 True 1
Fn
Data
Write C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1696 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml size = 31104 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1952 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2640 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 832 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2304 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 242 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1856 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 596352 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 71248 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 226 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 832 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 37696 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 26944 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 67200 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1392 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 242 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2368 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1616 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2000 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3200 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4208 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4288 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 246 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6432 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML size = 875536 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 816 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 31104 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1616 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6256 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20592 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8736 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2432 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9504 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1808 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1856 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8576 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 39024 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 656 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 227312 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 134864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1584 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 34928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 19792 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 33024 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1936 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 27408 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF size = 2192 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20640 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 43280 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 31840 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3488 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2736 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 29936 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 32608 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 960 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 2
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1376 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20384 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1296 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG size = 2048 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20576 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3968 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 25120 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 33280 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 1296 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1456 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1360 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 26416 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 32448 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1360 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 32416 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1360 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG size = 2560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG size = 234 True 2
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 18832 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 60736 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2480 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG size = 5136 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 33568 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 19488 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1664 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 18416 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 44864 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1248 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 48128 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 2
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 37456 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1600 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1344 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16752 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1376 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 21760 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11584 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 19568 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786688 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 37120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3984 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1440 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 53120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1424 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15744 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2608 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 99152 True 1
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 47968 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 321408 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3616 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 34176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 994192 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 944 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 29312 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 31984 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 2
