5a612b52...9af3 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Trojan

rruzcj.exe

Windows Exe (x86-32)

Created at 2019-06-09T09:41:00

...

Remarks (1/1)

(0x2000007): The operating system was rebooted during the analysis because the sample modified the master boot record (MBR).

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x97c Analysis Target High (Elevated) rruzcj.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rruzcj.exe" -
#2 0x990 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" #1
#3 0x9bc Child Process High (Elevated) mode.com mode con cp select=1251 #2
#4 0x9ec Child Process High (Elevated) vssadmin.exe vssadmin delete shadows /all /quiet #2
#5 0xa90 RPC Server System (Elevated) vssvc.exe C:\Windows\system32\vssvc.exe #4
#7 0x4 Kernel Analysis System (Elevated) System - -

Behavior Information - Grouped by Category

Process #1: rruzcj.exe
133155 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\rruzcj.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rruzcj.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:27, Reason: Analysis Target
Unmonitor End Time: 00:02:00, Reason: Self Terminated
Monitor Duration 00:01:33
OS Process Information
»
Information Value
PID 0x97c
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 980
0x 98C
0x 998
0x 99C
0x 9A0
0x 9A4
0x 9A8
0x 9C4
0x 9C8
0x 9CC
0x 9D0
0x 9D4
0x 9D8
0x 9DC
0x 9E0
0x 9E4
0x 9E8
0x 9F8
0x A98
0x B38
0x BC8
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
rruzcj.exe 0x00400000 0x0049EFFF Relevant Image - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh 64.25 KB MD5: d7e4ca859665f98e6b5b7c37bc882447
SHA1: f2156875ff17dd0eff8a861b8112775a170776ab
SHA256: 71d94ffacd765d3f6be031a048addcef8791edcf13a552df8dc939d206be14b3
SSDeep: 1536:oGQCRIAzvTMyGE6jsM4zvCkdNaeAqR0MisowkbokV2XwX5OkuCC:oiRn4FI/zaCaefRzishk0ksAxC 		True
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.47 KB MD5: feb3ca09030e0df4130dadd400f1da49
SHA1: 213782dfb7a3fcdbcfa129173f1c9280ce5a232e
SHA256: 0aa0cf62c19156dfa608b98a1d6e69929fc3ae20bdd4ccf8f30b3567d5367f7d
SSDeep: 48:pM+7I3nhd0LThqqS6xMst9Li9dgcp3xmD7T1K98Cnae4Q/UKaY27F:a+KURS6xMsbC3xAT1W8s4Q/UKaf5 		True
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.07 KB MD5: 051708c219c52186069332b2ed443a62
SHA1: 4a62e223204d7647eb56189993d2fe16e7b68798
SHA256: e2b4e6120d4322dc8e7b585769968d31f1788883712f0be0e0193437d118889b
SSDeep: 48:U5TBW26PcOxaZv40MEbqu1nvnKNZN+rZLfSmbIfZLj2ViYv7F:Axh1winvnKNZMFSNLzK5 		True
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 41cab2ab83296b372279af5d47e0c361
SHA1: de0ceef3c1eddb7a086e9352367b1580092ee803
SHA256: a786eaa36f68236f52e838be48cff88defbb791a44f4291096ba650b7eb7a828
SSDeep: 48:OY7Ks8GAAIEdLFM1EnuxUaNVqMBnCZ9FFgriv/jKte2m7V:8sOn3kkn6juiv/ZJ 		True
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.76 KB MD5: d23822e197b42b74d057d5488e35a412
SHA1: 8acf16d953773a37d23d552518332b1259c636e1
SHA256: 91ec3901d6730e7b05dd7b0f7b867b5f235fb40192e7c944d51cbdcc4fdecb85
SSDeep: 48:MH2Zy/niu6Q3Hb8uEA/f0RmYpUubUe2GF7r:sow6QiFmvubX3 		True
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 3.36 KB MD5: 02fefcc423b586e09844f51252be04af
SHA1: d186955a8a8d3430452704c8ff294c04607284ed
SHA256: a53193c57fa15bc410b5ac3aed6105195dd11f19894fecbb70181357a3a0c070
SSDeep: 96:ft9ebYbgX/W93OwtmeuzMOdlc7uS8QmcnLvEAL:6bYb0gXXWDKt 		True
...
C:\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh 8.25 KB MD5: f73044504780f881566f23c4dda97461
SHA1: f1becafb0753d2f65ffeb9ef018ba64049e378d6
SHA256: c7caee26d95f30b0f0c9fad78eec899512696ffbf4fa185cbc1ff1ff9fb46f11
SSDeep: 192:3n3EjNDCRcDgq3XhnFmGUvoR1XNoGfGhHOP4xUZpArvdpE9C:nEFCRcf3Rn0GUmdo5dyPAhi9C 		True
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.80 KB MD5: add512e5d8f4129381110a52bca41467
SHA1: a646ea6928e37be937b243429b3f8144ef15c0a4
SHA256: 7474f0d90c772bdbd0b91e295c7732d542dedcbca89e186a14b87717c80315d7
SSDeep: 48:1XNp2renuFyWEqcCFf1g+2cU8O9rItCQK4+venMV0XWgNihYE7F:ZSeulOEU8GItCQKvveMVUV8hN5 		True
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: c4c931c955ce08333e258d642041cc43
SHA1: 11ba660a585901aaab8f3c6dc23f3b23ea87a419
SHA256: 996b40bc6ea015fbe4f709ef511ecac7789186a2d8da4abe4010453876f4cdae
SSDeep: 48:e6ljXFPs2G8EYulru4yBueZyRmABJfqLUnHe2x7T:e6lJPsQUlq9lyRm4JfgI3f 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.55 KB MD5: d907f6915bad4bb9dd7d5837e5a21ddf
SHA1: 4838da4dcd534ee68969b2c547ca6a75e6b60d3f
SHA256: ff5e30940363d8d42be4d9f677d66db5d8754f031081ce5bdad614364ac5c853
SSDeep: 24:1IcFajqub+mf02/OCjID2XdoBJxyArRIknllk+/6rF8a5CckI9cd+yXeoF:1xOCmf0244gJxymISlvyt5C8P27F 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: e15e397c51d3baf101e4c99d5a664e72
SHA1: ca0a1b38ca4fe44f6f2e7c784323718e91f01270
SHA256: 8ab23ad6ab46915ddbd5ad4f4db9143647fb69f8983bef5d714a745f72c8b827
SSDeep: 48:2so8JYjNi+b1CVkda3iWVSUKRHP9w7N2pi7F:2sVeNfh5a3iMS5q95 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: dd9a22eeacee7f785b3138a2f0d7c99a
SHA1: 47708aa6374f457c2c1a1c146c9ec5395e3bf7a0
SHA256: bc422763817b07ce483c74f9c6c988e744acebbd4f259faa65912c3f3fdfc3c8
SSDeep: 48:LNiAVapbXy0SN1nXrIekCkHGF3x3Hsw+MAwMel87F:L4AcpJQVrTkmFhcwNQeq5 		True
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 4.33 KB MD5: e6ea9ba7b57669775220743b0759bdcc
SHA1: 9b13e8624ecc3f390da2e1b42c5409ae6093cc1f
SHA256: 369a3f7a632006005401095545999bd3c36508f5b1ef61f35ac1c846301cabdb
SSDeep: 96:Zk6ZvMKdjRQMwlt5ZAoJacn+T4e/gDP7640xevXdpb5:ZDUWWJ5ZjZ+T1/EPqmtD 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 5.97 KB MD5: 5f9f105b1348a389b831ddc56dc596ae
SHA1: 09241f32c85d36d24b5ab663e2fb578d6965382e
SHA256: 92f6ad561ac06793c08e24040cf45cec413af0e5d22fadbb930473e8b250d704
SSDeep: 96:9A4ecTIUmCfcEnxFKC0FxqInlHo6NfNvsHOiIgPBQHRlcpvlsLq/4jEu5:5Rm4ccKBnZnlHo6N1vsHyeBARlcpvCmW 		True
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.60 KB MD5: 6386baaa734730045cbbd4b2dbf74a23
SHA1: 0a5e7d24f0b3e9a29780309b2646511ab16376f4
SHA256: 0f0e45c22a98bfd9ffb6e15a967339a21c3d3a4b3591a2ab5e8be62a07bbebef
SSDeep: 24:fm3W92/gi1w6BI5yD3d3HpXEKu8df+GU9mIZCS5Apnk2le2yoM7eop:RtQGiVJUwV3IZls1e2BI7p 		True
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.54 KB MD5: 0450846d0ec59bb14407055ab32f944b
SHA1: 5afd1a886c03c8bb12588638d9bfd8acb1c8a9aa
SHA256: b2544a1f72ea35a328633c1679b74e94468a0b0b496a3b55cc55c8d34cad660a
SSDeep: 48:SJ1cJXU073f5S3VCZdwf6eq2YeycQ9yO1o/j9KdQP/1lAMYL7F:SDcX73fpwf6TkOS79jX1KMm5 		True
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.99 KB MD5: c1ede5b2eae5cf0211859492ad7bece3
SHA1: 70c863bf3e7a7de5dc32b5463ab320faa06071d7
SHA256: 34a946dca9020a823c6119816a18c59e54ca96aaf362c5d797df240de8a586ff
SSDeep: 48:rXbfT6Z71OJtchYMUKd7W28DoyulzvT9Ze2WYj7B:brT6JIJtbMbo2EoyyvTvjN 		True
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.04 KB MD5: 20a18d4805cc80225c1959daf68e2cab
SHA1: 32e3f4769ead56f0d434ad4be7cb02e5d30cac02
SHA256: c593e86e6bd4e619e5ed10fe1cf78e52b67f685dacbf5d4210abf21ec7cb3c4f
SSDeep: 24:ix6KaqXBTs7GyAWQWJQg+LiW/sC26Zk7Q0W4T87f3fd1cZ7V7MryY1E5AkdtQito:jmlMvYLQIN0H8zfEvMxEeQjYj7F 		True
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 6.33 KB MD5: f2f1013e533749af281bd818218f879a
SHA1: 5b4d6f60a6afd38fb2a666380f7b12bc36ae1967
SHA256: 01036affebf0e303a6aaaa45642741d3efc16f9256866abf843633fd3f04d3a9
SSDeep: 192:T2XHWwwJt9nEV9t+sSFDe+/dOYTYKRh68c:SHNwj9nEEFNEY8OVc 		True
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.60 KB MD5: 1fa173d736a69cdbe9a3ac02c4b886b3
SHA1: 0f4e6521ee089e4bfd79e3e6f643c678b4a7b176
SHA256: b1aaa9aa80062af1fafb08ab099bbf21f6ece989281551c63d3d2ae156c93266
SSDeep: 48:Y+d1+rGbt+EInNeQyraPFUk7s2quylRePs95Nx3+ytqOW/7Y57F:Yy+rGbDIsQFtU+byreU95Nh+KW/7Q5 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.03 KB MD5: dca0db349280d700d4c72ecfef8f046a
SHA1: 6f7434383abc2d3480195ca073429d5a3d158ef7
SHA256: ebf44eb8e9d0c6dc1d442ec97c9a8cd2c0fd747b53bc656fc819c949e0647db8
