larvvi.exe
Windows Exe (x86-32)
Created at 2019-05-18T08:21:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: larvvi.exe
44206
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\larvvi.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\larvvi.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:26, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:32, Reason: Self Terminated |
| Monitor Duration | 00:01:06 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9f8 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9FC
0x
A08
0x
A0C
0x
A10
0x
A14
0x
A54
0x
AA4
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| larvvi.exe | 0x00400000 | 0x00407FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | 2.24 KB |
MD5:
e8a901ed1b5d2a61833664c0c40c2839
SHA1: 29b786cd1113711866a35dbe587ce7399e18b1af SHA256: 586148cf07ed2df787b6fdf0a7fb8df4664e94a855cd94c195d83082f8fc72b5 SSDeep: 48:1WTm9RVUd9zoBXqbaSbJb4PDQS4LJ7oh6aBbFNIa6g9COfpE/mT4P:/9RV8WT7QLC3afOfv4P |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | 1.84 KB |
MD5:
fe43f751df041cd1ab949a805e8c6830
SHA1: 729127f9c65d2ce05ddb4e35d5901c314413a85a SHA256: 3b42158b16e75aeb8012b1ed10c0c045a85810f6e7d398bd1e2eb010c1524d7e SSDeep: 48:oWlBAfBxC5ecPbra9z8YKS4YhsnpZ2Dq5Jx+x6LpEw+2:oiBNw9/GnzOSJxPx |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.42 KB |
MD5:
c2a4221b06d80bf27ed21c34d38723ec
SHA1: 192cba9c2d649eca8245d9cbc8bd061870eddd54 SHA256: 830a07e4474c63dccd69b4be8604f4c27ec54c6035768bd4758351bb152a629e SSDeep: 24:iiB+NW7CeQK1IAk0bsgb0MGRpuQYwdyOsuKUpXce/0t97rubVHN5VUspxMa:1B0W7CeQKs0b5/G5ldLfXHYF0VHN55 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.EZDZ | 853.50 KB |
MD5:
9c795505e3af3edcd305ee82970bd62b
SHA1: 36086c58528b835a56b80f423ac83a5de77839d8 SHA256: bea071aa4f7076584d8798f5321983425ee90c4561d5f9d46118f8e71d2cd117 SSDeep: 24576:jBF+ar4gEgx3P6WBWkmf3egDqo8o93PU6py1p:jK8zgLf7qo26py1 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.EZDZ | 105.38 KB |
MD5:
b0e59e1df12f47f755ca297361a161f6
SHA1: cbcb95dab25e4c0a259d4c6eff443c619d3ea02f SHA256: 7d56551aaa2f7261c324f43debacd0b4c892a2e871d2211ac5896911fe3e92a0 SSDeep: 1536:6dgI4gB0BqaB85D7jr7q8gBw9bvulb89wPaLA7zaQZtXItkcj:6TwgQ/Ivj |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url | 236 bytes |
MD5:
c5da562de43347418a794c4c817e43ff
SHA1: fdff836eec9985dc64841018fd5238fa26cec0e0 SHA256: 4923e885faf0a9d5e66c20f5ef4f668b9e8c89f9e44840b744f495417f931f60 SSDeep: 6:QwJQjcdAFFkxY3v47j/RhaUd+tYme6xAeqQgz7Nj+e14:QGyFFRv25hxd+tadwQgq4 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HPfPz\0xMp.wav.EZDZ | 45.24 KB |
MD5:
42c709daa9657b62fd22ae8c6ebf2582
SHA1: b25924ba8f705e6fd67e87c9801cd769c1938196 SHA256: 21244e50fc2050f2d6012cc14ed11b0d0bad01ba8cba3cceec3066254a55aece SSDeep: 768:ichBEZx9zvEhntaKiZ2iejjUV5/7dGkCXZ2cTlpcGGElAVwDTpYHKxy90dOu8:dQZx9zyaX2iej6/BGkCXwgcGGcMwDepV |
|
|
| \\?\C:\Users\Default\Documents\desktop.ini | 402 bytes |
MD5:
05678bf9963f4fa7c227955cbbe15e2a
SHA1: b4154f5db7c52a5d3d1259bc7c3f951a9275fec8 SHA256: 42a599152d76ca7ac3b89bec8cf563d269ef2240ec7681c26ea3d7a7f9d4c338 SSDeep: 6:D7xpkbDwaWcHoq258YT58ksjbTBL2uHyQgerdsxMyN3OQ3W:D9TcG5riksTBCuHDlrdQBROiW |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url | 133 bytes |
MD5:
62a9af707cfd6c907eff20464468181f
SHA1: d1c91e083ec97582dbe51cd838b606b9ec5da6e6 SHA256: 72eb649acd50fda75d8993e145d748b6e9e1c11c76d58a9904a40145be2e9927 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREVVOU4:QwJQjc74kqPyZ7cuVzEV89 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url | 133 bytes |
MD5:
4a805e8ca74b4dd5d8468049d5f0697c
SHA1: d79cd6fba930cb47eb83c8e24bfe13be0e055b72 SHA256: b6f47a5f24fb4399d1ad2e14a6f294aa584bfd675efe643d743621741dd23395 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2BA4:QwJQjc74kqPyZ7cuV4gB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url | 133 bytes |
MD5:
16de4d1f6b01ef55ced29b946d9e2b1a
SHA1: 120c2449121479714faa395301b2f2e21e7e9394 SHA256: a02075b8cee8dbc796ddb9a245884e3fe361414f6cf70e6b6ad1db68d53dbf36 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2oKF4:QwJQjc74kqPyZ7cuV4x |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | 282 bytes |
MD5:
be80a60814ce63582e5977028e5d31c8
SHA1: 126ba18188d5cef978655851c0d5c1e6ca4b9763 SHA256: be6f5d5233830921ef200fff59c2d65509504d2f154df992c7ca6994af0c773c SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81igHr2BkH8ABsQvuX:D7xpkbDwaWcHoq258YTCv8ksjbTBLJ |
|
|
| \\?\C:\Users\desktop.ini | 174 bytes |
MD5:
891baac72ba32dfe8292b3d792b33b62
SHA1: 03dd18f023ee1099022818b9f25fc666b095588f SHA256: a73f3955729781b8019cd8789857838714178d6f4d491d220f93ae1e80f2a303 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81igHsQzB:D7xpkbDwaWcHoq258YTCsm |
|
|
| \\?\C:\Users\Public\Documents\desktop.ini | 278 bytes |
MD5:
037b8f09c02555cf2cf4f3c6ad757d6b
SHA1: 0e89031400d30e1345a652fe28248a384c0f3a38 SHA256: 0660805001775a6ed62160b721edd0b83015af683c354324e04e1ed0cd1b8a29 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihqEO8ABsQvuEKpi:D7xpkbDwaWcHoq258YThlO8ksjbTBLo |
|
|
| \\?\C:\Users\Public\Downloads\desktop.ini | 174 bytes |
MD5:
b945b6a4788960b837460a15e8985ca0
SHA1: 62c04e591538d4c480a59274d02a4fc8cb2c530b SHA256: 7c3b3181a5a598deb9c14c07bd214e0028a3f4ad6cc2bd08aec6e09500f4af67 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihG:D7xpkbDwaWcHoq258YThG |
|
|
| \\?\C:\Users\Public\Libraries\RecordedTV.library-ms | 876 bytes |
MD5:
f9aac07dde4533045d6ddfde29679e51
SHA1: 704e7d44b990a22086451e3ec46ec36210000ebd SHA256: 47af11cc0516065f56697a47e3839721f3236fbd316200aede33f74a8abb68ad SSDeep: 24:7C5GxcV2eiJjYlGLecC5//Qizus+hQobHsc4:7C8a5kUG6nws+hQlB |
|
|
| \\?\C:\Users\Public\Music\Sample Music\desktop.ini | 586 bytes |
MD5:
74b1c2f3ad16bd16a961de0fb40e98af
SHA1: 895135baf94af11d5033be1af1a72892d21bd57e SHA256: 8431f7a253da7c81e9085ba9d4f800b343ee8fcd0fc53c85f003e56abb429acb SSDeep: 12:EqB7Fg6sCcuWyQxruQ8HQC+H5IaszBPJZH4hP6EZR++180h1nVIEjvrknX:HB7Fgq3Qx98YHN4JdwRX1VIqM |
|
|
| \\?\C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.EZDZ | 858.78 KB |
MD5:
cd656158a79622740f1af8b660aa5ef6
SHA1: 88195d6f86756880b794a33caab3ec6b11fd3e51 SHA256: 5ceb14c800024d175e4448bb953ce082f49dcaf12209542a9bef9d99ba78b08a SSDeep: 24576:+ncVqKjFLzoy4z5LPrMcs5dmYOYFQn1s97QJv8wBU:4c/jFL0zzJsKJS1QJv8wBU |
|
|
| \\?\C:\Users\Public\Recorded TV\desktop.ini | 80 bytes |
MD5:
244132050760ca620674ad9a8fb89d94
SHA1: c152cfb5b598fa3221d29f49ed10bbccdecdc3d3 SHA256: f3e7046aa2fa11f75163337c0a2db0dcbb21707c009858e41409b3d584115de3 SSDeep: 3:Mu+V4nFFBqmRje11UDFINn:yoHw118CNn |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.EZDZ | 2.39 MB |
MD5:
6239235492ac6c1927f091864958eb3b
SHA1: 22be4bf643f912a3f1d4460fff318b60c27c1a43 SHA256: 5eca5e9e0640017f38fed690ad45c049289c476a15dca76400ae640dd629dcdf SSDeep: 49152:1cfDxL8QBoI9eljidTex4S120ytJyham6Co6:0R89EQ1o |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | 1.53 KB |
MD5:
3341f03343730ed31258b400fcd1e309
SHA1: 1f24a7f3926297eff24534452b73e53f4eebfd2b SHA256: 27223328527d26d84e84d701320653a8b095f31a444e1e0a7c7dce30bbde61b2 SSDeep: 48:UA0m8TG9+fDnY4KOoTKN/LLGB5GrCIduQ6zj:aJG2DnY4KOo2NzyBYmzzj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | 1.42 KB |
MD5:
cbcbf4947dc32a47a97156d59913659c
SHA1: d82c3cd7824d3279f25c8eac5c7f4c1244e20085 SHA256: 1243cfcb2ca2f35bb2b6798db377dab791c429aa90378e85fd4de4d1c3e75e60 SSDeep: 24:ue35pMTtPLI3k3HAk0bwgfGRpuhtgwYZgZhG67j4ylpVnvVK9PUAVm6SjydxLjMU:ueu0bFGwAshGIhvU9JfRd2+spu |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | 1.42 KB |
MD5:
f56a6006c92666bf95ef0d0755e2524c
SHA1: c36e237c7944aba04ef15dcaa5c27902c57d1eb6 SHA256: 75cbcb7af2f4e9ff92faef64e7fb4d04a789f9e86c7abb9872b7fc98976882a7 SSDeep: 24:OB7adNIMhoUcR7TGgeLhoVwP5NBls1drV6igZgnoRDQjbOYZghDjHgZgFjKy0ysa:O4NIMedTGxto6P5ND04iIxDSOAQvIA0s |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | 1.57 KB |
MD5:
bfb8fc5468b6b24be7b690e5da9ee51c
SHA1: 7145b8c558ef290ff5f17e500f4d0c699e6f8ec8 SHA256: 5cc97909cffab56f4d0a76eb3f6f787e4cba23749ce3ecd18c053c5f6227f8f4 SSDeep: 24:buf7JixEEJdasLxwd9zoB1oAJo3ZYbnAoci81Uv1nlHpsSB7PjkXize4eFh+SfFz:I7Jzd9zoBAKbnAabv1H3PjrK4famT4P |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.EZDZ | 14.13 MB |
MD5:
1d10be097bdcf8440b8dd63128c450ff
SHA1: 88a8595a83fa902dff5b29714481c80fa2d529f2 SHA256: 46053d8682622bc3e4799a13655d4bd1ad0a3a556c82003085aeb2fedf512dff SSDeep: 196608:bIwm3nNVAl+ig71eZ8FclBElWHp8byLbyo9crpLlR8ioLO0ZF9CrpbQ:WL71eiFgepGHyo2rpLkcoCrpbQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | 1.76 KB |
MD5:
a89b24414fcebec86a3c01f4a8022ff3
SHA1: 4a16571ea777ade63aba7947b75c1efc731af13e SHA256: 862020b0f3bda82fd38990dc7d6e3f7ce60b7ffe71e43047726c06a5b1dacb32 SSDeep: 24:EhUm2ynLuQzL6+ID8q9Jx16w+hUkygQW5Kv10EhRz6jnoc+ZgvB8uyl0CTDjJyLx:HpynLx90Jx1XzgH5s10Eh8ocqqlqgt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | 1.32 KB |
MD5:
9f1429dcb9a5944737fbf41f06226272
SHA1: 67a9898dba09ca2aeb7ee0e33e10f4eee78643a5 SHA256: e1b88c174f00cdc615a387040bb969972bc7156b012f0100c51205427ec35f5d SSDeep: 24:vgRlfj97hrIAk0b2gNHy17AbO27TxOYJZgJjJMty8aBns6GOcGiVhHGkku:Kr7c0boVKOoToMqf8us6GzGizGkr |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.EZDZ | 13.01 MB |
MD5:
240967ffbe0210eb082e31d4e80f0d75
SHA1: 578a62d55a2cfc58d7a8ee607a9b267b0d98867f SHA256: e293667cd4a689b40c7f535b6046fbe75c71c8e96fd1247ac2335259ccd347f0 SSDeep: 196608:K3Qu6eDsIwHBL4B9lCzT2bOgBoDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:K3+qsIwHNB26gfE7e/7JNMM5RTU+ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.EZDZ | 860.50 KB |
MD5:
db916beee865390f87645ae5facc67c5
SHA1: d3857be3d5f57a6dad68b4d342d2bd777be2a44a SHA256: cdc61576a60dcd6f87e95a46db5765cb5d8cb9c1b6890c43fa2590718ebb24a0 SSDeep: 24576:215CkQPmbxnP6WBzkm83xgDBo8o93OOr8Bky:2WwDxL8QBohr8Bk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | 1.42 KB |
MD5:
88b926b37cc77e63fa8f0c5927c603ca
SHA1: e494bb3b9c9df400a925a9207305e9dcce7754b2 SHA256: cae7c50bbc47ddae15a2e8a072c536acd0561196b3e31cf7e981cc5cc3edc162 SSDeep: 24:XdSmeSwIAk0bTgfGRpuQY0LYVuOXce4ruIiFqujZg3Ny8a999/rVhHGkqqGs9rj:XdSYH0bAG5BkXHhI2FN8MhzGkqqG2j |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.EZDZ | 20.09 MB |
MD5:
1624aececb557d9d69849c951a3154fa
SHA1: 676156c0b02b9c8dd4d4a08aeba0f3239424ede8 SHA256: 231029b27f62ab7df0ee0fcb5c83d93394e2ae50c1394e9376a2f033f096c8ee SSDeep: 196608:qncFNUxdiOm1j3/abCsYwFOSQo2eWDOQs4hW6s63HS:qbPmN3/abtYIQo2OQ93RS |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.EZDZ | 865.00 KB |
MD5:
3e530678ca04437873ea18b57532fd83
SHA1: 8295baa216d537e715d5c4497e6c5657727eb5fd SHA256: 6b03a9695fc3f2868232a11b794bcb989e217688fb605cee805dcbd979ec8e39 SSDeep: 24576:+15CkQPmzxnP6WBzkm83xgDBo8o93m9XLH5X:+WADxL8QBo6XLH5 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.EZDZ | 848.50 KB |
MD5:
a2f027ca56441fd2f9eb2fc58984536f
SHA1: 1a004c891ad03782a9254f25864ad1194fdd7778 SHA256: eba3e4ec79de90daec8296af90cac8138b665428228a8954f93adb80f0b31b5c SSDeep: 24576:FBF+ar4gElx3P6WBWkmf3egDqo8o93lo6pjEk:FKhzgLf7qo46pjE |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.EZDZ | 18.00 MB |
MD5:
2104e707d6ad4464f5c821c3fc46a09e
SHA1: 8244c5dca1bcccd449e3816c021ebcf605585333 SHA256: 649ae04ab70246997aa44813e03771e5a54948d0124b6c0f189e27f4ffd18b6e SSDeep: 196608:uhaDH9F7/iHXDI2CPKBUq6qMuGm9vqrRxoi93nnedBwzSlmKwDhANZbPhn:u8DdFDX2J5uuGyCEi9uIQmlANRh |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact | 1.15 KB |