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 64112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 27184 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1024 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 543312 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 629680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 176320 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7664 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 576 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 254 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll size = 31120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL size = 38784 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1744 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 21824 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 33488 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2528 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 44304 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 19536 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 18384 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG size = 6816 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1584 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 30176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 109728 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 72032 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 323952 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 334432 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 58032 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 264112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 123968 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 945008 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 606064 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 438192 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 720 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 252 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 42464 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 416928 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 169648 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 176 True 1
Fn
Write C:\Program Files\desktop.ini.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2672 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 712608 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 320400 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 241040 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1920 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 302992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll size = 73088 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll size = 236 True 1
Fn
Write C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png size = 280464 True 1
Fn
Write C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1392 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 209440 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 17264 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 30960 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 28976 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 18752 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 430096 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786692 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 39520 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 34080 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 32160 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 14880 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 29792 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6688 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8112 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7696 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 512 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11904 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 419248 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 52672 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 154464 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20960 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 862624 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 198064 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3488 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 12704 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 55696 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 250 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 12496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 10608 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5328 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786690 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15312 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2608 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4960 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7584 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6992 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 13264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8592 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5376 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4400 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3136 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3968 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4736 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5696 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11664 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3392 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 10848 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20592 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7088 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 105360 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 238 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 41872 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 14432 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3360 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1048560 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1600 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 744896 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 339872 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 252 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 43424 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7984 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1840 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 26336 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 27872 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 900000 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3760 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7376 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2768 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 342976 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7552 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 442288 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1012656 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 230 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5840 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9248 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2352 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3424 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2112 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6064 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 6640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4624 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7808 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7808 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7680 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2032 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3360 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 537520 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4304 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 451488 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4816 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5008 