SSDeep: 24:zoLkP0llPbDoLoguQxneybrK33CCCjHy/eor:zYP79GbrK33CCSHq7r 		True
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.44 KB MD5: dd27ae5cef303fb03213a6145b1efce2
SHA1: faf932465d87e86c8979833350941a97ef01e8da
SHA256: 5e2a26476e6147bbeb2915bcc6980ff6442c0753295b9361251a635b29a55948
SSDeep: 24:/XidIQyMS2Js6nzKDIQ5IPk7J4jRM0VvrLFtzEg45iSUwt57VX9vQe2yzSeop:/APRjLQiM7J4jRM0hBWgLarX9oe2r7p 		True
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 9.51 KB MD5: 04b0bd67825cd8bcd805c0b21016253a
SHA1: 3232b67dc2bea6360e534f1017d647dc58765afa
SHA256: 000fa95e4336c04f8bfc9715a2f5d3f9c4af4266a34b68af760b522c0f8cbffc
SSDeep: 192:pHrq0VRZ3zwVdaKjoijLtEL0mqxNUfD/8oS+X5WSlvzHqWW:pLq0VR1I9joij+i2j9xlvzKWW 		True
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.81 KB MD5: 6be9201489b7194cc443cfc29c747a23
SHA1: da4f0939244969c3ed2b8142dc50f1ed6fef4a30
SHA256: 313c2288cc20d84b98bd22856e35780064a4d411b53b81bf6599b0a694d56846
SSDeep: 48:cUhl9Fu65C4IsQjvCoN2WMh2KTJb5PDY1Ne2F7X:cg/bLhuvCoMh2UJbJDY1JL 		True
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.14 KB MD5: 2fab7c85a5ff496d20dca01640d61f36
SHA1: 65ecb06bb8397adb6bb68a66712431762c6c4fac
SHA256: 17dcdd78222ea3ee77d13ba4d0f15933d443992b64e72f9337b09fee057fc6cd
SSDeep: 24:x9AFKhEcqp02ePePayytpNhAppU2W5evFBM1eWH1VC0A7rUe2yFFeot:x3udZePeSyybfAbUCEekO0qUe2G7t 		True
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.18 KB MD5: c368fe553689cd8754a434822e88d2b7
SHA1: 6fb7415da0d3164bff086bda82f1f3657c1951ee
SHA256: 47c19426fdee05b2468792fa1b63e49ac8185ae4f66197e705047fb96c2b5014
SSDeep: 48:xYrL4xQ1dDdx5+OEFcJEwCik/GyE7YZX4oYH7F:xYfo2Ddr+aJrCUCXjq5 		True
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.07 KB MD5: 51ede0585aa232a35be55174f7d67aad
SHA1: 9c03d5088158fcffec3d04966e47dcd7877b4e1c
SHA256: 7b6adca605e80d48d12c56bfbb434348ce29c7bb390bcbdc53949111d24e92f5
SSDeep: 48:4659Szd/r0nT9yVnenlYRp3NbD+pKihrn9BL5FqPLPWWCkkY17F:465wzh0nTI1/+pRr7dFqSkkc5 		True
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 18efa07eafff0c270111888e03d26ab1
SHA1: 2a161e8c3cf352081c199d54591d760f6d889597
SHA256: 8360c9d6853bf298a066ad1e4c2821440c5354a55bd14ec4885448b1382f2729
SSDeep: 48:jgXH+0YjgsAln6pTvHUt7yoaAmPYuCe2i7X:Uu0YjtSnUvH3XPYuDL 		True
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.65 KB MD5: 504a07a58b2fdaf3331ed3299894798d
SHA1: 6159083e799e931a29bfecaf9de7d9bebdfd0103
SHA256: 7dfcb2d43223d06ab442d3f40f179caea6732995c5a7a6bda5d0314fa8ac9d28
SSDeep: 48:nI0zC8o0pY9y/Z41rLP4xC686IBfSzPMEYHaE7F:nIACRYYQZ4dLP4YuIB6zMEWp5 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.05 KB MD5: f3abb450e51eaf175f5296d091fa007a
SHA1: 7ab2b2e0f63d4a6940ea4e48e87437f94d33d09d
SHA256: d7da0d9a61007c3644f9e99cf919f17ac6ef19128d627424d73fc497adb3d81b
SSDeep: 24:H8U80hSWRGOiM09aCSnGWWlOHS2QyFeoT:H8WUWRPM9azklGS2Qw7T 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh 65.85 KB MD5: 7ee2256cc1bb722ea02b096d28dea276
SHA1: da99aca9265b0c5ed4b85f45e7cd481acd7695ca
SHA256: 24f9dfe7da491d3daba8f70e5df8fe57a974a926c57d657832943cf2badd2d0a
SSDeep: 1536:2oOmaME8biOgMcEKmtL7z2VGoLrN7OXKcwYhFD8gude1zdP:2hvZ82CcEDSGo3NqXKcwYhFx1V 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 9.37 KB MD5: b3154e79df44417501d694cd6fc88898
SHA1: 317ebcebff5cf777079cdd6de9d876075eecbf82
SHA256: 0b2010753b15dcbc08539b4fdc75b1c6135c908b0a67f73c9c075d212cff7b48
SSDeep: 192:Azp+hSvYa7Nhwd4nhG/UvoYJcIBm288Lrd50pvEJPzO:8kSZn/nhVvoYJBmcLrdipv+O 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh 582.61 KB MD5: 2e8d2e6ffe943ab29c71c241bced4827
SHA1: 479546afe1f3762f1a9771ad594a050fa3ed2378
SHA256: dd6fc006d5b44ed48c5f8ee5dee5b492eed866a1548e91db378dd020975dae52
SSDeep: 12288:mH9y739x+Ut1v72c5sj5Qy5zkg4McMAIGMiovCZPSYB5Aw:ey736UTCcCj5Qy5ggURIGMiovCZPSYBV 		True
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh 582.61 KB MD5: 3ce7d780308a217a5ff811f20401b7e3
SHA1: 9d31dd268616f812f91df64ca509e42174ae0e01
SHA256: 222c33d92c357a50711e757aa462cc4a2764c079ded58d70ee89768ac521f30a
SSDeep: 12288:80ZWz2sPY8xx/bw492NXP2W8rQSMrxd9C16ASxl/u+4CbPUa77Fsu5:8ukog2YiNxI+4CbP9t 		True
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.56 KB MD5: 6f1a34b063e8338d10cc8266d9f5a370
SHA1: 12d87b4313b979038a6a89f650cf46e248d02fb9
SHA256: 42d7adc8a571328b67e120304256f79acd16c6dcfa1e1a322d32ba990d0db168
SSDeep: 48:KK8dSE5lfwMmjgjtVktfXSNvmL014w2vhe227t:v8dbTogjtVAXA+A1f7h 		True
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 2.80 KB MD5: 87d584746d13e44e03dc9ea9b32edb51
SHA1: c9ec70a66a70ed8e737519bd4119db67407284e9
SHA256: 1061aed32414d1fc1d1be8eb81ebeb97cc485f7c512f2912e5e1c7a4ad18b4c9
SSDeep: 48:1qStdFoSULqECXwRT21dDor1bQl+C9QjNh5KOEe8izEcPYr17F:w62LqtA12bDor1Ul+hNhdwcP615 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh 5.67 KB MD5: d1d78dd2f62411a2aff597e4b27e2cfc
SHA1: 2f374cd0d4e6a22e1bd2aaea050c5e26d528559e
SHA256: 56e8f0fe070ff7852b85f6cf674f030a250c263014ea8bd84ba741a999a80278
SSDeep: 96:IDD/V0q/y015eHrNdOmZ5FQ9dJ48PFWhNXtTH2FlTKzImjlh:IPtsuyrNYmZcyN9LMmZ 		True
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 4.42 KB MD5: 44eb42090084a1bc966602e2f7e35282
SHA1: a14d057f5290ad89dd70ae86936422741905ba93
SHA256: fa775d29a32c62aed448c35ccdc565ae3e5cd9cc0d1c1c77f0dfce3570b271b1
SSDeep: 96:keV8l+z790Kk6iAJPsROmRMfgXZ+df0By6Ud3ADCLNw3O0L:kaLfJOABsROmagXZ+fN3ADCxw3V 		True
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh 26.79 KB MD5: 88d01273c2056f13d57bac57544f1c1b
SHA1: 7d3197386e81438e2b916c56f465d2c9238f0e85
SHA256: ac0b3880fb2c1ceb460b9a26c4cf701f0807724f4c9d2ed501ae1ecf359a70b1
SSDeep: 768:krPDsgnW9x5McMopIbM2EOCu9BUSo4JEcmuu:kVW9nMRopI42vFn1JEzuu 		True
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh 1.05 KB MD5: d8555506f951f689c9ce913a5e9ca02e
SHA1: f6f8609bd0650554ec9ca74f8e14b6fa45a7db1d
SHA256: df3a34c75a2eab22eadd2869ed673ab93a8801112be83a52f965b735efd64f34
SSDeep: 24:6C82zZYc0FOmUswREnT2V0LvseCdxhbE56WS2QyM3eoT:dhfsDnHv0xq5E2Qx37T 		True
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 4.42 KB MD5: eb6f404c201e1873784f4e9a8ed82fad
SHA1: f55cd7cacfe7d6f2d8037a1e1818cdc70b80d947
SHA256: 43a0a570ee3e4e6e675133c8317eb457f2f860c091bc734da3c1fb7cb3b88751
SSDeep: 96:Nc/XNeRIXPTSkI5dWUVKNZXB4ZJ4gwHF5KL:NM/HI5dWnZUXwl5w 		True
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 6.51 KB MD5: 8b6bd0bb9c7dabf1c70e91bd2d6cbe83
SHA1: 56a80c753017f8cc192b5c6757da64d034d8fe50
SHA256: 17ebf33a85787ae62d82530581742225fb2f6a03e86d6d1386310d29a9d8a7d7
SSDeep: 96:cV7ZM0uYHPD3N7/zbS3Ss9cuK/MOqdSaSIJWa28c+J/KuS5FR8cwsn9VdtU5h:cV70cPTN3q59A3qdSwxc+J/RyXdtUL 		True
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 16.52 KB MD5: abb11ef437bab1173febde3915782539
SHA1: 4978dd582d51a16c052a4a9a908f362704d3b422
SHA256: 108136617fca9f8f111e2183bdf825b1e40023a6d6d19d94799a17e255d99eef
SSDeep: 384:HMJnhzYcEdfx5HAs5T46SElFsh8Hm8ijCwKLIRu8r1:inh0cyfvHHTiEQITijCLcRu8p 		True
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 16.70 KB MD5: 1bc41fd277eb7ba2f530be281bf92493
SHA1: 4ea6910bd5a5ec9ac3e2f240ee4848806e89fd01
SHA256: cdeacd97c338b17cf49a38e53a87a5c8bc5bf7491a88769f365f0e897b4365f0
SSDeep: 384:rDVEqtnS05mhWo4w9TXR+6AyNd8CxdfFjhzDPQQ:tE6XVYVvrffFtYQ 		True
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 20.33 KB MD5: 018d7e744bff1df6529ac5842fa5e3fb
SHA1: 012b472793e68b38042b66fb4fae52b3192a070a
SHA256: ac8f23d7b23b55c3355887e97f5a0e07c783fb623b4387ae02d86e4fd9c16726
SSDeep: 384:NHqMJFdiyc2cPNwkEbOYg9A9r2c1lCcpR222o+BwNW/E3pmij:NHqMJFdzc2cSpgaFPr22oF2m8 		True
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 8.76 KB MD5: 7a545094c369c49474a5152ebf225a18
SHA1: 368c63c2a4036c65fafeed3d633158a4c33a9248
SHA256: 823b1ceb6e3a9acd7ee860b446208e40319669ea2f74ea9bbb06962df28aa4f9
SSDeep: 192:We/059SoTQxRtUjND+zT8HiIf75Dfp5G4Ed97I2:DnROd+/5IDRW1r02 		True
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh 14.94 KB MD5: b514d8766ea81dbd16b83e6399e5049b
SHA1: 91ad1225131cdcfb7e2d2e109ba499c3b40d1eed