MD5:
3c60691146c41690347b93ea69e17017
SHA1: 7d6438a10e0e6c626c95c29ae152be80243da7f8 SHA256: 5db502d29245967c7620179e0260dbf0142ad037c8a435ca3456db4001c029db SSDeep: 24:by+sd+CjOOcp+F7JdZjuQddYC0JkAf/NndZHVUkPUp2W:by+soCyzp+LdZjJddYCqkQ/NndZ1wEW |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.EZDZ | 66.78 KB |
MD5:
783b0e471aa631278ab13f20a2b394a5
SHA1: f9cfadc9b43e345ecaf34c875691bf6be35bf30c SHA256: 65be7bc937237088efd6d1170f14a4fd4798cf8a76abd3b111231cb4dff3db52 SSDeep: 1536:eQC9X8BhQ7FvohdZlwBv4oyGcT689+GkNsOkK+F10jJNZdPTI:eyQ5QhWB4ZXkuOwGHZds |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\73DGvzIzmIC8.odp.EZDZ | 76.31 KB |
MD5:
0ee3185843c39bf8f772dd367cba87b0
SHA1: ae19c59a649a14eecdc2d45dc871d9f80ad78994 SHA256: f45f2c3001cb1fc9aa73b9b5ca3cb3536957336c657ee7d1090f643e48f18cec SSDeep: 1536:E3ff00pbjvec5TzfG/P8JvCVkJv3c7Vdf5HZK6gm0w+y:4pPhK8xCE8VT5tgNu |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-D9LwOMHP I2-mZ.doc.EZDZ | 94.34 KB |
MD5:
39597713dc50012c218d37e7d56dbc4b
SHA1: 47b8eac31dc8313f3a42cd7bcbb9887031381025 SHA256: cba64aa44397d9e52841c94f0e7e68a3483ee6cf08d4d77f8affbac1536c51cb SSDeep: 1536:E71gU8iY5BSFMqUO6ozwY1pjCZJMfMHHgwPfTA9KflhHvNxkBcjiGAtcJX6D28AJ:Euw8GzV1pjKJMEnHeKnF1i1tcJX6DVAJ |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ci77Ti4lhul7c.pptx.EZDZ | 4.08 KB |
MD5:
20a4dcce8e3a8cf332ce36363084c3e6
SHA1: 2ceb1beccf2e13dbe992209e6a237a32807e3ab9 SHA256: 4511f29de30bb84ceef407f2f4948c23bd850bc389c03d10202197ec8f46bdee SSDeep: 96:dYDNoNSAG5cdCBVxLbhvMMW2OwKbYcUXoghb7:dyNoNS55cdIzbfkzp27 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | 216 bytes |
MD5:
4d2016bfbc6db7452da3021f2d86efe9
SHA1: fe4952eafbd11cd5f7152eab0012e2c2df21b889 SHA256: 2ace0d65cfe060fb096caf179df6bbc8df8084317978d489e9384c1c332ab692 SSDeep: 3:2+n7xp/gZBkHWpDwLjNJKx+1ukYg+KaKBCHF/QqAV9J0+qLFoBcx2B7uBxXb8ABZ:D7xpkbDwX/poXgWszVH0iCxL8kOQH |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.EZDZ | 29.22 KB |
MD5:
6b443917a897bb9fa6d07bef882bc7fb
SHA1: c2918d3a1d12991eb9701b52f1127f7a70309f15 SHA256: 161f48e512c3199345a8ab5dfbd5e45d170253c3418598dd0f320df02d6e9d08 SSDeep: 384:IFJzaFmhb13p3ZKCE40aYC9w4WnX5mrmB9TZellrLFR1twZGhYRw:szaFSbjpzsaYH4WnX5l9UXrXjgGhN |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\477E54rkiZ.ods.EZDZ | 81.59 KB |
MD5:
83bc964ac1a3f34aa298618700befabb
SHA1: a00a557d6651f036405a02c30f7012c3d84aee62 SHA256: 8fabf9519167f199c74eec21044e020043fb138da6e7e288f9718e4135fb7fb8 SSDeep: 1536:UlZBsmQkyNoNwdUwJh8BpTTNuU1tL2luq8wHQDTc1kF+7VGOXmYOn5hQvE766XkO:UT2ooUwJhYTNV2kq9Hyc1yK7XxO5hQIx |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\-8Hz2TqvFV1rlvG2RQHR.xls.EZDZ | 64.93 KB |
MD5:
f906da73ad98662ffb45c41d6a544530
SHA1: ce25356957e6aeaf59b1413513dfef6c2dad399a SHA256: 33c206b17abdf27fd61201bb54edef221e13dd0a17c0e1c032be5893eba7483e SSDeep: 1536:MZ0m6xq5eFfOQeopHxeJaLfl1un/dwdu105jj3D1kjU:MkqEF2QeoVUM9cwu25jj3/ |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\hSE8808C39qcG6UJM.pps | 1.41 KB |
MD5:
091fb214e946a2628d90b4678be2b92c
SHA1: 28a091503ab0438c912c2b4f0e9ffed05dd1bd71 SHA256: 608657ae5590e3667f4b44848e2040ea48be71db769d119f582689fa112ab86e SSDeep: 24:hN3PpMzlpGlnlrWJkCWzby3YCz/iJvbB4Hhcx4HLrW3VyHcD3swcA:hPu7G5lSJkCpYCLY15x4mycD3swcA |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\fCDuSz1M.rtf.EZDZ | 70.62 KB |
MD5:
40dfbd37f99adc8ca1e6d3f2caa5815e
SHA1: 0348e07bc5c51a11bf940d93fc062281d09a03e7 SHA256: 962cd5c5f08bfafef132f81edb8557c59fbb7ab9ac23619d3c3648b11714ebe7 SSDeep: 1536:KaMUZDkXgL3xKzlfu2DW9qHZCO1BSIuso1t1o2z5ypw7lGaP:KaEwsxuFEHZfBSAoNvz5n |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.EZDZ | 265.00 KB |
MD5:
f45382f0f2374a27064e75912d06b925
SHA1: 4928d4ae70842b16467b5c2deaf15ea70548d14d SHA256: ce3722d6c80fc17920642caec48cfe64ce318c59fb795e0464c479d63f3cb140 SSDeep: 768:lenAfS53a43f1+1qpu22JXDGXx1h9vSzabpZA7tp/7+IhgpfQo6p1uLnBuEzqobo:fe7PU1qpL2Wbk2zYQpv6pdcRO |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk | 486 bytes |
MD5:
2e2dfee6ba00c7d405b06e6e5198bfd3
SHA1: fa9b009ba12db4b4fe5f98f7b017e928d4309d11 SHA256: d0580bf82c5db9baafd6066864c52057707a1476a38c7442a985125022e463e4 SSDeep: 12:W8t/V8LNbrBtBEPEH2rp3MxQ9vr/7ZQoT/B/NH/B/N3:WYGRb9tB2fraWhrVPLzfz3 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk.EZDZ | 929 bytes |
MD5:
0a35415ab6b101b7ed34455230213419
SHA1: cde9f619332bf3f35ce1a2a360c0226a26ca414a SHA256: 7d80f525eaaf7e5b1a110d7b7b27d05d60ad00496385887aa286b5d10e641e72 SSDeep: 24:WkipsiUOEMA0zw/c6JQ/zAIcTGdVeprVxSQxPdW/SCjBa:WTzpc5QJLdwbxSQxlWK6a |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\JANP3Yj62Cpv\4EiSqDeaZ.m4a.EZDZ | 82.12 KB |
MD5:
5095e0bf10be02009325a3214f17efd4
SHA1: 43230ebd9a4838c8867a4a7d81c14672e6668d44 SHA256: 3282d6080ae89770593c0fb66c76f9025b33732e9c8bc5fef9fa43e13f01a0a0 SSDeep: 1536:f/xObMGHWWa2q/8nNhc5ppHeuUh6M5WwxVZ7C6m3xksgYbMAHuSd:XEHW3ghqppH1UoM5Wwhzm5xbM0uSd |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\ThVL9n0DbS\mQV8J7-.m4a.EZDZ | 81.11 KB |
MD5:
fd29bfc5d76b325d949c7054efedcbac
SHA1: 418b21c2ef227772830232bd6031e07e2c32490d SHA256: c6feede3d1c734e3fe2d7ffaa67589c5240bdf252d57af1b03645e3b756c5017 SSDeep: 1536:fKRlCSOrhDktLDdfIxnzGSp6ybqP3T6hbNqNBb07AH+sWLniSFtKzEy:qOrhUxfIxndZhxMM6xW7iSt+Ey |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini | 20 bytes |
MD5:
5a4ec2b08d9dfcc697c14ef7aafbd854
SHA1: 5ae6e4745be6b1467e9ea4d341f1f299a1bbb0ca SHA256: da4b6af6bfca9ce7f72327ba4b5a43f5e9778b34f2fbe7a5c7400e62e261d5a3 SSDeep: 3:2QBB4k:L4k |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\6pOkvTj9CQqlV.mkv.EZDZ | 94.71 KB |
MD5:
79a49e9c3fbd961264cc79dde008f279
SHA1: 6e39918221d1113b1aafbd9d964ce7190db8407f SHA256: 63d97b76ecbc67cead98c0cfcd15875fdcb8ecdfc324d4e9479e77a04b1d4096 SSDeep: 1536:hKCQ0/hRoGxHWaUdTgxE4nYJnGgDgFxdPe3x++y8LOAgsMTivRL4evdcTFr4Qpqp:hD3LxdLnTTxdPeB++yrTivN4+IJw |
|
|
| \\?\C:\Users\Default\Desktop\desktop.ini | 282 bytes |
MD5:
f95e4692364f4d5cd36c0386443254ae
SHA1: 5e29e0f69183b17c48f14f5495c29404a7eedd5d SHA256: 4046f61eeb6044542e595f36b1dff34d58e10b7c2beda7156e3d9f7d7102a133 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihxg08ABsQvuEKpE:D7xpkbDwaWcHoq258YTV8ksjbTBLC |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | 282 bytes |
MD5:
6b7f50cd6c9aa0ab0aa62c8974572834
SHA1: cdad19ead92d5774524e032fd9e099a6a4edacf7 SHA256: 2d3bd4383d518596a600dd42a3f64d09f29f8bf78824a116679bb9ac2d31927b SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81iHTH8ABsQvuEKpam:D7xpkbDwaWcHoq258YTr8ksjbTBLv |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | 402 bytes |
MD5:
d51eb4b31a39b5691720aad195afc5c7
SHA1: 27ebe7876b1f12d56138ecf38d0e81adb010ab30 SHA256: 215fe4eb57837a2b853ace5838aa8c5c4462b68035e0feba62cd5c570fbae462 SSDeep: 6:D7xpkbDwaWcHoq258YTx8ksjbTBLeHyQgerdsxMyN3OQ3NDZl:D9TcG5r6ksTBaHDlrdQBROiNDZl |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | 80 bytes |
MD5:
85a07a326856d108cc25d070cca291ef
SHA1: 594c3743b166859cc52e7a7de1978266e0c073fd SHA256: 1e97a754ee29eaf000e2a81ca2cde4aa9852353d31b0e97819625ae33ee82b20 SSDeep: 3:Mu+V4nFFBsvJWDDkB+iOSWon:yom8fSF |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url | 226 bytes |
MD5:
a49e8bf18c7861603eed37abedc73bfd
SHA1: 24c3f0b494d9080e7587720a1216626aa854a885 SHA256: 01d1081d6edf454626bc9030a8f7c1f7be49f9e5acc346e46500853dec183ab1 SSDeep: 6:QwJQjc74kqPyZ7cuV4sOALEpMukQaRk9sioZdGDnI++a:QG7k9u9OzpxP98dGDI+l |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url | 133 bytes |
MD5:
3934abe431b8c14e4d7d988d65e6b76f
SHA1: f0997323dacd03f8cf6d6ce4d8ff93dad41cc44e SHA256: 05bcb717463d903e0b5393323c16b24a996c2d4b0154557ee2b21d84ef594d23 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFya/fA4:QwJQjc74kqPyZ7cuV4a/5 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 133 bytes |
MD5:
4e2e5006a1d2e103cfc58d4e4bb5b81f
SHA1: 5f83067f96eb1a7f1030b1cc4b6a42043759fb68 SHA256: d77c02420404d39ae82191de3c4a3e84acf6951b7e97861e1810f138e2689ddb SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREXZIhuF4:QwJQjc74kqPyZ7cuVzEXqb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url | 133 bytes |
MD5:
d828e4b37625e30146015d6c22c55f26
SHA1: 9d24f15380885872b977612c70f32db50ed75983 SHA256: d1f0a8b750c2384f086d54ec4d5c42ee9476784fd35043252d244fc3caa9912c SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREWybU4:QwJQjc74kqPyZ7cuVzEJb9 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url | 134 bytes |
MD5:
021592d9185cdd060561096d33ec184f
SHA1: c7921dca61bfab662c224ea64740d90522d705aa SHA256: a531470fcf2cb09cfd765f381ac867cbb956734f9a3063b8c20294f13c73fde8 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFRESE8gS2snLn:QwJQjc74kqPyZ7cuVzELGLn |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url | 133 bytes |
MD5:
c7d1cb588723751d5fc442cbe06160b8
SHA1: 3a42be1da3117693b6c73c36b5a7a12aa644ef87 SHA256: a54b3aba29e90d287bdc5933ed66959c5f5cf02a581661641a41b9e5e24a0fb6 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyfhFy4:QwJQjc74kqPyZ7cuV4JFb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url | 133 bytes |
MD5:
08f4a01d8214c315e43018cd710970ce
SHA1: 1cc1d363f78a856d2d5aab76cbcca9c837d67076 SHA256: 7659a580f9e2945213fa7dd92c99fdb45abb0f6c4dbe69405b9c567dfff5543f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2UY4:QwJQjc74kqPyZ7cuV4F |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url | 133 bytes |
MD5:
bca9ca4e54c8b43c2577119dc9510f2c
SHA1: b175a24a250606a032cc9e677866401d16c0b5ed SHA256: 7827033c46d8694354253358e98c5206c992da5c0e2e10294b6a23d36d7d7df4 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2UmF4:QwJQjc74kqPyZ7cuV4VB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url | 133 bytes |
MD5:
1b6468df4fae19d14acaf8b5baee4e2b
SHA1: 6fab1d4812bf351f4b54bbbda5c51e6a1759fd21 SHA256: 2e5096d84a85c3ad9f215dd7f5d1de7820e50f2d28412b43830c693f61cf3b14 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyeYp4jFy4:QwJQjc74kqPyZ7cuV4evjFb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url | 133 bytes |
MD5:
5e8c2681b72088a157e53699bff08ba8
SHA1: a00a480ef093e61e2f25e3fde69c1841849a4bec SHA256: 4369b19ae1a90cf61cb7166c5330eea9a156b24b2a49c6c52ba0cccd2a96b20e SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2rmF4:QwJQjc74kqPyZ7cuV4KB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url | 133 bytes |
MD5:
e6ffa5faee39cd3aca0bb53462edf2b4
SHA1: bbb9f018a0a67ba05fe8872c2d198665a879812f SHA256: 012fd2d97eac87547a3a9fc082ae2ebdee99be2b0d7f1f3bf282d2ec57cbd58f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyJoRFhuF4:QwJQjc74kqPyZ7cuV4Jy5 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url | 133 bytes |
MD5:
52b07b5df3b6159f5495226391535cee
SHA1: 4a7d9d4c032b7653ab20928646b71d99d250da15 SHA256: fa565703c2cc5a3ef152eb13ef62d2eb8c8d3cac9ac6d7119b7aad4024d6fbcd SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyEetmF4:QwJQjc74kqPyZ7cuV4E+B |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url | 133 bytes |
MD5:
3d1cfa13428d43af5abe5e8af72d51d2
SHA1: f872f0c8f2c5617c140e4dea7844b594f115adcc SHA256: c289a890b0187e3431a9d270f63a0455b2c8f9928347bf60be113f50f76fcc4f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2qY4:QwJQjc74kqPyZ7cuV47 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | 580 bytes |
MD5:
becff9f206680e5fa4aea5c1b6ecb410