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 55760 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 691632 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 297376 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL size = 5008 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4880 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 26896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 28960 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11648 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16192 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 17248 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16128 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 26752 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 16688 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4928 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 22528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 24784 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 40208 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 47792 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4080 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 24336 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 14544 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 13520 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20560 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7968 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20464 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 12992 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 15744 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 20192 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9712 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 502176 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 18320 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8784 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 14496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 318384 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 385376 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 48000 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786690 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11072 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 786682 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 518992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 138624 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9824 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7872 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 12528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 10160 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1712 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4000 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 8080 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1520 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9312 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1472 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1552 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4032 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4720 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 14448 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2560 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 12496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 1744 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 2656 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5760 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 5280 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3792 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 816 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 71040 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 4176 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 27056 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 9600 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 7008 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 13104 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 11504 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 19488 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 27568 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF.id-9C354B42.[sebekgrime@tutanota.com].AYE size = 3776 True 1
Fn
Delete C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml - True 1
Fn
For performance reasons, the remaining 3712 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (8)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = 83, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run value_name = pdasib.exe, data = C:\Windows\System32\pdasib.exe, size = 60, type = REG_SZ True 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0xb3c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Module (135)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x773b0000 True 1
Fn
Load advapi32.dll base_address = 0x76f90000 True 1
Fn
Load user32.dll base_address = 0x771d0000 True 1
Fn
Load Shell32.dll base_address = 0x75cc0000 True 1
Fn
Load ntdll.dll base_address = 0x77a40000 True 1
Fn
Load mpr.dll base_address = 0x75470000 True 1
Fn
Load ws2_32.dll base_address = 0x77300000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x773b0000 True 16
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pdasib.exe, size = 32767 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x773c1222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x773c34b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x773c54ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x773c4442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x773d9af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x773c59e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x773c4950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x773c1b18 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x773c7a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x773c5223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x773cdd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x773db6e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x773c424c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x773c1700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x773c5a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x773c1809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x773c1136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x773c5371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x773c110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x773c89b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x773c170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x773c1916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x773c10ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77a62270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x773c3ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x773c3f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x773c5151 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77a622b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x773c4220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x773dd5cd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x773c3e8e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77a745f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x773c111e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x773c1410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x773c4467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x773c34d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x773c4173 