SHA256: 84ace4e0b5fa1a0a1cb2ca4fb3ab822ab89811d46f1660bdcf117f15fad995bd
SSDeep: 384:WlINV8A7bN6Ykelk20UwRQ8ld3Q9UW/MsjDZdob9qpFCqvBj:WlINJJk2a7W/McdaqpMm 		True
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh 30.60 KB MD5: f42e040e2c744a05f2bf965a9147f4a6
SHA1: ef75d06a9dbce472c4a18363cd39fa98c056fa15
SHA256: e444894fd672022e618be8388c7813a776fa1623ae765dc80986102a03ebc184
SSDeep: 768:XeVNiwhdn4Uu17nxDNErukGSQnIYas3auA1MucVUme9FnWvIYLX1e:2j4Uu17Z+MFx/aF1Vpo1e 		True
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh 1.27 KB MD5: 7f07aeadb18ba6405a7dcec5a98401b4
SHA1: 4bee1674f256a6d3f35aa07c94bc57d049cd0d8b
SHA256: fc718c5e9cd20fecc176603004f464c387e1e73095bf32d3927c91b9069e43f6
SSDeep: 24:eFIEDDIxrmDranhlbxc2274+P2uCu3p/NqDk/ENBEQZbypeoH:eFIFxWmhldS4+P2uCuFIBHbc7H 		True
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh 1.88 KB MD5: 41f901096a554368619fc6a9e11c13ac
SHA1: 3dcb4e68009da94da049dc719a9110030cd2d013
SHA256: 2c37a721eef54b3322729e97d60da99d9041578a983c0d960765bb62020ed8cb
SSDeep: 48:ZXpb2AteulhVU5E2tpYgCQf8Uf2ORBDeky27H:vbB9I5EHIEU+ODl7 		True
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh 4.42 KB MD5: f2f6584793869f11d772af3dba953b31
SHA1: c437aaa1040f2b4595db5eb423f7e5a12e50c362
SHA256: 277354983ef6843822019cf62ea7671d8b6944ff1e27e89d2b9e9cecff2a7472
SSDeep: 96:/6fjeH/J1oQjo7tE3rekLrl+d6qYGpcMO4tkqRL8ZLseL:/ijeH/J1bj8bkLrqYP34tkB 		True
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh 1.27 KB MD5: 10423f776463bf7d6ae7c4ab9cf98a3e
SHA1: 1123eea06de7d22050a2762f490871a50eb4e97e
SHA256: d5e18119d2a1c90ce8ef7b4b19a8bb8c3f32f9b401d9344628fc61bef4bc650a
SSDeep: 24:bvU7tZmTeZVI8w34393qyxHJ28m4MEKa6xMNrF2ltzW+jUZyFFeoH:bvA+JsxlG/JEKa2orUHjQYF7H 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.56 KB MD5: a4601843dc7e2c8a5b7752b7f841ec9b
SHA1: e3392419b0f5617dc95cf8170f6676d7452856ff
SHA256: 451044a715f36b2560f045bb527649a7be831771928337b5089a32670010d475
SSDeep: 24:A0h32f9BApsaB0AezHRKljZioc3ssUZ7LitMYWSpyRaeot:AbBSWAeAZioc3sZdLiCOpZ7t 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.05 KB MD5: 0cce90ab2fe7abb4cb726c2d751f115e
SHA1: 70455e809148820803d2b56b7a794b73dd061ac8
SHA256: 7b57b1c85022e83ae16442b053d1e51021e0b5f0e347d599b9e42d7ffb41efcb
SSDeep: 24:RHdfjhvX0GpZj5QWzg30eOguDzbao86A6lFFSwo3WS2wyj4neoT:RHd665Q0gv+Xj86A6lFow62wLn7T 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.80 KB MD5: 56d43958a6f7dbdf9b25cea52b98d768
SHA1: cc092d185bbcc958cf971c88ca3b978e1e595304
SHA256: 83108aa8e23e4f2b357d9f2e182970e9787c4bc037372975a8dea5a7de315398
SSDeep: 48:uPbbE2ndEbinHgVHU7hG9Zj/6jRVBG/RdDZlrYQe5jKwD2i4dPE9QsulI9pYN7F:pcmsgVHUVGjz6jRfwtlrYQvwiiIE2sHQ 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.76 KB MD5: 6c12e4676b2509d0e1c55bdb8261362a
SHA1: e51f5dc0ab2e19c6fe82abc61f26527d3d283826
SHA256: 1bf14f3d076bd98871f4e1ba4099e23a93d12f1855a9b5e3794f36e0ab85310d
SSDeep: 48:ejxbY2DCwq6vgHRN7ZbOQEoRl0MOlnUFmQpmmmp2F7r:8fqVZqEwpFWpma3 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.47 KB MD5: 1848aa0095e50c81a2d7764810fc0235
SHA1: 84699c6121279295c67167504531c4946ac59118
SHA256: 9b73586179f0d069d0d8751cde8cd04f19b3c3f0d2efb9f595abb08aada4e8e2
SSDeep: 48:EH0wI/LwxHTRko6LJGxwL5nWoF5uKiv5PvZsyulHRTqYA07F:EUwITwhCoCJGxA5nW4uDvtvqzHhqT05 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.14 KB MD5: eccc5325e15867d1dd56c0a2e829dcf7
SHA1: d4029d01290ffd6cffb4eb3b3a7fe667d7857964
SHA256: 1cf7d12e1d11f7367d552f2d516259803cb455c910a91453ce42336d8da2da32
SSDeep: 24:7/qCzF0MQ+Nf4RLteSlFMKTSDo7ifsabBjsbpzRiQP24GDEpygKFeot:mCzFWEIrlFMKTSDocTFCzRiQxDpXg7t 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh 2.13 KB MD5: 9e76696ec36651567552406d1261c31f
SHA1: a02aac4ff86748f010f3e2398663472e2bbde828
SHA256: f99fbac37641fd981dd76d12145b2e81301745699db3f2fff3189246143db3e8
SSDeep: 48:P6LJJxG28P6zmsQpwWitwW5Ooxy+cpZWrtNXG16g900zikjHuIN0y4W7v:AJJu+BQUFQCyJpsxUzBn9vj 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.65 KB MD5: 6b028371d5007262d8ade0481d13e87a
SHA1: 2ce0ccc0e5f955f53ba6982d26984fe6ae48de69
SHA256: ae0924238b809c78e1c0878d990c6cc301e4e3f88f04e51405ac451dfcc9a508
SSDeep: 24:Gt0VHuTmPoznemWe9VzfFtcQ1yOEqRBCKLbT+xCu94YM5AgK6y4Srv1DfwYyvjeW:C0VOhqqt3fE2CKLbT2CuCAT6ynx4YK7F 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh 582.61 KB MD5: 36da7abcf32422d28b1db851efeedaea
SHA1: 8c2935dde2c7fb1833b356c69c90a08ae59eec60
SHA256: eb363c74cb8643d047392bc16e6732eb26c6fd621e5e33f358479cf0988522c8
SSDeep: 12288:1li52uRD8deRNhcJUbYZPS7uUJAOLKz6yKCSLUG4Vptv818aV6tB658W:1lRud4iIdoNLKWyKQztv8yaI3dW 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh 855.24 KB MD5: 3fbc779122a22a3eaaa65047f5e4f5e1
SHA1: 97c4f1040ef7e9a5c12be1516c0fdcd6d227aede
SHA256: 3f1f34d3d4951b630785e095e8a1ff7e00b53ffdced34058d61d00930bb3c292
SSDeep: 24576:x2Chz44LFB/DmCXmVm/FB84brhciYeo6TNgwtf:x2044LFtvXmVY84bq4gwtf 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.44 KB MD5: c259a5b3432d608248af1e5178bcf158
SHA1: ec28d79165cc0550f311a17443b6fc3d0aa10e93
SHA256: 1a776aefdb99ee8d58a84daeb59837dbd06f11b9f190e07a2b332940242db600
SSDeep: 24:cecO8U/xXwlGyz/N1tl3FLSaK6JaJqAYqcckXq0T+TMPho87oTDdDe/eIpyleop:lxX4z/T/FLSCJCqFccZxPXEDdDupQ7p 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 5.67 KB MD5: 52e3d0eb903300c4b354d18347dcacae
SHA1: 14fc14a1a46d07e945f6f8e65d964be6530ab0d6
SHA256: 843067e8dee07352563d2e920b4633c7f0c9db99c4bbbf515fddd059544f6967
SSDeep: 96:KPY0b//GcXacd48Xe9+QrIpb5xV1kyWhtCrDEdUFKGsxbK4QbxpwkGxMqalwh:SBb/Xf489QEpbdCyWh0EdUFjstK4Q7wB 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.05 KB MD5: 9a0f82224c5a1616be1af366952b5107
SHA1: a404e6706ad0f69170cb95b3dbf8994777ce935b
SHA256: e9dc8c0699e7f27c9ec20932c45533e5ca34dde75cc6b2eb76527c7c4895e4fd
SSDeep: 24:TWd4KuM11688S06R15Ud2kVmcHlVTgBRM7GS2wyjeoT:TWdcnbwkVmcFpy5S2wG7T 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 37.04 KB MD5: f8076b73bd141a56941d29c8d4ef75a3
SHA1: 5f5094c03daab9a56379729acdab7637deecba4e
SHA256: 637f20f572c247fc16519d055228f43fa48794e204241169dab4c683f726aace
SSDeep: 768:HrcjaLhcQzfz2NqkeGdM30ZupNRUR23NN2gNlg:HrcmLhcQrSN2GdM3JfthNO 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.04 KB MD5: 4d326dbe625a15505b26cf306c1da336
SHA1: d5df82973aed29baad47caad90916caf3d64665f
SHA256: 9b9249c88cf684f2ce7a841026539e2c6c6f77edcfd569e43064750d334ed09d
SSDeep: 48:8Fo2ufJhJ7nSc07qDhXzZEUST/WE7RI7+4Yp7F:WufJhlnf0+Dh21T/27H05 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 69.80 KB MD5: 57ec3f547cd4cd2873ae733668caa167
SHA1: e053106b7b8dfb39ec33ff37c95dd763fda7745d
SHA256: b67f06ecef52288f512d72471aaa9425e4a3fb1ddf0f5d4b9536c81da7a544a5
SSDeep: 1536:jq9awp14DRvP2MvcFFBvFoK9pIb6T9DJVJKls8E:W46sRvPNsMK9089Dcls8E 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 65.85 KB MD5: e6fd30b421de0f75c234d380193fa8c4
SHA1: fdc0862038089ed17fbfbdf616ba60238985a7d3
SHA256: cd2dbbf63f6be804de152e3e92e12f7fddf12f53e3109149e92ffb7d11dda8cb
SSDeep: 1536:cEU4KzqskSQRxOAw0miRIN19siqtBz0u7VHU+sX/oI:cX4KFQRxON0VyEiqTgi5sX/x 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 26.79 KB MD5: bec1904ca0d9743da129314c61d991b3
SHA1: 6a95585106d5d4d9f42e62200f7d0ca1f42a6e76
SHA256: c3c82d84752917a93c6f0b72b416fe31db0bbbd9a5a90ab91e9035de64e73720
SSDeep: 768:GH7LYVao2MdS4I+nkVFnpQFMkL2z9ZT5OzSxY1ZXO:Gbaa6SZ+enpLk09F4fo 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 9.37 KB MD5: 098f430d14f8400e2f83571cf69767e8
SHA1: 9a6b358c883a1609d38feea439ad44b2efbdcd0d
SHA256: 8415f84d430c92af16dc3128969fd7697ff311b224d83014358b4d48503fbce8
SSDeep: 192:8GduUUWykk79Qv/SYFfm1mQo06grfMdR+ZEfoHtA2+COaySkL/RFyxDU:8GdunWyX79BYJOw06/ct4CTkLZFT 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.54 KB MD5: cb5721e9f1d14d787f6831adb1ebebd8
SHA1: 31281b89997e7b9ab2693f606ce7e372da42a844
SHA256: be1bf0fb417221490058b00d7566e32b4715e5c75702f66c29c4f13aedb88377