SHA1: d0f87b20421952769546e4926fce10728c4e84d6 SHA256: 60fb79a2024fcfb80206dcbc06d9d5bbfc67c349c4407011d6ab70ab317ecf88 SSDeep: 12:D9TcG5rCAksTBdgJ85mV99vx4auqQSQzkticrBFHqauGVx:+G0AkmdgEED49qHNVNq9GVx |
|
|
| \\?\C:\Users\Default\Links\Desktop.lnk | 467 bytes |
MD5:
14a3332f13302e85b16f4ec07be491a9
SHA1: 9477b7f1c87b4d5fcd84b9620a446c9ade034daa SHA256: 1d5ff94037496ea70a3e908207ca8281e773a5db3d182f73d28a65ffe458d188 SSDeep: 12:WeTBF8MjkitZ0QQPzljHXIzFYyA/h8kPnp+rqco0oBH4QH4J:WegoftuQQPzh453A/h8hquc4c4J |
|
|
| \\?\C:\Users\Default\Links\Downloads.lnk | 894 bytes |
MD5:
5130bd333b0a2d4b501170df41f6da09
SHA1: b0744bcab1a7b22120c52d5bba82d002ee7b8dfe SHA256: b16cf68557ba0fc6a92ae960d2dfa16304a6af3dccc75f4ed6d287731b75a4ac SSDeep: 24:WShpsilAW1qHSoEGCPsDlLqc7cX1TQaMp:W+AW1KBEGCkQc7avMp |
|
|
| \\?\C:\Users\Default\Music\desktop.ini | 504 bytes |
MD5:
281026cdaa1dcc6f911dcb4e23baa480
SHA1: 3a6bb34ad9e0be789e9cdde0e37818a2327f1034 SHA256: f756a005da2468ac2653d746d8321bcb850aa9e0c7603e22ab3d58c8a2fcd745 SSDeep: 6:D7xpkbDwaWcHoq258YTD6/dynuBxfUKwQhWKJrEvFpsLd6szxcS1HHig258Y62dC:D9TcG5r7CcK7LrEj4dzxcQnQ5XRxwh |
|
|
| \\?\C:\Users\Default\NTUSER.DAT.EZDZ | 768.00 KB |
MD5:
a2b92ef61a779fe0b27fcecfb9bb169b
SHA1: 244ab34b96d57d060acec51d1e49ae431e9c978b SHA256: 834645e3c0bac17a0b978578b3241f6c5285c7b78506a0b88ea013cd6375a75c SSDeep: 3072:id6YDddC9Ut6nubXfZLsYYOYW4ICmP47r13oJ6u7hANa/SunD/L1xzucC8dL0a:dYG9rnuBAYG5CP47rL8nD3jD0a |
|
|
| \\?\C:\Users\Default\Pictures\desktop.ini | 504 bytes |
MD5:
364c77cc3a658dff43af967ae532f65a
SHA1: e6f29470e7d1d499eba2172d0cc16cc05cfcefed SHA256: 4491466fd5b49ec968f6ba41b30e7455fcb8c9ce6251bbe8b782edc7c349606b SSDeep: 6:D7xpkbDwaWcHoq258YTIL6/dynuBxfpmwQhWKJrEvFpsLd6szxoRg1HHig258Y6c:D9TcG5r6CM7LrEj4dzxoRqnQ5XRx3 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | 524 bytes |
MD5:
0f0483227510fbcdedd48564247cfe2d
SHA1: 1aba49e0c2de1f4628addc470503adbe4527dfe4 SHA256: b4dc8a796df4744822eaa2793a603796110ca3faed04d9f446b4fa0a42b8ddf5 SSDeep: 12:D9TcG5oM87LrEj4dzxx/xXcij3Sgl4dC6:+GGM8nrjdzxxGiN4dC6 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | 504 bytes |
MD5:
0a53f97829dee34dee0ed25891c3e007
SHA1: 21a7c8a973fe73c805301ef4315447eba05c5926 SHA256: 7d26b9bc69aa1cf0de34c3015f8e0c7acc5f12632dbf0feb94f1daa65835b25b SSDeep: 6:D7xpkbDwaWcHoq258YTOhEO6/dynuBx4vKwQhWKJrEvFpsLd6szx1Rg1HHig258K:D9TcG5rlSC4y7LrEj4dzx2nQ5XRx5H |
|
|
| \\?\C:\Users\Public\Libraries\desktop.ini | 88 bytes |
MD5:
56746aece9fcce704d66617d13948417
SHA1: 13cdc7283cff201f184a7a1016a6e964db961238 SHA256: d7ca373eff45f21ce705775fb0b3410a053ea8df8df7f8002c9ad95b3d365d45 SSDeep: 3:1XWpkaYnWu9/ZjU3nr8+Igu7zn:p2kx79/ZQxIgcn |
|
|
| \\?\C:\Users\Public\Music\desktop.ini | 380 bytes |
MD5:
b823fce7c3df90a4a6d1a8a37b921f64
SHA1: f22ea30ffba7564b8e44a230ab93567d80bd8599 SHA256: 41ce1088cde89eab71afed08715f3d6030f2d7ad9a58fadb6ff2ea89011e8db6 SSDeep: 6:D7xpkbDwaWcHoq258YThRA6/dynuBxfUKwQhWKJrEvFpsLd6szbSQL:D9TcG5rgCcK7LrEj4dz2QL |
|
|
| \\?\C:\Users\Public\Pictures\desktop.ini | 380 bytes |
MD5:
0a4103bc1ba04b0a02c0389b9c39aaca
SHA1: 96b2c11cae52d00a071c4becc54d4d1745f0ef45 SHA256: 86c30f711703f88a2b87c4480143448e786279a3b770dab4ab9d9e2acbc39e9c SSDeep: 6:D7xpkbDwaWcHoq258YThHV6/dynuBxfpmwQhWKJrEvFpsLd6szbSQL:D9TcG5rFFCM7LrEj4dz2QL |
|
|
| \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | 171 bytes |
MD5:
54ab5bf44f8b8bae5497bbbcc4ad68fe
SHA1: e0fcdd3f9ca81234ebddcb816b8477540cf84bf6 SHA256: 7c594626c1e3fe1c48d8f3a5f0583afc16731a905b48b632980659b3467865e8 SSDeep: 3:Mu+V4nFFBqmRje11UDFgiVsz3DSiyNyfdOoG8Qw/tp6Ms/mBqB3:yoHw118NV6zSiX8oGzw/tpn63 |
|
|
| \\?\C:\Users\Public\Videos\desktop.ini | 380 bytes |
MD5:
95a06a55f07f8ae6b3351c4ab86ea6ec
SHA1: bbb1df986ae0070cc97e0ad7a883dcee7a8942e1 SHA256: a321ed6cd717a9385b52c8f5a8a7669f9cb8f53170f427c0185d812833b17588 SSDeep: 6:D7xpkbDwaWcHoq258YThFV6/dynuBx4vKwQhWKJrEvFpsLd6szbSQL:D9TcG5rlC4y7LrEj4dz2QL |
|
|
| \\?\C:\HELP_PC.EZDZ-REMOVE.txt | 696 bytes |
MD5:
2e557c96ec93272ff1990073715e74a1
SHA1: 268f83233c43a39cbb56c9a035d23432323d3742 SHA256: 2a065491015ed41ebe905ccace4937e6e72f959983299a2c95f41c878e717bef SSDeep: 12:HIoVy7YOwimFmqxztCYEZVF97yPCg+1ZMlyrGIIdSn4lssGcavQ95IfvTP/T72cY:rJzimFeYW9WP08lsGIIAss5E5IfvTP/o |
|
|
| \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | 326 bytes |
MD5:
217f5fe8c0957bebb0b041231c2ce6e8
SHA1: ac0e741615dae937614a6da5ed0f789f4d6e35ef SHA256: 8089dbe9f3a033898f645008af0a5afa176d6e3fe31940ab1cb3245ac154193d SSDeep: 6:JLWqnngdIMC8gH58TKBXcB5B5vW7xpkbDwaWcHoq258YThP:EqIIMCH5IaszB5vW9TcG5rl |
|
|
| \\?\C:\bootmgr.EZDZ | 374.79 KB |
MD5:
259525cfb422e6ac8e87bc9777b1df73
SHA1: 7a2ac87b31aa40a1ea92eb34410305fac9f8bc6a SHA256: 0769a292114dfe181dc4931159c24cd7adb6a3f3823177e40eb45ee59688ea4a SSDeep: 6144:lSjzP3sVgTkndKzy1mVsEdUISLEoad8k33TW45/vPB1dTM3BMnOb:4vPnTk89VfdUPEJBTW45X/dTM3m4 |
|
|
| \\?\C:\BOOTSECT.BAK.EZDZ | 8.00 KB |
MD5:
ba747f5e22df8f2b63fa5e0fd627765c
SHA1: a588e53440ec0393b1cae408e73606f72e94face SHA256: 75ff1b1836fd6d04c5ea4e17b4fad1163f8059dcaf2def13f1c79c69b061a464 SSDeep: 96:vzDaidCuhFwDG+8A4PtbiW+uGGfz/+vWVrQUqDayFB3d4:7Oid3zwDGIOtbiW4q/+ZUgBN4 |
|
|
Modified Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | 1.84 KB |
MD5:
fe43f751df041cd1ab949a805e8c6830
SHA1: 729127f9c65d2ce05ddb4e35d5901c314413a85a SHA256: 3b42158b16e75aeb8012b1ed10c0c045a85810f6e7d398bd1e2eb010c1524d7e SSDeep: 48:oWlBAfBxC5ecPbra9z8YKS4YhsnpZ2Dq5Jx+x6LpEw+2:oiBNw9/GnzOSJxPx |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.42 KB |
MD5:
c2a4221b06d80bf27ed21c34d38723ec
SHA1: 192cba9c2d649eca8245d9cbc8bd061870eddd54 SHA256: 830a07e4474c63dccd69b4be8604f4c27ec54c6035768bd4758351bb152a629e SSDeep: 24:iiB+NW7CeQK1IAk0bsgb0MGRpuQYwdyOsuKUpXce/0t97rubVHN5VUspxMa:1B0W7CeQKs0b5/G5ldLfXHYF0VHN55 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url | 236 bytes |
MD5:
c5da562de43347418a794c4c817e43ff
SHA1: fdff836eec9985dc64841018fd5238fa26cec0e0 SHA256: 4923e885faf0a9d5e66c20f5ef4f668b9e8c89f9e44840b744f495417f931f60 SSDeep: 6:QwJQjcdAFFkxY3v47j/RhaUd+tYme6xAeqQgz7Nj+e14:QGyFFRv25hxd+tadwQgq4 |
|
|
| \\?\C:\Users\Default\Documents\desktop.ini | 402 bytes |
MD5:
05678bf9963f4fa7c227955cbbe15e2a
SHA1: b4154f5db7c52a5d3d1259bc7c3f951a9275fec8 SHA256: 42a599152d76ca7ac3b89bec8cf563d269ef2240ec7681c26ea3d7a7f9d4c338 SSDeep: 6:D7xpkbDwaWcHoq258YT58ksjbTBL2uHyQgerdsxMyN3OQ3W:D9TcG5riksTBCuHDlrdQBROiW |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url | 133 bytes |
MD5:
62a9af707cfd6c907eff20464468181f
SHA1: d1c91e083ec97582dbe51cd838b606b9ec5da6e6 SHA256: 72eb649acd50fda75d8993e145d748b6e9e1c11c76d58a9904a40145be2e9927 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREVVOU4:QwJQjc74kqPyZ7cuVzEV89 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url | 133 bytes |
MD5:
4a805e8ca74b4dd5d8468049d5f0697c
SHA1: d79cd6fba930cb47eb83c8e24bfe13be0e055b72 SHA256: b6f47a5f24fb4399d1ad2e14a6f294aa584bfd675efe643d743621741dd23395 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2BA4:QwJQjc74kqPyZ7cuV4gB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url | 133 bytes |
MD5:
16de4d1f6b01ef55ced29b946d9e2b1a
SHA1: 120c2449121479714faa395301b2f2e21e7e9394 SHA256: a02075b8cee8dbc796ddb9a245884e3fe361414f6cf70e6b6ad1db68d53dbf36 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2oKF4:QwJQjc74kqPyZ7cuV4x |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | 282 bytes |
MD5:
be80a60814ce63582e5977028e5d31c8
SHA1: 126ba18188d5cef978655851c0d5c1e6ca4b9763 SHA256: be6f5d5233830921ef200fff59c2d65509504d2f154df992c7ca6994af0c773c SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81igHr2BkH8ABsQvuX:D7xpkbDwaWcHoq258YTCv8ksjbTBLJ |
|
|
| \\?\C:\Users\desktop.ini | 174 bytes |
MD5:
891baac72ba32dfe8292b3d792b33b62
SHA1: 03dd18f023ee1099022818b9f25fc666b095588f SHA256: a73f3955729781b8019cd8789857838714178d6f4d491d220f93ae1e80f2a303 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81igHsQzB:D7xpkbDwaWcHoq258YTCsm |
|
|
| \\?\C:\Users\Public\Documents\desktop.ini | 278 bytes |
MD5:
037b8f09c02555cf2cf4f3c6ad757d6b
SHA1: 0e89031400d30e1345a652fe28248a384c0f3a38 SHA256: 0660805001775a6ed62160b721edd0b83015af683c354324e04e1ed0cd1b8a29 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihqEO8ABsQvuEKpi:D7xpkbDwaWcHoq258YThlO8ksjbTBLo |
|
|
| \\?\C:\Users\Public\Downloads\desktop.ini | 174 bytes |
MD5:
b945b6a4788960b837460a15e8985ca0
SHA1: 62c04e591538d4c480a59274d02a4fc8cb2c530b SHA256: 7c3b3181a5a598deb9c14c07bd214e0028a3f4ad6cc2bd08aec6e09500f4af67 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihG:D7xpkbDwaWcHoq258YThG |
|
|
| \\?\C:\Users\Public\Libraries\RecordedTV.library-ms | 876 bytes |
MD5:
f9aac07dde4533045d6ddfde29679e51
SHA1: 704e7d44b990a22086451e3ec46ec36210000ebd SHA256: 47af11cc0516065f56697a47e3839721f3236fbd316200aede33f74a8abb68ad SSDeep: 24:7C5GxcV2eiJjYlGLecC5//Qizus+hQobHsc4:7C8a5kUG6nws+hQlB |
|
|
| \\?\C:\Users\Public\Music\Sample Music\desktop.ini | 586 bytes |
MD5:
74b1c2f3ad16bd16a961de0fb40e98af
SHA1: 895135baf94af11d5033be1af1a72892d21bd57e SHA256: 8431f7a253da7c81e9085ba9d4f800b343ee8fcd0fc53c85f003e56abb429acb SSDeep: 12:EqB7Fg6sCcuWyQxruQ8HQC+H5IaszBPJZH4hP6EZR++180h1nVIEjvrknX:HB7Fgq3Qx98YHN4JdwRX1VIqM |
|
|
| \\?\C:\Users\Public\Recorded TV\desktop.ini | 80 bytes |
MD5:
244132050760ca620674ad9a8fb89d94
SHA1: c152cfb5b598fa3221d29f49ed10bbccdecdc3d3 SHA256: f3e7046aa2fa11f75163337c0a2db0dcbb21707c009858e41409b3d584115de3 SSDeep: 3:Mu+V4nFFBqmRje11UDFINn:yoHw118CNn |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | 1.53 KB |
MD5:
3341f03343730ed31258b400fcd1e309
SHA1: 1f24a7f3926297eff24534452b73e53f4eebfd2b SHA256: 27223328527d26d84e84d701320653a8b095f31a444e1e0a7c7dce30bbde61b2 SSDeep: 48:UA0m8TG9+fDnY4KOoTKN/LLGB5GrCIduQ6zj:aJG2DnY4KOo2NzyBYmzzj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | 1.42 KB |
MD5:
cbcbf4947dc32a47a97156d59913659c
SHA1: d82c3cd7824d3279f25c8eac5c7f4c1244e20085 SHA256: 1243cfcb2ca2f35bb2b6798db377dab791c429aa90378e85fd4de4d1c3e75e60 SSDeep: 24:ue35pMTtPLI3k3HAk0bwgfGRpuhtgwYZgZhG67j4ylpVnvVK9PUAVm6SjydxLjMU:ueu0bFGwAshGIhvU9JfRd2+spu |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | 1.42 KB |
MD5:
f56a6006c92666bf95ef0d0755e2524c
SHA1: c36e237c7944aba04ef15dcaa5c27902c57d1eb6 SHA256: 75cbcb7af2f4e9ff92faef64e7fb4d04a789f9e86c7abb9872b7fc98976882a7 SSDeep: 24:OB7adNIMhoUcR7TGgeLhoVwP5NBls1drV6igZgnoRDQjbOYZghDjHgZgFjKy0ysa:O4NIMedTGxto6P5ND04iIxDSOAQvIA0s |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | 1.57 KB |
MD5:
bfb8fc5468b6b24be7b690e5da9ee51c
SHA1: 7145b8c558ef290ff5f17e500f4d0c699e6f8ec8 SHA256: 5cc97909cffab56f4d0a76eb3f6f787e4cba23749ce3ecd18c053c5f6227f8f4 SSDeep: 24:buf7JixEEJdasLxwd9zoB1oAJo3ZYbnAoci81Uv1nlHpsSB7PjkXize4eFh+SfFz:I7Jzd9zoBAKbnAabv1H3PjrK4famT4P |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | 1.76 KB |
MD5:
a89b24414fcebec86a3c01f4a8022ff3
SHA1: 4a16571ea777ade63aba7947b75c1efc731af13e SHA256: 862020b0f3bda82fd38990dc7d6e3f7ce60b7ffe71e43047726c06a5b1dacb32 SSDeep: 24:EhUm2ynLuQzL6+ID8q9Jx16w+hUkygQW5Kv10EhRz6jnoc+ZgvB8uyl0CTDjJyLx:HpynLx90Jx1XzgH5s10Eh8ocqqlqgt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | 1.32 KB |
MD5:
9f1429dcb9a5944737fbf41f06226272
SHA1: 67a9898dba09ca2aeb7ee0e33e10f4eee78643a5 SHA256: e1b88c174f00cdc615a387040bb969972bc7156b012f0100c51205427ec35f5d SSDeep: 24:vgRlfj97hrIAk0b2gNHy17AbO27TxOYJZgJjJMty8aBns6GOcGiVhHGkku:Kr7c0boVKOoToMqf8us6GzGizGkr |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | 1.42 KB |