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x773c1725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x773c41f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x773c11f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x773dd4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x773dc860 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x773c1282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x773dc807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x773dce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x773c4435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x773c14e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77a81f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77a6e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x773c14c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x7744415b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x773d195c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x773c103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x773c3bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x773c3c5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x773c1986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x773dd802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x773c5a96 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x773c5a7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x773c11c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x773e735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x773e896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x773e8baf True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x76fa468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x76fa46ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x76fa14d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x76fa469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x76fa4304 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x76fa431c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x76f9ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x76f9ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x76fa369c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x76fb7144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x76fa2a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x76f91e3a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x76f9b466 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x771e90d3 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ce1e46 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77a5fda0 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x75472dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x75472f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x75473058 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x77303ab2 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x77303eb8 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x77306f01 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x77306b0e True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x77306bdd True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x77303918 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x77317673 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x7730311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x77302d57 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x77302d57 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x77302d8b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x773dd650 True 16
Fn
Service (87)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 6
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 6
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 7
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 7
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 6
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 7
Fn
System (279)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Sleep duration = -1 (infinite) False 1
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 28
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 8
Fn
Get Time type = Ticks, time = 296869 True 3
Fn
Get Time type = Ticks, time = 297525 True 2
Fn
Get Time type = Ticks, time = 297634 True 2
Fn
Get Time type = Ticks, time = 297821 True 2
Fn
Get Time type = Ticks, time = 297946 True 2
Fn
Get Time type = Ticks, time = 298383 True 2
Fn
Get Time type = Ticks, time = 298601 True 4
Fn
Get Time type = Ticks, time = 298710 True 2
Fn
Get Time type = Ticks, time = 298960 True 2
Fn
Get Time type = Ticks, time = 299256 True 2
Fn
Get Time type = Ticks, time = 299553 True 2
Fn
Get Time type = Ticks, time = 299755 True 4
Fn
Get Time type = Ticks, time = 299989 True 2
Fn
Get Time type = Ticks, time = 300301 True 2
Fn
Get Time type = Ticks, time = 300785 True 4
Fn
Get Time type = Ticks, time = 301035 True 2
Fn
Get Time type = Ticks, time = 301315 True 2
Fn
Get Time type = Ticks, time = 301705 True 2
Fn
Get Time type = Ticks, time = 302033 True 4
Fn
Get Time type = Ticks, time = 302220 True 2
Fn
Get Time type = Ticks, time = 302517 True 2
Fn
Get Time type = Ticks, time = 302626 True 2
Fn
Get Time type = Ticks, time = 302953 True 2
Fn
Get Time type = Ticks, time = 303297 True 4
Fn
Get Time type = Ticks, time = 303468 True 2
Fn
Get Time type = Ticks, time = 303780 True 2
Fn
Get Time type = Ticks, time = 303905 True 2
Fn
Get Time type = Ticks, time = 304108 True 2
Fn
Get Time type = Ticks, time = 304264 True 2
Fn
Get Time type = Ticks, time = 304420 True 4
Fn
Get Time type = Ticks, time = 304669 True 2
Fn
Get Time type = Ticks, time = 304903 True 2
Fn
Get Time type = Ticks, time = 305059 True 2
Fn
Get Time type = Ticks, time = 305215 True 2
Fn
Get Time type = Ticks, time = 305574 True 4
Fn
Get Time type = Ticks, time = 305871 True 2
Fn
Get Time type = Ticks, time = 306307 True 2
Fn
Get Time type = Ticks, time = 306604 True 4
Fn
Get Time type = Ticks, time = 306760 True 2
Fn
Get Time type = Ticks, time = 306994 True 2
Fn
Get Time type = Ticks, time = 307212 True 2
Fn
Get Time type = Ticks, time = 307696 True 4
Fn
Get Time type = Ticks, time = 307821 True 2
Fn
Get Time type = Ticks, time = 307961 True 2
Fn
Get Time type = Ticks, time = 308070 True 2
Fn
Get Time type = Ticks, time = 308179 True 2
Fn
Get Time type = Ticks, time = 308320 True 2
Fn
Get Time type = Ticks, time = 308429 True 2
Fn
Get Time type = Ticks, time = 308725 True 4
Fn
Get Time type = Ticks, time = 308835 True 2
Fn
Get Time type = Ticks, time = 309225 True 2
Fn
Get Time type = Ticks, time = 309334 True 2
Fn
Get Time type = Ticks, time = 309443 True 2
Fn
Get Time type = Ticks, time = 309646 True 2
Fn
Get Time type = Ticks, time = 309755 True 4
Fn
Get Time type = Ticks, time = 309864 True 2
Fn
Get Time type = Ticks, time = 310176 True 2
Fn
Get Time type = Ticks, time = 310285 True 2
Fn
Get Time type = Ticks, time = 310457 True 2
Fn
Get Time type = Ticks, time = 310691 True 2
Fn
Get Time type = Ticks, time = 310800 True 4
Fn
Get Time type = Ticks, time = 310925 True 2
Fn
Get Time type = Ticks, time = 311065 True 2
Fn
Get Time type = Ticks, time = 311175 True 2
Fn
Get Time type = Ticks, time = 311284 True 2
Fn
Get Time type = Ticks, time = 311533 True 2
Fn
Get Time type = Ticks, time = 311658 True 2
Fn
Get Time type = Ticks, time = 311767 True 2
Fn
Get Time type = Ticks, time = 311877 True 4
Fn