SSDeep: 48:Ldp2e+TVn2O2KWINP+AoBORKeJU4okDTCEf33I6PcdVqIAaYN7F:LzH+TV2NUdJtokDT5/bPuc5ag5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.81 KB MD5: bcc9ec22efc20f67e3cd724dbd610094
SHA1: 5f1afa794aa8f47a3e9fbcc9cd20719c285d098c
SHA256: 58740175315db73b7e11ad5cdb22d4888fcbc5b6e05243dd0247f8cf717c514d
SSDeep: 48:1OxuB3hzKtItUwhH7nSW2x3G8NJZpwf7X:ExY3kOtUy43tJuL 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.18 KB MD5: ee81381068d922dd5ac09d0e52c7b787
SHA1: 6e6094fd8df9d92995e8908b4424d48c9bf04edb
SHA256: 9df934d2d6543983be513de20da41d27642d096b71d5dd384548f42d3c4368b9
SSDeep: 48:xEYakURFRj0IEDOof9XXfZAvRVK3uUv+m8Deiu5TmgqY7n7F:SYakiFRDIOof9XvC71y+m8dwmgqC5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh 4.42 KB MD5: 0f6dffbbe19c10ed727a34aad715ce14
SHA1: 7a41027fe79c91398b60dfb336a0b39616c1338c
SHA256: afa881e281c9b1921dc0c05c2644184c7858c5284a9fc52952e92fa260c1cd4b
SSDeep: 96:OMLTIvhhqKcW6jIp0veDCqPakQFUBO7WBtVewqyvgL:OrvhhDcRIHDbzRBvBe66 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 26.54 KB MD5: 924bb4eece1dbc72784d2331536a0298
SHA1: ac6a6ebc81baa68c3ae10ff42e63646687388c1d
SHA256: 01c0b882b7b10f11b819a82303ccdbd00e46438e17c1e6018ca6178f3648dc39
SSDeep: 768:OsOCQQf3jQ0MCiCKSci3F0aSYHEo2xRVRxnV2QQnmwf:7HPjQ0sSzSYHR2xRTxV2Qamo 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.60 KB MD5: f1b2edfc9793904f1e0fb1b701247c46
SHA1: 21fc35f6704de5780a0ef980e2eb5c7741e3712f
SHA256: 9648c7d50aca1432e65426da4beb2f598d95ef7b36c54e0595b0246b6da4823f
SSDeep: 48:jrdR2ZFc5LN0fswSt2mmBK/ODS0CQyxVvH1pR7p:j5R2ZFc5LNYM2NBtDS7RxVF1 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh 860.74 KB MD5: 15ad1657ad91f8bd9da1185eccbde0eb
SHA1: a410ec500f4b5c736144a987deee8bd5f7164f31
SHA256: 47bdfc77e236149ceb5770754e431b1824174fbf57f799191fe4d0fb9cb1dedb
SSDeep: 24576:JReLKEpBvNtHV/pg+xv+tc5d6N6M1nQz/9z0p0v:bMdr/jvQ31Q7+pe 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh 848.75 KB MD5: 6eb23adde6aca840b7e2b8024f35b89d
SHA1: 54e2d658781a80f20ab07c15a62f914464fdc0cd
SHA256: 53d86505f0478d3fbbc9309a92e4167af4fe2932d1ed6db8e9065d7c29afe5da
SSDeep: 24576:jLQ+VUbQvcI3Gbb46XinLK9z+M7MzPX7RmWtQUqe:XQ+ybQkiGbhiIz+QgPLRVpqe 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 250e149f4a77e1bb292d7350125c6c0b
SHA1: 9503967f2c6594b3c77b6927809edc1d45e1369f
SHA256: e0552d8149ebdbd3fe22b423cefd94d747f459d3925cf956a9c40bd6acdcb924
SSDeep: 48:zJ/Dg4rRkjxx7nvcuAaqe5oieLCtda+3iJzKjLtpRB7V:9M4Vkjf8aqSolYdzyJiBJ 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh 6.51 KB MD5: 71d6428169c1452ccad9b4edb6208f32
SHA1: 5df93b60bd22b6f8be6ab1e78211cc66b1cbea3a
SHA256: e3dc638679a69edfadd9d3fbf17422381282a8fbebe20619a257629274bd99e9
SSDeep: 96:FJ9j+0mzyHsZY2AvedZ4skkqmrhE9t1x0V9yiIMv48Cp7tWdGqEvivbndch:DVmzyHsvs+a7mru10R4bpQBEvEdo 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 16.52 KB MD5: 62b9c9c20a7254741215fa06e5bab796
SHA1: 50431c473832a8db9c22f101c2cb17468a0ee457
SHA256: 50f3705e174ab4511ca20ef7b3b0e9b12607979f80d95bb13165dd854de70f9e
SSDeep: 384:2/Ikm8loFoxmVEmFQ6ycIq3+mD7lCMForQ2G9y:WI1hyKFQVO++Groy 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 2e5d8ef7e2a29d831596b3d0b5ecbfa8
SHA1: 4eafb9871299914e571c48160fcc6afba4fef41b
SHA256: 9be1cc2bc1a7511bc5392f0cd3d382d84c88339055dbf8cacb873f30124b7dae
SSDeep: 24:CbtEEkGoamx069c0YruQ0Mx/CAwB88xpfeX8P4oYgKZ0170snMkIjQpyAyeoX:C6Ha6Nm0YrSfp88OgKUYQppy7X 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 3.36 KB MD5: e76784e5f1a61f34bb0e2803c724bc89
SHA1: 90c9c82706225493555eb5a984c53cd390a9cd2a
SHA256: f4e923b0fc27af101aa59206d6efb6be6337190a27c097cb68447c19f177a680
SSDeep: 96:df7Pg9wS+EFVSNkajaedBl2PGDLNbIIcdcswKz0MUdjL:dEK4VKkaW8BcPGDLCPmsKx 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.55 KB MD5: 01b5bc734787b834542ce14154d4d40d
SHA1: 69fbf013679bc2220af4224ef1b5312b8e6460cd
SHA256: 95af48ff6b4f44643ff9987d97df67df3e490425640db91b84d68ea61a3ef2fe
SSDeep: 24:Hs7SM83TCK2bDt+Kp3TBJARenBm6HGISj35YBO4KUYy5TBIXMsl4KFLNv7bQyaeW:pM8jsbDhQenBS5YBO47fpBoHFpT8L7F 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 3c394dcae69f3af7cac4f8224136b244
SHA1: ae713da87e775dda55e50ec641903bd9ab446431
SHA256: 2364908eec7f62fbb714ae89fc4ed95038d6d381d4e729ac34449555d2e3da17
SSDeep: 48:7gKDt2shnYCKICFcokvZk6iXw95JPCfEeqz7F:75tYCKFFNkW0JPOEe45 		True
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 853.75 KB MD5: a2741c43719794177b557d4ae71cbbc8
SHA1: fd7e9ffdbf7cbe3975539e5b206a0c1816c67171
SHA256: aaa10c1564b2e837e32c2776bbd3f6d8ec2e48b940aa5be288ed4159f5204950
SSDeep: 24576:U3a5Zow9A+ExeOvNHdRwuHimi5a3EZntkI:Ua5vEkOvN9axw30R 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.07 KB MD5: 05ecb5032e2ec4548428cb191f8dfe2b
SHA1: 1db499c8f18261aff4a5b267ec42d67c7ad129bb
SHA256: 43675de2f03c2aff1a470351bbb11e77148263c34f8ca5b7bd4f7f78e84eebd7
SSDeep: 48:DLu67D5OKPFlywRQrwOEZrHnrZeiP86noHIhpsPvN/kN7OcYz7F:WcOKPFowWEZrH9eA1nowmPvFktlS5 		True
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh 865.24 KB MD5: 7989a32854b80401b95864dc7dfd3d39
SHA1: 7397fda8a5c257d874c69367ef1514c54fff203e
SHA256: 4890762de6cd260ca5f61f965c6af83636967be8056e81f8823f6dda48ac6b58
SSDeep: 24576:UJlz17UJy0QXblOF8a3BHs0R7/49DkGWos:s6J/Qxa3BMu7/494Gm 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 4.33 KB MD5: 9e35b4b7bdd64800861fb1f3a6c257e7
SHA1: 291e19a8bfb88de95e79e6f9ab9b5258a5dde849
SHA256: 513528656ca41b22d39a27bd37f8fd98dc2088ffde1c4b534a62f1ecaeb6228e
SSDeep: 96:DQ7YsiqIw+h2J1YNqLakOZmDpw6UXueNJySCKBQg14fdOFUB6Brezx5:D4rjb7xDpud/9FCfO86Br4 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 7ffe53fa9da8fb54caddab0f6f606871
SHA1: e1000a7edf3f965dae53948f7a1ab2ade6595350
SHA256: 278ddf632ae615bfcba1e11be26ac544dfefd06bd81776206854b793be034bb2
SSDeep: 48:Q+WLs4H9y29fILggoRJ8FeewEeAu9W4s9Dwo+S7F:hP4d1QcJiiEv4FYDPR5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.07 KB MD5: 39adb6a374ad97797d5f876c85725a36
SHA1: cf5c0f3c7614a01ae4f371539e625fb0e0049e2c
SHA256: 8af041d9ad9e0197b02def12e4d7b1729c864c6af7329d9f2d495b722d6d649f
SSDeep: 48:noujXqf6JAt81Wqe4E9KHGV0Bpi+5f1YZ7F:zIBov9lA+5f1k5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.03 KB MD5: 822d6ffb94e8b3311c4eb71193a429e8
SHA1: fe525d7104dfb58801579eac2e4319610bdbe453
SHA256: 6d2d8a95380817670737bea798208061f658b95904e015816340483c4d1aee8a
SSDeep: 24:Kx3nAbkKugaCN+3DPJOp9oEdmaoOgv4W0EAuGF3qnyA4Teor:KukKY6+3DPJOkI2v8EAUnZ27r 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.66 KB MD5: 399fec3358286e8eb981837cbe4ebf46
SHA1: 4343fc3dfaf27259448d59247f6086d706ee4705
SHA256: 0b0c27640a1fc0e1db10c23407243b58469777b01bf6784e3219512ca1ef42dd
SSDeep: 48:EzVVPwpIj0/PkZDxlBLLgVzEoE6TI/oSp+47T:wVMZPk5xXLgOo1I/oyf 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.80 KB MD5: cc4eb5914c5f3613a4c11da6269e8f60
SHA1: 9106edcdadbdf17542188c4b2a85dd7b277a0cca
SHA256: 0c25db7e2724493e9673d7fab338666d34d1eb94f925ec29f27e08c5d095b73b
SSDeep: 48:qN2/x1KXTLzlQz0yI5yxhmgcwH3oMr1fN/WYBE7F:qN2/x1KvBQzvG6dcOZxN/Wr5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 30.60 KB MD5: a0ce0fbb48a4df4423638ff6282076e1
SHA1: d95889e221d2fa797a219842ba2e0f233e244d56
SHA256: 484c88d497983645f9f3d73ac2cdbb1f0b5672aaf649849c7a0a3e85a98ea415
SSDeep: 768:+nf8P3Q21Vn4B8tWHPJys3HD61MxJAaqDCWQxTDd:+nf8/X1B4B8tiyCjnJAaG7MN 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 5.97 KB MD5: 431378b54938c0658265b6948806c249
SHA1: 875eb96a157307d9f2adc9a0b287f0f17903c5ea
SHA256: 740494bf3ad98bd2b6880d9840c0d27376f1b410f2d0092ddb70dd049e376dc8
SSDeep: 96:wiOdi+IfoVqnIjh3IiydTMboEuqYFj6r/aOMPH3g2wIsHPrnwmJP4nWuAF56/13C:wiFdngBIztMrbYFO/aOC3g2wJTnj/F5Z 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh 16.70 KB MD5: 6dc8970659d8e3efca8fc899b9380251
SHA1: 2b99b28bb72e8a118bc3e598c05e9010d3464375
SHA256: 99f4410cc99c9ca3a8f7ae4fde58cbf5484e379baefa837078ab70354064e096
SSDeep: 384:y03eowzNTXw3yyrwVb+rNC39Jiv3dDPCUHzdcmuEXe42:5IG3yyrwh+ro83dxhKge42 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh 8.76 KB MD5: 32daa87a61ba69df189849a51bc7693b