MD5:
88b926b37cc77e63fa8f0c5927c603ca
SHA1: e494bb3b9c9df400a925a9207305e9dcce7754b2 SHA256: cae7c50bbc47ddae15a2e8a072c536acd0561196b3e31cf7e981cc5cc3edc162 SSDeep: 24:XdSmeSwIAk0bTgfGRpuQY0LYVuOXce4ruIiFqujZg3Ny8a999/rVhHGkqqGs9rj:XdSYH0bAG5BkXHhI2FN8MhzGkqqG2j |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact | 1.15 KB |
MD5:
3c60691146c41690347b93ea69e17017
SHA1: 7d6438a10e0e6c626c95c29ae152be80243da7f8 SHA256: 5db502d29245967c7620179e0260dbf0142ad037c8a435ca3456db4001c029db SSDeep: 24:by+sd+CjOOcp+F7JdZjuQddYC0JkAf/NndZHVUkPUp2W:by+soCyzp+LdZjJddYCqkQ/NndZ1wEW |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | 216 bytes |
MD5:
4d2016bfbc6db7452da3021f2d86efe9
SHA1: fe4952eafbd11cd5f7152eab0012e2c2df21b889 SHA256: 2ace0d65cfe060fb096caf179df6bbc8df8084317978d489e9384c1c332ab692 SSDeep: 3:2+n7xp/gZBkHWpDwLjNJKx+1ukYg+KaKBCHF/QqAV9J0+qLFoBcx2B7uBxXb8ABZ:D7xpkbDwX/poXgWszVH0iCxL8kOQH |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\hSE8808C39qcG6UJM.pps | 1.41 KB |
MD5:
091fb214e946a2628d90b4678be2b92c
SHA1: 28a091503ab0438c912c2b4f0e9ffed05dd1bd71 SHA256: 608657ae5590e3667f4b44848e2040ea48be71db769d119f582689fa112ab86e SSDeep: 24:hN3PpMzlpGlnlrWJkCWzby3YCz/iJvbB4Hhcx4HLrW3VyHcD3swcA:hPu7G5lSJkCpYCLY15x4mycD3swcA |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk | 486 bytes |
MD5:
2e2dfee6ba00c7d405b06e6e5198bfd3
SHA1: fa9b009ba12db4b4fe5f98f7b017e928d4309d11 SHA256: d0580bf82c5db9baafd6066864c52057707a1476a38c7442a985125022e463e4 SSDeep: 12:W8t/V8LNbrBtBEPEH2rp3MxQ9vr/7ZQoT/B/NH/B/N3:WYGRb9tB2fraWhrVPLzfz3 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini | 20 bytes |
MD5:
5a4ec2b08d9dfcc697c14ef7aafbd854
SHA1: 5ae6e4745be6b1467e9ea4d341f1f299a1bbb0ca SHA256: da4b6af6bfca9ce7f72327ba4b5a43f5e9778b34f2fbe7a5c7400e62e261d5a3 SSDeep: 3:2QBB4k:L4k |
|
|
| \\?\C:\Users\Default\Desktop\desktop.ini | 282 bytes |
MD5:
f95e4692364f4d5cd36c0386443254ae
SHA1: 5e29e0f69183b17c48f14f5495c29404a7eedd5d SHA256: 4046f61eeb6044542e595f36b1dff34d58e10b7c2beda7156e3d9f7d7102a133 SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81ihxg08ABsQvuEKpE:D7xpkbDwaWcHoq258YTV8ksjbTBLC |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | 282 bytes |
MD5:
6b7f50cd6c9aa0ab0aa62c8974572834
SHA1: cdad19ead92d5774524e032fd9e099a6a4edacf7 SHA256: 2d3bd4383d518596a600dd42a3f64d09f29f8bf78824a116679bb9ac2d31927b SSDeep: 3:2+n7xp/gZBkHWpDwLmBC8WOyUQvkBoxfqwj5URAZ/ABxuJ81iHTH8ABsQvuEKpam:D7xpkbDwaWcHoq258YTr8ksjbTBLv |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | 402 bytes |
MD5:
d51eb4b31a39b5691720aad195afc5c7
SHA1: 27ebe7876b1f12d56138ecf38d0e81adb010ab30 SHA256: 215fe4eb57837a2b853ace5838aa8c5c4462b68035e0feba62cd5c570fbae462 SSDeep: 6:D7xpkbDwaWcHoq258YTx8ksjbTBLeHyQgerdsxMyN3OQ3NDZl:D9TcG5r6ksTBaHDlrdQBROiNDZl |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | 80 bytes |
MD5:
85a07a326856d108cc25d070cca291ef
SHA1: 594c3743b166859cc52e7a7de1978266e0c073fd SHA256: 1e97a754ee29eaf000e2a81ca2cde4aa9852353d31b0e97819625ae33ee82b20 SSDeep: 3:Mu+V4nFFBsvJWDDkB+iOSWon:yom8fSF |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url | 226 bytes |
MD5:
a49e8bf18c7861603eed37abedc73bfd
SHA1: 24c3f0b494d9080e7587720a1216626aa854a885 SHA256: 01d1081d6edf454626bc9030a8f7c1f7be49f9e5acc346e46500853dec183ab1 SSDeep: 6:QwJQjc74kqPyZ7cuV4sOALEpMukQaRk9sioZdGDnI++a:QG7k9u9OzpxP98dGDI+l |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url | 133 bytes |
MD5:
3934abe431b8c14e4d7d988d65e6b76f
SHA1: f0997323dacd03f8cf6d6ce4d8ff93dad41cc44e SHA256: 05bcb717463d903e0b5393323c16b24a996c2d4b0154557ee2b21d84ef594d23 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFya/fA4:QwJQjc74kqPyZ7cuV4a/5 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 133 bytes |
MD5:
4e2e5006a1d2e103cfc58d4e4bb5b81f
SHA1: 5f83067f96eb1a7f1030b1cc4b6a42043759fb68 SHA256: d77c02420404d39ae82191de3c4a3e84acf6951b7e97861e1810f138e2689ddb SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREXZIhuF4:QwJQjc74kqPyZ7cuVzEXqb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url | 133 bytes |
MD5:
d828e4b37625e30146015d6c22c55f26
SHA1: 9d24f15380885872b977612c70f32db50ed75983 SHA256: d1f0a8b750c2384f086d54ec4d5c42ee9476784fd35043252d244fc3caa9912c SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFREWybU4:QwJQjc74kqPyZ7cuVzEJb9 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url | 134 bytes |
MD5:
021592d9185cdd060561096d33ec184f
SHA1: c7921dca61bfab662c224ea64740d90522d705aa SHA256: a531470fcf2cb09cfd765f381ac867cbb956734f9a3063b8c20294f13c73fde8 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFRESE8gS2snLn:QwJQjc74kqPyZ7cuVzELGLn |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url | 133 bytes |
MD5:
c7d1cb588723751d5fc442cbe06160b8
SHA1: 3a42be1da3117693b6c73c36b5a7a12aa644ef87 SHA256: a54b3aba29e90d287bdc5933ed66959c5f5cf02a581661641a41b9e5e24a0fb6 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyfhFy4:QwJQjc74kqPyZ7cuV4JFb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url | 133 bytes |
MD5:
08f4a01d8214c315e43018cd710970ce
SHA1: 1cc1d363f78a856d2d5aab76cbcca9c837d67076 SHA256: 7659a580f9e2945213fa7dd92c99fdb45abb0f6c4dbe69405b9c567dfff5543f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2UY4:QwJQjc74kqPyZ7cuV4F |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url | 133 bytes |
MD5:
bca9ca4e54c8b43c2577119dc9510f2c
SHA1: b175a24a250606a032cc9e677866401d16c0b5ed SHA256: 7827033c46d8694354253358e98c5206c992da5c0e2e10294b6a23d36d7d7df4 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2UmF4:QwJQjc74kqPyZ7cuV4VB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url | 133 bytes |
MD5:
1b6468df4fae19d14acaf8b5baee4e2b
SHA1: 6fab1d4812bf351f4b54bbbda5c51e6a1759fd21 SHA256: 2e5096d84a85c3ad9f215dd7f5d1de7820e50f2d28412b43830c693f61cf3b14 SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyeYp4jFy4:QwJQjc74kqPyZ7cuV4evjFb |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url | 133 bytes |
MD5:
5e8c2681b72088a157e53699bff08ba8
SHA1: a00a480ef093e61e2f25e3fde69c1841849a4bec SHA256: 4369b19ae1a90cf61cb7166c5330eea9a156b24b2a49c6c52ba0cccd2a96b20e SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2rmF4:QwJQjc74kqPyZ7cuV4KB |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url | 133 bytes |
MD5:
e6ffa5faee39cd3aca0bb53462edf2b4
SHA1: bbb9f018a0a67ba05fe8872c2d198665a879812f SHA256: 012fd2d97eac87547a3a9fc082ae2ebdee99be2b0d7f1f3bf282d2ec57cbd58f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyJoRFhuF4:QwJQjc74kqPyZ7cuV4Jy5 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url | 133 bytes |
MD5:
52b07b5df3b6159f5495226391535cee
SHA1: 4a7d9d4c032b7653ab20928646b71d99d250da15 SHA256: fa565703c2cc5a3ef152eb13ef62d2eb8c8d3cac9ac6d7119b7aad4024d6fbcd SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFyEetmF4:QwJQjc74kqPyZ7cuV4E+B |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url | 133 bytes |
MD5:
3d1cfa13428d43af5abe5e8af72d51d2
SHA1: f872f0c8f2c5617c140e4dea7844b594f115adcc SHA256: c289a890b0187e3431a9d270f63a0455b2c8f9928347bf60be113f50f76fcc4f SSDeep: 3:QV/iaFB+VB662SUu74kq3/nyZR5fcIhnuhaFy2qY4:QwJQjc74kqPyZ7cuV47 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | 580 bytes |
MD5:
becff9f206680e5fa4aea5c1b6ecb410
SHA1: d0f87b20421952769546e4926fce10728c4e84d6 SHA256: 60fb79a2024fcfb80206dcbc06d9d5bbfc67c349c4407011d6ab70ab317ecf88 SSDeep: 12:D9TcG5rCAksTBdgJ85mV99vx4auqQSQzkticrBFHqauGVx:+G0AkmdgEED49qHNVNq9GVx |
|
|
| \\?\C:\Users\Default\Links\Desktop.lnk | 467 bytes |
MD5:
14a3332f13302e85b16f4ec07be491a9
SHA1: 9477b7f1c87b4d5fcd84b9620a446c9ade034daa SHA256: 1d5ff94037496ea70a3e908207ca8281e773a5db3d182f73d28a65ffe458d188 SSDeep: 12:WeTBF8MjkitZ0QQPzljHXIzFYyA/h8kPnp+rqco0oBH4QH4J:WegoftuQQPzh453A/h8hquc4c4J |
|
|
| \\?\C:\Users\Default\Links\Downloads.lnk | 894 bytes |
MD5:
5130bd333b0a2d4b501170df41f6da09
SHA1: b0744bcab1a7b22120c52d5bba82d002ee7b8dfe SHA256: b16cf68557ba0fc6a92ae960d2dfa16304a6af3dccc75f4ed6d287731b75a4ac SSDeep: 24:WShpsilAW1qHSoEGCPsDlLqc7cX1TQaMp:W+AW1KBEGCkQc7avMp |
|
|
| \\?\C:\Users\Default\Music\desktop.ini | 504 bytes |
MD5:
281026cdaa1dcc6f911dcb4e23baa480
SHA1: 3a6bb34ad9e0be789e9cdde0e37818a2327f1034 SHA256: f756a005da2468ac2653d746d8321bcb850aa9e0c7603e22ab3d58c8a2fcd745 SSDeep: 6:D7xpkbDwaWcHoq258YTD6/dynuBxfUKwQhWKJrEvFpsLd6szxcS1HHig258Y62dC:D9TcG5r7CcK7LrEj4dzxcQnQ5XRxwh |
|
|
| \\?\C:\Users\Default\Pictures\desktop.ini | 504 bytes |
MD5:
364c77cc3a658dff43af967ae532f65a
SHA1: e6f29470e7d1d499eba2172d0cc16cc05cfcefed SHA256: 4491466fd5b49ec968f6ba41b30e7455fcb8c9ce6251bbe8b782edc7c349606b SSDeep: 6:D7xpkbDwaWcHoq258YTIL6/dynuBxfpmwQhWKJrEvFpsLd6szxoRg1HHig258Y6c:D9TcG5r6CM7LrEj4dzxoRqnQ5XRx3 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | 524 bytes |
MD5:
0f0483227510fbcdedd48564247cfe2d
SHA1: 1aba49e0c2de1f4628addc470503adbe4527dfe4 SHA256: b4dc8a796df4744822eaa2793a603796110ca3faed04d9f446b4fa0a42b8ddf5 SSDeep: 12:D9TcG5oM87LrEj4dzxx/xXcij3Sgl4dC6:+GGM8nrjdzxxGiN4dC6 |
|
|
| \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | 504 bytes |
MD5:
0a53f97829dee34dee0ed25891c3e007
SHA1: 21a7c8a973fe73c805301ef4315447eba05c5926 SHA256: 7d26b9bc69aa1cf0de34c3015f8e0c7acc5f12632dbf0feb94f1daa65835b25b SSDeep: 6:D7xpkbDwaWcHoq258YTOhEO6/dynuBx4vKwQhWKJrEvFpsLd6szx1Rg1HHig258K:D9TcG5rlSC4y7LrEj4dzx2nQ5XRx5H |
|
|
| \\?\C:\Users\Public\Libraries\desktop.ini | 88 bytes |
MD5:
56746aece9fcce704d66617d13948417
SHA1: 13cdc7283cff201f184a7a1016a6e964db961238 SHA256: d7ca373eff45f21ce705775fb0b3410a053ea8df8df7f8002c9ad95b3d365d45 SSDeep: 3:1XWpkaYnWu9/ZjU3nr8+Igu7zn:p2kx79/ZQxIgcn |
|
|
| \\?\C:\Users\Public\Music\desktop.ini | 380 bytes |
MD5:
b823fce7c3df90a4a6d1a8a37b921f64
SHA1: f22ea30ffba7564b8e44a230ab93567d80bd8599 SHA256: 41ce1088cde89eab71afed08715f3d6030f2d7ad9a58fadb6ff2ea89011e8db6 SSDeep: 6:D7xpkbDwaWcHoq258YThRA6/dynuBxfUKwQhWKJrEvFpsLd6szbSQL:D9TcG5rgCcK7LrEj4dz2QL |
|
|
| \\?\C:\Users\Public\Pictures\desktop.ini | 380 bytes |
MD5:
0a4103bc1ba04b0a02c0389b9c39aaca
SHA1: 96b2c11cae52d00a071c4becc54d4d1745f0ef45 SHA256: 86c30f711703f88a2b87c4480143448e786279a3b770dab4ab9d9e2acbc39e9c SSDeep: 6:D7xpkbDwaWcHoq258YThHV6/dynuBxfpmwQhWKJrEvFpsLd6szbSQL:D9TcG5rFFCM7LrEj4dz2QL |
|
|
| \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | 171 bytes |
MD5:
54ab5bf44f8b8bae5497bbbcc4ad68fe
SHA1: e0fcdd3f9ca81234ebddcb816b8477540cf84bf6 SHA256: 7c594626c1e3fe1c48d8f3a5f0583afc16731a905b48b632980659b3467865e8 SSDeep: 3:Mu+V4nFFBqmRje11UDFgiVsz3DSiyNyfdOoG8Qw/tp6Ms/mBqB3:yoHw118NV6zSiX8oGzw/tpn63 |
|
|
| \\?\C:\Users\Public\Videos\desktop.ini | 380 bytes |
MD5:
95a06a55f07f8ae6b3351c4ab86ea6ec
SHA1: bbb1df986ae0070cc97e0ad7a883dcee7a8942e1 SHA256: a321ed6cd717a9385b52c8f5a8a7669f9cb8f53170f427c0185d812833b17588 SSDeep: 6:D7xpkbDwaWcHoq258YThFV6/dynuBx4vKwQhWKJrEvFpsLd6szbSQL:D9TcG5rlC4y7LrEj4dz2QL |
|
|
| \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | 326 bytes |
MD5:
217f5fe8c0957bebb0b041231c2ce6e8
SHA1: ac0e741615dae937614a6da5ed0f789f4d6e35ef SHA256: 8089dbe9f3a033898f645008af0a5afa176d6e3fe31940ab1cb3245ac154193d SSDeep: 6:JLWqnngdIMC8gH58TKBXcB5B5vW7xpkbDwaWcHoq258YThP:EqIIMCH5IaszB5vW9TcG5rl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | 2.39 MB |
MD5:
6b29f54c03cbeb7bf8dd78ff9efce81d
SHA1: fa0c9480ca6e57d7bfda67e8e21bd10954079946 SHA256: 834ae5562217b0fa8250f13e86aa043967a47ce9b1814fbd2fe719fe4bdf11a1 SSDeep: 49152:9cfDxL8QBoI9eljidTex4S120ytJyha16CZt:sR89EQ1o |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | 10.00 MB |