Get Time type = Ticks, time = 311986 True 2
Fn
Get Time type = Ticks, time = 312095 True 2
Fn
Get Time type = Ticks, time = 312236 True 2
Fn
Get Time type = Ticks, time = 312563 True 2
Fn
Get Time type = Ticks, time = 312704 True 2
Fn
Get Time type = Ticks, time = 312844 True 2
Fn
Get Time type = Ticks, time = 312969 True 4
Fn
Get Time type = Ticks, time = 313078 True 2
Fn
Get Time type = Ticks, time = 313187 True 2
Fn
Get Time type = Ticks, time = 313296 True 2
Fn
Get Time type = Ticks, time = 313406 True 2
Fn
Get Time type = Ticks, time = 313515 True 2
Fn
Get Time type = Ticks, time = 313624 True 2
Fn
Get Time type = Ticks, time = 313733 True 2
Fn
Get Time type = Ticks, time = 313842 True 2
Fn
Get Time type = Ticks, time = 313952 True 2
Fn
Get Time type = Ticks, time = 314061 True 4
Fn
Get Time type = Ticks, time = 314170 True 2
Fn
Get Time type = Ticks, time = 314279 True 2
Fn
Get Time type = Ticks, time = 314388 True 2
Fn
Get Time type = Ticks, time = 314607 True 2
Fn
Get Time type = Ticks, time = 314732 True 2
Fn
Get Time type = Ticks, time = 314950 True 2
Fn
Get Time type = Ticks, time = 315059 True 2
Fn
Get Time type = Ticks, time = 315200 True 4
Fn
Get Time type = Ticks, time = 315309 True 2
Fn
Get Time type = Ticks, time = 315449 True 2
Fn
Get Time type = Ticks, time = 315683 True 2
Fn
Get Time type = Ticks, time = 315855 True 2
Fn
Get Time type = Ticks, time = 316073 True 2
Fn
Get Time type = Ticks, time = 316182 True 2
Fn
Get Time type = Ticks, time = 316432 True 4
Fn
Get Time type = Ticks, time = 316572 True 2
Fn
Get Info type = Operating System True 2
Fn
Mutex (4)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\syncronize_G80QSOA True 1
Fn
Create mutex_name = Global\syncronize_G80QSOU True 1
Fn
Open mutex_name = Global\syncronize_G80QSOA, desired_access = SYNCHRONIZE False 1
Fn
Open mutex_name = Global\syncronize_G80QSOU, desired_access = SYNCHRONIZE False 1
Fn
Process #3: cmd.exe
245 0
»
Information Value
ID #3
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\system32\cmd.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:04:08, Reason: Child Process
Unmonitor End Time: 00:04:33, Reason: Self Terminated
Monitor Duration 00:00:25
OS Process Information
»
Information Value
PID 0xb3c
Parent PID 0xb30 (c:\users\5p5nrgjn0js halpmcxz\desktop\pdasib.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B40
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory rw True False False -
private_0x0000000000070000 0x00070000 0x00070fff Private Memory rw True False False -
private_0x0000000000080000 0x00080000 0x00080fff Private Memory rw True False False -
c_1251.nls 0x00090000 0x000a0fff Memory Mapped File r False False False -
private_0x00000000000b0000 0x000b0000 0x001affff Private Memory rw True False False -
locale.nls 0x001b0000 0x00216fff Memory Mapped File r False False False -
private_0x00000000002a0000 0x002a0000 0x0039ffff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x0049ffff Private Memory rw True False False -
private_0x00000000004c0000 0x004c0000 0x004cffff Private Memory rw True False False -
pagefile_0x00000000004d0000 0x004d0000 0x00657fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000660000 0x00660000 0x007e0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000007f0000 0x007f0000 0x01beffff Pagefile Backed Memory r True False False -
pagefile_0x0000000001bf0000 0x01bf0000 0x01f32fff Pagefile Backed Memory r True False False -
basebrd.dll 0x01f40000 0x02007fff Memory Mapped File r False False False -
pagefile_0x0000000002010000 0x02010000 0x02402fff Pagefile Backed Memory r True False False -
sortdefault.nls 0x02410000 0x026defff Memory Mapped File r False False False -
cmd.exe 0x4a120000 0x4a178fff Memory Mapped File rwx True False False -
user32.dll 0x77640000 0x77739fff Memory Mapped File rwx False False False -
kernel32.dll 0x77740000 0x7785efff Memory Mapped File rwx False False False -
ntdll.dll 0x77860000 0x77a08fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff5000 0x7fff5000 0x7fff5fff Private Memory rw True False False -
winbrand.dll 0x7fef9060000 0x7fef9067fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefd900000 0x7fefd96afff Memory Mapped File rwx False False False -
usp10.dll 0x7fefdb80000 0x7fefdc48fff Memory Mapped File rwx False False False -
lpk.dll 0x7fefdd30000 0x7fefdd3dfff Memory Mapped File rwx False False False -
imm32.dll 0x7fefdd40000 0x7fefdd6dfff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefed10000 0x7fefed76fff Memory Mapped File rwx False False False -
msctf.dll 0x7fefed80000 0x7fefee88fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feffa80000 0x7feffb1efff Memory Mapped File rwx False False False -
apisetschema.dll 0x7feffb80000 0x7feffb80fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffdcfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Host Behavior
File (182)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 11
Fn
Get Info STD_INPUT_HANDLE type = file_type True 5
Fn
Open STD_OUTPUT_HANDLE - True 25
Fn
Open STD_INPUT_HANDLE - True 69
Fn
Read STD_INPUT_HANDLE size = 1, size_out = 1 True 60
Fn
Data
Write STD_OUTPUT_HANDLE size = 36 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 2 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 63 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\mode.com os_pid = 0xb90, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\vssadmin.exe os_pid = 0xba0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info C:\Windows\system32\mode.com type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info C:\Windows\system32\vssadmin.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Memory (2)
»
Operation Process Additional Information Success Count Logfile
Read C:\Windows\system32\mode.com address = 0x7fffffda000, size = 896 True 1
Fn
Data
Read C:\Windows\system32\vssadmin.exe address = 0x7fffffd5000, size = 896 True 1
Fn
Data
Module (10)
»
Operation Module Additional Information Success Count Logfile
Load NTDLL.DLL base_address = 0x77860000 True 1
Fn
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a120000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77740000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77756d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x777523d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77748290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x777517e0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x778b14a0 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-02-22 13:33:04 (UTC) True 1
Fn
Get Time type = Ticks, time = 297478 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (25)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 8
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 3
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 2
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 2
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: mode.com
0 0
»
Information Value
ID #4
File Name c:\windows\system32\mode.com
Command Line mode con cp select=1251
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:04:11, Reason: Child Process
Unmonitor End Time: 00:04:14, Reason: Self Terminated
Monitor Duration 00:00:03
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb90
Parent PID 0xb3c (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B94
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x000cffff Private Memory rw True False False -
locale.nls 0x000d0000 0x00136fff Memory Mapped File r False False False -
private_0x0000000000140000 0x00140000 0x00140fff Private Memory rw True False False -