SHA1: d3e240b972a8fa8669fff893e19451aab982872d
SHA256: 20b4069e9a29c272922b4c86bda57a2dde03c11356bcde0da49bbeb4a1e13740
SSDeep: 192:jpl7QV3j9MTJ+fTgwaCyZbcnKE3eqt1cdgvhdIs70s3OOtXQItA:juMTJ+Mwav4KEdCdMhdgPOtXQItA 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.60 KB MD5: e164dfedbe6b9d400d23078afc014759
SHA1: 36eeea3234b0090f3598b32a1d7298353df381bf
SHA256: a03e10d636b544652dda62b120a964319142cfce0a9106d4b979a1570eefe6ce
SSDeep: 48:bmsuH04KauH6mkmHQL3boqVNm9nbNcl0hBTop25YexRRpVjL33YcaE7F:qBU4RmkmStmFNY07J5YeD1ncE5 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh 20.33 KB MD5: 6b18b54221b5a6bced60f0ce8b9d9614
SHA1: d6bb1bfc8140493ae485f89d28663cd01f398539
SHA256: 25b9d1c3b7cf81f486ad1767ee96430d193d9c46485be945915964c61ac3cc16
SSDeep: 384:iEqPYsGK7PNttMhnQLvw0rum5LsrfXYqg27T26ygtsT36qRous6uf2:ZqAsGKJMhnkvwvmybzgA25q6Touge 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 1.99 KB MD5: d3cd2ceae63535914c1e3c419f3b12fb
SHA1: 95d9e3d80f680b48b7dba79b90f1c8cc1a18158b
SHA256: 03098385ed0c2034ebcf50e142e07c40efcdfb5fa3d7f226fd71c5be90e56179
SSDeep: 48:tC6Gwdnl2JBSwn3OIPwBpAqr8sT/tEKZa24RH/t+pS7B:3l2JBr3OxpASbb2xN 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh 8.94 KB MD5: dd8652df0f90f1bcfe4abb5578ed8dbf
SHA1: 86b2fe0db9713282255c900416324a132bb0e550
SHA256: 29e6bda8e77a198bbbc73f2b7dd3f9a0a0f5571e294fcc7a83ef69057e7ca461
SSDeep: 192:LG9esN/l9HMk+e2xGjWe0QIW+tWQ7x3gS8QXBw37yM2mXrmPG:LU/GbGj10QI9WagnQxM7yMHXS+ 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.04 KB MD5: be8aebb2d147ff48d2f7f215cd274cdb
SHA1: b4c402837fb1c20c8b2e910cdd1795b67504e694
SHA256: 7328608b7c4abcff0da97c4202cbadf73a6a4555cfacaef6e6c238cd872a9a5a
SSDeep: 48:dyy54LEJJX9ouNURc5tLgltFgGVTX0zVIQ7F:dyy54L21NKAa1gGW5d5 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh 38.34 KB MD5: 3121f0bb8cf7ac63973384bbe411b352
SHA1: f5fd0d2076430e6d122756e3049f11d0eed61347
SHA256: 6a039ce1892d1c10c72bc49a202c93f0932dd19a12fcc4b3ea92e4495939dec1
SSDeep: 768:TNL5mSO8/n64PEJN7FhF5BudunR48lW2fNMHtLNmPZuh01PJD/UFO7p:95mtj7FhjnR4wfwtLNmBKiKFOV 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh 11.43 KB MD5: 4c7a289e2ffad2f0a7de3484d2f362ab
SHA1: 07e59fdfa436b94b91c774bea76ba07f48a3ac91
SHA256: e38a4cd6687d0c6eec552de0312f0b50091bd2ee2d2e8c53c4b7b302308e840f
SSDeep: 192:dbj24JPaVH9An+KQwVMeihkHiNmsnPas+TLc+Ld/yqLx7MUfHUd4LBrR6SL:Jj2uWC+3heimC+cm/yqLx7MU84RHL 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh 8.60 KB MD5: 2e776cbc430c959f52da06b63caf90ef
SHA1: 4e0df10685554fe598e42b82b9b9134b2422cc2f
SHA256: 59b15781caf1ec4761cc0795e28d6aca02f427e5ff45097e3b01b6384056268f
SSDeep: 192:KKHGFZMQJ08tYpcY8fP1qlqUiSKKOtAn+p/89AgJcNJ22+KA:KKHG75tYpcxP0DKKf+K9NgQ 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh 222.21 KB MD5: e8586a3123dfb0ef94f82ced15293b15
SHA1: cd1b52e1b9595f2aa335b379db0739ef97a1ffbf
SHA256: 697c476c979e636c93ae68ce471820cd2e10f96c5167ff74b6d42f00edc0bbcb
SSDeep: 6144:hM6TH9rAJ52IU5tOqTkaHwjj06Ywx+3ubB6ufS:hMmdcJF7qTkaHwf0rReN6ufS 		True
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh 9.51 KB MD5: b13c968fe1479a527ad24686ee75465c
SHA1: 67add21708c37b6ebf6cfae7f4aaf8c6c874353d
SHA256: 8e9780807647af177390ad534abff04d6e91d9fbee2cfd5e786843a45cc56314
SSDeep: 192:4dEPiaXW6uCQhAU+a8NG21SudNlWLtDHkZD48g6Iy0mgv:47aXWWwAU+a8E2hnWBDHkbrQv 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh 2.85 KB MD5: 2697b6b4a4de35809881eac3381bbfaf
SHA1: 2f4d60fd437358d8fa6f71202ccd7f4b81568dd2
SHA256: 271b217d2d32e829f8fa4224fc8f0c2ea2f44715c79f06525d7c211f53e24d0d
SSDeep: 48:l/2SGt0kQk3OQTtxTT9hO3636CY7hD9cFQWvfRqvA5a2vIAgx76IV77v:l/8cktXPDY67Yd4fqvcg/j 		True
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh 1.13 MB MD5: 9f3185ead4c1cb944fe7c922b8e20283
SHA1: 00d10c00b265a4635410ac838357f008ff633238
SHA256: adee49dac519697ea5d1ab5856b9c111bfc581c8c26f1a9b506cefab85ef466a
SSDeep: 24576:OXexiINwGxYfkZzDx4Kpb4ukcw9VpkKHfQGosjuo:IKxYsZVR4NHBYmP 		True
...
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh 378 bytes MD5: 6a043bbdf4457fedfa49467fd0d387d4
SHA1: 004d8f0151b5fd90b1125050c9fc98d31e7d106c
SHA256: 44af49d9b71188ac8c0e5cdafa85225d6d7f73fa4df543921346007f8ebdaa6d
SSDeep: 6:Bm0LOJvj1c+SI5s6WCiUyaZD6YisVbUpu275iB:wzhcDk1yaZDqsVbUpP5iB 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 16.94 MB MD5: 2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 3.14 MB MD5: c4dfabdfc43665ddd61217b2ec822620
SHA1: d851ce0d88417c77a3514e2b8c2a02ae1398bece
SHA256: 7448dbfe6a40133de18e6bb89c8b76935041bdcdd2b3f474c4dbe4d3664fb93c
SSDeep: 49152:zDxL8QBo0Tex4S120ytJyrvzYoT6874hHVO:zR89t1QIlsH4 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 3.14 MB MD5: 532b9761f6153639179d987c746de5d7
SHA1: 763ca17072638a5589bf029abed76a10f43bc860
SHA256: 4ae97fc7d95c1005a0a302c819b46d29eaee2629a37399930c4ceb4206ee0e1f
SSDeep: 49152:zDxL8QBo6Tex4S120ytJyNwSvgs25XdC3ZoSToWXX:zR89j1llnWXCowoOX 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 67.85 MB MD5: 6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 3.15 MB MD5: 8189358a89bd2e27ec4e20ca8e69f3ac
SHA1: 8786f8cb6194516e05218e6ce3e1d434cbaf41b1
SHA256: ffcd7aa125ad2151d1fd4a2cb112ccbc0f95b2620a9d31ddb66619192a3dc5c2
SSDeep: 49152:zDxL8QBonTex4S120ytJyINVNfv4xo/H+qUZxQ:zR89K1uVNfQo/HLUZxQ 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 10.25 MB MD5: 91b6a024fb0a49196044309d3308ba19
SHA1: 2b1f2ea3ff6382fbb5a15bfe0cd5492f4332cffb
SHA256: 68b4a1876b8fb4a05d62f4781b37bd322443600ab239773c2790d7c0f980399f
SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+Fx1:MUvTiNhU4L7tZiTnprP0txRsT1 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 14.88 MB MD5: 0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35
SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 3.48 MB MD5: c9d53821b87f71c45e6a33a4a39589c7
SHA1: 3be8fc59677f39ad9c0191daceeccabd9275f7d3
SHA256: f732efca2e4768b67e403defc83599d5734e6eafcc78dd1f00b370e6949a9019
SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6RjCo9C2e0wALZyn9r7Od5xIa:fqLVW6v99CylK9rKd5xIa 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 42.53 MB MD5: 4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh 11.70 MB MD5: 052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d
SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021
SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh 3.16 MB MD5: e4b7c6986f435ecb20414ab436d6862f
SHA1: 78db27caa954a265f97fc1c1db650c403a82d8a6
SHA256: dc904166cd86152417b1ad207c783a9385d0f559a5893ae449b0e0dcfb43d29f
SSDeep: 49152:zDxL8QBoSTex4S120ytJycSkCP1JfXsG5Bq:zR89r1ESkC9Jfs 		False
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh 2.35 MB MD5: a6d16d93afa24e626217d262f995b799
SHA1: 25ae879ffc34b9c16d33498cc26dae2ade586478
SHA256: 02a1fe83adbfe2a86390106b9ff13df79e0f1fa3cb495380c06730b6ba4fc81b
SSDeep: 49152:R0opH/cgHa3HRxz+4gDYpsoBbNzVjMhB7jpE/WvU:R0op1Har+MjzV46/v 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh 13.76 MB MD5: 42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163
SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455
SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh 20.84 MB MD5: 3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0
SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f
SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS 		False
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 3.54 MB MD5: 4f53ff74aafdb4425312ef71911a5c9c
SHA1: d50d94f1cbf5c9c583c01bd4887ff60bb937dff4
SHA256: 13fa32b69aad5e02c3e49fbfcc0f828641e6e7832abe573aee42efb33290ed12
SSDeep: 98304:zDMUwxyODPFhbY12HLodiF4+5rifL8Qdgif:z4UwVthio4/pP 		False
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh 18.75 MB MD5: 06e69471c0bb81eb102e539f0a04490d
SHA1: e0e8dbed58bcba38c03ab546d7753d1f973df44f
SHA256: b53484f0eccebe76bbdf0262097d8f747d5a05d0e569a544452eb328aada91bc
SSDeep: 196608:iaDH9F7/iHXDI2CPKBUq6qMuGm9vqExoi93nnedBwzSlmKwDhANZbPhn:DDdFDX2J5uuGyCfi9uIQmlANRh 		False
...