MD5:
d9b7b40593c2e7e21d3414e2c99438b9
SHA1: a13d1b6c1fc4ae2d82eff4a6804d4537428ced46 SHA256: 22af90d74922fa4a6b95b72b2096579268d3abd54fd51189678b14bd4c1c3dda SSDeep: 196608:d74KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:d74KKCX5FvaVczxmUJnYSE7dzAT |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | 2.40 MB |
MD5:
030ad2a82687c3de2632d125dc183130
SHA1: dc64bdccbeeca0535974acd863be56f05a24fc1c SHA256: c3ef9c56344a2265d4c7e6aa636733e42ec8a577ef63f15775140cd6d68c679b SSDeep: 49152:4cfDxL8QBoI9eljidTex4S120ytJyhaLz6CCHm:JR89EQ1oL |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | 9.50 MB |
MD5:
cb39779fa9d7e5f5bda6df8a29f78553
SHA1: 8a66356bf9a4ba326cf53db50c72c56cba84cf7c SHA256: 6c25b159da2003464b59ad2bdc85c4b3f9ed3c636c641bb92d8a30dd481f59d6 SSDeep: 196608:dPUvTYpH9lBl/tus7o4L7tZiTnp/jE4U/bxlLRx+c:JUvTiJhU4L7tZiTnprP0txRsc |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | 1.50 MB |
MD5:
0b7295cfc0cf4a46db4579e88c322ddb
SHA1: 557f2eb641a295fa2b61aebf10171f5e4261bc56 SHA256: a7b3ccceeb990dd76eac8b35ce19f3cffa606656fd415be5b7649cd9948bf150 SSDeep: 24576:O1w+SV77GTUmArplqvmJfn1JbWVwX20QyQCzUeOFhptL6zQyfUjLDOlFtE/ueTQ+:O1wp57GTUTptf+VwX9geOn/m+mlFt+9B |
|
|
Host Behavior
File (44053)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Documents and Settings\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\PerfLogs\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\PerfLogs\Admin\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files (x86) | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\ProgramData | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Recovery | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\System Volume Information | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Application Data\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Cookies\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-Amk9o75eMLK.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-TKR5.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1uK3wKx8aEtv.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\88ugRjF.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9o-8i.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9oRaioevZK.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9W6LUt.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BewVrrN36J_7.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\edwMCMTRr.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ftV3BjDCsptOs.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ioEcXfDfCcssbES8.csv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iq S4WPsfB2Lvk0E-WF.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kuK-90e.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\L17juNataF.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\larvvi.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mmZoR3rUq.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nMfmmAOTUYEnqUGFt2.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\73DGvzIzmIC8.odp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\7Nao1.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\ep5X.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\I8ehK.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\NCPiZ1uXfcks2I.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\rm-nWY04SORe.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\u5gWB.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\yEkiK6rDQNF.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\YOjV4Fx2CMHe-5Lss\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\YOjV4Fx2CMHe-5Lss\olk5RMR1oqfphck2U05.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qaZw5h1f5qw.pdf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QyatA7NyKq.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIfv5oFQ8J4.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sEZycavJYj9O7p9Z_.xls | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TZievc7SWtbu2dQahm.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wdTrbf31w.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\yvD6QNYOS7LntPhz_E.csv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-D9LwOMHP I2-mZ.doc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1qpDjou6KdiPY1ady_WR.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\4RxlOUzIV3GEDD.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aUn_9x11cBK9e7uGI.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BxanQYzz\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ci77Ti4lhul7c.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ejx-aMjp69alv7.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\hT64EeyHqF.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k9s4AF2LNL7a1H.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LfRHvvMmU.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\477E54rkiZ.ods | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\QDQZClQOXIBX4Tg6Gs6.ots | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\Uaa58B4We2Q82P.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\cs5rxI11lfbV_WJ7.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\DJbMXQFHJLa.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\d0Mg24yzFY6.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\u17FjZYa8q.doc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\g0Mqkg_Mm4DFbs8.ppt | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\-8Hz2TqvFV1rlvG2RQHR.xls | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\jByZol7EW.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\vqkBCI.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\y7HoVWj4Qidf.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\yw_Ko2f.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\eLJuwg.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\f4cy9wxLpuzAWvl.odt | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\NhS9nLw.ods | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\pRGxEDIMLZW.odp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\hSE8808C39qcG6UJM.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\fCDuSz1M.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\O19y.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\sVhAc7.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\yH3ubVw7Z.ppt | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\YMhE0R5.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ofp82Cf.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\oXRpN42LM1.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PjtlNPu.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QcZ0II6_7LS.pdf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qj44AkZEKy3FksdP5.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Qu1FnjYeu.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\SPiXfTR.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TQ4D6hQZ.ods | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vbi2WZV80G3A6F8ABV.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Local Settings\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\3I3AS6__yr2TK4.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\6InJvy5KUxz42.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\EA0iSwBF7AKYO.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\H2-qoDEm_bBlu0.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\IfcP61Rpbh6VH\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\IfcP61Rpbh6VH\gDDDWJ8.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\IfcP61Rpbh6VH\pPCLPAZtraWVAddDD.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\IfcP61Rpbh6VH\PSYTBK7AGK0Ou.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\IfcP61Rpbh6VH\RXEjqiRD.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\JANP3Yj62Cpv\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\JANP3Yj62Cpv\4EiSqDeaZ.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\JANP3Yj62Cpv\kt-IHH1IgOytAr4_2q.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\JANP3Yj62Cpv\ouuRJtRLs.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\Nq1poMV_zea.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\S3xVUVbwcEb.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\0mjYE.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\5ttuQm.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\bMw5p.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\s0DntIA8UKndpsC.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\e2LHCmVEvIV7\VhRMVGuBQL.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\opix0T _7ZRj.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\vnfyQ2yBfRCn00\PUefx JvIdw81yy1.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\44Q4Y701hW_AjHvRD\wYqiWFi.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HPfPz\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HPfPz\0xMp.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HPfPz\7v2tGU68EY d8J.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HPfPz\b1SFe817g4EQ5.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\ilpomDa-zFNbklgvUJ3.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP4t2kUPYJXGQ.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\jxUbuuwfdL2.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\A5jgVVQp8BxaGnt.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\euCPfpC.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\FFrg7.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\ThVL9n0DbS\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\ThVL9n0DbS\mQV8J7-.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\ThVL9n0DbS\VyPU4A6f.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\5 1r.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\KgyS5IvV.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\SvZsryuwvzH8IpKaAEM.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\wEnNtVoYJXf6q7_V7bu.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\WXxtgLNVOr.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WQL90KrgVVGy1xk89d9\XlicEIp_sPN2Mo\YJUPojxVv98L88H.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\My Documents\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\NetHood\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG1 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG2 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\0e_qv6_9cCKUcSB1uWlc.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\0I5 J4wsbc920.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1MVZTLyRKg0s.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5Nt.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6yftr_fHEW.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9pHwaXEE3Q9.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\a3m-oL f_c52.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\a5WMJmd-THJhi_.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\B79x8zLkTLb5TEy63.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BGuQkphSV9mWobF.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\dnhcXA.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EEliM6.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eHK4Ir7R4hM2DgBBEe.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f9OODcEPXRNm.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\G27YDK_aZf6sq.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\GYUkp-YqWJXgn6lfMu.