private_0x0000000000150000 0x00150000 0x00150fff Private Memory rw True False False -
c_1251.nls 0x00160000 0x00170fff Memory Mapped File r False False False -
pagefile_0x0000000000180000 0x00180000 0x00186fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000190000 0x00190000 0x00191fff Pagefile Backed Memory rw True False False -
private_0x00000000001b0000 0x001b0000 0x002affff Private Memory rw True False False -
private_0x00000000002b0000 0x002b0000 0x003affff Private Memory rw True False False -
private_0x00000000003e0000 0x003e0000 0x003effff Private Memory rw True False False -
pagefile_0x00000000003f0000 0x003f0000 0x00577fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000580000 0x00580000 0x00700fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000710000 0x00710000 0x01b0ffff Pagefile Backed Memory r True False False -
ulib.dll.mui 0x01b10000 0x01b47fff Memory Mapped File rw False False False -
user32.dll 0x77640000 0x77739fff Memory Mapped File rwx False False False -
kernel32.dll 0x77740000 0x7785efff Memory Mapped File rwx False False False -
ntdll.dll 0x77860000 0x77a08fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
mode.com 0xff7f0000 0xff7fbfff Memory Mapped File rwx False False False -
ulib.dll 0x7fef9030000 0x7fef9057fff Memory Mapped File rwx False False False -
ureg.dll 0x7fefb9d0000 0x7fefb9dbfff Memory Mapped File rwx False False False -
uxtheme.dll 0x7fefbf90000 0x7fefbfe5fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefd900000 0x7fefd96afff Memory Mapped File rwx False False False -
usp10.dll 0x7fefdb80000 0x7fefdc48fff Memory Mapped File rwx False False False -
lpk.dll 0x7fefdd30000 0x7fefdd3dfff Memory Mapped File rwx False False False -
imm32.dll 0x7fefdd40000 0x7fefdd6dfff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefed10000 0x7fefed76fff Memory Mapped File rwx False False False -
msctf.dll 0x7fefed80000 0x7fefee88fff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0f0000 0x7feff1cafff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feff1d0000 0x7feff2fcfff Memory Mapped File rwx False False False -
sechost.dll 0x7feff850000 0x7feff86efff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feffa80000 0x7feffb1efff Memory Mapped File rwx False False False -
apisetschema.dll 0x7feffb80000 0x7feffb80fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffda000 0x7fffffda000 0x7fffffdafff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Process #5: vssadmin.exe
0 0
»
Information Value
ID #5
File Name c:\windows\system32\vssadmin.exe
Command Line vssadmin delete shadows /all /quiet
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:04:14, Reason: Child Process
Unmonitor End Time: 00:04:33, Reason: Self Terminated
Monitor Duration 00:00:19
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xba0
Parent PID 0xb3c (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x BA4
0x BA8
0x BAC
0x BB0
0x BB4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File r False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory r True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory rw True False False -
vssadmin.exe.mui 0x000e0000 0x000ecfff Memory Mapped File rw False False False -
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory rw True False False -
private_0x0000000000100000 0x00100000 0x00100fff Private Memory rw True False False -
private_0x0000000000110000 0x00110000 0x0018ffff Private Memory rw True False False -
c_1251.nls 0x00190000 0x001a0fff Memory Mapped File r False False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c0fff Pagefile Backed Memory r True False False -
private_0x0000000000230000 0x00230000 0x0032ffff Private Memory rw True False False -
private_0x0000000000330000 0x00330000 0x0042ffff Private Memory rw True False False -
private_0x0000000000460000 0x00460000 0x0046ffff Private Memory rw True False False -
pagefile_0x0000000000470000 0x00470000 0x005f7fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000600000 0x00600000 0x00780fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000790000 0x00790000 0x01b8ffff Pagefile Backed Memory r True False False -
private_0x0000000001c20000 0x01c20000 0x01c9ffff Private Memory rw True False False -
private_0x0000000001cc0000 0x01cc0000 0x01d3ffff Private Memory rw True False False -
private_0x0000000001e00000 0x01e00000 0x01e7ffff Private Memory rw True False False -
sortdefault.nls 0x01e80000 0x0214efff Memory Mapped File r False False False -
private_0x00000000021e0000 0x021e0000 0x0225ffff Private Memory rw True False False -
user32.dll 0x77640000 0x77739fff Memory Mapped File rwx False False False -
kernel32.dll 0x77740000 0x7785efff Memory Mapped File rwx False False False -
ntdll.dll 0x77860000 0x77a08fff Memory Mapped File rwx False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory r True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory r True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory r True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
vssadmin.exe 0xfffe0000 0x10000cfff Memory Mapped File rwx False False False -
vsstrace.dll 0x7fef7e80000 0x7fef7e96fff Memory Mapped File rwx False False False -
vssapi.dll 0x7fef7ea0000 0x7fef804ffff Memory Mapped File rwx False False False -
vss_ps.dll 0x7fef8fb0000 0x7fef8fc3fff Memory Mapped File rwx False False False -
atl.dll 0x7fefb260000 0x7fefb278fff Memory Mapped File rwx False False False -
rsaenh.dll 0x7fefcda0000 0x7fefcde6fff Memory Mapped File rwx False False False -
cryptsp.dll 0x7fefd0a0000 0x7fefd0b6fff Memory Mapped File rwx False False False -
cryptbase.dll 0x7fefd6a0000 0x7fefd6aefff Memory Mapped File rwx False False False -
rpcrtremote.dll 0x7fefd790000 0x7fefd7a3fff Memory Mapped File rwx False False False -
kernelbase.dll 0x7fefd900000 0x7fefd96afff Memory Mapped File rwx False False False -
usp10.dll 0x7fefdb80000 0x7fefdc48fff Memory Mapped File rwx False False False -
oleaut32.dll 0x7fefdc50000 0x7fefdd26fff Memory Mapped File rwx False False False -
lpk.dll 0x7fefdd30000 0x7fefdd3dfff Memory Mapped File rwx False False False -
imm32.dll 0x7fefdd40000 0x7fefdd6dfff Memory Mapped File rwx False False False -
gdi32.dll 0x7fefed10000 0x7fefed76fff Memory Mapped File rwx False False False -
msctf.dll 0x7fefed80000 0x7fefee88fff Memory Mapped File rwx False False False -
advapi32.dll 0x7feff0f0000 0x7feff1cafff Memory Mapped File rwx False False False -
rpcrt4.dll 0x7feff1d0000 0x7feff2fcfff Memory Mapped File rwx False False False -
clbcatq.dll 0x7feff560000 0x7feff5f8fff Memory Mapped File rwx False False False -
sechost.dll 0x7feff850000 0x7feff86efff Memory Mapped File rwx False False False -
ole32.dll 0x7feff870000 0x7feffa72fff Memory Mapped File rwx False False False -
msvcrt.dll 0x7feffa80000 0x7feffb1efff Memory Mapped File rwx False False False -
apisetschema.dll 0x7feffb80000 0x7feffb80fff Memory Mapped File rwx False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory r True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd5fff Private Memory rw True False False -
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd7fff Private Memory rw True False False -
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory rw True False False -
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory rw True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory rw True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory rw True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image