Host Behavior
File (5931)
»
Operation Filename Additional Information Success Count Logfile
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\en-US\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\en-US\memtest.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\en-US\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\es-ES\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\fi-FI\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\fi-FI\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\Fonts\chs_boot.ttf desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create \??\C:\Boot\Fonts\wgl4_boot.ttf desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\fr-FR\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\hu-HU\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\it-IT\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\ja-JP\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\ko-KR\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\memtest.exe desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\nb-NO\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\nl-NL\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\pl-PL\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\pt-BR\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\pt-PT\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\ru-RU\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\sv-SE\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\sv-SE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\tr-TR\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\tr-TR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\zh-CN\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\zh-CN\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\zh-HK\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\zh-HK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Boot\zh-TW\bootmgr.exe.mui desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\zh-TW\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\bootmgr desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\hiberfil.sys desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \??\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML desired_access = FILE_READ_ATTRIBUTES, SYNCHRONIZE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Read C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini size = 1048560, size_out = 129 True 1
Fn
Data
Read C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini size = 1048560, size_out = 0 True 1
Fn
Read C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini size = 1048560, size_out = 645 True 1
Fn
Data
Read C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini size = 1048560, size_out = 0 True 1
Fn
Read C:\Program Files\desktop.ini size = 1048560, size_out = 174 True 1
Fn
Read C:\Program Files\desktop.ini size = 1048560, size_out = 0 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh size = 15072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh size = 1072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 1696 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1072 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 832 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 2640 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 2304 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 786688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh size = 1952 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 596352 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 5568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 832 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 37696 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM size = 1856 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM size = 71248 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM size = 226 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 67200 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 9360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 26944 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1392 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 27200 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 2368 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1616 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 2000 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 4288 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 242 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 246 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 6432 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 16688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 3200 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 4208 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 816 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1616 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 31104 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 2
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 5888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 16864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 240 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 8736 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML size = 2432 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 20592 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1808 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 8928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 1856 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh size = 39024 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh size = 11472 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 8576 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh size = 227312 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 9504 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 2688 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh size = 134864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh size = 656 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf size = 6256 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1584 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 25248 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 34928 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2192 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 20640 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1936 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 27408 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3488 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 33024 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2736 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 43280 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 960 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 31840 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2048 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 29936 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1376 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 19792 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 20384 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 20576 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 1296 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3968 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 33280 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2992 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 28608 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1296 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 26416 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 32416 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1360 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 32448 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 655888 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG size = 519600 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2560 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 25120 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 18832 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 60736 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5136 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5184 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1248 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 18416 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3600 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 33568 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 2480 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 19488 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1392 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 48128 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG size = 1664 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2576 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 37456 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1600 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 44864 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 21760 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG size = 1376 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1440 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 37120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 11584 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1424 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 15744 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3984 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 19568 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 53120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1344 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 16752 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3616 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 34176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 47968 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG size = 2608 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1024 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 27184 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 2
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 31984 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2528 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 19536 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1744 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 944 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 18384 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 29312 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2672 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 42464 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1584 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 21824 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 33488 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 44304 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 30176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 334432 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 329104 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 109728 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 58032 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 123968 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 416928 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 945008 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 72032 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[restdoc@protonmail.com].zoh size = 169648 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\System\ado\adovbs.inc size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[restdoc@protonmail.com].zoh size = 720 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[restdoc@protonmail.com].zoh size = 252 True 1
Fn
Write C:\Program Files\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh size = 176 True 1
Fn
Write C:\Program Files\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png size = 786694 True 1
Fn
Write C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png size = 262144 True 3
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL size = 262144 True 3
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 99152 True 1
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 64112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[restdoc@protonmail.com].zoh size = 2560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 543312 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 629680 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh size = 576 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh size = 254 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh size = 176320 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7664 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 31120 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll size = 994192 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 17264 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 321408 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 38784 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[restdoc@protonmail.com].zoh size = 6816 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 323952 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 712608 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 264112 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[restdoc@protonmail.com].zoh size = 606064 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 438192 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 30960 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 32160 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 39520 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 34080 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 241040 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[restdoc@protonmail.com].zoh size = 1920 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[restdoc@protonmail.com].zoh size = 1392 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[restdoc@protonmail.com].zoh size = 224 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 73088 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 29792 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 14880 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 6688 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 28976 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 18752 True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 11904 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 512 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 12704 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3488 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7696 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 12496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 10608 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 15312 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5328 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4960 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 8112 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2608 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7584 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 13264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 8592 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 6992 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9264 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4400 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3392 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3968 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3040 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4736 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5696 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 20592 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5376 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3136 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 320400 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 209440 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 280464 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 228 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 10848 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 14432 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7088 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3360 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1600 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7984 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 