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\iacPIpqAoxzS0CWF.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LaNK7rv8.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LUnxfcx.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mlGV.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nsF_nxRUWzSe.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\NXzZ.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QMrEfixVYv5l.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QN UHQ.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QO3h1Ha.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\rczXq.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\rRH1.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\u2674X23wxitDUBOc.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\v_Gb9mg.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wDZgTBaXH9x9y.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\xJd5WxtmwGwPuB1Jc.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Xw6XBL-4-RK2mHe.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\yH3lYNzCcsIwBb79.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Z1YJ1zzC.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zDDPsjK6bgCwkBBmjGGq.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zRT9lMwx_.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZyB4tFtLfa.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_8QCLXqwOza5.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\PrintHood\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Recent\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\SendTo\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Start Menu\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Templates\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\5igRMzsxG4 r8Q2Q9\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\5igRMzsxG4 r8Q2Q9\f8z2wLap7dFFb_.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\5igRMzsxG4 r8Q2Q9\GGtdu.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\5igRMzsxG4 r8Q2Q9\_qXWAQ9D.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\BZjxaKtRwsyoL.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\Eaqt6S5ng_wlZdjcF.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\iqLNt72_rvpd8KazzZ.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\oC18bMYeDGO1cmA86l9o.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\X4mt7UnLC5.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\-8lwJ0Ci\ZG27W8XYqy-.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\8DJhF.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\6pOkvTj9CQqlV.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\bIe5WM.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\FsB2u3xnzh2JA.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\fWKNg.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\hDQpXq.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\V09Mt7lwiiksC93h9kF.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\22VXjH5D\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\22VXjH5D\G4lWez2xHoWP2qC_.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\22VXjH5D\pDrxLTfqfJz.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\4-HyBfokkdgGkLlGS.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\FDa6smMzP18wZYAjuLC\vHDvaah0EJEBQXzd wkU\UIoUFA0qUA7.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\hS1sl7.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\5m_AL ziXL4s.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\Dby7R_6T0fxUWGgKTu.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\388raz.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\549Dqt9.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\fXb8GU4CwGe.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\lSqQXZ2q8lEtdEk.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\tNN LWxrUk.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\VgJpLa1X.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\E-m3FEF3NDQtJFE\ztx1Ki7.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\iL9FWSGwmcfS8tbF-T.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\KyDsg2qW.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\QsAlv9z0.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\kZNGHH\WvPHBcUNOWUS2YzCx.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\XqwBOOaj.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dvHHUN\yQolzSWZFa.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Eiz3Ozs4T84J62KJkeD.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Wqi AjAR-VwmTUb.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\xoahs0JlJhT0l PDCCU.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\All Users | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\AppData | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Application Data\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Contacts\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Contacts\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Contacts\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Contacts\Administrator.contact | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Contacts\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Cookies\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Desktop\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Desktop\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Desktop\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Desktop\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\My Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\My Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Documents\My Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Downloads\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Downloads\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Downloads\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Downloads\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Links\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Links\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Links\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Links\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Links\Web Slice Gallery.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSN Autos.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSN Money.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSN Sports.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSN.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\MSN Websites\MSNBC News.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Windows Live\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Windows Live\Get Windows Live.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\Desktop.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\Downloads.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Links\RecentPlaces.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Local Settings\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Music\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Music\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Music\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\My Documents\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NetHood\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT.LOG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT.LOG1 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT.LOG2 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\ntuser.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Pictures\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Pictures\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Pictures\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\PrintHood\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Recent\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Saved Games\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Saved Games\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Saved Games\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Saved Games\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\Everywhere.search-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Searches\Indexed Locations.search-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\SendTo\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Start Menu\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Templates\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Videos\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Videos\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default\Videos\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Default User\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\Adobe Reader X.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\Google Chrome.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Desktop\Mozilla Firefox.lnk | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\My Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\My Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Documents\My Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Downloads\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Downloads\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Downloads\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Downloads\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Favorites\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Favorites\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Favorites\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Libraries\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Libraries\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Libraries\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Libraries\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Libraries\RecordedTV.library-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\Kalimba.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Music\Sample Music\Sleep Away.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Desert.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Koala.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\Sample Media\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\Sample Media\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\Sample Media\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\Sample Videos\HELP_PC.EZDZ-REMOVE.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\Sample Videos\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\Sample Videos\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Users\Public\Videos\Sample Videos\Wildlife.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Move | \\?\C:\$Recycle.Bin.EZDZ | source_filename = \\?\C:\$Recycle.Bin |
|
1 | |
| Move | \\?\C:\Boot.EZDZ | source_filename = \\?\C:\Boot |
|
1 | |
| Move | \\?\C:\bootmgr.EZDZ | source_filename = \\?\C:\bootmgr |
|
1 | |
| Move | \\?\C:\BOOTSECT.BAK.EZDZ | source_filename = \\?\C:\BOOTSECT.BAK |
|
1 | |
| Move | \\?\C:\Config.Msi\..EZDZ | source_filename = \\?\C:\Config.Msi\. |
|
1 | |
| Move | \\?\C:\Config.Msi\...EZDZ | source_filename = \\?\C:\Config.Msi\.. |
|
1 | |
| Move | \\?\C:\hiberfil.sys.EZDZ | source_filename = \\?\C:\hiberfil.sys |
|
1 | |
| Move | \\?\C:\MSOCache\..EZDZ | source_filename = \\?\C:\MSOCache\. |
|
1 | |
| Move | \\?\C:\MSOCache\...EZDZ | source_filename = \\?\C:\MSOCache\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\..EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\...EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.EZDZ | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml |
|
1 | |
| Move | \\?\C:\pagefile.sys.EZDZ | source_filename = \\?\C:\pagefile.sys |
|
1 | |
| Move | \\?\C:\Program Files.EZDZ | source_filename = \\?\C:\Program Files |
|
1 | |
| Move | \\?\C:\Program Files (x86).EZDZ | source_filename = \\?\C:\Program Files (x86) |
|
1 | |
| Move | \\?\C:\ProgramData.EZDZ | source_filename = \\?\C:\ProgramData |
|
1 | |
| Move | \\?\C:\Recovery.EZDZ | source_filename = \\?\C:\Recovery |
|
1 | |
| Move | \\?\C:\System Volume Information.EZDZ | source_filename = \\?\C:\System Volume Information |
|
1 | |
| Move | \\?\C:\Users\..EZDZ | source_filename = \\?\C:\Users\. |
|
1 | |
| Move | \\?\C:\Users\...EZDZ | source_filename = \\?\C:\Users\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-Amk9o75eMLK.avi.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-Amk9o75eMLK.avi |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-TKR5.flv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-TKR5.flv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1uK3wKx8aEtv.avi.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1uK3wKx8aEtv.avi |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\88ugRjF.mkv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\88ugRjF.mkv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9o-8i.mkv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9o-8i.mkv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9oRaioevZK.swf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9oRaioevZK.swf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9W6LUt.flv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9W6LUt.flv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BewVrrN36J_7.m4a.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BewVrrN36J_7.m4a |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\edwMCMTRr.jpg.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\edwMCMTRr.jpg |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ftV3BjDCsptOs.mp3.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ftV3BjDCsptOs.mp3 |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ioEcXfDfCcssbES8.csv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ioEcXfDfCcssbES8.csv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iq S4WPsfB2Lvk0E-WF.png.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iq S4WPsfB2Lvk0E-WF.png |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kuK-90e.m4a.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kuK-90e.m4a |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\L17juNataF.png.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\L17juNataF.png |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\larvvi.exe.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\larvvi.exe |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mmZoR3rUq.bmp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mmZoR3rUq.bmp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nMfmmAOTUYEnqUGFt2.mkv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nMfmmAOTUYEnqUGFt2.mkv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\73DGvzIzmIC8.odp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\73DGvzIzmIC8.odp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\7Nao1.m4a.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\7Nao1.m4a |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\ep5X.png.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\ep5X.png |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\I8ehK.mkv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\I8ehK.mkv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\NCPiZ1uXfcks2I.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\NCPiZ1uXfcks2I.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\rm-nWY04SORe.mp3.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\rm-nWY04SORe.mp3 |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\u5gWB.mkv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\u5gWB.mkv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\yEkiK6rDQNF.bmp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\yEkiK6rDQNF.bmp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\YOjV4Fx2CMHe-5Lss\olk5RMR1oqfphck2U05.bmp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OHw3M1GbO1rxX\YOjV4Fx2CMHe-5Lss\olk5RMR1oqfphck2U05.bmp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qaZw5h1f5qw.pdf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qaZw5h1f5qw.pdf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QyatA7NyKq.bmp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QyatA7NyKq.bmp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIfv5oFQ8J4.mp4.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIfv5oFQ8J4.mp4 |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sEZycavJYj9O7p9Z_.xls.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sEZycavJYj9O7p9Z_.xls |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TZievc7SWtbu2dQahm.wav.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TZievc7SWtbu2dQahm.wav |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wdTrbf31w.jpg.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wdTrbf31w.jpg |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\yvD6QNYOS7LntPhz_E.csv.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\yvD6QNYOS7LntPhz_E.csv |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-D9LwOMHP I2-mZ.doc.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-D9LwOMHP I2-mZ.doc |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1qpDjou6KdiPY1ady_WR.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1qpDjou6KdiPY1ady_WR.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\4RxlOUzIV3GEDD.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\4RxlOUzIV3GEDD.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aUn_9x11cBK9e7uGI.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aUn_9x11cBK9e7uGI.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ci77Ti4lhul7c.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ci77Ti4lhul7c.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ejx-aMjp69alv7.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ejx-aMjp69alv7.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\hT64EeyHqF.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\hT64EeyHqF.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k9s4AF2LNL7a1H.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k9s4AF2LNL7a1H.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LfRHvvMmU.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LfRHvvMmU.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\477E54rkiZ.ods.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\477E54rkiZ.ods |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\QDQZClQOXIBX4Tg6Gs6.ots.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\QDQZClQOXIBX4Tg6Gs6.ots |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\Uaa58B4We2Q82P.rtf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\Uaa58B4We2Q82P.rtf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\cs5rxI11lfbV_WJ7.rtf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\cs5rxI11lfbV_WJ7.rtf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\DJbMXQFHJLa.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\DJbMXQFHJLa.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\d0Mg24yzFY6.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\d0Mg24yzFY6.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\u17FjZYa8q.doc.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\ftUc_CpNgJCLv\u17FjZYa8q.doc |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\g0Mqkg_Mm4DFbs8.ppt.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\g0Mqkg_Mm4DFbs8.ppt |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\-8Hz2TqvFV1rlvG2RQHR.xls.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\-8Hz2TqvFV1rlvG2RQHR.xls |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\jByZol7EW.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\jByZol7EW.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\vqkBCI.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\vqkBCI.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\y7HoVWj4Qidf.pps.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\y7HoVWj4Qidf.pps |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\yw_Ko2f.pps.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\lJg8R\yw_Ko2f.pps |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\eLJuwg.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\eLJuwg.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\f4cy9wxLpuzAWvl.odt.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\f4cy9wxLpuzAWvl.odt |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\NhS9nLw.ods.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\NhS9nLw.ods |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\pRGxEDIMLZW.odp.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\pRGxEDIMLZW.odp |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\hSE8808C39qcG6UJM.pps.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\hSE8808C39qcG6UJM.pps |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\fCDuSz1M.rtf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\fCDuSz1M.rtf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\O19y.rtf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\lES-IyA\O19y.rtf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\sVhAc7.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\V I7sRX\RILP g 1rqsEUushWn\S7pLkd3 3MfqDgcWxZk\sVhAc7.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\yH3ubVw7Z.ppt.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\yH3ubVw7Z.ppt |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\YMhE0R5.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\myhM-u8Oczqbn\YMhE0R5.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ofp82Cf.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ofp82Cf.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\oXRpN42LM1.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\oXRpN42LM1.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PjtlNPu.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PjtlNPu.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QcZ0II6_7LS.pdf.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QcZ0II6_7LS.pdf |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qj44AkZEKy3FksdP5.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qj44AkZEKy3FksdP5.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Qu1FnjYeu.docx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Qu1FnjYeu.docx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\SPiXfTR.pptx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\SPiXfTR.pptx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TQ4D6hQZ.ods.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TQ4D6hQZ.ods |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vbi2WZV80G3A6F8ABV.xlsx.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vbi2WZV80G3A6F8ABV.xlsx |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\.. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\..EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\. |