302992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1840 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 430096 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786692 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 198064 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 52672 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 26336 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 20960 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2768 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7376 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 27872 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7552 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 862624 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 6640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9248 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2352 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 6064 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3760 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 55696 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 250 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 419248 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 339872 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 252 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL size = 154464 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3424 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786690 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 6640 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4624 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3152 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7680 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7808 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7808 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2032 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5840 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4304 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4816 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 8496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 2112 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5008 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3360 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5008 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4880 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 26896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 28960 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 11648 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 22528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 16192 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 17248 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 26752 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4928 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4080 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 16688 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 24784 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 48000 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 40208 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 16128 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 24336 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 41872 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 744896 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 11664 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 43424 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 1012656 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 230 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 342976 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 105360 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 238 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 15808 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL size = 442288 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 900000 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 451488 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 14544 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7968 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 47792 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 20560 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 13520 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 55760 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 691632 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 297376 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 537520 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 20464 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 12992 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 385376 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9712 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 8784 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 14496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786690 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 11072 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 12528 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9824 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 502176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 15744 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 896 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 10160 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1472 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 20192 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1520 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4000 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 8080 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 9312 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 318384 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 518992 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 786682 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 18320 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 14448 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1552 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4720 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1744 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 7872 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 1712 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 786690 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL size = 4032 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 12496 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 157040 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 204176 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 71040 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 138624 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 234 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786688 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 473968 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786682 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5760 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 5280 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll size = 2560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 786688 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 56160 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 232 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 1048560 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 705408 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh size = 262144 True 3
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 121184 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3024 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 3792 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 4176 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 816 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB size = 149920 True 1
Fn
Write C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB size = 232 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 13104 True 1
Fn
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh size = 236 True 1
Fn
Delete C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml - True 1
Fn
For performance reasons, the remaining 4198 entries are omitted.
The remaining entries can be found in glog.xml.
Process (1152)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 1137
Fn
Enumerate Processes - - False 15
Fn
Module (255)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Load advapi32.dll base_address = 0x74d40000 True 1
Fn
Load user32.dll base_address = 0x74f40000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Load ntdll.dll base_address = 0x77130000 True 1
Fn
Load mpr.dll base_address = 0x74a90000 True 1
Fn
Load ws2_32.dll base_address = 0x75bc0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 22
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\rruzcj.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rruzcj.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x76c31b18 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x76c4b6e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x76c3424c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x76c35151 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x76c34220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x76c4d5cd True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x76c33e8e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x76c3111e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x76c34173 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x76c341f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x76c4d4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x76c4c860 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x76cb415b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x76c4195c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x76c33c5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x76c35a96 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x76c35a7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x74d54304 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x74d5431c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x74d41e3a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x74d4b466 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x74f590d3 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x7714fda0 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74a92dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74a92f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74a93058 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x75bc3ab2 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x75bc3eb8 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x75bc6f01 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x75bc6b0e True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x75bc6bdd True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x75bc3918 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x75bc2d57 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x75bc2d57 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x75bc2d8b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x76c4d650 True 10
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\rruzcj.exe, protection = PAGE_READWRITE False 106
Fn
Service (84)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (1419)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 693
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 18
Fn
Get Time type = System Time, time = 2019-06-09 09:41:42 (UTC) True 1
Fn
Get Time type = Ticks, time = 100090 True 1
Fn
Get Time type = Performance Ctr, time = 15012144872 True 1
Fn
Get Time type = Performance Ctr, time = 15199603787 True 1
Fn
Get Time type = Ticks, time = 101775 True 3
Fn
Get Time type = Ticks, time = 102336 True 2
Fn
Get Time type = Ticks, time = 102445 True 2
Fn
Get Time type = Ticks, time = 102617 True 2
Fn
Get Time type = Ticks, time = 102976 True 2
Fn
Get Time type = Ticks, time = 103381 True 4
Fn
Get Time type = Ticks, time = 103912 True 2
Fn
Get Time type = Ticks, time = 104583 True 4
Fn
Get Time type = Ticks, time = 104926 True 2
Fn
Get Time type = Ticks, time = 105581 True 2
Fn
Get Time type = Ticks, time = 105893 True 4
Fn
Get Time type = Ticks, time = 106143 True 2
Fn
Get Time type = Ticks, time = 106455 True 2
Fn
Get Time type = Ticks, time = 106611 True 2
Fn
Get Time type = Ticks, time = 107001 True 4
Fn
Get Time type = Ticks, time = 107188 True 2
Fn
Get Time type = Ticks, time = 107500 True 2
Fn
Get Time type = Ticks, time = 107905 True 2
Fn
Get Time type = Ticks, time = 108202 True 4
Fn
Get Time type = Ticks, time = 108342 True 2
Fn
Get Time type = Ticks, time = 108467 True 2
Fn
Get Time type = Ticks, time = 108685 True 2
Fn
Get Time type = Ticks, time = 108873 True 2
Fn
Get Time type = Ticks, time = 109138 True 2
Fn
Get Time type = Ticks, time = 109356 True 4
Fn
Get Time type = Ticks, time = 109684 True 2
Fn
Get Time type = Ticks, time = 110105 True 2
Fn
Get Time type = Ticks, time = 110557 True 4
Fn
Get Time type = Ticks, time = 110979 True 2
Fn
Get Time type = Ticks, time = 111135 True 2
Fn
Get Time type = Ticks, time = 111478 True 2
Fn
Get Time type = Ticks, time = 111837 True 4
Fn
Get Time type = Ticks, time = 112086 True 2
Fn
Get Time type = Ticks, time = 112367 True 2
Fn
Get Time type = Ticks, time = 112741 True 2
Fn
Get Time type = Ticks, time = 112991 True 4
Fn
Get Time type = Ticks, time = 113209 True 2
Fn
Get Time type = Ticks, time = 113833 True 2
Fn
Get Time type = Ticks, time = 114208 True 4
Fn
Get Time type = Ticks, time = 114504 True 2
Fn
Get Time type = Ticks, time = 115144 True 2
Fn
Get Time type = Ticks, time = 115253 True 4
Fn
Get Time type = Ticks, time = 115378 True 2
Fn
Get Time type = Ticks, time = 115690 True 2
Fn
Get Time type = Ticks, time = 116111 True 2
Fn
Get Time type = Ticks, time = 116454 True 4
Fn
Get Time type = Ticks, time = 116844 True 2
Fn
Get Time type = Ticks, time = 117109 True 2
Fn
Get Time type = Ticks, time = 117375 True 2
Fn
Get Time type = Ticks, time = 117749 True 4
Fn
Get Time type = Ticks, time = 118092 True 2
Fn
Get Time type = Ticks, time = 118279 True 2
Fn
Get Time type = Ticks, time = 118451 True 2
Fn
Get Time type = Ticks, time = 118794 True 4
Fn
Get Time type = Ticks, time = 118981 True 2
Fn
Get Time type = Ticks, time = 119325 True 2
Fn
Get Time type = Ticks, time = 119605 True 2
Fn
Get Time type = Ticks, time = 119839 True 4
Fn
Get Time type = Ticks, time = 120042 True 2
Fn
Get Time type = Ticks, time = 120385 True 2
Fn
Get Time type = Ticks, time = 121134 True 4
Fn
Get Time type = Ticks, time = 121415 True 2
Fn
Get Time type = Ticks, time = 121805 True 2
Fn
Get Time type = Ticks, time = 122008 True 2
Fn
Get Time type = Ticks, time = 122413 True 4
Fn
Get Time type = Ticks, time = 122538 True 2
Fn
Get Time type = Ticks, time = 122694 True 2
Fn
Get Time type = Ticks, time = 122928 True 2
Fn
Get Time type = Ticks, time = 123833 True 4
Fn
Get Time type = Ticks, time = 124051 True 2
Fn
Get Time type = Ticks, time = 124176 True 2
Fn
Get Time type = Ticks, time = 124363 True 2
Fn
Get Time type = Ticks, time = 124395 True 2
Fn
Get Time type = Ticks, time = 124566 True 2
Fn
Get Time type = Ticks, time = 125346 True 4
Fn
Get Time type = Ticks, time = 125736 True 2
Fn
Get Time type = Ticks, time = 125908 True 2
Fn
Get Time type = Ticks, time = 126204 True 2
Fn
Get Time type = Ticks, time = 126563 True 4
Fn
Get Time type = Ticks, time = 126672 True 2
Fn
Get Time type = Ticks, time = 126782 True 2
Fn
Get Time type = Ticks, time = 126953 True 2
Fn
Get Time type = Ticks, time = 127780 True 4
Fn
Get Time type = Ticks, time = 128170 True 1
Fn
Get Time type = Ticks, time = 128186 True 1
Fn
Get Time type = Ticks, time = 128342 True 2
Fn
Get Time type = Ticks, time = 128856 True 4
Fn
Get Time type = Ticks, time = 129215 True 2
Fn
Get Time type = Ticks, time = 129356 True 2
Fn
Get Time type = Ticks, time = 129605 True 2
Fn
Get Time type = Ticks, time = 129824 True 1
Fn
Get Time type = Ticks, time = 129839 True 1
Fn
Get Time type = Ticks, time = 130354 True 4
Fn
Get Time type = Ticks, time = 131040 True 2
Fn
Get Time type = Ticks, time = 131337 True 2
Fn
Get Time type = Ticks, time = 131446 True 4
Fn
Get Time type = Ticks, time = 131836 True 1
Fn
Get Time type = Ticks, time = 131852 True 1
Fn
Get Time type = Ticks, time = 132242 True 2
Fn
Get Time type = Ticks, time = 132554 True 2
Fn
Get Time type = Ticks, time = 132569 True 2
Fn
Get Time type = Ticks, time = 133412 True 2
Fn
Get Time type = Ticks, time = 133552 True 2
Fn