|
1 | |
| Move | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\...EZDZ | source_filename = \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\.. |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | size = 8, size_out = 8 |
|
27 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | size = 8, size_out = 8 |
|
35 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | size = 8, size_out = 8 |
|
50 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | size = 8, size_out = 8 |
|
10 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | size = 8, size_out = 8 |
|
72 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | size = 8, size_out = 8 |
|
35 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | size = 8, size_out = 8 |
|
65 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | size = 8, size_out = 8 |
|
63 | |
| Read | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Default\Desktop\desktop.ini | size = 8, size_out = 8 |
|
35 | |
| Read | \\?\C:\Users\Default\Desktop\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Default\Documents\desktop.ini | size = 8, size_out = 8 |
|
50 | |
| Read | \\?\C:\Users\Default\Documents\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Default\Downloads\desktop.ini | size = 8, size_out = 8 |
|
35 | |
| Read | \\?\C:\Users\Default\Downloads\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Default\Favorites\desktop.ini | size = 8, size_out = 8 |
|
50 | |
| Read | \\?\C:\Users\Default\Favorites\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Default\Favorites\Links\desktop.ini | size = 8, size_out = 8 |
|
10 | |
| Read | \\?\C:\Users\Default\Favorites\Links\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Default\Links\desktop.ini | size = 8, size_out = 8 |
|
72 | |
| Read | \\?\C:\Users\Default\Links\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\Default\Music\desktop.ini | size = 8, size_out = 8 |
|
63 | |
| Read | \\?\C:\Users\Default\Music\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Default\Pictures\desktop.ini | size = 8, size_out = 8 |
|
63 | |
| Read | \\?\C:\Users\Default\Pictures\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Default\Saved Games\desktop.ini | size = 8, size_out = 8 |
|
35 | |
| Read | \\?\C:\Users\Default\Saved Games\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Default\Searches\desktop.ini | size = 8, size_out = 8 |
|
65 | |
| Read | \\?\C:\Users\Default\Searches\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\Default\Videos\desktop.ini | size = 8, size_out = 8 |
|
63 | |
| Read | \\?\C:\Users\Default\Videos\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\desktop.ini | size = 8, size_out = 8 |
|
21 | |
| Read | \\?\C:\Users\desktop.ini | size = 8, size_out = 6 |
|
1 | |
| Read | \\?\C:\Users\Public\Documents\desktop.ini | size = 8, size_out = 8 |
|
34 | |
| Read | \\?\C:\Users\Public\Documents\desktop.ini | size = 8, size_out = 6 |
|
1 | |
| Read | \\?\C:\Users\Public\Downloads\desktop.ini | size = 8, size_out = 8 |
|
21 | |
| Read | \\?\C:\Users\Public\Downloads\desktop.ini | size = 8, size_out = 6 |
|
1 | |
| Read | \\?\C:\Users\Public\Libraries\desktop.ini | size = 8, size_out = 8 |
|
11 | |
| Read | \\?\C:\Users\Public\Libraries\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Public\Music\desktop.ini | size = 8, size_out = 8 |
|
47 | |
| Read | \\?\C:\Users\Public\Music\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\Public\Music\Sample Music\desktop.ini | size = 8, size_out = 8 |
|
73 | |
| Read | \\?\C:\Users\Public\Music\Sample Music\desktop.ini | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\Users\Public\Pictures\desktop.ini | size = 8, size_out = 8 |
|
47 | |
| Read | \\?\C:\Users\Public\Pictures\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\Public\Recorded TV\desktop.ini | size = 8, size_out = 8 |
|
10 | |
| Read | \\?\C:\Users\Public\Recorded TV\desktop.ini | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | size = 8, size_out = 8 |
|
21 | |
| Read | \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | size = 8, size_out = 3 |
|
1 | |
| Read | \\?\C:\Users\Public\Videos\desktop.ini | size = 8, size_out = 8 |
|
47 | |
| Read | \\?\C:\Users\Public\Videos\desktop.ini | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | size = 8, size_out = 8 |
|
40 | |
| Read | \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | size = 8, size_out = 6 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ci77Ti4lhul7c.pptx | size = 8 |
|
249 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | size = 8 |
|
27 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | size = 8 |
|
35 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | size = 8 |
|
50 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | size = 8 |
|
10 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | size = 8 |
|
72 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | size = 8 |
|
35 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | size = 8 |
|
65 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | size = 8 |
|
63 | |
| Write | \\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Default\Desktop\desktop.ini | size = 8 |
|
35 | |
| Write | \\?\C:\Users\Default\Desktop\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Default\Documents\desktop.ini | size = 8 |
|
50 | |
| Write | \\?\C:\Users\Default\Documents\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Default\Downloads\desktop.ini | size = 8 |
|
35 | |
| Write | \\?\C:\Users\Default\Downloads\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Default\Favorites\desktop.ini | size = 8 |
|
50 | |
| Write | \\?\C:\Users\Default\Favorites\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Default\Favorites\Links\desktop.ini | size = 8 |
|
10 | |
| Write | \\?\C:\Users\Default\Favorites\Links\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Default\Links\desktop.ini | size = 8 |
|
72 | |
| Write | \\?\C:\Users\Default\Links\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\Default\Music\desktop.ini | size = 8 |
|
63 | |
| Write | \\?\C:\Users\Default\Music\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Default\Pictures\desktop.ini | size = 8 |
|
63 | |
| Write | \\?\C:\Users\Default\Pictures\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Default\Saved Games\desktop.ini | size = 8 |
|
35 | |
| Write | \\?\C:\Users\Default\Saved Games\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Default\Searches\desktop.ini | size = 8 |
|
65 | |
| Write | \\?\C:\Users\Default\Searches\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\Default\Videos\desktop.ini | size = 8 |
|
63 | |
| Write | \\?\C:\Users\Default\Videos\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\desktop.ini | size = 8 |
|
21 | |
| Write | \\?\C:\Users\desktop.ini | size = 6 |
|
1 | |
| Write | \\?\C:\Users\Public\Documents\desktop.ini | size = 8 |
|
34 | |
| Write | \\?\C:\Users\Public\Documents\desktop.ini | size = 6 |
|
1 | |
| Write | \\?\C:\Users\Public\Downloads\desktop.ini | size = 8 |
|
21 | |
| Write | \\?\C:\Users\Public\Downloads\desktop.ini | size = 6 |
|
1 | |
| Write | \\?\C:\Users\Public\Libraries\desktop.ini | size = 8 |
|
11 | |
| Write | \\?\C:\Users\Public\Libraries\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Public\Music\desktop.ini | size = 8 |
|
47 | |
| Write | \\?\C:\Users\Public\Music\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\Public\Music\Sample Music\desktop.ini | size = 8 |
|
73 | |
| Write | \\?\C:\Users\Public\Music\Sample Music\desktop.ini | size = 2 |
|
1 | |
| Write | \\?\C:\Users\Public\Pictures\desktop.ini | size = 8 |
|
47 | |
| Write | \\?\C:\Users\Public\Pictures\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\Public\Recorded TV\desktop.ini | size = 8 |
|
10 | |
| Write | \\?\C:\Users\Public\Recorded TV\desktop.ini | size = 0 |
|
1 | |
| Write | \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | size = 8 |
|
21 | |
| Write | \\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini | size = 3 |
|
1 | |
| Write | \\?\C:\Users\Public\Videos\desktop.ini | size = 8 |
|
47 | |
| Write | \\?\C:\Users\Public\Videos\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | size = 8 |
|
40 | |
| Write | \\?\C:\Users\Public\Videos\Sample Videos\desktop.ini | size = 6 |
|
1 | |
|
For performance reasons, the remaining 986 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | c:\users\5p5nrgjn0js halpmcxz\desktop\larvvi.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Module (19)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | ntdll.dll | base_address = 0x77130000 |
|
6 | |
| Load | Netapi32.dll | base_address = 0x74b30000 |
|
2 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\larvvi.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\larvvi.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = RtlCreateProcessParametersEx, address_out = 0x7717bd9b |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtWow64ReadVirtualMemory64, address_out = 0x771520f4 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtWow64QueryInformationProcess64, address_out = 0x771520dc |
|
1 | |
| Get Address | c:\windows\syswow64\netapi32.dll | function = NetApiBufferFree, address_out = 0x74b213d2 |
|
1 | |
| Get Address | c:\windows\syswow64\netapi32.dll | function = NetWkstaGetInfo, address_out = 0x74b35570 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7714fac8 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = RtlInitUnicodeString, address_out = 0x7715e208 |
|
4 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = -1 (infinite) |
|
1 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Hardware Information |
|
1 | |
| Get Info | type = Windows Directory, result_out = C:\Windows |
|
1 |
Process #2: dllhost.exe
0
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\syswow64\dllhost.exe |
| Command Line | C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:34, Reason: RPC Server |
| Unmonitor | End Time: 00:00:43, Reason: Self Terminated |
| Monitor Duration | 00:00:08 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa18 |
| Parent PID | 0x254 (c:\windows\system32\svchost.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A30
0x
A2C
0x
A28
0x
A24
0x
A20
0x
A1C
0x
A38
0x
A3C
0x
AA0
|
Process #3: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet |
| Initial Working Directory | C:\Windows\sysnative\ |
| Monitor | Start Time: 00:00:35, Reason: Child Process |
| Unmonitor | End Time: 00:01:10, Reason: Self Terminated |
| Monitor Duration | 00:00:35 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa40 |
| Parent PID | 0xa18 (c:\windows\syswow64\dllhost.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A44
0x
A5C
0x
A60
0x
A64
0x
A68
|
Process #4: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:37, Reason: RPC Server |
| Unmonitor | End Time: 00:04:26, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:48 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa6c |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A88
0x
A84
0x
A80
0x
A7C
0x
A78
0x
A74
0x
A70
0x
A98
0x
B3C
0x
BF8
0x
97C
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-18 08:21:56 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 103803 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15942847943 |
|
1 |