Get Time type = Ticks, time = 133739 True 4
Fn
Get Time type = Ticks, time = 133958 True 2
Fn
Get Time type = Ticks, time = 134894 True 4
Fn
Get Time type = Ticks, time = 135018 True 2
Fn
Get Time type = Ticks, time = 135174 True 2
Fn
Get Time type = Ticks, time = 135299 True 2
Fn
Get Time type = Ticks, time = 135830 True 2
Fn
Get Time type = Ticks, time = 135939 True 4
Fn
Get Time type = Ticks, time = 136048 True 2
Fn
Get Time type = Ticks, time = 136625 True 2
Fn
Get Time type = Ticks, time = 136781 True 2
Fn
Get Time type = Ticks, time = 136984 True 4
Fn
Get Time type = Ticks, time = 137483 True 2
Fn
Get Time type = Ticks, time = 138170 True 4
Fn
Get Time type = Ticks, time = 138560 True 2
Fn
Get Time type = Ticks, time = 138903 True 2
Fn
Get Time type = Ticks, time = 139090 True 2
Fn
Get Time type = Ticks, time = 139246 True 4
Fn
Get Time type = Ticks, time = 139386 True 2
Fn
Get Time type = Ticks, time = 139667 True 2
Fn
Get Time type = Ticks, time = 139854 True 2
Fn
Get Time type = Ticks, time = 140088 True 2
Fn
Get Time type = Ticks, time = 140650 True 4
Fn
Get Time type = Ticks, time = 141087 True 1
Fn
Get Time type = Ticks, time = 141180 True 1
Fn
Get Time type = Ticks, time = 141290 True 2
Fn
Get Time type = Ticks, time = 141492 True 2
Fn
Get Time type = Ticks, time = 141602 True 2
Fn
Get Time type = Ticks, time = 141836 True 2
Fn
Get Time type = Ticks, time = 141851 True 2
Fn
Get Time type = Ticks, time = 142210 True 2
Fn
Get Time type = Ticks, time = 142662 True 2
Fn
Get Time type = Ticks, time = 142787 True 2
Fn
Get Time type = Ticks, time = 143333 True 4
Fn
Get Time type = Ticks, time = 143442 True 2
Fn
Get Time type = Ticks, time = 143552 True 2
Fn
Get Time type = Ticks, time = 143723 True 2
Fn
Get Time type = Ticks, time = 144098 True 2
Fn
Get Time type = Ticks, time = 144222 True 2
Fn
Get Time type = Ticks, time = 144378 True 4
Fn
Get Time type = Ticks, time = 144893 True 2
Fn
Get Time type = Ticks, time = 145034 True 2
Fn
Get Time type = Ticks, time = 145143 True 2
Fn
Get Time type = Ticks, time = 145486 True 4
Fn
Get Time type = Ticks, time = 145892 True 2
Fn
Get Time type = Ticks, time = 146219 True 2
Fn
Get Time type = Ticks, time = 146640 True 4
Fn
Get Time type = Ticks, time = 146906 True 2
Fn
Get Time type = Ticks, time = 147186 True 2
Fn
Get Time type = Ticks, time = 147389 True 2
Fn
Get Time type = Ticks, time = 147498 True 2
Fn
Get Time type = Ticks, time = 148310 True 4
Fn
Get Time type = Ticks, time = 148466 True 2
Fn
Get Time type = Ticks, time = 148606 True 2
Fn
Get Time type = Ticks, time = 149277 True 2
Fn
Get Time type = Ticks, time = 149620 True 2
Fn
Get Time type = Ticks, time = 149636 True 2
Fn
Get Time type = Ticks, time = 149838 True 2
Fn
Get Time type = Ticks, time = 150634 True 3
Fn
Get Time type = Ticks, time = 150993 True 1
Fn
Get Time type = Ticks, time = 151024 True 2
Fn
Get Time type = Ticks, time = 151133 True 1
Fn
Get Time type = Ticks, time = 151258 True 1
Fn
Get Time type = Ticks, time = 151320 True 1
Fn
Get Time type = Ticks, time = 151383 True 1
Fn
Get Time type = Ticks, time = 151632 True 1
Fn
Get Time type = Ticks, time = 151710 True 1
Fn
Get Time type = Ticks, time = 151788 True 2
Fn
Get Time type = Ticks, time = 152069 True 2
Fn
Get Time type = Ticks, time = 152100 True 1
Fn
Get Time type = Ticks, time = 152584 True 2
Fn
Get Time type = Ticks, time = 152771 True 2
Fn
Get Time type = Ticks, time = 153036 True 2
Fn
Get Time type = Ticks, time = 153052 True 1
Fn
Get Time type = Ticks, time = 153224 True 3
Fn
Get Time type = Ticks, time = 153442 True 2
Fn
Get Time type = Ticks, time = 153848 True 2
Fn
Get Time type = Ticks, time = 154425 True 2
Fn
Get Time type = Ticks, time = 154440 True 2
Fn
Get Time type = Ticks, time = 154690 True 1
Fn
Get Time type = Ticks, time = 154752 True 1
Fn
Get Time type = Ticks, time = 154830 True 1
Fn
Get Time type = Ticks, time = 154908 True 1
Fn
Get Time type = Ticks, time = 155049 True 1
Fn
Get Time type = Ticks, time = 155579 True 2
Fn
Get Time type = Ticks, time = 155642 True 2
Fn
Get Time type = Ticks, time = 155688 True 1
Fn
Get Time type = Ticks, time = 155891 True 1
Fn
Get Time type = Ticks, time = 155907 True 1
Fn
Get Time type = Ticks, time = 156079 True 1
Fn
Get Time type = Ticks, time = 156157 True 1
Fn
Get Time type = Ticks, time = 156359 True 1
Fn
Get Time type = Ticks, time = 156547 True 2
Fn
Get Time type = Ticks, time = 156890 True 4
Fn
Get Time type = Ticks, time = 157124 True 2
Fn
Get Time type = Ticks, time = 157327 True 2
Fn
Get Time type = Ticks, time = 157467 True 2
Fn
Get Time type = Ticks, time = 157717 True 2
Fn
Get Time type = Ticks, time = 157888 True 2
Fn
Get Time type = Ticks, time = 158029 True 4
Fn
Get Time type = Ticks, time = 158200 True 2
Fn
Get Time type = Ticks, time = 158356 True 2
Fn
Get Time type = Ticks, time = 158621 True 2
Fn
Get Time type = Ticks, time = 158809 True 2
Fn
Get Time type = Ticks, time = 159074 True 4
Fn
Get Time type = Ticks, time = 159464 True 2
Fn
Get Time type = Ticks, time = 159776 True 2
Fn
Get Time type = Ticks, time = 159979 True 2
Fn
Get Time type = Ticks, time = 160150 True 4
Fn
Get Time type = Ticks, time = 160306 True 2
Fn
Get Time type = Ticks, time = 160696 True 1
Fn
Get Time type = Ticks, time = 160712 True 1
Fn
Get Time type = Ticks, time = 160821 True 1
Fn
Get Time type = Ticks, time = 160946 True 1
Fn
Get Time type = Ticks, time = 160961 True 1
Fn
Get Time type = Ticks, time = 161195 True 2
Fn
Get Time type = Ticks, time = 161227 True 2
Fn
Get Time type = Ticks, time = 161507 True 1
Fn
Get Time type = Ticks, time = 161539 True 1
Fn
Get Time type = Ticks, time = 161663 True 2
Fn
Get Time type = Ticks, time = 161929 True 2
Fn
Get Time type = Ticks, time = 162241 True 1
Fn
Get Time type = Ticks, time = 162256 True 1
Fn
Get Time type = Ticks, time = 162459 True 1
Fn
Get Time type = Ticks, time = 162490 True 1
Fn
Get Time type = Ticks, time = 162568 True 1
Fn
Get Time type = Ticks, time = 162615 True 1
Fn
Get Time type = Ticks, time = 162677 True 1
Fn
Get Time type = Ticks, time = 162818 True 1
Fn
Get Time type = Ticks, time = 162865 True 1
Fn
Get Time type = Ticks, time = 163005 True 1
Fn
Get Time type = Ticks, time = 163067 True 1
Fn
Get Time type = Ticks, time = 163177 True 2
Fn
Get Time type = Ticks, time = 163426 True 2
Fn
Get Time type = Ticks, time = 163551 True 2
Fn
Get Time type = Ticks, time = 163847 True 1
Fn
Get Time type = Ticks, time = 163910 True 1
Fn
Get Time type = Ticks, time = 164206 True 1
Fn
Get Time type = Ticks, time = 164222 True 1
Fn
Get Time type = Ticks, time = 164456 True 2
Fn
Get Time type = Ticks, time = 164565 True 2
Fn
Get Time type = Ticks, time = 164877 True 2
Fn
Get Time type = Ticks, time = 165017 True 2
Fn
Get Time type = Ticks, time = 165548 True 2
Fn
Get Time type = Ticks, time = 165673 True 2
Fn
Get Time type = Ticks, time = 165813 True 2
Fn
Get Time type = Ticks, time = 166125 True 1
Fn
Get Time type = Ticks, time = 166141 True 1
Fn
Get Time type = Ticks, time = 166281 True 2
Fn
Get Time type = Ticks, time = 166468 True 2
Fn
Get Time type = Ticks, time = 166577 True 2
Fn
Get Time type = Ticks, time = 166733 True 2
Fn
Get Time type = Ticks, time = 166874 True 2
Fn
Get Time type = Ticks, time = 167030 True 2
Fn
Get Time type = Ticks, time = 167155 True 2
Fn
Get Time type = Ticks, time = 167404 True 2
Fn
Get Time type = Ticks, time = 167607 True 2
Fn
Get Time type = Ticks, time = 167825 True 2
Fn
Get Time type = Ticks, time = 168013 True 1
Fn
Get Time type = Ticks, time = 168028 True 1
Fn
Get Time type = Ticks, time = 168184 True 2
Fn
Get Time type = Ticks, time = 168449 True 2
Fn
Get Time type = Ticks, time = 168590 True 2
Fn
Get Time type = Ticks, time = 168886 True 2
Fn
Get Time type = Ticks, time = 168995 True 2
Fn
Get Time type = Ticks, time = 169229 True 2
Fn
Get Time type = Ticks, time = 169401 True 2
Fn
Get Time type = Ticks, time = 169526 True 1
Fn
Get Time type = Ticks, time = 169573 True 1
Fn
Get Time type = Ticks, time = 169744 True 1
Fn
Get Time type = Ticks, time = 169760 True 1
Fn
Get Time type = Ticks, time = 170041 True 1
Fn
Get Time type = Ticks, time = 170056 True 1
Fn
Get Time type = Ticks, time = 170353 True 2
Fn
Get Time type = Ticks, time = 170524 True 2
Fn
Get Time type = Ticks, time = 170883 True 2
Fn
Get Time type = Ticks, time = 171023 True 2
Fn
Get Time type = Ticks, time = 171179 True 2
Fn
Get Time type = Ticks, time = 171398 True 2
Fn
Get Time type = Ticks, time = 171538 True 2
Fn
Get Time type = Ticks, time = 171663 True 2
Fn
Get Time type = Ticks, time = 171881 True 2
Fn
Get Time type = Ticks, time = 172225 True 2
Fn
Get Time type = Ticks, time = 172459 True 2
Fn
Get Time type = Ticks, time = 172599 True 2
Fn
Get Time type = Ticks, time = 172864 True 2
Fn
Get Time type = Ticks, time = 173114 True 2
Fn
Get Time type = Ticks, time = 173457 True 2
Fn
Get Time type = Ticks, time = 173675 True 2
Fn
Get Time type = Ticks, time = 173785 True 2
Fn
Get Time type = Ticks, time = 174143 True 2
Fn
Get Time type = Ticks, time = 174549 True 2
Fn
Get Time type = Ticks, time = 174783 True 2
Fn
Get Time type = Ticks, time = 174908 True 2
Fn
Get Time type = Ticks, time = 175017 True 2
Fn
Get Time type = Ticks, time = 175485 True 2
Fn
Get Time type = Ticks, time = 175766 True 2
Fn
Get Time type = Ticks, time = 175953 True 1
Fn
Get Time type = Ticks, time = 175969 True 1
Fn
Get Time type = Ticks, time = 176125 True 2
Fn
Get Time type = Ticks, time = 176405 True 2
Fn
Get Time type = Ticks, time = 176764 True 2
Fn
Get Time type = Ticks, time = 177045 True 2
Fn
Get Time type = Ticks, time = 177217 True 2
Fn
Get Time type = Ticks, time = 177357 True 2
Fn
Get Time type = Ticks, time = 177716 True 2
Fn
Get Time type = Ticks, time = 177887 True 2
Fn
Get Time type = Ticks, time = 178246 True 2
Fn
Get Time type = Ticks, time = 178387 True 2
Fn
Get Time type = Ticks, time = 178589 True 2
Fn
Get Time type = Ticks, time = 178699 True 2
Fn
Get Time type = Ticks, time = 179057 True 2
Fn
Get Time type = Ticks, time = 179525 True 2
Fn
Get Time type = Ticks, time = 179681 True 2
Fn
Get Time type = Ticks, time = 179900 True 2
Fn
Get Time type = Ticks, time = 180149 True 2
Fn
Get Time type = Ticks, time = 180259 True 2
Fn
Get Time type = Ticks, time = 180446 True 2
Fn
Get Time type = Ticks, time = 180961 True 2
Fn
Get Time type = Ticks, time = 181366 True 2
Fn
Get Time type = Ticks, time = 181694 True 2
Fn
Get Time type = Ticks, time = 181865 True 2
Fn
Get Time type = Ticks, time = 182084 True 2
Fn
Get Time type = Ticks, time = 182365 True 2
Fn
Get Time type = Ticks, time = 182677 True 2
Fn
Get Time type = Ticks, time = 182817 True 2
Fn
Get Time type = Ticks, time = 182957 True 2
Fn
Get Time type = Ticks, time = 183301 True 2
Fn
Get Time type = Ticks, time = 183722 True 2
Fn
Get Time type = Ticks, time = 183956 True 2
Fn
Get Time type = Ticks, time = 184081 True 2
Fn
Get Time type = Ticks, time = 184221 True 2
Fn
Get Time type = Ticks, time = 184564 True 2
Fn
Get Time type = Ticks, time = 184673 True 2
Fn
Get Time type = Ticks, time = 184954 True 1
Fn
Get Time type = Ticks, time = 184970 True 1
Fn
Get Time type = Ticks, time = 185344 True 2
Fn
Get Time type = Ticks, time = 185734 True 2
Fn
Get Info type = Operating System True 2
Fn
Mutex (4)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\syncronize_5SR5S9A True 1
Fn
Create mutex_name = Global\syncronize_5SR5S9U True 1
Fn
Open mutex_name = Global\syncronize_5SR5S9A, desired_access = SYNCHRONIZE False 1
Fn
Open mutex_name = Global\syncronize_5SR5S9U, desired_access = SYNCHRONIZE False 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #2: cmd.exe
281 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\system32\cmd.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:31, Reason: Child Process
Unmonitor End Time: 00:01:31, Reason: Self Terminated
Monitor Duration 00:00:59
OS Process Information
»
Information Value
PID 0x990
Parent PID 0x97c (c:\users\5p5nrgjn0js halpmcxz\desktop\rruzcj.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 994
Host Behavior
File (212)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 14
Fn
Get Info STD_INPUT_HANDLE type = file_type True 7
Fn
Open STD_OUTPUT_HANDLE - True 33
Fn
Open STD_INPUT_HANDLE - True 78
Fn
Read STD_INPUT_HANDLE size = 1, size_out = 1 True 65
Fn
Data
Write STD_OUTPUT_HANDLE size = 36 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 2 True 5
Fn
Data
Write STD_OUTPUT_HANDLE size = 63 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 5 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\mode.com os_pid = 0x9bc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\vssadmin.exe os_pid = 0x9ec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info C:\Windows\system32\mode.com type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info C:\Windows\system32\vssadmin.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Memory (2)
»
Operation Process Additional Information Success Count Logfile
Read C:\Windows\system32\mode.com address = 8796092887040, size = 896 True 1
Fn
Data
Read C:\Windows\system32\vssadmin.exe address = 8796092841984, size = 896 True 1
Fn
Data
Module (10)
»
Operation Module Additional Information Success Count Logfile
Load NTDLL.DLL base_address = 0x76f50000 True 1
Fn
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a590000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76e30000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76e46d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76e423d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76e38290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76e417e0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x76fa14a0 True 1
Fn
System (4)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-06-09 09:41:44 (UTC) True 1
Fn
Get Time type = Ticks, time = 102211 True 1
Fn
Get Time type = Performance Ctr, time = 15339253522 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (30)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 10
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 3
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 3
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 2
Fn
Set Environment String name = =ExitCode, value = 00000000 True 2
Fn
Set Environment String name = =ExitCodeAscii True 2
Fn
Process #3: mode.com
0 0
»
Information Value
ID #3
File Name c:\windows\system32\mode.com
Command Line mode con cp select=1251
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:33, Reason: Child Process
Unmonitor End Time: 00:00:34, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x9bc
Parent PID 0x990 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9C0
Process #4: vssadmin.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\vssadmin.exe
Command Line vssadmin delete shadows /all /quiet
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:34, Reason: Child Process
Unmonitor End Time: 00:01:31, Reason: Self Terminated
Monitor Duration 00:00:56
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x9ec
Parent PID 0x990 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9F0
0x A78
0x A7C
0x A88
0x A8C
Process #5: vssvc.exe
3 0
»
Information Value
ID #5
File Name c:\windows\system32\vssvc.exe
Command Line C:\Windows\system32\vssvc.exe
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:41, Reason: RPC Server
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:03:45
OS Process Information
»
Information Value
PID 0xa90
Parent PID 0x1cc (c:\windows\system32\services.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x AB0
0x AAC
0x AA8
0x AA4
0x AA0
0x A9C
0x A94
0x AC8
0x B68
0x 8E0
Host Behavior
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-06-09 09:41:52 (UTC) True 1
Fn
Get Time type = Ticks, time = 110433 True 1
Fn
Get Time type = Performance Ctr, time = 16310629800 True 1
Fn
Process #7: System
0 0
»
Information Value
ID #7
File Name System
Command Line -
Initial Working Directory -
Monitor Start Time: 00:02:48, Reason: Kernel Analysis
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:01:38
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x4
Parent PID 0x0 (Unknown)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 8
0x 24
0x 38
0x 3C
0x C4
0x 80
0x 78
0x C0
0x 28
0x 20
0x 4C
0x 44
0x 9C
0x 40
0x 34
0x CC
0x D0
0x B8
0x D4
0x D8
0x DC
0x E8
0x EC
0x 48
0x 64
0x 2C
0x 90
0x FC
0x 100
0x 10C
0x 104
0x 108
0x B0
0x 110
0x 5C
0x 60
0x 128
0x 12C
0x 130
0x 134
0x 170
0x 88
0x 98
0x 8C
0x 68
0x 74
0x 268
0x 2E0
0x 84
0x 3B0
0x 1C
0x 440
0x 46C
0x 94
0x 50
0x 474
0x 5C0
0x 5D0
0x 614
0x 470
0x 62C
0x 698
0x 69C
0x 7C
0x 18
0x 748
0x 750
0x 798
0x 7A0
0x 7B4
0x 7BC
0x 7C4
0x 58C
0x 2F8
0x 708
0x 0
0x A0
0x BC
0x 54
0x 648
0x 600
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image